@coderook/cli 0.31.10 → 0.31.12

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, from Claude Code.",
-  "version": "0.31.10",
+  "version": "0.31.12",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/dist/cli/src/api.js

@@ -7,6 +7,7 @@ exports.completeUpload = completeUpload;
 exports.attachToVersion = attachToVersion;
 exports.whoami = whoami;
 exports.projects = projects;
+exports.projectById = projectById;
 exports.findPublicProject = findPublicProject;
 exports.findProject = findProject;
 exports.health = health;
@@ -184,6 +185,37 @@ async function projects() {
         updatedAt: String(row.updatedAt ?? row.createdAt ?? ""),
     }));
 }
+/**
+ * One project by its id, including somebody else's public or unlisted one.
+ *
+ * The account's own list holds only projects it is in, so a folder cloned
+ * from somebody else's public project had no way back to it: every command
+ * after the clone said the project was "no longer on your account". The
+ * service answers this route for anybody signed in when the project is open,
+ * and says whether the caller is one of its people.
+ */
+async function projectById(repositoryId) {
+    try {
+        const row = await call(`/v1/repositories/${encodeURIComponent(repositoryId)}`);
+        if (!row.id)
+            return null;
+        return {
+            id: String(row.id),
+            slug: String(row.slug ?? ""),
+            name: String(row.displayName || row.slug || "Untitled"),
+            visibility: String(row.visibility ?? "public"),
+            defaultBranch: String(row.defaultBranch || "main"),
+            versionCount: Number(row.versionCount ?? 0),
+            fileCount: Number(row.fileCount ?? 0),
+            storedBytes: Number(row.storedSize ?? 0),
+            updatedAt: String(row.updatedAt ?? row.createdAt ?? ""),
+            member: row.member !== false,
+        };
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * One public project, by the two names that identify it.
  *

package/dist/cli/src/cli.js

@@ -195,9 +195,23 @@ const folderFor = (parsed, index = 0) => node_path_1.default.resolve(parsed.posi
 async function reconcile(folder, options = {}) {
     const link = await (0, config_js_1.readLink)(folder);
     const reference = link?.slug ?? node_path_1.default.basename(folder);
-    const project = link
+    let member = true;
+    let project = link
         ? (await (0, api_js_2.projects)()).find((candidate) => candidate.id === link.repositoryId)
         : await (0, api_js_2.findProject)(reference);
+    /*
+      Not on the account's own list, which holds only projects it is in. A
+      folder cloned from somebody else's public project is exactly that, and
+      it was told the project had gone. Asked by id instead, the service still
+      answers for an open project and says the caller is a visitor.
+    */
+    if (link && !project) {
+        const visited = await (0, api_js_2.projectById)(link.repositoryId);
+        if (visited) {
+            project = visited;
+            member = visited.member;
+        }
+    }
     /*
       A link that has outlived the project it points at.
   
@@ -217,12 +231,12 @@ async function reconcile(folder, options = {}) {
     }
     if (!project?.versionCount) {
         // Nothing saved on the account, so everything here is outstanding.
-        return { link: link ?? null, baseline: null, behind: null };
+        return { link: link ?? null, baseline: null, behind: null, member };
     }
     const downloader = new download_js_1.Downloader(config_js_1.credentials);
     const latest = (await downloader.versions(project.id))[0];
     if (!latest)
-        return { link: link ?? null, baseline: null, behind: null };
+        return { link: link ?? null, baseline: null, behind: null, member };
     /*
       A folder that already knows which version it stands on keeps it. Only a
       folder that has never been reconciled — or was linked before versions
@@ -250,6 +264,7 @@ async function reconcile(folder, options = {}) {
             */
             baseline: new Map(Object.entries(known.local ?? known.manifest)),
             behind,
+            member,
         };
     }
     const baseline = new Map();
@@ -271,7 +286,7 @@ async function reconcile(folder, options = {}) {
     if (!options.quiet && !link) {
         console.log(dim(`Linked this folder to ${project.slug}.`));
     }
-    return { link: fresh, baseline, behind: null };
+    return { link: fresh, baseline, behind: null, member };
 }
 // ── commands ────────────────────────────────────────────────────────────────
 async function commandSignIn(parsed) {
@@ -585,7 +600,19 @@ async function commandImport(parsed) {
 async function commandSubmit(parsed) {
     const folder = folderFor(parsed);
     const message = flagText(parsed, "m", "message") ?? "";
-    const { link, baseline, behind } = await reconcile(folder);
+    const { link, baseline, behind, member } = await reconcile(folder);
+    /*
+      Somebody else's project, cloned from its public page. Reading and
+      fetching are fine; saving into it is not this account's to do, and the
+      service would refuse it anyway, less clearly.
+    */
+    if (link && !member) {
+        console.error(red(`Access denied: you are not a collaborator on ${link.slug}.`) +
+            "\n" +
+            dim(`  Ask its owner to invite you, or run ${accent("cbx unlink")} to start a project of ` +
+                "your own from these files."));
+        return 1;
+    }
     /*
       A first save gets a licence unless it is turned down.
   
@@ -2282,9 +2309,8 @@ const SPECS = [
             "calls link only, keeps it off your profile and out of search. Public\n" +
             "lists it on your profile, and its page offers the saves somebody named\n" +
             "and did not hide.\n\n" +
-            "Opening a project up asks first and says what becomes readable: any\n" +
-            "account signed in to CodeRook that has its link can open every save\n" +
-            "through the API, not only the named versions. Going private asks\n" +
+            "Opening a project up asks first and says what becomes readable: the\n" +
+            "named versions nobody hid, and nothing else. Going private asks\n" +
             "nothing.",
         options: [
             { flags: "-y, --yes", description: "open it up without asking, for scripts" },

package/dist/cli/src/project_commands.js

@@ -288,16 +288,6 @@ async function commandVisibility(parsed) {
         else {
             console.log(`Making ${bold(project.name)} link only keeps it off your profile and out of search.`);
         }
-        /*
-          Said because it is true today, not because it is the design. The public
-          page follows the named-versions rule; the signed-in routes let any
-          account read an unlisted or public project whole, commits and hidden
-          versions included. Somebody deciding whether to open a project up
-          should be deciding about that.
-        */
-        console.log(dim("  Any account signed in to CodeRook that has its link can open every save\n" +
-            "  through the API, not only the named versions. Check the history holds\n" +
-            "  nothing you would not share."));
         if (!(await agreed(`Make ${project.name} ${wordFor(target)}? [y/N] `))) {
             console.log(dim(`Nothing changed. ${project.name} is still ${wordFor(current)}.`));
             return 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.31.10",
+  "version": "0.31.12",
   "description": "The command line for CodeRook (coderook.com): version control and project hosting for projects of any size. Every save is a compressed snapshot, private or public, never used to train AI.",
   "license": "SEE LICENSE IN LICENSE.txt",
   "homepage": "https://coderook.com",