@coderook/cli 0.35.0 → 0.37.0

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, with cbx or plain git, from Claude Code.",
-  "version": "0.35.0",
+  "version": "0.37.0",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/README.md

@@ -169,7 +169,7 @@ Once a folder has a history, `status`, `diff`, `log`, `switch`, `merge`,
 unsaved change. `--force` discards those changes. Files the history has never
 held are never touched.
 
-## Proposals
+## Proposals and pull requests
 
 A line gets back to main by being proposed. The proposal is checked and
 reviewed before it lands, and it follows the line: saving onto it afterwards
@@ -194,11 +194,56 @@ Tests whenever a line is proposed or saved onto, and its result is a required
 check. `--on-save` runs an action on every save, and `--by-hand` only when
 somebody starts it.
 
+Every proposal also has a `coderook/malware` check: what the line adds or
+changes is scanned before it can land, and a finding names the file and stops
+the proposal being applied.
+
 A **protected** line refuses saves made straight onto it — from `cbx submit`,
 the desktop application and `git push` alike — so the way in is a line of your
 own and a proposal. It also cannot be put back on an earlier save, and a merge
 cannot land on it over a conflict or a failing check.
 
+### Pull requests from the terminal
+
+```
+cbx pr list [--all] [--mine] [--label bug]   this project's pull requests
+cbx pr view M-3                    description, reviews, checks, conversation, what blocks it
+cbx pr files M-3                   what it changes
+cbx pr comment M-3 -m "…" [--line src/app.ts:42]
+cbx pr approve M-3                 or: cbx pr request-changes M-3 -m "…"
+cbx pr ask M-3 sam,priya           ask people to review it
+cbx pr label M-3 bug,ui
+cbx pr ready M-3                   or: draft, title, retarget, close, reopen
+cbx pr merge M-3
+```
+
+An approval stops counting when new saves land on the line, and a draft
+cannot be merged until it is marked ready. The website's Pull requests tab
+does the same, with comments on lines and suggested changes.
+
+## Keeping files private
+
+```
+cbx private add "design/" "*.psd"   a folder anywhere, a file type
+cbx private list
+cbx private remove "*.psd"
+```
+
+In a public project, everybody outside it is served every version without
+those files: the file list, zips, git clone, Pages and search leave them out.
+Members see everything. Only the owner or an admin can change the list.
+
+### Signed releases and dependencies
+
+```
+cbx release v2.0 --draft --generate-notes  nothing public until: cbx release publish --version 41
+cbx release v2.1.0-beta.1 --prerelease --channel beta
+cbx verify sam/editor v2.0.0 ./setup.exe   check a download against the signed manifest
+cbx deps                                   known vulnerabilities in the lockfiles (OSV)
+cbx pr merge M-3 --squash
+cbx pr auto-merge M-3
+```
+
 ## Who can reach a project
 
     cbx visibility                        # what it is now, and what each level means
@@ -436,6 +481,56 @@ artifacts or with `cbx attach <file>`, so a release made by pushing a tag
 simply has none until something adds them — which is what a release without a
 build has always looked like.
 
+## Actions
+
+```
+cbx runs                  what has run, and how it went
+cbx logs 12 --follow      watch a run as it happens
+cbx cancel 12             stop a run that is waiting or working
+cbx runner                run this project's work on this machine
+```
+
+CodeRook's own runners give every account 1,000 minutes a month; your own
+machine has no limit. A run nobody picks up within a day is ended with the
+reason.
+
+### More from Actions
+
+```
+cbx rerun 12                       run it again, against the same save
+cbx approve 14                     a run waiting for approval
+cbx actions check                  check .rook/workflows/*.yml before saving
+cbx actions set Nightly --schedule "0 3 * * *" --timeout 30
+cbx actions set Deploy --approval on --concurrency deploy --cancel-old
+cbx secret set DEPLOY_TOKEN        asked for at a hidden prompt; never shown again
+cbx secret list
+```
+
+Every run gets `CODEROOK_TOKEN`, `CODEROOK_API` and `CODEROOK_PROJECT`, so
+`cbx issue comment`, `cbx pr label` or `cbx release` inside a workflow need no
+setup. Secrets reach only runs started by people who can change the project.
+
+## Issues
+
+```
+cbx issue view 12
+cbx issue comment 12 -m "Fixed in v41"
+cbx issue close 12 --duplicate-of 9        or --reason not-planned
+cbx issue label 12 bug,ui                  --remove to take them off
+cbx issue assign 12 sam                    or none
+cbx issue labels --starter
+```
+
+## Forks and security reports
+
+```
+cbx fork sam/editor                        your own copy
+cbx fork offer fix-export --title "…"      offer a line back as a pull request
+cbx fork sync                              the original's latest, on "upstream"
+cbx security report sam/editor --title "…" --severity high
+cbx security list | view S-3 | reply S-3 -m "…" | mark S-3 fixed
+```
+
 ## Releases and app downloads
 
 ```
@@ -452,6 +547,10 @@ no need for a second project that only holds releases. `--downloads private`
 takes them back. Without a release name it changes an existing release and
 leaves its notes alone.
 
+Every attached file is scanned for malware before anybody outside the project
+can download it, usually within a minute; one that fails is never offered, and
+whoever attached it and the owner are told what was found.
+
 `cbx releases` marks each one `public`, `downloads public` or `private`, and
 for a public project prints the addresses an app or a script reads, which
 need no account:

package/dist/cli/src/actions_command.js

@@ -0,0 +1,254 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commandSecret = commandSecret;
+exports.commandCheckWorkflows = commandCheckWorkflows;
+exports.commandSetWorkflow = commandSetWorkflow;
+exports.commandApprove = commandApprove;
+/**
+ * The newer parts of Actions from the terminal:
+ *
+ *   cbx secret list | set NAME | remove NAME     a project's secrets
+ *   cbx actions check [files…]                   check workflow files before saving them
+ *   cbx actions set <action> --schedule … --timeout … --approval on|off --concurrency …
+ *   cbx approve <run>                            let a run that waits for approval start
+ *
+ * A secret's value is never printed and never taken as an argument (it would
+ * sit in shell history): it is read from standard input, from another
+ * environment variable with --from-env, or typed at a hidden prompt.
+ */
+const promises_1 = require("node:fs/promises");
+const node_path_1 = __importDefault(require("node:path"));
+const api_js_1 = require("./api.js");
+const colour_js_1 = require("./colour.js");
+const project_commands_js_1 = require("./project_commands.js");
+function projectFlag(parsed) {
+    const named = parsed.flags.get("project");
+    return typeof named === "string" ? named : undefined;
+}
+/** Read a secret without it appearing anywhere: piped in, from another variable, or typed hidden. */
+async function readSecretValue(name, parsed) {
+    const fromEnv = parsed.flags.get("from-env");
+    if (typeof fromEnv === "string" && fromEnv.trim()) {
+        const value = process.env[fromEnv.trim()];
+        if (!value) {
+            console.error((0, colour_js_1.red)(`The environment variable ${fromEnv.trim()} is empty or not set.`));
+            return null;
+        }
+        return value;
+    }
+    if (!process.stdin.isTTY) {
+        const chunks = [];
+        for await (const chunk of process.stdin)
+            chunks.push(Buffer.from(chunk));
+        return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+    }
+    process.stdout.write(`Value for ${name} (hidden; Enter to finish): `);
+    return new Promise((resolve) => {
+        const input = process.stdin;
+        let value = "";
+        input.setRawMode(true);
+        input.resume();
+        input.setEncoding("utf8");
+        const done = (result) => {
+            input.setRawMode(false);
+            input.pause();
+            input.removeListener("data", onData);
+            process.stdout.write("\n");
+            resolve(result);
+        };
+        const onData = (key) => {
+            for (const character of key) {
+                if (character === "\r" || character === "\n")
+                    return done(value);
+                if (character === "\u0003")
+                    return done(null); // Ctrl+C
+                if (character === "\u007f" || character === "\b")
+                    value = value.slice(0, -1);
+                else
+                    value += character;
+            }
+        };
+        input.on("data", onData);
+    });
+}
+async function commandSecret(parsed) {
+    const sub = parsed.positional[0] ?? "list";
+    const project = await (0, project_commands_js_1.resolveProject)(projectFlag(parsed));
+    if (!project)
+        return 1;
+    const base = `/v1/repositories/${encodeURIComponent(project.id)}/secrets`;
+    if (sub === "list") {
+        const { secrets } = await (0, api_js_1.callApi)(base);
+        if (!secrets.length) {
+            console.log(`${(0, colour_js_1.bold)(project.slug)} has no secrets.`);
+            console.log((0, colour_js_1.dim)("  Add one: cbx secret set DEPLOY_TOKEN   (you are asked for the value; it is never shown)"));
+            return 0;
+        }
+        console.log((0, colour_js_1.bold)(`Secrets in ${project.slug}`) + (0, colour_js_1.dim)(" — values are never shown"));
+        for (const secret of secrets) {
+            console.log(`  ${(0, colour_js_1.accent)(secret.name.padEnd(28))} ${(0, colour_js_1.dim)(`set ${new Date(secret.updatedAt).toLocaleString()}${secret.updatedBy ? ` by ${secret.updatedBy}` : ""}`)}`);
+        }
+        return 0;
+    }
+    const name = (parsed.positional[1] ?? "").trim().toUpperCase();
+    if (!name) {
+        console.error((0, colour_js_1.red)(`Name the secret: cbx secret ${sub} DEPLOY_TOKEN`));
+        return 1;
+    }
+    if (sub === "set") {
+        const value = await readSecretValue(name, parsed);
+        if (value === null)
+            return 1;
+        if (!value) {
+            console.error((0, colour_js_1.red)("Nothing was entered, so nothing was saved."));
+            return 1;
+        }
+        await (0, api_js_1.callApi)(`${base}/${encodeURIComponent(name)}`, { method: "PUT", body: { value } });
+        console.log(`${(0, colour_js_1.green)("Saved.")} Runs started by people who can change ${project.slug} get ${(0, colour_js_1.accent)(name)} as an environment variable.`);
+        console.log((0, colour_js_1.dim)("  It is replaced by *** in run logs. A run from outside the project never gets it."));
+        return 0;
+    }
+    if (sub === "remove") {
+        await (0, api_js_1.callApi)(`${base}/${encodeURIComponent(name)}`, { method: "DELETE" });
+        console.log(`${(0, colour_js_1.green)("Removed")} ${name}.`);
+        return 0;
+    }
+    console.error((0, colour_js_1.red)(`cbx secret has no "${sub}". `) + "Try: list, set, remove");
+    return 1;
+}
+const EVENT_WORDS = {
+    manual: "by hand",
+    version_saved: "on save",
+    merge_opened: "on pull requests",
+    merge_applied: "when merged",
+    issue_opened: "issue opened",
+    issue_labeled: "issue labelled",
+    issue_commented: "issue comment",
+    release_published: "on release",
+    schedule: "on a schedule",
+};
+/** `cbx actions check [files…]`: what each file would make, and what is wrong with it. */
+async function commandCheckWorkflows(parsed) {
+    let files = parsed.positional.slice(1);
+    if (!files.length) {
+        const folder = node_path_1.default.join(process.cwd(), ".rook", "workflows");
+        try {
+            files = (await (0, promises_1.readdir)(folder)).filter((name) => /\.ya?ml$/.test(name)).map((name) => node_path_1.default.join(folder, name));
+        }
+        catch {
+            files = [];
+        }
+    }
+    if (!files.length) {
+        console.log("No workflow files here. They live in .rook/workflows/*.yml");
+        console.log((0, colour_js_1.dim)("  See: https://coderook.com/docs#workflow-files"));
+        return 0;
+    }
+    const project = await (0, project_commands_js_1.resolveProject)(projectFlag(parsed));
+    if (!project)
+        return 1;
+    let failed = false;
+    for (const file of files) {
+        const relative = node_path_1.default.relative(process.cwd(), file).split(node_path_1.default.sep).join("/");
+        const text = await (0, promises_1.readFile)(file, "utf8");
+        const answer = await (0, api_js_1.callApi)(`/v1/repositories/${encodeURIComponent(project.id)}/workflow-files/check`, {
+            method: "POST",
+            body: { path: relative.startsWith(".rook/") ? relative : `.rook/workflows/${node_path_1.default.basename(file)}`, text },
+        });
+        console.log(answer.ok ? `${(0, colour_js_1.green)("✓")} ${(0, colour_js_1.bold)(relative)}` : `${(0, colour_js_1.red)("×")} ${(0, colour_js_1.bold)(relative)}`);
+        for (const error of answer.errors)
+            console.log(`    ${(0, colour_js_1.red)(error)}`);
+        for (const workflow of answer.workflows) {
+            const details = [
+                workflow.on.map((event) => EVENT_WORDS[event] ?? event).join(", "),
+                workflow.schedule ? `"${workflow.schedule}" UTC` : null,
+                workflow.runsOn !== "hosted" ? `on ${workflow.runsOn}` : null,
+                workflow.matrix ? `${Object.values(workflow.matrix).reduce((all, values) => all * values.length, 1)} runs (matrix)` : null,
+                workflow.needs.length ? `after ${workflow.needs.join(", ")}` : null,
+                workflow.needsApproval ? "needs approval" : null,
+                workflow.timeoutMinutes ? `${workflow.timeoutMinutes} min limit` : null,
+            ].filter(Boolean);
+            console.log(`    ${(0, colour_js_1.accent)(workflow.name)} ${(0, colour_js_1.dim)(details.join(" · "))}`);
+        }
+        failed ||= !answer.ok;
+    }
+    if (!failed)
+        console.log((0, colour_js_1.dim)("\nSave them to the project's main line and they take effect."));
+    return failed ? 1 : 0;
+}
+/** `cbx actions set <action> …`: the options a workflow made on the website can have. */
+async function commandSetWorkflow(parsed) {
+    const named = (parsed.positional[1] ?? "").trim();
+    if (!named) {
+        console.error((0, colour_js_1.red)('Which action? cbx actions set "Nightly build" --schedule "0 3 * * *"'));
+        return 1;
+    }
+    const project = await (0, project_commands_js_1.resolveProject)(projectFlag(parsed));
+    if (!project)
+        return 1;
+    const target = (await (0, api_js_1.workflows)(project.id)).find((one) => one.name.toLowerCase() === named.toLowerCase());
+    if (!target) {
+        console.error((0, colour_js_1.red)(`${project.name} has no action called ${named}.`));
+        return 1;
+    }
+    const change = {};
+    const schedule = parsed.flags.get("schedule");
+    if (typeof schedule === "string") {
+        change.schedule = schedule === "off" ? null : schedule;
+        if (schedule !== "off")
+            change.trigger = "schedule";
+    }
+    const timeout = parsed.flags.get("timeout");
+    if (typeof timeout === "string")
+        change.timeoutMinutes = timeout === "off" ? null : Number(timeout);
+    const approval = parsed.flags.get("approval");
+    if (typeof approval === "string")
+        change.needsApproval = approval === "on";
+    const concurrency = parsed.flags.get("concurrency");
+    if (typeof concurrency === "string")
+        change.concurrencyGroup = concurrency === "off" ? null : concurrency;
+    if (parsed.flags.has("cancel-old"))
+        change.cancelInProgress = true;
+    if (parsed.flags.has("keep-old"))
+        change.cancelInProgress = false;
+    if (!Object.keys(change).length) {
+        console.error((0, colour_js_1.red)("Nothing to change. ") + (0, colour_js_1.dim)("Options: --schedule, --timeout, --approval on|off, --concurrency, --cancel-old"));
+        return 1;
+    }
+    await (0, api_js_1.changeWorkflow)(project.id, target.id, change);
+    console.log(`${(0, colour_js_1.green)("Saved.")} ${target.name}:`);
+    if ("schedule" in change)
+        console.log(`  ${change.schedule ? `runs on "${change.schedule}" (UTC)` : "no schedule"}`);
+    if ("timeoutMinutes" in change)
+        console.log(`  ${change.timeoutMinutes ? `stopped after ${change.timeoutMinutes} minutes` : "no time limit of its own"}`);
+    if ("needsApproval" in change)
+        console.log(`  ${change.needsApproval ? "each run waits for approval (cbx approve)" : "runs start without approval"}`);
+    if ("concurrencyGroup" in change)
+        console.log(`  ${change.concurrencyGroup ? `one at a time in "${change.concurrencyGroup}"` : "no concurrency group"}`);
+    if ("cancelInProgress" in change)
+        console.log(`  ${change.cancelInProgress ? "a new run cancels the group's older ones" : "a new run waits its turn"}`);
+    return 0;
+}
+/** `cbx approve <run>`: start a run that is waiting for approval. */
+async function commandApprove(parsed) {
+    const asked = parsed.positional[0];
+    const number = Number((asked ?? "").replace(/^#/, ""));
+    if (!asked || !Number.isInteger(number) || number < 1) {
+        console.error((0, colour_js_1.red)("Which run? Try: cbx approve 12"));
+        return 1;
+    }
+    const project = await (0, project_commands_js_1.resolveProject)(parsed.positional[1] ?? projectFlag(parsed));
+    if (!project)
+        return 1;
+    const run = (await (0, api_js_1.runs)(project.id)).find((one) => one.number === number);
+    if (!run) {
+        console.error((0, colour_js_1.red)(`${project.name} has no run #${number}.`));
+        return 1;
+    }
+    await (0, api_js_1.callApi)(`/v1/repositories/${encodeURIComponent(project.id)}/runs/${encodeURIComponent(run.id)}/approve`, { method: "POST" });
+    console.log(`${(0, colour_js_1.accent)(`#${number}`)} approved. It is queued and starts when a runner takes it.`);
+    return 0;
+}

package/dist/cli/src/api.js

@@ -43,8 +43,13 @@ exports.setWatch = setWatch;
 exports.workflows = workflows;
 exports.changeWorkflow = changeWorkflow;
 exports.runs = runs;
+exports.rerunRun = rerunRun;
+exports.cancelRun = cancelRun;
 exports.runLogs = runLogs;
 exports.tokens = tokens;
+exports.getPrivatePaths = getPrivatePaths;
+exports.putPrivatePaths = putPrivatePaths;
+exports.callApi = callApi;
 exports.revokeToken = revokeToken;
 exports.deleteProject = deleteProject;
 exports.projectLabels = projectLabels;
@@ -330,7 +335,10 @@ async function findProject(reference) {
             return [];
         throw error;
     });
-    const ownersMatch = (project) => project.slug.toLowerCase() === bare || project.name.toLowerCase() === bare;
+    const ownersMatch = (project) => project.slug.toLowerCase() === bare ||
+        project.name.toLowerCase() === bare ||
+        /* By id too: a run is handed its project's id as CODEROOK_PROJECT. */
+        project.id.toLowerCase() === trimmed.toLowerCase();
     if (!owner) {
         const mine = all.find(ownersMatch);
         if (mine)
@@ -618,12 +626,12 @@ async function versions(repositoryId) {
  * — pushing the same tag twice renames the same version to the same thing
  * rather than making a second release.
  */
-async function markRelease(repositoryId, versionId, name, notes) {
+async function markRelease(repositoryId, versionId, name, notes, options = {}) {
     const body = await call(`/v1/repositories/${encodeURIComponent(repositoryId)}` +
         `/versions/${encodeURIComponent(versionId)}/release`, 
     // `call` serialises the body itself; handing it a string would send a
     // JSON-encoded string where the service expects an object.
-    { method: "PUT", body: { name, ...(notes ? { notes } : {}) } });
+    { method: "PUT", body: { name, ...(notes ? { notes } : {}), ...options } });
     return {
         name: String(body.release?.name ?? name),
         versionId: String(body.release?.versionId ?? versionId),
@@ -790,6 +798,14 @@ async function runs(repositoryId, filter = {}) {
         };
     });
 }
+/** Stop a run that is waiting or working. */
+/** Start a finished run again: same action, same save, same pull request. */
+async function rerunRun(repositoryId, runId) {
+    return call(`/v1/repositories/${encodeURIComponent(repositoryId)}/runs/${encodeURIComponent(runId)}/rerun`, { method: "POST" });
+}
+async function cancelRun(repositoryId, runId) {
+    await call(`/v1/repositories/${encodeURIComponent(repositoryId)}/runs/${encodeURIComponent(runId)}/cancel`, { method: "POST" });
+}
 /** Everything a run printed, in the order it printed it. */
 async function runLogs(repositoryId, runId) {
     const body = await call(`/v1/repositories/${encodeURIComponent(repositoryId)}/runs/` +
@@ -806,6 +822,23 @@ async function tokens() {
         createdAt: String(row.createdAt ?? ""),
     }));
 }
+/** The project's private paths: patterns only its own people see (members only). */
+async function getPrivatePaths(repositoryId) {
+    const body = await call(`/v1/repositories/${encodeURIComponent(repositoryId)}/private-paths`);
+    return body.patterns ?? [];
+}
+/** Replace them. The project's owner or an admin only. */
+async function putPrivatePaths(repositoryId, patterns) {
+    const body = await call(`/v1/repositories/${encodeURIComponent(repositoryId)}/private-paths`, {
+        method: "PUT",
+        body: { patterns },
+    });
+    return body.patterns ?? [];
+}
+/** A signed-in request to any route, for commands with many of them (pr_command.ts). */
+async function callApi(route, options = {}) {
+    return call(route, options);
+}
 async function revokeToken(tokenId) {
     await call(`/v1/account/tokens/${encodeURIComponent(tokenId)}`, {
         method: "DELETE",

package/dist/cli/src/build_command.js

@@ -832,6 +832,14 @@ async function commandBuild(parsed) {
     const host = thisHost();
     console.log(dim(`Checking what this ${host.os} ${host.arch} machine can build with…`));
     const tools = await detectTools(host);
+    /*
+      Docker only when asked for. Every target is reached natively, by
+      cross-compiling or through WSL where it can be; a container is the last
+      resort somebody chooses with --docker, never one picked for them because
+      Docker Desktop happened to be running.
+    */
+    if (!parsed.flags.has("docker"))
+        tools.docker = false;
     const plan = planBuild(project, host, tools, targets);
     console.log(`${bold(project.name)} ${dim(`(${project.preset})`)}`);
     const width = Math.max(...plan.map((one) => one.target.length));