@coderook/cli 0.34.9 → 0.34.10

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, with cbx or plain git, from Claude Code.",
-  "version": "0.34.9",
+  "version": "0.34.10",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/README.md

@@ -436,6 +436,32 @@ artifacts or with `cbx attach <file>`, so a release made by pushing a tag
 simply has none until something adds them — which is what a release without a
 build has always looked like.
 
+## Releases and app downloads
+
+```
+cbx release 1.4.0                        name the newest save as a release
+cbx attach ./dist/MyApp-Setup-1.4.0.exe  put the installer on it
+cbx release --downloads public           offer its downloads, keep the source private
+cbx releases                             each release, its files, and who can take them
+```
+
+In a public project, `--downloads public` offers a release's notes,
+attachments and update feed to anybody while the version's own files keep
+their visibility, so one project holds the code and ships the app. There is
+no need for a second project that only holds releases. `--downloads private`
+takes them back. Without a release name it changes an existing release and
+leaves its notes alone.
+
+`cbx releases` marks each one `public`, `downloads public` or `private`, and
+for a public project prints the addresses an app or a script reads, which
+need no account:
+
+```
+https://api.coderook.com/v1/public/projects/OWNER/SLUG/releases/latest
+https://api.coderook.com/v1/public/projects/OWNER/SLUG/releases
+https://api.coderook.com/v1/public/projects/OWNER/SLUG/updates      electron-updater's generic provider
+```
+
 ## Building for every platform
 
 ```

package/dist/cli/src/api.js

@@ -31,6 +31,7 @@ exports.compareVersions = compareVersions;
 exports.fileTextAt = fileTextAt;
 exports.versions = versions;
 exports.markRelease = markRelease;
+exports.setReleaseDownloadsPublic = setReleaseDownloadsPublic;
 exports.issues = issues;
 exports.createIssue = createIssue;
 exports.releases = releases;
@@ -628,6 +629,17 @@ async function markRelease(repositoryId, versionId, name, notes) {
         versionId: String(body.release?.versionId ?? versionId),
     };
 }
+/**
+ * Make a release's downloads public, or private again, apart from its source.
+ *
+ * What is attached to the release, its notes and the update feed are offered
+ * to anybody while the version's files keep their own visibility, so one
+ * project can ship its installers without a second public project for them.
+ */
+async function setReleaseDownloadsPublic(repositoryId, versionId, value) {
+    await call(`/v1/repositories/${encodeURIComponent(repositoryId)}` +
+        `/versions/${encodeURIComponent(versionId)}/release/downloads`, { method: "PUT", body: { public: value } });
+}
 async function issues(repositoryId) {
     const body = await call(`/v1/repositories/${encodeURIComponent(repositoryId)}/issues`);
     return {
@@ -671,6 +683,9 @@ async function releases(repositoryId) {
         releasedAt: String(row.releasedAt ?? ""),
         releasedBy: String(row.releasedBy ?? ""),
         assets: Array.isArray(row.assets) ? row.assets : [],
+        attachments: Array.isArray(row.attachments) ? row.attachments : [],
+        downloadsPublic: row.downloadsPublic === true,
+        sourcePublic: row.sourcePublic === true,
     }));
 }
 async function collaborators(repositoryId) {

package/dist/cli/src/cli.js

@@ -2801,6 +2801,10 @@ const SPECS = [
         group: "Your projects",
         summary: "what has been released, and its files",
         usage: "releases [project]",
+        detail: "Each release with its files and who can take them: public (source and\n" +
+            "downloads), downloads public (the source stays private) or private.\n" +
+            "For a public project it also prints the addresses an app or a script\n" +
+            "reads them from, which need no account.",
         run: service_commands_js_1.commandReleases,
     },
     {
@@ -3060,14 +3064,22 @@ const SPECS = [
             "Nothing is uploaded: a release is a version with a name on it, so the\n" +
             "version has to exist already.\n\n" +
             "The same thing happens when a git tag is pushed to a CodeRook remote —\n" +
-            "`git push cbx v1.0` and `cbx release v1.0` are one action.",
+            "`git push cbx v1.0` and `cbx release v1.0` are one action.\n\n" +
+            "Put the installers on it with `cbx attach`. In a public project,\n" +
+            "--downloads public offers the release's notes, attachments and update\n" +
+            "feed to anybody while the version's source stays private, so one\n" +
+            "project can ship its own app without a second, public project for the\n" +
+            "installers. Without a name, --downloads changes an existing release.",
         options: [
             { flags: "--version <n>", description: "name this version instead of the newest" },
             { flags: "--notes <text>", description: "what changed, for the release page" },
+            { flags: "--downloads <public|private>", description: "who can take what is attached, apart from the source" },
         ],
         examples: [
             "cbx release v1.0",
             'cbx release v1.2 --version 41 --notes "Fixes the export dialog"',
+            "cbx release 1.4.0 --downloads public",
+            "cbx release --downloads private --version 41",
         ],
         run: service_commands_js_1.commandRelease,
     },

package/dist/cli/src/service_commands.js

@@ -119,12 +119,22 @@ async function commandIssues(parsed) {
  * would be a feature that exists twice and agrees by luck.
  */
 async function commandRelease(parsed) {
+    /*
+      `--downloads public|private` decides who can take what is attached,
+      apart from the source. Given without a name it changes an existing
+      release and nothing else: naming it again would rewrite its notes.
+    */
+    const downloads = parsed.flags.get("downloads");
+    if (downloads !== undefined && downloads !== "public" && downloads !== "private") {
+        console.error((0, colour_js_1.red)("--downloads is public or private: cbx release v1.0 --downloads public"));
+        return 1;
+    }
     const name = parsed.positional[0];
-    if (!name) {
+    if (!name && downloads === undefined) {
         console.error((0, colour_js_1.red)("Name the release: cbx release v1.0"));
         return 1;
     }
-    const project = await (0, project_commands_js_1.resolveProject)(parsed.positional[1]);
+    const project = await (0, project_commands_js_1.resolveProject)(name ? parsed.positional[1] : parsed.positional[0]);
     if (!project)
         return 1;
     const all = await (0, api_js_1.versions)(project.id);
@@ -161,15 +171,32 @@ async function commandRelease(parsed) {
         return 1;
     }
     const notes = parsed.flags.get("notes");
-    try {
-        await (0, api_js_1.markRelease)(project.id, target.id, name, typeof notes === "string" ? notes : null);
+    if (name) {
+        try {
+            await (0, api_js_1.markRelease)(project.id, target.id, name, typeof notes === "string" ? notes : null);
+        }
+        catch (error) {
+            console.error((0, colour_js_1.red)(error instanceof Error ? error.message : String(error)));
+            return 1;
+        }
+        console.log(`${(0, colour_js_1.green)("Released")} ${(0, colour_js_1.bold)(name)} ${(0, colour_js_1.dim)("at")} v${target.sequence}` +
+            `${(0, colour_js_1.dim)(" — ")}${target.message.split("\n")[0].slice(0, 48)}`);
     }
-    catch (error) {
-        console.error((0, colour_js_1.red)(error instanceof Error ? error.message : String(error)));
-        return 1;
+    if (downloads !== undefined) {
+        try {
+            await (0, api_js_1.setReleaseDownloadsPublic)(project.id, target.id, downloads === "public");
+        }
+        catch (error) {
+            console.error((0, colour_js_1.red)(error instanceof Error ? error.message : String(error)));
+            return 1;
+        }
+        console.log(downloads === "public"
+            ? `${(0, colour_js_1.green)("Downloads public")} ${(0, colour_js_1.dim)("on")} v${target.sequence}${(0, colour_js_1.dim)(": anybody can take what is attached; the source keeps its own visibility.")}`
+            : `${(0, colour_js_1.green)("Downloads private")} ${(0, colour_js_1.dim)("on")} v${target.sequence}${(0, colour_js_1.dim)(": only people on this project can take them now.")}`);
+        if (downloads === "public" && project.visibility !== "public") {
+            console.log((0, colour_js_1.dim)("  The project itself is not public, so nobody outside it can reach them yet: cbx visibility public."));
+        }
     }
-    console.log(`${(0, colour_js_1.green)("Released")} ${(0, colour_js_1.bold)(name)} ${(0, colour_js_1.dim)("at")} v${target.sequence}` +
-        `${(0, colour_js_1.dim)(" — ")}${target.message.split("\n")[0].slice(0, 48)}`);
     return 0;
 }
 async function commandReleases(parsed) {
@@ -186,13 +213,30 @@ async function commandReleases(parsed) {
         const when = release.releasedAt
             ? new Date(release.releasedAt).toLocaleDateString()
             : "";
+        const who = release.sourcePublic
+            ? "public"
+            : release.downloadsPublic
+                ? "downloads public"
+                : "private";
         console.log(`  ${(0, colour_js_1.accent)(`v${release.sequence}`).padEnd(16)} ` +
             `${(release.name || "—").padEnd(28)} ${when.padEnd(14)} ` +
-            `${release.assets.length} files`);
+            `${`${release.assets.length + release.attachments.length} files`.padEnd(10)} ${(0, colour_js_1.dim)(who)}`);
         const firstLine = release.notes.split("\n")[0];
         if (firstLine)
             console.log(`    ${(0, colour_js_1.dim)(firstLine)}`);
     }
+    /* Where an app or a script reads them, for a project anybody can reach. */
+    const owner = project.visibility === "public" && published.some((one) => one.downloadsPublic || one.sourcePublic)
+        ? await (0, api_js_1.whoami)().then((me) => me.username).catch(() => null)
+        : null;
+    if (owner) {
+        const base = `https://api.coderook.com/v1/public/projects/${encodeURIComponent(owner)}/${encodeURIComponent(project.slug)}`;
+        console.log("");
+        console.log((0, colour_js_1.dim)("  From code, no account needed:"));
+        console.log(`  ${(0, colour_js_1.dim)("latest release")}  ${base}/releases/latest`);
+        console.log(`  ${(0, colour_js_1.dim)("all releases")}    ${base}/releases`);
+        console.log(`  ${(0, colour_js_1.dim)("update feed")}     ${base}/updates`);
+    }
     return 0;
 }
 /** Who can reach a project, and who has been asked. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.34.9",
+  "version": "0.34.10",
   "description": "The command line for CodeRook (coderook.com): version control and project hosting for projects of any size. Every save is a compressed snapshot, private or public, never used to train AI.",
   "license": "Apache-2.0",
   "homepage": "https://coderook.com",

package/skills/coderook/SKILL.md

@@ -246,11 +246,13 @@ line's source to find these — this is the whole of it:
 GET /projects?q=                                  public projects, newest first
 GET /projects/{owner}/{slug}                      one project
 GET /projects/{owner}/{slug}/versions             the versions it offers
+GET /projects/{owner}/{slug}/releases             every release, with its downloads
 GET /projects/{owner}/{slug}/releases/latest      newest release and its files
 GET /projects/{owner}/{slug}/updates/latest.yml   electron-updater feed
 GET /projects/{owner}/{slug}/versions/{v}/files         every file, with digests
 GET /projects/{owner}/{slug}/versions/{v}/file?path=    one file
 GET /projects/{owner}/{slug}/versions/{v}/archive       the version as a zip
+GET /projects/{owner}/{slug}/versions/{v}/last-changes?path=   which version last changed each entry
 GET /projects/{owner}/{slug}/versions/{v}/attachments   files attached to it
 GET /projects/{owner}/{slug}/versions/{v}/attachments/{id}   download one
 ```
@@ -279,8 +281,16 @@ The feed serves `latest.yml`, `latest-mac.yml` and `latest-linux.yml` with
 each file's size and SHA-512, and redirects file names to their downloads.
 Anything else can read `releases/latest` as JSON: version, notes, and every
 file with its size, SHA-256 and `url`. Updaters have no account, so the
-project they read must be public; keep private code in a separate project and
-ship releases from a public one.
+project they read must be public, but its source need not be:
+
+```bash
+cbx release 1.4.0 --downloads public   # notes, attachments and feed public; files stay private
+cbx releases                           # public / downloads public / private, and the addresses
+```
+
+**Ask before `--downloads public`**: it publishes the attached files to anyone.
+One project holds the code and ships the app; a second "releases" project is
+no longer needed.
 
 ## Building executables for every platform