@coderook/cli 0.27.0 → 0.29.0

package/dist/cli/src/git_remote.js

@@ -1045,12 +1045,18 @@ async function doPush(requests, url) {
                 continue;
             }
             /*
-              Said before the work starts, not after. Each commit is a published
-              version and versions are not free to make, so somebody pushing years
+              Said before the work starts, not after. Each commit becomes a save on
+              the project and saves are not free to make, so somebody pushing years
               of history deserves the chance to stop and import a snapshot instead.
+      
+              "to publish as versions" is what this used to say, and it stopped
+              being true when commits and versions separated: a pushed commit is a
+              save that nobody outside the project can see. Publishing one is what
+              pushing a *tag* does, because a tag is a name and a named save is a
+              version.
             */
             const estimate = Math.round((commits.length * 11) / 60);
-            say(`  ${commits.length} commit${commits.length === 1 ? "" : "s"} to publish as version${commits.length === 1 ? "" : "s"}` +
+            say(`  ${commits.length} commit${commits.length === 1 ? "" : "s"} to send as save${commits.length === 1 ? "" : "s"}` +
                 (commits.length > 20 ? ` — roughly ${estimate} minute${estimate === 1 ? "" : "s"}` : ""));
             /*
               A push that continues a branch has to start from where the branch
@@ -1114,8 +1120,8 @@ async function doPush(requests, url) {
                     .slice(1);
                 if (parents.length > 1 && !warnedAboutMerges) {
                     warnedAboutMerges = true;
-                    say(`  note: merge commits are published as one version holding the ` +
-                        `merged tree.\n        The contents are exact; the branch shape is not kept.`);
+                    say(`  note: a merge commit arrives as one save holding the merged ` +
+                        `tree.\n        The contents are exact; the branch shape is not kept.`);
                 }
                 const changes = await applyCommit(catFile, scratch, previous, sha);
                 previous = sha;

package/dist/cli/src/service_commands.js

@@ -21,6 +21,7 @@ exports.commandRuns = commandRuns;
 exports.commandLogs = commandLogs;
 exports.commandTokens = commandTokens;
 exports.commandDelete = commandDelete;
+exports.commandHooks = commandHooks;
 const node_process_1 = __importDefault(require("node:process"));
 const promises_1 = require("node:readline/promises");
 const api_js_1 = require("./api.js");
@@ -51,11 +52,47 @@ async function commandIssues(parsed) {
     }
     if (typeof title === "string" && title.trim()) {
         const body = parsed.flags.get("body");
+        /*
+          Labels at the moment it is opened, rather than in a second command
+          afterwards. The service has always taken them here; nothing had ever
+          sent any, so every issue arrived unlabelled and the label filter on the
+          website had nothing to filter by until somebody went back and tidied.
+        */
+        const named = parsed.flags.get("labels");
+        const labels = typeof named === "string"
+            ? named
+                .split(",")
+                .map((one) => one.trim())
+                .filter(Boolean)
+            : [];
+        /*
+          And which save it is about, when it is about one. "It broke" and "it
+          broke in v41" are different reports, and only the first could be
+          written down.
+        */
+        const about = parsed.flags.get("version");
+        let versionId;
+        if (typeof about === "string" && about.trim()) {
+            const wanted = about.trim().replace(/^v/i, "");
+            const all = await (0, api_js_1.versions)(project.id);
+            const found = all.find((one) => String(one.sequence) === wanted);
+            if (!found) {
+                console.error(red(`${project.name} has no version ${about.trim()}.`));
+                return 1;
+            }
+            versionId = found.id;
+        }
         const created = await (0, api_js_1.createIssue)(project.id, {
             title: title.trim(),
             body: typeof body === "string" ? body : "",
+            labels,
+            ...(versionId ? { versionId } : {}),
         });
         console.log(green(`Opened issue #${created.number} on ${project.name}.`));
+        if (labels.length)
+            console.log(dim(`  labelled ${labels.join(", ")}`));
+        if (versionId)
+            console.log(dim(`  about v${about}`));
         return 0;
     }
     const found = await (0, api_js_1.issues)(project.id);
@@ -216,10 +253,67 @@ async function commandWatch(parsed) {
 }
 /** The automations a project has, and how they have been going. */
 async function commandWorkflows(parsed) {
-    const project = await (0, project_commands_js_1.resolveProject)(parsed.positional[0]);
+    const project = await (0, project_commands_js_1.resolveProject)(typeof parsed.flags.get("project") === "string"
+        ? String(parsed.flags.get("project"))
+        : parsed.positional[0]);
     if (!project)
         return 1;
     const found = (await (0, api_js_1.workflows)(project.id)).filter((workflow) => !workflow.archivedAt);
+    /*
+      Setting, before printing. `cbx actions --ship Build` reads as a sentence
+      and then shows the list it has just changed, which is the same shape
+      `cbx notes` uses: one command, print by default, flags to write.
+    */
+    const ship = parsed.flags.get("ship");
+    const stop = parsed.flags.get("no-ship");
+    if (ship !== undefined || stop !== undefined) {
+        const wanted = ship !== undefined;
+        const named = wanted ? ship : stop;
+        if (typeof named !== "string" || !named.trim()) {
+            console.error(red("Which action?") + dim(`  cbx actions ${wanted ? "--ship" : "--no-ship"} "Build"`));
+            return 1;
+        }
+        const target = found.find((workflow) => workflow.name.toLowerCase() === named.trim().toLowerCase());
+        if (!target) {
+            console.error(red(`${project.name} has no action called ${named.trim()}.`));
+            if (found.length) {
+                console.error(dim(`  It has: ${found.map((one) => one.name).join(", ")}`));
+            }
+            return 1;
+        }
+        if (wanted && !target.artifactPaths.length) {
+            /*
+              Refused rather than set. Shipping what a run collected means nothing
+              when the run collects nothing, and a flag that reported success and
+              then never produced a download would be indistinguishable from the
+              feature being broken.
+            */
+            console.error(red(`${target.name} keeps no files, so it has nothing to ship.`));
+            console.error(dim("  Give it something to keep on the Actions screen first, e.g. dist/*.exe"));
+            return 1;
+        }
+        try {
+            await (0, api_js_1.changeWorkflow)(project.id, target.id, { attachArtifacts: wanted });
+        }
+        catch (error) {
+            console.error(red(error instanceof Error ? error.message : String(error)));
+            return 1;
+        }
+        target.attachArtifacts = wanted;
+        console.log(wanted
+            ? green(`${target.name} will attach what it builds to the version it ran against.`)
+            : green(`${target.name} will keep its files without attaching them.`));
+        if (wanted) {
+            /*
+              Said plainly, because attaching is publishing. An attachment on a
+              public version is a download anybody can take, and somebody turning
+              this on for a workflow that builds an internal tool deserves to hear
+              that before the next run rather than after it.
+            */
+            console.log(dim("  Anything it attaches to a public version is public the moment it lands."));
+        }
+        console.log("");
+    }
     if (!found.length) {
         console.log(dim("No actions on this project."));
         return 0;
@@ -232,6 +326,12 @@ async function commandWorkflows(parsed) {
         console.log(`  ${workflow.name.padEnd(24)} ${dim(workflow.trigger).padEnd(20)} ` +
             `${dim(workflow.runsOn).padEnd(18)} ${health}`);
         console.log(`    ${dim(workflow.command)}`);
+        if (workflow.artifactPaths.length) {
+            console.log(`    ${dim("keeps")} ${dim(workflow.artifactPaths.join(", "))}` +
+                (workflow.attachArtifacts
+                    ? ` ${accent("→ downloads on the version")}`
+                    : ""));
+        }
     }
     return 0;
 }
@@ -399,3 +499,103 @@ async function commandDelete(parsed) {
     console.log(green(`Deleted ${project.name}.`));
     return 0;
 }
+/**
+ * Where a project tells something else that something happened.
+ *
+ * The service has been able to do this since Merge Tracks shipped — queue an
+ * event, sign it, deliver it after the request that caused it — and nothing
+ * could reach it. A project could not be told to notify a build box, a chat
+ * room or a status page, because no client asked.
+ */
+async function commandHooks(parsed) {
+    const project = await (0, project_commands_js_1.resolveProject)(typeof parsed.flags.get("project") === "string"
+        ? String(parsed.flags.get("project"))
+        : parsed.positional[0]);
+    if (!project)
+        return 1;
+    const adding = parsed.flags.get("add");
+    if (adding !== undefined) {
+        if (typeof adding !== "string" || !adding.trim()) {
+            console.error(red("Which address?") + dim("  cbx hooks --add https://example.com/hook"));
+            return 1;
+        }
+        const url = adding.trim();
+        if (!/^https:\/\//i.test(url)) {
+            /*
+              Refused here as well as by the service. A webhook carries a signed
+              payload about a private project, and http would put it on the wire in
+              the clear — worth saying before the round trip rather than after.
+            */
+            console.error(red("A webhook address has to be https."));
+            return 1;
+        }
+        const named = parsed.flags.get("events");
+        const events = typeof named === "string"
+            ? named.split(",").map((one) => one.trim()).filter(Boolean)
+            : [];
+        try {
+            const made = await (0, api_js_1.addWebhook)(project.id, url, events);
+            console.log(green(`${project.name} will notify ${url}.`));
+            console.log("");
+            /*
+              Printed once because it exists once. The service generates it and no
+              route ever hands it back, so this is the only moment anybody can
+              write it down — and saying so is the difference between a person
+              copying it and a person losing it.
+            */
+            console.log(`  ${bold("Signing secret")}  ${made.secret}`);
+            console.log(dim("  Written once and never again. Use it to check the signature on"));
+            console.log(dim("  what arrives, so nobody else can post to your endpoint."));
+            if (events.length)
+                console.log(dim(`  Sending: ${events.join(", ")}`));
+            else
+                console.log(dim("  Sending: everything this project announces"));
+        }
+        catch (error) {
+            console.error(red(error instanceof Error ? error.message : String(error)));
+            return 1;
+        }
+        return 0;
+    }
+    const removing = parsed.flags.get("remove");
+    if (removing !== undefined) {
+        if (typeof removing !== "string" || !removing.trim()) {
+            console.error(red("Which one?") + dim("  cbx hooks --remove <id>"));
+            return 1;
+        }
+        const wanted = removing.trim();
+        const found = (await (0, api_js_1.webhooks)(project.id)).find((one) => one.id === wanted || one.url === wanted);
+        if (!found) {
+            console.error(red(`${project.name} has no webhook called ${wanted}.`));
+            return 1;
+        }
+        await (0, api_js_1.removeWebhook)(project.id, found.id);
+        console.log(green(`${found.url} will not be notified any more.`));
+        return 0;
+    }
+    const found = await (0, api_js_1.webhooks)(project.id);
+    if (!found.length) {
+        console.log(dim("This project notifies nothing."));
+        console.log(dim("  cbx hooks --add https://example.com/coderook"));
+        return 0;
+    }
+    console.log(bold(project.name));
+    for (const hook of found) {
+        /*
+          A run of failures shown rather than hidden. A webhook that has been
+          failing for a week looks exactly like one that works until somebody
+          checks the receiving end, which is the wrong place to find out.
+        */
+        const health = !hook.active
+            ? red("off")
+            : hook.consecutiveFailures
+                ? red(`${hook.consecutiveFailures} failed in a row`)
+                : hook.lastDeliveredAt
+                    ? green("delivering")
+                    : dim("nothing sent yet");
+        console.log(`  ${hook.url}`);
+        console.log(`    ${dim(hook.id)}  ${health}` +
+            (hook.events.length ? `  ${dim(hook.events.join(", "))}` : `  ${dim("everything")}`));
+    }
+    return 0;
+}

package/dist/desktop-app/src/main/detect.js

@@ -39,6 +39,40 @@ const RULES = [
     { directory: ".next", reason: "Next.js build output", recommended: true },
     { directory: ".gradle", reason: "Gradle build state", recommended: true },
     { directory: ".terraform", reason: "Downloaded Terraform providers", recommended: true },
+    /*
+      Game engines, which is where the size actually is.
+  
+      A Unity project is mostly not the project: `Library/` alone is routinely
+      thousands of times the size of `Assets/`, and every byte of it is rebuilt
+      from `Assets/` and `Packages/` the next time the editor opens. Until these
+      existed a Unity folder produced no suggestions at all — the one shape of
+      project where the question "what should I leave out?" has the largest
+      possible answer was the one the detector had nothing to say about.
+    */
+    { directory: "Library", reason: "Unity's import cache — rebuilt when the project next opens", recommended: true },
+    { directory: "Temp", reason: "Unity's scratch folder for the running editor", recommended: true },
+    { directory: "MemoryCaptures", reason: "Unity memory snapshots — large, and not the project", recommended: true },
+    { directory: "Recordings", reason: "Unity recorder output", recommended: true },
+    { directory: "UserSettings", reason: "Your own editor layout — not part of the project", recommended: true },
+    { directory: "DerivedDataCache", reason: "Unreal's derived data cache — rebuilt on demand", recommended: true },
+    { directory: "Intermediate", reason: "Unreal build intermediates — rebuilt when you build", recommended: true },
+    { directory: "Binaries", reason: "Unreal compiled output — rebuilt when you build", recommended: true },
+    /*
+      Named like the work, and it is not: Unreal keeps logs, crash reports and
+      autosaves here. Offered rather than ticked, because a folder called
+      "Saved" is the one nobody should have excluded on our say-so.
+    */
+    { directory: "Saved", reason: "Unreal logs and autosaves — check before excluding", recommended: false },
+    { directory: ".godot", reason: "Godot's import cache — rebuilt when the project next opens", recommended: true },
+    { directory: ".import", reason: "Godot's import cache — rebuilt when the project next opens", recommended: true },
+    { directory: "Logs", reason: "Editor logs", recommended: true },
+    { directory: "obj", reason: "Compiler intermediates — rebuilt when you build", recommended: true },
+    { directory: ".vs", reason: "Visual Studio's local cache", recommended: true },
+    /*
+      Offered, not ticked. JetBrains keeps run configurations in here that some
+      projects deliberately share, so this is a judgement rather than a fact.
+    */
+    { directory: ".idea", reason: "JetBrains editor state — check before excluding", recommended: false },
     /*
       A Chromium or Electron profile left in the project folder. Worth its own
       reason because the consequence is not only size: these hold lock files
@@ -59,6 +93,7 @@ const RULES = [
     { directory: "dist", reason: "Usually build output — check before excluding", recommended: false },
     { directory: "build", reason: "Usually build output — check before excluding", recommended: false },
     { directory: "out", reason: "Usually build output — check before excluding", recommended: false },
+    { directory: "bin", reason: "Usually build output — check before excluding", recommended: false },
     { extension: ".safetensors", reason: "Model weights — large, and usually downloadable", recommended: false },
     { extension: ".ckpt", reason: "Model weights — large, and usually downloadable", recommended: false },
     { extension: ".pt", reason: "Model weights — large, and usually downloadable", recommended: false },
@@ -86,13 +121,29 @@ function suggestExclusions(files) {
         const extension = node_path_1.default.extname(name).toLowerCase();
         for (const rule of RULES) {
             let pattern = null;
-            if (rule.directory && segments.slice(0, -1).includes(rule.directory)) {
-                pattern = `${rule.directory}/`;
+            if (rule.directory) {
+                /*
+                  Matched without regard to case, and written back with the case the
+                  folder actually has.
+        
+                  Every engine disagrees about capitals — Unity ships `Library` and
+                  `obj` in the same project, Unreal `Binaries`, Godot `.godot` — and
+                  an exact-name match meant the detector recognised whichever spelling
+                  happened to be written here and silently missed the rest. Emitting
+                  the observed name rather than the rule's own keeps the line that
+                  gets written matching the folder that is there.
+                */
+                const wanted = rule.directory.toLowerCase();
+                const found = segments
+                    .slice(0, -1)
+                    .find((segment) => segment.toLowerCase() === wanted);
+                if (found)
+                    pattern = `${found}/`;
             }
-            else if (rule.file && name === rule.file) {
+            if (!pattern && rule.file && name === rule.file) {
                 pattern = rule.file;
             }
-            else if (rule.extension && extension === rule.extension) {
+            if (!pattern && rule.extension && extension === rule.extension) {
                 pattern = `*${rule.extension}`;
             }
             if (!pattern)

package/dist/desktop-app/src/main/tracks.js

@@ -1,8 +1,66 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Tracks = void 0;
+/**
+ * The lines a project is saved on, and the merges waiting on a person.
+ *
+ * The service has had all of this since Tracks existed: a project has one or
+ * more lines of versions, and a publish that diverges from what the account
+ * holds is put on a Merge Track of its own rather than laid over work the
+ * uploader had not seen. That is the right behaviour and it already happens.
+ *
+ * What did not exist was any way to know. The app never asked for a track, so
+ * a save that diverted reported "done" and said nothing about where the work
+ * went — the version was safe, on a track nobody could see, and the only way
+ * to find it was the website. This is the half that was missing.
+ */
+const node_crypto_1 = require("node:crypto");
 const identify_js_1 = require("./identify.js");
 const retry_js_1 = require("./retry.js");
+/** A media type from the name, so an edited file is stored as what it is. */
+function mediaTypeForPath(path) {
+    const known = {
+        css: "text/css",
+        html: "text/html",
+        js: "text/javascript",
+        json: "application/json",
+        md: "text/markdown",
+        py: "text/x-python",
+        ts: "text/typescript",
+        tsx: "text/typescript",
+        xml: "application/xml",
+        yaml: "application/yaml",
+        yml: "application/yaml",
+    };
+    return known[path.split(".").pop()?.toLowerCase() ?? ""] ?? "text/plain";
+}
+/**
+ * The error to raise for a failed request, with a refusal said properly.
+ *
+ * A build refused for being too old is not a network failure and must not
+ * read like one: the person can fix it, and only if they are told how. The
+ * two requests below build their own fetches rather than going through
+ * `call`, so without this a refused desktop was told only "(426)".
+ */
+function refusalOrError(body, status, fallback) {
+    const tooOld = (0, identify_js_1.readRefusal)(status, body);
+    if (tooOld) {
+        return new Error(`${tooOld.message} You are running ${tooOld.yourVersion ?? "an older build"}; ` +
+            `update from ${tooOld.upgradeUrl}.`);
+    }
+    let message = `${fallback} (${status})`;
+    if (body.trimStart().startsWith("{")) {
+        try {
+            message =
+                JSON.parse(body).error?.message ??
+                    message;
+        }
+        catch {
+            /* keep the generic message */
+        }
+    }
+    return Object.assign(new Error(message), { status });
+}
 class Tracks {
     credentials;
     constructor(credentials) {
@@ -177,17 +235,106 @@ class Tracks {
             return [];
         }
     }
-    /** One merge and every path it is waiting on. */
+    /**
+     * One merge and every path it is waiting on.
+     *
+     * The merge itself is nested under `mergeTrack`, which this used to spread
+     * flat — so `track.reference` was undefined and the window's title fell
+     * back to the word "Merge" on every merge there has ever been. The rest of
+     * the reply was thrown away with it, including the two version ids that
+     * make showing the conflict possible at all.
+     */
     async merge(mergeTrackId) {
         const body = await this.call(`/v1/merge-tracks/${mergeTrackId}`);
-        const { conflicts = [], ...track } = body;
-        return { track: track, conflicts };
+        return {
+            track: body.mergeTrack,
+            conflicts: body.conflicts ?? [],
+            repositoryId: body.mergeTrack.repositoryId,
+            candidateVersionId: body.mergeTrack.candidateVersionId ?? null,
+            currentTargetVersionId: body.currentTargetVersionId ?? null,
+            checks: body.checks ?? [],
+            ready: body.provisional?.ready ?? false,
+            unresolvedPaths: body.provisional?.unresolvedPaths ?? [],
+            blockedByChecks: body.provisional?.blockedByChecks ?? [],
+        };
+    }
+    /**
+     * One side of a conflict, as text.
+     *
+     * Both sides of a merge are versions, so this is the ordinary file route.
+     * Null means there is genuinely no file on that side, which is half of
+     * these conflicts: one person edited what another deleted.
+     */
+    async fileAt(repositoryId, versionId, path) {
+        if (!versionId)
+            return null;
+        const token = await this.credentials.token();
+        if (!token)
+            throw new Error("Sign in again");
+        const response = await fetch(`${this.credentials.origin()}/v1/repositories/${repositoryId}` +
+            `/versions/${versionId}/file?path=${encodeURIComponent(path)}`, {
+            headers: {
+                authorization: `Bearer ${token}`,
+                "user-agent": "CodeRook/0.1",
+                ...(0, identify_js_1.clientHeaders)(),
+            },
+        });
+        if (response.status === 404)
+            return null;
+        if (!response.ok) {
+            throw refusalOrError(await response.text().catch(() => ""), response.status, `Could not read ${path}`);
+        }
+        const bytes = new Uint8Array(await response.arrayBuffer());
+        /*
+          Decoded strictly, so a file that is not UTF-8 reports itself as binary
+          rather than arriving as a screenful of replacement characters somebody
+          might then save over the real thing.
+        */
+        let text = null;
+        try {
+            text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+            if (text.includes("\u0000"))
+                text = null;
+        }
+        catch {
+            text = null;
+        }
+        return { text, bytes: bytes.byteLength };
+    }
+    /**
+     * Send a file somebody wrote, and answer with the object it became.
+     *
+     * The other half of an edited resolution: the service takes an object id,
+     * and something has to put the bytes there first.
+     */
+    async putText(repositoryId, path, text) {
+        const token = await this.credentials.token();
+        if (!token)
+            throw new Error("Sign in again");
+        const bytes = new TextEncoder().encode(text);
+        const digest = (0, node_crypto_1.createHash)("sha256").update(bytes).digest("hex");
+        const response = await fetch(`${this.credentials.origin()}/v1/repositories/${repositoryId}` +
+            `/objects/${digest}?kind=chunk&role=chunk&logicalSize=${bytes.byteLength}` +
+            `&mediaType=${encodeURIComponent(mediaTypeForPath(path))}`, {
+            method: "PUT",
+            headers: {
+                authorization: `Bearer ${token}`,
+                "content-type": "application/octet-stream",
+                "user-agent": "CodeRook/0.1",
+                ...(0, identify_js_1.clientHeaders)(),
+            },
+            body: bytes,
+        });
+        const body = await response.text();
+        if (!response.ok)
+            throw refusalOrError(body, response.status, "Could not send the file");
+        return JSON.parse(body).objectId;
     }
-    /** Settle one path. */
-    async resolve(mergeTrackId, conflictId, resolution) {
+    /** Settle one path. An edit also names the object it produced. */
+    async resolve(mergeTrackId, conflictId, resolution, objectId) {
         await this.call(`/v1/merge-tracks/${mergeTrackId}/conflicts/${conflictId}`, {
             method: "PUT",
-            body: JSON.stringify({ resolution }),
+            body: JSON.stringify(objectId ? { resolution, objectId } : { resolution }),
         });
     }
     /**

package/dist/desktop-app/src/main/upload.js

@@ -354,7 +354,15 @@ class Uploader {
         */
         const everything = await (0, profile_js_1.timed)("survey the project", () => (0, worktree_js_1.surveyFiles)(request.localPath, rules));
         (0, profile_js_1.counted)("files surveyed", everything.length);
-        const ticked = new Set(request.include);
+        const unticked = new Set(request.excluded ?? []);
+        const ticked = request.excluded
+            ? new Set([
+                ...everything
+                    .map((file) => file.path)
+                    .filter((path) => !unticked.has(path)),
+                ...(request.deletions ?? []),
+            ])
+            : new Set(request.include);
         if (!ticked.size)
             throw new Error("Nothing is selected to upload");
         const prior = request.repositoryId