@coderook/cli 0.34.11 → 0.36.0

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, with cbx or plain git, from Claude Code.",
-  "version": "0.34.11",
+  "version": "0.36.0",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/README.md

@@ -194,6 +194,33 @@ Tests whenever a line is proposed or saved onto, and its result is a required
 check. `--on-save` runs an action on every save, and `--by-hand` only when
 somebody starts it.
 
+Every proposal also has a `coderook/malware` check: what the line adds or
+changes is scanned before it can land, and a finding names the file and stops
+the proposal being applied.
+
+### Reviewing proposals on GitHub
+
+CodeRabbit, Blacksmith and most CI only connect to GitHub, so `cbx github`
+keeps a GitHub repository as a mirror: each open proposal becomes a pull
+request there, whatever is installed on it reviews and builds it, and the
+results come back to the proposal as checks (`github/<check>`,
+`review/<reviewer>`).
+
+```
+cbx github setup my-name/my-game-mirror           token, secret, workflow
+cbx submit                                        save the workflow into the project
+cbx github sync --repo my-name/my-game-mirror     mirror once from here
+```
+
+`setup` makes a token that reaches this project only and can only read it and
+report checks, stores it as the repository's `CODEROOK_TOKEN` secret (with the
+GitHub CLI; otherwise it prints it once), and writes
+`.github/workflows/coderook-bridge.yml`, which then runs on GitHub every ten
+minutes. Add `CODEROOK_BRIDGE_PUSH`, a fine-grained GitHub token with Contents
+and Pull requests read and write: GitHub's own workflow token cannot start
+other workflows, so CI would never run. Results are advice unless named in
+`CODEROOK_REQUIRED` (or `--required`). Use a repository nothing else pushes to.
+
 A **protected** line refuses saves made straight onto it — from `cbx submit`,
 the desktop application and `git push` alike — so the way in is a line of your
 own and a proposal. It also cannot be put back on an earlier save, and a merge
@@ -452,6 +479,10 @@ no need for a second project that only holds releases. `--downloads private`
 takes them back. Without a release name it changes an existing release and
 leaves its notes alone.
 
+Every attached file is scanned for malware before anybody outside the project
+can download it, usually within a minute; one that fails is never offered, and
+whoever attached it and the owner are told what was found.
+
 `cbx releases` marks each one `public`, `downloads public` or `private`, and
 for a public project prints the addresses an app or a script reads, which
 need no account:
@@ -462,6 +493,46 @@ https://api.coderook.com/v1/public/projects/OWNER/SLUG/releases
 https://api.coderook.com/v1/public/projects/OWNER/SLUG/updates      electron-updater's generic provider
 ```
 
+## Mod repositories for games
+
+A mod repository is where a game's players get mods from. The game's maker
+sets one up and its rules; modders publish with their own accounts; nothing is
+listed until it passes those rules and a malware scan.
+
+```
+cbx mods create my-game --name "My Game" --allow .png,.ogg,.json --nested .pak
+cbx mods builds my-game --new                 a build secret for the game, shown once
+cbx mods builds my-game --register secret.bin or your own, never printed
+cbx mods info my-game                         the address and public key to pin
+cbx mods settings my-game --uploads owner     change the rules
+```
+
+Rules: `--allow` and `--block` for file types (programs and scripts such as
+`.exe`, `.dll`, `.ps1` and `.js` are refused in every repository, and so is a
+file that is really a program whatever it is called), `--nested` for archive
+types that are opened and checked too, `--manifest` and `--fields` for the
+manifest each part carries (`mod.json` by default) and which of its fields must
+match, `--max-part`, `--max-files`, `--max-parts` and `--max-ratio` for size,
+and `--uploads anyone|owner`.
+
+```
+cbx mods publish ./BetterTrees --repo my-game              zip, upload, wait for the checks
+cbx mods publish ./HD-Art --repo my-game --part animals    one part of a bigger mod
+cbx mods list my-game                                      your mods and how their checks went
+cbx mods remove better-trees --repo my-game
+```
+
+`publish` reads the folder's manifest for the mod's id, name, folder and
+version (`--id`, `--name`, `--folder` and `--version` override it), writes the
+manifest the repository expects into the zip, uploads in pieces that are
+retried, and waits up to 30 minutes for the result; `--no-wait` returns
+straight away. A rejected part says what was wrong, file by file.
+
+The owner also has `cbx mods reports`, `cbx mods block <username> --take-down`,
+`cbx mods list --all`, `cbx mods remove --as-owner` and `cbx mods delete`.
+How the game signs its requests and checks the catalogue is at
+<https://coderook.com/docs#mod-repositories>.
+
 ## Building for every platform
 
 ```

package/dist/cbx/src/core/worktree.js

@@ -1614,10 +1614,29 @@ const SECRET_SUFFIXES = [".pem", ".key", ".p12", ".pfx", ".keystore", ".jks"];
   the answer be a rule — one line in .gitignore covers the lot, where a list
   of the files inside it would go stale the moment the program ran again.
 */
+/** Chromium's disk cache: an index beside data_N blocks, Cache_Data, or the js/wasm code cache. */
+async function looksLikeBrowserCache(directory) {
+    const names = new Set((await (0, promises_1.readdir)(directory).catch(() => [])).map((name) => name.toLowerCase()));
+    if (names.has("cache_data") || names.has("index-dir"))
+        return true;
+    if (names.has("index") && names.has("data_0"))
+        return true;
+    return names.has("js") && names.has("wasm");
+}
 const PRIVATE_DIRECTORIES = [
     {
-        match: /^(Local Storage|Session Storage|IndexedDB|Service Worker|Cache|Code Cache|GPUCache)$/i,
+        match: /^(Local Storage|Session Storage|IndexedDB|Service Worker)$/i,
+        because: "a browser profile, which holds the sites you are signed in to",
+    },
+    /*
+      "Cache" is also an ordinary name for source: FreeType keeps ftcache.c in
+      `src/cache`, and a Godot checkout was refused as "a browser profile" for
+      it. So these three only count when what is inside is a browser's cache.
+    */
+    {
+        match: /^(Cache|Code Cache|GPUCache)$/i,
         because: "a browser profile, which holds the sites you are signed in to",
+        inside: looksLikeBrowserCache,
     },
     { match: /^\.wrangler$/i, because: "local service state, including emulated databases" },
     { match: /^\.aws$/i, because: "cloud credentials" },
@@ -1667,7 +1686,15 @@ async function detectPrivateDirectories(root) {
                 continue;
             const full = node_path_1.default.join(directory, entry.name);
             const relative = node_path_1.default.relative(root, full).split(node_path_1.default.sep).join("/");
-            const rule = PRIVATE_DIRECTORIES.find((candidate) => candidate.match.test(entry.name));
+            let rule;
+            for (const candidate of PRIVATE_DIRECTORIES) {
+                if (!candidate.match.test(entry.name))
+                    continue;
+                if (candidate.inside && !(await candidate.inside(full)))
+                    continue;
+                rule = candidate;
+                break;
+            }
             if (rule) {
                 found.push({
                     path: relative,

package/dist/cli/src/api.js

@@ -45,6 +45,8 @@ exports.changeWorkflow = changeWorkflow;
 exports.runs = runs;
 exports.runLogs = runLogs;
 exports.tokens = tokens;
+exports.createToken = createToken;
+exports.reportMergeCheck = reportMergeCheck;
 exports.revokeToken = revokeToken;
 exports.deleteProject = deleteProject;
 exports.projectLabels = projectLabels;
@@ -806,6 +808,20 @@ async function tokens() {
         createdAt: String(row.createdAt ?? ""),
     }));
 }
+/** Make a token. Limited to one project when `repositoryId` is given; shown once. */
+async function createToken(input) {
+    return call("/v1/account/tokens", {
+        method: "POST",
+        body: input,
+    });
+}
+/** Say how a check on a proposal went; the same name again replaces it. */
+async function reportMergeCheck(mergeTrackId, name, input) {
+    await call(`/v1/merge-tracks/${mergeTrackId}/checks/${encodeURIComponent(name)}`, {
+        method: "PUT",
+        body: input,
+    });
+}
 async function revokeToken(tokenId) {
     await call(`/v1/account/tokens/${encodeURIComponent(tokenId)}`, {
         method: "DELETE",

package/dist/cli/src/cli.js

@@ -31,6 +31,8 @@ const attach_command_js_1 = require("./attach_command.js");
 const build_command_js_1 = require("./build_command.js");
 const node_check_js_1 = require("./node_check.js");
 const pages_command_js_1 = require("./pages_command.js");
+const mods_command_js_1 = require("./mods_command.js");
+const github_bridge_js_1 = require("./github_bridge.js");
 const project_commands_js_1 = require("./project_commands.js");
 const track_commands_js_1 = require("./track_commands.js");
 const tracks_js_1 = require("../../cbx/src/core/tracks.js");
@@ -2792,6 +2794,101 @@ const SPECS = [
         ],
         run: pages_command_js_1.commandPages,
     },
+    {
+        name: "github",
+        group: "Your projects",
+        summary: "review and test proposals with GitHub tools (CodeRabbit, Blacksmith, Actions)",
+        usage: "github <setup|sync> …",
+        detail: "Mirrors a project's open proposals to pull requests in a GitHub repository,\n" +
+            "so tools that only connect to GitHub review and build them, and reports\n" +
+            "what they conclude back to each proposal as checks. A required check that\n" +
+            "fails stops the proposal being applied, like any other check.\n\n" +
+            "It runs on GitHub, in a workflow setup writes into the project. CodeRook\n" +
+            "never holds a GitHub credential; GitHub holds a CodeRook token that reaches\n" +
+            "this project only and can read it and report checks, nothing else.\n\n" +
+            "  setup <owner>/<repo> [folder]   make the token, write the workflow\n" +
+            "  sync [--repo <owner>/<repo>]    mirror and report once (what the workflow runs)\n\n" +
+            "Use a GitHub repository nothing else pushes to: the mirror only moves\n" +
+            "forward, and a branch changed on GitHub is left alone and reported.",
+        options: [
+            { flags: "--repo <owner/repo>", description: "sync: the GitHub repository (default: the one the workflow runs in)" },
+            { flags: "--project <slug>", description: "sync: the CodeRook project (default: this folder's)" },
+            { flags: "--required <names>", description: "checks that must pass, e.g. \"github/build,review/coderabbitai[bot]\"" },
+            { flags: "--force", description: "setup: write the workflow again" },
+        ],
+        examples: [
+            "cbx github setup my-name/my-game-mirror",
+            "cbx submit",
+            "cbx github sync --repo my-name/my-game-mirror",
+        ],
+        run: github_bridge_js_1.commandGithub,
+    },
+    {
+        name: "mods",
+        group: "Your projects",
+        summary: "mod repositories for games: set one up, publish to one",
+        usage: "mods <create|repos|info|settings|builds|list|publish|remove|block|reports|delete> …",
+        detail: "A mod repository is where a game's players get mods from. Its owner\n" +
+            "sets the rules — which file types a mod may hold, archives opened and\n" +
+            "checked too, the manifest each upload carries, size limits, and whether\n" +
+            "anybody or only the owner may upload. Modders publish with their own\n" +
+            "CodeRook accounts; nothing is listed until it passes the rules and a\n" +
+            "malware scan, and anything that runs (.exe, .dll, scripts) is refused\n" +
+            "in every repository. The game's client reads a catalogue signed with\n" +
+            "the repository's own key: see coderook.com/docs#mod-repositories.\n\n" +
+            "  create <repo> --name \"Game\"   set one up; prints its address and public key\n" +
+            "  repos                          the repositories you run\n" +
+            "  info <repo>                    a repository's rules, for anybody\n" +
+            "  settings <repo> [rules…]       change the rules (owner)\n" +
+            "  builds <repo>                  game builds allowed to read it (owner)\n" +
+            "  publish <folder|zip> --repo <repo>   upload a mod; waits for its checks\n" +
+            "  list <repo> [--all]            your mods and how their checks went\n" +
+            "  remove <mod> --repo <repo>     take a mod down\n" +
+            "  block <username> --repo <repo> stop an uploader (owner)\n" +
+            "  reports <repo>                 what players reported (owner)\n" +
+            "  delete <repo>                  delete a repository and everything in it",
+        options: [
+            { flags: "--name <text>", description: "create/settings: the game's name" },
+            { flags: "--allow <exts>", description: "create/settings: file types a mod may hold, e.g. .png,.json" },
+            { flags: "--nested <exts>", description: "create/settings: archives inside a mod that are opened and checked too" },
+            { flags: "--manifest <file|none>", description: "create/settings: the manifest every part carries (default mod.json)" },
+            { flags: "--fields <list>", description: "create/settings: manifest fields that must match: id,name,folder,version" },
+            { flags: "--uploads <anyone|owner>", description: "create/settings: who may upload" },
+            { flags: "--max-part <size>", description: "create/settings: largest part, e.g. 2GB" },
+            { flags: "--register <file>", description: "builds: register the build secret in this file (never printed)" },
+            { flags: "--new", description: "builds: have the service make a build secret (shown once)" },
+            { flags: "--off <id>", description: "builds: turn a build off" },
+            { flags: "--repo <repo>", description: "publish/list/remove/block: which repository" },
+            { flags: "--part <id>", description: "publish: which part of the mod this is (default main)" },
+            { flags: "--id <mod>", description: "publish: the mod's id (default: manifest, then folder name)" },
+            { flags: "--version <v>", description: "publish: the mod's version" },
+            { flags: "--folder <name>", description: "publish: the folder the game installs it into" },
+            { flags: "--part-name <text>", description: "publish: a readable name for the part" },
+            { flags: "--about <text>", description: "create/settings/publish: a description" },
+            { flags: "--notice <text>", description: "publish: a notice shown with the mod (credits, licences)" },
+            { flags: "--block <exts>", description: "create/settings: more file types to refuse" },
+            { flags: "--max-files <n>", description: "create/settings: most files in a part" },
+            { flags: "--max-ratio <n>", description: "create/settings: how many times its size a part may unpack to" },
+            { flags: "--max-parts <n>", description: "create/settings: most parts in a mod" },
+            { flags: "--expires <date>", description: "builds: when a registered build stops working" },
+            { flags: "--all", description: "list: every mod in the repository (owner)" },
+            { flags: "--as-owner", description: "remove: as the repository's owner, any mod" },
+            { flags: "--disable", description: "settings: stop serving and taking uploads" },
+            { flags: "--enable", description: "settings: start again" },
+            { flags: "--undo", description: "block: let the uploader back in" },
+            { flags: "-y, --yes", description: "remove/delete: without asking" },
+            { flags: "--no-wait", description: "publish: do not wait for the checks" },
+            { flags: "--take-down", description: "block: also hide the uploader's mods" },
+        ],
+        examples: [
+            'cbx mods create my-game --name "My Game" --allow .png,.ogg,.json --nested .pak',
+            "cbx mods builds my-game --register release/build-secret.bin",
+            "cbx mods publish ./mods/BetterTrees --repo my-game",
+            "cbx mods list my-game",
+            "cbx mods publish ./HD-Art --repo zt1 --part animals",
+        ],
+        run: mods_command_js_1.commandMods,
+    },
     {
         name: "issues",
         group: "Your projects",