@coderook/cli 0.34.11 → 0.36.0

package/dist/cli/src/zip_writer.js

@@ -0,0 +1,188 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.crc32 = crc32;
+exports.listFiles = listFiles;
+exports.writeZip = writeZip;
+/**
+ * Write a folder as a zip, one file at a time, to disk.
+ *
+ * Mod repositories take each part as a zip, and a game's mod can hold
+ * hundreds of thousands of files and run to gigabytes — ZT1's art packs do —
+ * so the archive is written as it goes rather than built in memory, and
+ * ZIP64 records are used once sizes, offsets or the file count pass what the
+ * classic format can hold. Each file is deflated, or stored when deflating
+ * would not make it smaller (already-compressed images and audio).
+ */
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = __importDefault(require("node:path"));
+const node_zlib_1 = require("node:zlib");
+const CRC_TABLE = (() => {
+    const table = new Uint32Array(256);
+    for (let n = 0; n < 256; n += 1) {
+        let c = n;
+        for (let k = 0; k < 8; k += 1)
+            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+        table[n] = c >>> 0;
+    }
+    return table;
+})();
+function crc32(bytes) {
+    let crc = 0xffffffff;
+    for (let i = 0; i < bytes.length; i += 1)
+        crc = CRC_TABLE[(crc ^ bytes[i]) & 0xff] ^ (crc >>> 8);
+    return (crc ^ 0xffffffff) >>> 0;
+}
+const MAX32 = 0xffffffff;
+const MAX16 = 0xffff;
+function dosTime(when) {
+    return {
+        time: (when.getHours() << 11) | (when.getMinutes() << 5) | Math.floor(when.getSeconds() / 2),
+        date: ((Math.max(1980, when.getFullYear()) - 1980) << 9) | ((when.getMonth() + 1) << 5) | when.getDate(),
+    };
+}
+/** Every file under a folder, as zip paths with forward slashes, in a stable order. */
+async function listFiles(root, skip = () => false) {
+    const found = [];
+    const walk = async (dir) => {
+        const entries = (await (0, promises_1.readdir)(node_path_1.default.join(root, dir), { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name));
+        for (const entry of entries) {
+            const relative = dir ? `${dir}/${entry.name}` : entry.name;
+            if (skip(relative))
+                continue;
+            if (entry.isSymbolicLink())
+                continue;
+            if (entry.isDirectory())
+                await walk(relative);
+            else if (entry.isFile())
+                found.push(relative);
+        }
+    };
+    await walk("");
+    return found;
+}
+/**
+ * Zip these files (paths relative to root) into `out`. `extra` adds entries
+ * written from memory — a generated manifest, for one.
+ */
+async function writeZip(root, files, out, extra = [], onProgress) {
+    const stream = (0, node_fs_1.createWriteStream)(out);
+    let failed = null;
+    stream.on("error", (error) => {
+        failed = error;
+    });
+    const write = async (chunk) => {
+        if (failed)
+            throw failed;
+        if (!stream.write(chunk))
+            await new Promise((resolve) => stream.once("drain", resolve));
+        if (failed)
+            throw failed;
+    };
+    const written = [];
+    let offset = 0;
+    const { time, date } = dosTime(new Date());
+    const extraNames = new Set(extra.map((one) => one.path));
+    const sources = [
+        ...extra.map((one) => ({ path: one.path, load: async () => one.bytes })),
+        ...files.filter((file) => !extraNames.has(file)).map((file) => ({ path: file, load: () => (0, promises_1.readFile)(node_path_1.default.join(root, file)) })),
+    ];
+    for (const [index, source] of sources.entries()) {
+        const raw = await source.load();
+        const deflated = (0, node_zlib_1.deflateRawSync)(raw, { level: 6 });
+        const store = deflated.length >= raw.length;
+        const body = store ? raw : deflated;
+        const name = Buffer.from(source.path, "utf8");
+        const crc = crc32(raw);
+        const zip64 = raw.length >= MAX32 || body.length >= MAX32;
+        const local = Buffer.alloc(30);
+        local.writeUInt32LE(0x04034b50, 0);
+        local.writeUInt16LE(zip64 ? 45 : 20, 4);
+        local.writeUInt16LE(0x0800, 6); /* UTF-8 names */
+        local.writeUInt16LE(store ? 0 : 8, 8);
+        local.writeUInt16LE(time, 10);
+        local.writeUInt16LE(date, 12);
+        local.writeUInt32LE(crc, 14);
+        local.writeUInt32LE(zip64 ? MAX32 : body.length, 18);
+        local.writeUInt32LE(zip64 ? MAX32 : raw.length, 22);
+        local.writeUInt16LE(name.length, 26);
+        const localExtra = zip64 ? zip64Extra([raw.length, body.length]) : Buffer.alloc(0);
+        local.writeUInt16LE(localExtra.length, 28);
+        await write(local);
+        await write(name);
+        if (localExtra.length)
+            await write(localExtra);
+        await write(body);
+        written.push({ name, crc, method: store ? 0 : 8, compressed: body.length, size: raw.length, offset, time, date });
+        offset += local.length + name.length + localExtra.length + body.length;
+        onProgress?.(index + 1, sources.length);
+    }
+    const centralStart = offset;
+    for (const entry of written) {
+        const big = [entry.size >= MAX32, entry.compressed >= MAX32, entry.offset >= MAX32];
+        const values = [
+            ...(big[0] ? [entry.size] : []),
+            ...(big[1] ? [entry.compressed] : []),
+            ...(big[2] ? [entry.offset] : []),
+        ];
+        const extraField = values.length ? zip64Extra(values) : Buffer.alloc(0);
+        const central = Buffer.alloc(46);
+        central.writeUInt32LE(0x02014b50, 0);
+        central.writeUInt16LE(values.length ? 45 : 20, 4);
+        central.writeUInt16LE(values.length ? 45 : 20, 6);
+        central.writeUInt16LE(0x0800, 8);
+        central.writeUInt16LE(entry.method, 10);
+        central.writeUInt16LE(entry.time, 12);
+        central.writeUInt16LE(entry.date, 14);
+        central.writeUInt32LE(entry.crc, 16);
+        central.writeUInt32LE(big[1] ? MAX32 : entry.compressed, 20);
+        central.writeUInt32LE(big[0] ? MAX32 : entry.size, 24);
+        central.writeUInt16LE(entry.name.length, 28);
+        central.writeUInt16LE(extraField.length, 30);
+        central.writeUInt32LE((0o100644 * 0x10000) >>> 0, 38); /* a plain file, never a link */
+        central.writeUInt32LE(big[2] ? MAX32 : entry.offset, 42);
+        await write(central);
+        await write(entry.name);
+        if (extraField.length)
+            await write(extraField);
+        offset += central.length + entry.name.length + extraField.length;
+    }
+    const centralSize = offset - centralStart;
+    const needs64 = written.length >= MAX16 || centralStart >= MAX32 || centralSize >= MAX32;
+    if (needs64) {
+        const record = Buffer.alloc(56);
+        record.writeUInt32LE(0x06064b50, 0);
+        record.writeBigUInt64LE(44n, 4);
+        record.writeUInt16LE(45, 12);
+        record.writeUInt16LE(45, 14);
+        record.writeBigUInt64LE(BigInt(written.length), 24);
+        record.writeBigUInt64LE(BigInt(written.length), 32);
+        record.writeBigUInt64LE(BigInt(centralSize), 40);
+        record.writeBigUInt64LE(BigInt(centralStart), 48);
+        const locator = Buffer.alloc(20);
+        locator.writeUInt32LE(0x07064b50, 0);
+        locator.writeBigUInt64LE(BigInt(offset), 8);
+        locator.writeUInt32LE(1, 16);
+        await write(record);
+        await write(locator);
+    }
+    const end = Buffer.alloc(22);
+    end.writeUInt32LE(0x06054b50, 0);
+    end.writeUInt16LE(needs64 ? MAX16 : written.length, 8);
+    end.writeUInt16LE(needs64 ? MAX16 : written.length, 10);
+    end.writeUInt32LE(needs64 ? MAX32 : centralSize, 12);
+    end.writeUInt32LE(needs64 ? MAX32 : centralStart, 16);
+    await write(end);
+    await new Promise((resolve, reject) => stream.end((error) => (error ? reject(error) : resolve())));
+    return { files: written.length, bytes: offset + (needs64 ? 76 : 0) + 22 };
+}
+function zip64Extra(values) {
+    const field = Buffer.alloc(4 + values.length * 8);
+    field.writeUInt16LE(0x0001, 0);
+    field.writeUInt16LE(values.length * 8, 2);
+    values.forEach((value, index) => field.writeBigUInt64LE(BigInt(value), 4 + index * 8));
+    return field;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.34.11",
+  "version": "0.36.0",
   "description": "The command line for CodeRook (coderook.com): version control and project hosting for projects of any size. Every save is a compressed snapshot, private or public, never used to train AI.",
   "license": "Apache-2.0",
   "homepage": "https://coderook.com",

package/skills/coderook/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: coderook
-description: Save, browse and restore versions of a project on CodeRook — a version host where every version is a complete snapshot, reached with the cbx command or with plain git. Use when asked to save, submit or push work to CodeRook, check what has changed, look at a project's versions or files, fetch a project, start or switch a line of work, resolve a save that landed at the same time as somebody else's, or build a project's executables for Windows, Linux and macOS from one machine (cbx build).
+description: Save, browse and restore versions of a project on CodeRook — a version host where every version is a complete snapshot, reached with the cbx command or with plain git. Use when asked to save, submit or push work to CodeRook, check what has changed, look at a project's versions or files, fetch a project, start or switch a line of work, resolve a save that landed at the same time as somebody else's, build a project's executables for Windows, Linux and macOS from one machine (cbx build), or publish a mod to a game's mod repository or set one up (cbx mods).
 allowed-tools: Bash Read
 ---
 
@@ -306,6 +306,50 @@ unasked. `--ship` attaches the results to the newest save, so **ask before
 `--ship`**, as before any save. A project's own build description lives in
 `coderook.build.json`.
 
+## Reviewing proposals with GitHub tools
+
+When someone wants CodeRabbit, Blacksmith or GitHub Actions on their CodeRook
+proposals, that is `cbx github`: a GitHub repository mirrors each open
+proposal as a pull request, and the results come back as checks named
+`github/<check>` and `review/<reviewer>`.
+
+```bash
+cbx github setup OWNER/REPO   # token limited to this project, secret, workflow file
+cbx submit                    # the workflow has to be saved into the project
+cbx github sync --repo OWNER/REPO
+```
+
+**Ask before `setup`**: it creates a token and stores it in GitHub. The person
+adds the second secret, `CODEROOK_BRIDGE_PUSH` (a GitHub fine-grained token
+with Contents and Pull requests read/write), themselves, because it is their
+GitHub credential. Every proposal also carries a `coderook/malware` check; a
+failure names the file. Do not try to get round it.
+
+## Mod repositories for games
+
+A game's maker can run a mod repository: players' game clients read a signed
+catalogue from it, modders publish to it, and nothing is listed until it
+passes the repository's rules and a malware scan.
+
+```bash
+cbx mods info zt1                                   # a repository's rules, for anybody
+cbx mods publish ./BetterTrees --repo zt1           # zip, upload, wait for the checks
+cbx mods publish ./HD-Art --repo zt1 --part animals # one part of a bigger mod
+cbx mods list zt1                                   # your mods and how their checks went
+cbx mods create my-game --name "My Game" --allow .png,.ogg,.json
+```
+
+`publish` reads the folder's `mod.json` (or the repository's manifest) for the
+mod's id, name, folder and version; `--id`, `--name`, `--folder` and
+`--version` override it. It waits up to 30 minutes for the checks and prints
+what failed, file by file — pass that on as it is. Programs and scripts
+(`.exe`, `.dll`, `.ps1`, `.js` …) are refused in every repository, so do not
+try to rename one past the check. **Ask before `publish`**, as before any
+save: it makes the mod public once it passes. Ask before `remove`, `block`
+and `delete`, which only the person should decide. The game-side protocol
+(signed requests, the catalogue signature, downloads) is at
+https://coderook.com/docs#mod-repositories.
+
 ## Things not to do
 
 - Do not run `cbx delete` unless the person has asked for that project to