@coderook/cli 0.34.8 → 0.34.10

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, with cbx or plain git, from Claude Code.",
-  "version": "0.34.8",
+  "version": "0.34.10",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/README.md

@@ -436,6 +436,32 @@ artifacts or with `cbx attach <file>`, so a release made by pushing a tag
 simply has none until something adds them — which is what a release without a
 build has always looked like.
 
+## Releases and app downloads
+
+```
+cbx release 1.4.0                        name the newest save as a release
+cbx attach ./dist/MyApp-Setup-1.4.0.exe  put the installer on it
+cbx release --downloads public           offer its downloads, keep the source private
+cbx releases                             each release, its files, and who can take them
+```
+
+In a public project, `--downloads public` offers a release's notes,
+attachments and update feed to anybody while the version's own files keep
+their visibility, so one project holds the code and ships the app. There is
+no need for a second project that only holds releases. `--downloads private`
+takes them back. Without a release name it changes an existing release and
+leaves its notes alone.
+
+`cbx releases` marks each one `public`, `downloads public` or `private`, and
+for a public project prints the addresses an app or a script reads, which
+need no account:
+
+```
+https://api.coderook.com/v1/public/projects/OWNER/SLUG/releases/latest
+https://api.coderook.com/v1/public/projects/OWNER/SLUG/releases
+https://api.coderook.com/v1/public/projects/OWNER/SLUG/updates      electron-updater's generic provider
+```
+
 ## Building for every platform
 
 ```

package/dist/cbx/src/core/upload.js

@@ -113,6 +113,24 @@ class UploadCancelled extends Error {
     }
 }
 exports.UploadCancelled = UploadCancelled;
+/*
+  Version listings already read by this process, by repository and version.
+
+  A save read the version it started from twice — once to plan, once to
+  send — and then read the version it had just made, each time the whole
+  list: three downloads of 6,628 rows to change one line of one file. A
+  version never changes once it exists, so a listing read once is the
+  listing for good.
+*/
+const versionListings = new Map();
+/*
+  Delta signatures, for the same reason: one describes a file of a version
+  that will never change, and the planning pass and the sending pass each
+  asked for it.
+*/
+const signatures = new Map();
+/** How many version listings a folder keeps in `.coderook/versions`. */
+const KEPT_LISTINGS = 3;
 class Uploader {
     credentials;
     aborted = false;
@@ -127,6 +145,7 @@ class Uploader {
     deltaProtocol = null;
     /** Batch delta is separate so V2 single-file support remains compatible. */
     deltaBatchSupported = null;
+    versionDeltaSupported = null;
     microchunkSupported = null;
     /** One shared preflight, so parallel upload lanes cannot race /health. */
     capabilityRequest = null;
@@ -524,7 +543,7 @@ class Uploader {
         if (!ticked.size)
             throw new Error("Nothing is selected to upload");
         const prior = request.repositoryId
-            ? await this.versionFiles(request.repositoryId, request.baseVersionId)
+            ? await this.versionFiles(request.repositoryId, request.baseVersionId, request.localPath)
             : new Map();
         // Ticked files are sent; everything else the project still has keeps the
         // copy already stored, and a file that is new but unticked is left out.
@@ -1013,7 +1032,56 @@ class Uploader {
             : null;
         const linesAdded = counted ? counted.added : request.linesAdded;
         const linesRemoved = counted ? counted.removed : request.linesRemoved;
-        const completed = await (0, profile_js_1.timed)("publish the version", () => this.call(`/v1/repositories/${repositoryId}/versions`, {
+        /*
+          The version's whole file list, as the service will hold it.
+        */
+        const wire = contents.map((item) => ({
+            path: item.path,
+            ...(item.pack
+                ? {
+                    pack: {
+                        objectId: item.pack.packObjectId,
+                        offset: item.pack.offset,
+                        length: item.pack.length,
+                    },
+                    sha256: item.sha256,
+                }
+                : item.chunks
+                    ? { chunks: item.chunks, sha256: item.sha256 }
+                    : { objectId: item.objectId }),
+            sourceSize: item.sourceSize,
+            storedSize: item.storedSize,
+            mediaType: item.mediaType,
+            executable: item.executable === true,
+        }));
+        /*
+          Or only what changed (version-delta-v1).
+    
+          The list above names every file in the project, so a save of one line
+          in a 6,628-file project sent 2.3 MB describing 6,627 files the service
+          already held exactly that way. When the service can take it, the save
+          names the version it started from, the paths that went, and only the
+          entries that differ from that version; the service fills in the rest
+          from its own record before it checks anything.
+        */
+        const startedFrom = typeof request.baseVersionId === "string" &&
+            prior.size &&
+            (await this.versionDeltaAllowed())
+            ? request.baseVersionId
+            : null;
+        const changesOnly = startedFrom
+            ? {
+                files: wire.filter((entry) => {
+                    const before = prior.get(entry.path);
+                    return !before || !sameEntry(entry, wireFromPrior(entry.path, before));
+                }),
+                filesFrom: {
+                    versionId: startedFrom,
+                    removed: [...prior.keys()].filter((held) => !named.has(held)),
+                },
+            }
+            : null;
+        const send = (asChanges) => (0, profile_js_1.timed)("publish the version", () => this.call(`/v1/repositories/${repositoryId}/versions`, {
             method: "POST",
             contentType: "application/json",
             body: JSON.stringify({
@@ -1057,27 +1125,21 @@ class Uploader {
                   One shape or the other, never both — the service refuses a file that
                   names an object and a chunk list, and so does its database.
                 */
-                files: contents.map((item) => ({
-                    path: item.path,
-                    ...(item.pack
-                        ? {
-                            pack: {
-                                objectId: item.pack.packObjectId,
-                                offset: item.pack.offset,
-                                length: item.pack.length,
-                            },
-                            sha256: item.sha256,
-                        }
-                        : item.chunks
-                            ? { chunks: item.chunks, sha256: item.sha256 }
-                            : { objectId: item.objectId }),
-                    sourceSize: item.sourceSize,
-                    storedSize: item.storedSize,
-                    mediaType: item.mediaType,
-                    executable: item.executable === true,
-                })),
+                ...(asChanges && changesOnly ? changesOnly : { files: wire }),
             }),
         }));
+        /*
+          A service that cannot build on the version named (it was taken down,
+          say) answers files_from_*; the whole list is then sent instead, which
+          every service accepts.
+        */
+        const completed = await send(true).catch((error) => {
+            const code = error.code;
+            if (changesOnly && typeof code === "string" && code.startsWith("files_from_")) {
+                return send(false);
+            }
+            throw error;
+        });
         /*
           A clean stale-base save may contain a server-side merge. The candidate
           manifest built above is then not the Version that landed: it lacks the
@@ -1086,8 +1148,21 @@ class Uploader {
           Version once rather than guessing.
         */
         let acceptedManifest = (0, publication_js_1.acceptedManifestDigests)(completed.manifest?.files);
-        if (!completed.mergeTrack && !Object.keys(acceptedManifest).length) {
-            acceptedManifest = Object.fromEntries([...(await this.versionFiles(repositoryId, completed.version.id))].map(([file, descriptor]) => [file, descriptor.sha256]));
+        /*
+          A service that lists version-delta-v1 also says when it combined this
+          save with somebody else's (`combined`). Without that, and for a repeated
+          attempt, the version that landed may not be the list sent here, so it is
+          read back. Otherwise it is exactly that list, and reading 6,628 rows to
+          learn what was just sent is the third download this used to cost.
+        */
+        const landedAsSent = !completed.mergeTrack &&
+            !completed.repeated &&
+            !completed.combined &&
+            /* A key published on purpose is stored as its covered copy, not as sent. */
+            !request.allowSecrets &&
+            (await this.versionDeltaAllowed());
+        if (!completed.mergeTrack && !landedAsSent && !Object.keys(acceptedManifest).length) {
+            acceptedManifest = Object.fromEntries([...(await this.versionFiles(repositoryId, completed.version.id, request.localPath))].map(([file, descriptor]) => [file, descriptor.sha256]));
         }
         const manifest = Object.keys(acceptedManifest).length
             ? acceptedManifest
@@ -1146,6 +1221,19 @@ class Uploader {
             if (held)
                 local[path] = held;
         }
+        /*
+          The next save starts from this version, so its listing is kept in the
+          folder now, from the list just sent — every entry with its digest — and
+          that save does not have to download it.
+        */
+        if (landedAsSent && request.localPath) {
+            const rows = wire.map((entry) => ({ ...entry, sha256: manifest[entry.path] }));
+            if (rows.every((row) => typeof row.sha256 === "string" && row.sha256.length === 64)) {
+                const key = `${repositoryId}/${completed.version.id}`;
+                versionListings.set(key, Promise.resolve(rows));
+                await writeListing(request.localPath, repositoryId, completed.version.id, rows);
+            }
+        }
         report({
             stage: "done",
             files: declarations.length,
@@ -2000,7 +2088,9 @@ class Uploader {
         });
     }
     /** What the newest version holds, so unchanged files can point at it. */
-    async versionFiles(repositoryId, versionId) {
+    async versionFiles(repositoryId, versionId, 
+    /** The project folder, whose `.coderook/versions` keeps listings between runs. */
+    localPath) {
         const held = new Map();
         try {
             // Explicit null is a genuinely empty base. Undefined belongs only to
@@ -2014,10 +2104,8 @@ class Uploader {
             }
             if (!wanted)
                 return held;
-            const body = await this.call(`/v1/repositories/${repositoryId}/versions/${wanted}/files`, {
-                method: "GET",
-            });
-            for (const row of body.files ?? []) {
+            const rows = await this.listing(repositoryId, wanted, localPath);
+            for (const row of rows) {
                 const pieces = Array.isArray(row.chunks)
                     ? row.chunks.map((chunk) => ({
                         objectId: String(chunk.objectId ?? ""),
@@ -2052,6 +2140,37 @@ class Uploader {
         }
         return held;
     }
+    /**
+     * A version's files, as the service lists them: from this process's memo,
+     * then the folder's own cache, and only then from the service.
+     *
+     * The folder cache is what makes the next save cheap: the version a save
+     * starts from is nearly always the one the previous save made, and that
+     * one is written here by the save that made it (rememberListing).
+     */
+    async listing(repositoryId, versionId, localPath) {
+        const key = `${repositoryId}/${versionId}`;
+        const known = versionListings.get(key);
+        if (known)
+            return known;
+        const reading = (async () => {
+            const cached = localPath
+                ? await readListing(localPath, repositoryId, versionId)
+                : null;
+            if (cached)
+                return cached;
+            const body = await this.call(`/v1/repositories/${repositoryId}/versions/${versionId}/files`, {
+                method: "GET",
+            });
+            const rows = body.files ?? [];
+            if (localPath)
+                await writeListing(localPath, repositoryId, versionId, rows);
+            return rows;
+        })();
+        versionListings.set(key, reading);
+        reading.catch(() => versionListings.delete(key));
+        return reading;
+    }
     /** The account's repository with this slug, if it has one. */
     async findBySlug(slug) {
         try {
@@ -2372,7 +2491,17 @@ class Uploader {
             return null;
         }
     }
-    async deltaSignature(repositoryId, baseVersionId, filePath, baseSha256, version) {
+    deltaSignature(repositoryId, baseVersionId, filePath, baseSha256, version) {
+        const key = [repositoryId, baseVersionId, filePath, baseSha256, version].join("\u0000");
+        const known = signatures.get(key);
+        if (known)
+            return known;
+        const asking = this.fetchDeltaSignature(repositoryId, baseVersionId, filePath, baseSha256, version);
+        signatures.set(key, asking);
+        asking.catch(() => signatures.delete(key));
+        return asking;
+    }
+    async fetchDeltaSignature(repositoryId, baseVersionId, filePath, baseSha256, version) {
         const token = await this.credentials.token();
         if (!token)
             throw new Error("Sign in again before uploading");
@@ -2841,6 +2970,20 @@ class Uploader {
                 : 0;
         return this.deltaProtocol;
     }
+    /**
+     * Whether a save may name only what changed (`filesFrom`).
+     *
+     * Asked, never assumed, and for a stronger reason than the others: a
+     * service that does not know the field would drop it and publish the
+     * changed files alone as the whole project. Only a service that lists
+     * `version-delta-v1` gets anything but the full list.
+     */
+    async versionDeltaAllowed() {
+        if (this.versionDeltaSupported !== null)
+            return this.versionDeltaSupported;
+        this.versionDeltaSupported = (await this.serviceFeatures()).includes("version-delta-v1");
+        return this.versionDeltaSupported;
+    }
     async deltaBatchAllowed() {
         if (this.deltaBatchSupported !== null)
             return this.deltaBatchSupported;
@@ -2975,3 +3118,84 @@ async function executableFor(request, relative, before) {
         return before;
     }
 }
+/*
+  The folder's cache of version listings: `.coderook/versions/<id>.json`.
+
+  `.coderook` is never uploaded and ignores itself, so this never reaches a
+  project. A version never changes, so an entry is either right or for a
+  different version; it is checked against both names it was written under,
+  and anything unreadable is simply not used.
+*/
+async function readListing(localPath, repositoryId, versionId) {
+    try {
+        const kept = JSON.parse(await (0, promises_1.readFile)(node_path_1.default.join(localPath, ".coderook", "versions", `${versionId}.json`), "utf8"));
+        if (kept.repositoryId !== repositoryId ||
+            kept.versionId !== versionId ||
+            !Array.isArray(kept.files)) {
+            return null;
+        }
+        return kept.files;
+    }
+    catch {
+        return null;
+    }
+}
+async function writeListing(localPath, repositoryId, versionId, files) {
+    const folder = node_path_1.default.join(localPath, ".coderook", "versions");
+    try {
+        await (0, promises_1.mkdir)(folder, { recursive: true });
+        await (0, promises_1.writeFile)(node_path_1.default.join(folder, `${versionId}.json`), JSON.stringify({ repositoryId, versionId, files }));
+        /* Only the newest few: the next save needs one, a retry another. */
+        const entries = await Promise.all((await (0, promises_1.readdir)(folder))
+            .filter((name) => name.endsWith(".json"))
+            .map(async (name) => ({
+            name,
+            at: (await (0, promises_1.stat)(node_path_1.default.join(folder, name))).mtimeMs,
+        })));
+        entries.sort((left, right) => right.at - left.at);
+        for (const old of entries.slice(KEPT_LISTINGS)) {
+            await (0, promises_1.rm)(node_path_1.default.join(folder, old.name), { force: true });
+        }
+    }
+    catch {
+        /* A cache that cannot be written costs one download next time, nothing more. */
+    }
+}
+/** A file the previous version holds, in the shape a save names it. */
+function wireFromPrior(filePath, held) {
+    return {
+        path: filePath,
+        ...(held.pack
+            ? {
+                pack: {
+                    objectId: held.pack.objectId,
+                    offset: held.pack.offset,
+                    length: held.pack.length,
+                },
+                sha256: held.sha256,
+            }
+            : held.chunks?.length
+                ? { chunks: held.chunks, sha256: held.sha256 }
+                : { objectId: held.objectId }),
+        sourceSize: held.sourceSize,
+        storedSize: held.storedSize,
+        mediaType: held.mediaType,
+        executable: held.executable === true,
+    };
+}
+/** Whether two entries name the same file stored the same way. */
+function sameEntry(left, right) {
+    return canonical(left) === canonical(right);
+}
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    if (value && typeof value === "object") {
+        return `{${Object.keys(value)
+            .filter((key) => value[key] !== undefined)
+            .sort()
+            .map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value);
+}

package/dist/cli/src/api.js

@@ -31,6 +31,7 @@ exports.compareVersions = compareVersions;
 exports.fileTextAt = fileTextAt;
 exports.versions = versions;
 exports.markRelease = markRelease;
+exports.setReleaseDownloadsPublic = setReleaseDownloadsPublic;
 exports.issues = issues;
 exports.createIssue = createIssue;
 exports.releases = releases;
@@ -628,6 +629,17 @@ async function markRelease(repositoryId, versionId, name, notes) {
         versionId: String(body.release?.versionId ?? versionId),
     };
 }
+/**
+ * Make a release's downloads public, or private again, apart from its source.
+ *
+ * What is attached to the release, its notes and the update feed are offered
+ * to anybody while the version's files keep their own visibility, so one
+ * project can ship its installers without a second public project for them.
+ */
+async function setReleaseDownloadsPublic(repositoryId, versionId, value) {
+    await call(`/v1/repositories/${encodeURIComponent(repositoryId)}` +
+        `/versions/${encodeURIComponent(versionId)}/release/downloads`, { method: "PUT", body: { public: value } });
+}
 async function issues(repositoryId) {
     const body = await call(`/v1/repositories/${encodeURIComponent(repositoryId)}/issues`);
     return {
@@ -671,6 +683,9 @@ async function releases(repositoryId) {
         releasedAt: String(row.releasedAt ?? ""),
         releasedBy: String(row.releasedBy ?? ""),
         assets: Array.isArray(row.assets) ? row.assets : [],
+        attachments: Array.isArray(row.attachments) ? row.attachments : [],
+        downloadsPublic: row.downloadsPublic === true,
+        sourcePublic: row.sourcePublic === true,
     }));
 }
 async function collaborators(repositoryId) {

package/dist/cli/src/cli.js

@@ -2801,6 +2801,10 @@ const SPECS = [
         group: "Your projects",
         summary: "what has been released, and its files",
         usage: "releases [project]",
+        detail: "Each release with its files and who can take them: public (source and\n" +
+            "downloads), downloads public (the source stays private) or private.\n" +
+            "For a public project it also prints the addresses an app or a script\n" +
+            "reads them from, which need no account.",
         run: service_commands_js_1.commandReleases,
     },
     {
@@ -3060,14 +3064,22 @@ const SPECS = [
             "Nothing is uploaded: a release is a version with a name on it, so the\n" +
             "version has to exist already.\n\n" +
             "The same thing happens when a git tag is pushed to a CodeRook remote —\n" +
-            "`git push cbx v1.0` and `cbx release v1.0` are one action.",
+            "`git push cbx v1.0` and `cbx release v1.0` are one action.\n\n" +
+            "Put the installers on it with `cbx attach`. In a public project,\n" +
+            "--downloads public offers the release's notes, attachments and update\n" +
+            "feed to anybody while the version's source stays private, so one\n" +
+            "project can ship its own app without a second, public project for the\n" +
+            "installers. Without a name, --downloads changes an existing release.",
         options: [
             { flags: "--version <n>", description: "name this version instead of the newest" },
             { flags: "--notes <text>", description: "what changed, for the release page" },
+            { flags: "--downloads <public|private>", description: "who can take what is attached, apart from the source" },
         ],
         examples: [
             "cbx release v1.0",
             'cbx release v1.2 --version 41 --notes "Fixes the export dialog"',
+            "cbx release 1.4.0 --downloads public",
+            "cbx release --downloads private --version 41",
         ],
         run: service_commands_js_1.commandRelease,
     },

package/dist/cli/src/service_commands.js

@@ -119,12 +119,22 @@ async function commandIssues(parsed) {
  * would be a feature that exists twice and agrees by luck.
  */
 async function commandRelease(parsed) {
+    /*
+      `--downloads public|private` decides who can take what is attached,
+      apart from the source. Given without a name it changes an existing
+      release and nothing else: naming it again would rewrite its notes.
+    */
+    const downloads = parsed.flags.get("downloads");
+    if (downloads !== undefined && downloads !== "public" && downloads !== "private") {
+        console.error((0, colour_js_1.red)("--downloads is public or private: cbx release v1.0 --downloads public"));
+        return 1;
+    }
     const name = parsed.positional[0];
-    if (!name) {
+    if (!name && downloads === undefined) {
         console.error((0, colour_js_1.red)("Name the release: cbx release v1.0"));
         return 1;
     }
-    const project = await (0, project_commands_js_1.resolveProject)(parsed.positional[1]);
+    const project = await (0, project_commands_js_1.resolveProject)(name ? parsed.positional[1] : parsed.positional[0]);
     if (!project)
         return 1;
     const all = await (0, api_js_1.versions)(project.id);
@@ -161,15 +171,32 @@ async function commandRelease(parsed) {
         return 1;
     }
     const notes = parsed.flags.get("notes");
-    try {
-        await (0, api_js_1.markRelease)(project.id, target.id, name, typeof notes === "string" ? notes : null);
+    if (name) {
+        try {
+            await (0, api_js_1.markRelease)(project.id, target.id, name, typeof notes === "string" ? notes : null);
+        }
+        catch (error) {
+            console.error((0, colour_js_1.red)(error instanceof Error ? error.message : String(error)));
+            return 1;
+        }
+        console.log(`${(0, colour_js_1.green)("Released")} ${(0, colour_js_1.bold)(name)} ${(0, colour_js_1.dim)("at")} v${target.sequence}` +
+            `${(0, colour_js_1.dim)(" — ")}${target.message.split("\n")[0].slice(0, 48)}`);
     }
-    catch (error) {
-        console.error((0, colour_js_1.red)(error instanceof Error ? error.message : String(error)));
-        return 1;
+    if (downloads !== undefined) {
+        try {
+            await (0, api_js_1.setReleaseDownloadsPublic)(project.id, target.id, downloads === "public");
+        }
+        catch (error) {
+            console.error((0, colour_js_1.red)(error instanceof Error ? error.message : String(error)));
+            return 1;
+        }
+        console.log(downloads === "public"
+            ? `${(0, colour_js_1.green)("Downloads public")} ${(0, colour_js_1.dim)("on")} v${target.sequence}${(0, colour_js_1.dim)(": anybody can take what is attached; the source keeps its own visibility.")}`
+            : `${(0, colour_js_1.green)("Downloads private")} ${(0, colour_js_1.dim)("on")} v${target.sequence}${(0, colour_js_1.dim)(": only people on this project can take them now.")}`);
+        if (downloads === "public" && project.visibility !== "public") {
+            console.log((0, colour_js_1.dim)("  The project itself is not public, so nobody outside it can reach them yet: cbx visibility public."));
+        }
     }
-    console.log(`${(0, colour_js_1.green)("Released")} ${(0, colour_js_1.bold)(name)} ${(0, colour_js_1.dim)("at")} v${target.sequence}` +
-        `${(0, colour_js_1.dim)(" — ")}${target.message.split("\n")[0].slice(0, 48)}`);
     return 0;
 }
 async function commandReleases(parsed) {
@@ -186,13 +213,30 @@ async function commandReleases(parsed) {
         const when = release.releasedAt
             ? new Date(release.releasedAt).toLocaleDateString()
             : "";
+        const who = release.sourcePublic
+            ? "public"
+            : release.downloadsPublic
+                ? "downloads public"
+                : "private";
         console.log(`  ${(0, colour_js_1.accent)(`v${release.sequence}`).padEnd(16)} ` +
             `${(release.name || "—").padEnd(28)} ${when.padEnd(14)} ` +
-            `${release.assets.length} files`);
+            `${`${release.assets.length + release.attachments.length} files`.padEnd(10)} ${(0, colour_js_1.dim)(who)}`);
         const firstLine = release.notes.split("\n")[0];
         if (firstLine)
             console.log(`    ${(0, colour_js_1.dim)(firstLine)}`);
     }
+    /* Where an app or a script reads them, for a project anybody can reach. */
+    const owner = project.visibility === "public" && published.some((one) => one.downloadsPublic || one.sourcePublic)
+        ? await (0, api_js_1.whoami)().then((me) => me.username).catch(() => null)
+        : null;
+    if (owner) {
+        const base = `https://api.coderook.com/v1/public/projects/${encodeURIComponent(owner)}/${encodeURIComponent(project.slug)}`;
+        console.log("");
+        console.log((0, colour_js_1.dim)("  From code, no account needed:"));
+        console.log(`  ${(0, colour_js_1.dim)("latest release")}  ${base}/releases/latest`);
+        console.log(`  ${(0, colour_js_1.dim)("all releases")}    ${base}/releases`);
+        console.log(`  ${(0, colour_js_1.dim)("update feed")}     ${base}/updates`);
+    }
     return 0;
 }
 /** Who can reach a project, and who has been asked. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.34.8",
+  "version": "0.34.10",
   "description": "The command line for CodeRook (coderook.com): version control and project hosting for projects of any size. Every save is a compressed snapshot, private or public, never used to train AI.",
   "license": "Apache-2.0",
   "homepage": "https://coderook.com",

package/skills/coderook/SKILL.md

@@ -246,11 +246,13 @@ line's source to find these — this is the whole of it:
 GET /projects?q=                                  public projects, newest first
 GET /projects/{owner}/{slug}                      one project
 GET /projects/{owner}/{slug}/versions             the versions it offers
+GET /projects/{owner}/{slug}/releases             every release, with its downloads
 GET /projects/{owner}/{slug}/releases/latest      newest release and its files
 GET /projects/{owner}/{slug}/updates/latest.yml   electron-updater feed
 GET /projects/{owner}/{slug}/versions/{v}/files         every file, with digests
 GET /projects/{owner}/{slug}/versions/{v}/file?path=    one file
 GET /projects/{owner}/{slug}/versions/{v}/archive       the version as a zip
+GET /projects/{owner}/{slug}/versions/{v}/last-changes?path=   which version last changed each entry
 GET /projects/{owner}/{slug}/versions/{v}/attachments   files attached to it
 GET /projects/{owner}/{slug}/versions/{v}/attachments/{id}   download one
 ```
@@ -279,8 +281,16 @@ The feed serves `latest.yml`, `latest-mac.yml` and `latest-linux.yml` with
 each file's size and SHA-512, and redirects file names to their downloads.
 Anything else can read `releases/latest` as JSON: version, notes, and every
 file with its size, SHA-256 and `url`. Updaters have no account, so the
-project they read must be public; keep private code in a separate project and
-ship releases from a public one.
+project they read must be public, but its source need not be:
+
+```bash
+cbx release 1.4.0 --downloads public   # notes, attachments and feed public; files stay private
+cbx releases                           # public / downloads public / private, and the addresses
+```
+
+**Ask before `--downloads public`**: it publishes the attached files to anyone.
+One project holds the code and ships the app; a second "releases" project is
+no longer needed.
 
 ## Building executables for every platform