@coderook/cli 0.36.0 → 0.38.1

package/dist/cli/src/cli.js

@@ -22,6 +22,7 @@ const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_path_1 = __importDefault(require("node:path"));
 const node_process_1 = __importDefault(require("node:process"));
+const workspace_command_js_1 = require("./workspace_command.js");
 const api_js_1 = require("./api.js");
 const registry_js_1 = require("./registry.js");
 const help_js_1 = require("./help.js");
@@ -32,7 +33,12 @@ const build_command_js_1 = require("./build_command.js");
 const node_check_js_1 = require("./node_check.js");
 const pages_command_js_1 = require("./pages_command.js");
 const mods_command_js_1 = require("./mods_command.js");
-const github_bridge_js_1 = require("./github_bridge.js");
+const private_command_js_1 = require("./private_command.js");
+const actions_command_js_1 = require("./actions_command.js");
+const issue_command_js_1 = require("./issue_command.js");
+const verify_command_js_1 = require("./verify_command.js");
+const community_command_js_1 = require("./community_command.js");
+const pr_command_js_1 = require("./pr_command.js");
 const project_commands_js_1 = require("./project_commands.js");
 const track_commands_js_1 = require("./track_commands.js");
 const tracks_js_1 = require("../../cbx/src/core/tracks.js");
@@ -681,7 +687,7 @@ async function commandImport(parsed) {
         flags: submitFlags,
     });
     if (code === 0 && plan.temporary) {
-        console.log(dim(`The working copy stays at ${plan.folder} until you remove it.
+        console.log(dim(`The working copy stays at ${plan.folder} until you remove it.
 ` +
             `Run ${accent("cbx get " + plan.name)} anywhere to fetch it fresh.`));
     }
@@ -967,17 +973,17 @@ async function commandSubmit(parsed) {
     */
     const shielded = (await (0, worktree_js_1.detectPrivateDirectories)(folder)).filter((finding) => [...sending].some((file) => file === finding.path || file.startsWith(`${finding.path}/`)));
     if (shielded.length && !hasFlag(parsed, "allow-private")) {
-        console.log(red(`
+        console.log(red(`
 ${shielded.length} folder${shielded.length === 1 ? "" : "s"} here belong${shielded.length === 1 ? "s" : ""} to a program, not to your project:`));
         for (const finding of shielded) {
             console.log(`  ${finding.path}  ${dim(`— ${finding.because}`)}`);
         }
-        console.log(`
+        console.log(`
 Nothing was sent. To leave them behind:`);
         for (const finding of shielded) {
             console.log(`  ${accent(`echo "${finding.rule}" >> .gitignore`)}`);
         }
-        console.error(`
+        console.error(`
 Or pass ${accent("--allow-private")} if they genuinely belong in the project.`);
         return 1;
     }
@@ -1026,7 +1032,7 @@ Or pass ${accent("--allow-private")} if they genuinely belong in the project.`);
             `rest were not opened.`));
     }
     if (stillPasted.length) {
-        console.log(red(`
+        console.log(red(`
 ${stillPasted.length} file${stillPasted.length === 1 ? " has a credential" : "s have credentials"} inside:`));
         for (const finding of stillPasted.slice(0, 20)) {
             console.log(`  ${finding.path}`);
@@ -1041,11 +1047,11 @@ ${stillPasted.length} file${stillPasted.length === 1 ? " has a credential" : "s
             console.log(dim(`  …and ${stillPasted.length - 20} more`));
         }
         if (!hasFlag(parsed, "allow-secrets")) {
-            console.error(`
+            console.error(`
 Nothing was sent. Move the key into an environment variable, and if` +
                 ` it has ever been published, replace it at the service that issued` +
                 ` it — a key that has leaked stays leaked.` +
-                `
+                `
 Pass ${accent("--allow-secrets")} if these are not real keys.`);
             return 1;
         }
@@ -1252,7 +1258,7 @@ Pass ${accent("--allow-secrets")} if these are not real keys.`);
                 continue;
             }
             if (failure?.kind === "interrupted") {
-                console.error(red(`
+                console.error(red(`
 The connection failed: ${text}`));
                 console.error(`Your work may already have been saved. Run the same command again —` +
                     ` it will not create a second version.`);
@@ -1495,7 +1501,7 @@ async function commandGet(parsed) {
                     `changed while the interrupted fetch was stopped:`));
                 for (const file of changedInTheGap.slice(0, 20))
                     console.error(`  ${file.path}`);
-                console.error(`
+                console.error(`
 Save them with ${accent("cbx submit")}, or finish the fetch and ` +
                     `discard them with ${accent("cbx get --replace")}.`);
                 return 1;
@@ -1778,8 +1784,8 @@ async function suggestRules(folder, apply) {
     const addition = (0, detect_js_1.rulesFromSuggestions)(recommended);
     const shared = rules.shared.trimEnd();
     await (0, worktree_js_1.writeRules)(folder, {
-        shared: shared ? `${shared}
-
+        shared: shared ? `${shared}
+
 ${addition}` : addition,
         local: rules.local,
     });
@@ -1984,7 +1990,7 @@ async function commandMerges(parsed) {
         const counts = merge.conflicts;
         console.log(`${accent(merge.reference)}  ${counts ? `${counts.unresolved} of ${counts.total} still to decide` : ""}  ${dim(new Date(merge.createdAt).toLocaleString())}`);
     }
-    console.log(dim(`
+    console.log(dim(`
 Run cbx merge <reference> to look at one.`));
     return 0;
 }
@@ -2087,7 +2093,7 @@ async function commandMerge(parsed) {
             console.log(dim(`  waiting on ${waiting.map((person) => person.displayName).join(", ")}`));
         }
     }
-    console.log(`
+    console.log(`
 ${accent(now.mergeTrack.reference)} · ` +
         /*
           The combined version is only counted once it can be built; until then
@@ -2106,7 +2112,7 @@ ${accent(now.mergeTrack.reference)} · ` +
             return 1;
         }
         const applied = await (0, api_js_1.applyMerge)(summary.id);
-        console.log(`
+        console.log(`
 Applied as ${accent(`v${applied.version.sequence}`)}.`);
         if (applied.closedIssues?.length) {
             console.log(`Closed ${applied.closedIssues.map((number) => `#${number}`).join(", ")}.`);
@@ -2116,13 +2122,13 @@ Applied as ${accent(`v${applied.version.sequence}`)}.`);
     }
     const stillOpen = now.conflicts.some((conflict) => !conflict.resolvedAt);
     if (!decision && stillOpen) {
-        console.log(dim(`
+        console.log(dim(`
 --mine keeps yours, --theirs keeps what was already saved,` +
-            ` --both keeps theirs and saves yours beside it, --drop removes the file.
+            ` --both keeps theirs and saves yours beside it, --drop removes the file.
 Add --path <file> for one file, then --apply when ready.`));
     }
     else if (now.provisional.ready) {
-        console.log(dim(`
+        console.log(dim(`
 Run cbx merge ${now.mergeTrack.reference} --apply to publish it.`));
     }
     return 0;
@@ -2708,6 +2714,33 @@ const SPECS = [
         ],
         run: project_commands_js_1.commandVersions,
     },
+    {
+        name: "workspace",
+        group: "Your projects",
+        summary: "edit, save and run a private project remotely without a checkout",
+        usage: "workspace <open|list|show|read|files|search|diff|patch|save|run|logs|cancel|deploy|preview|handoff|close|recipe> <project> [workspace] [job]",
+        detail: "Works on CodeRook's durable remote draft, never the current local folder. Use --data-file for structured edits or recipe configuration. Mutations need the reviewed --revision and a unique --key; reuse the same key and request when retrying. Recipes reference existing project workflows. Saving and deploying are separate operations.",
+        options: [
+            { flags: "--data-file <path>", description: "read an operation's JSON from this local file" },
+            { flags: "--name <name>", description: "name a new workspace" },
+            { flags: "--track <track>", description: "base the workspace on this project Track" },
+            { flags: "--base-version <id>", description: "select a saved base version" },
+            { flags: "--revision <number>", description: "the exact reviewed workspace revision" },
+            { flags: "--key <operation-key>", description: "unique idempotency key; preserve it for retries" },
+            { flags: "--path <path>", description: "read this project-relative file" },
+            { flags: "--query <text>", description: "text to find in the remote workspace" },
+            { flags: "--offset <number>", description: "continue a paginated listing, search or diff" },
+            { flags: "--start-line <number>", description: "first text line to read" },
+            { flags: "--lines <number>", description: "maximum text lines to read" },
+            { flags: "--recipe <name>", description: "configured hosted execution recipe" },
+            { flags: "--target <target>", description: "exact configured deployment target" },
+            { flags: "--version <id>", description: "saved workspace version to deploy" },
+            { flags: "-m, --message <text>", description: "describe the version being saved" },
+            { flags: "--note <text>", description: "task context for another computer/assistant" },
+        ],
+        examples: ["cbx workspace open my-project --name \"Laptop work\" --key laptop-open-001", "cbx workspace list my-project"],
+        run: workspace_command_js_1.commandWorkspace,
+    },
     {
         name: "ai",
         group: "Your projects",
@@ -2795,33 +2828,29 @@ const SPECS = [
         run: pages_command_js_1.commandPages,
     },
     {
-        name: "github",
+        name: "private",
         group: "Your projects",
-        summary: "review and test proposals with GitHub tools (CodeRabbit, Blacksmith, Actions)",
-        usage: "github <setup|sync> …",
-        detail: "Mirrors a project's open proposals to pull requests in a GitHub repository,\n" +
-            "so tools that only connect to GitHub review and build them, and reports\n" +
-            "what they conclude back to each proposal as checks. A required check that\n" +
-            "fails stops the proposal being applied, like any other check.\n\n" +
-            "It runs on GitHub, in a workflow setup writes into the project. CodeRook\n" +
-            "never holds a GitHub credential; GitHub holds a CodeRook token that reaches\n" +
-            "this project only and can read it and report checks, nothing else.\n\n" +
-            "  setup <owner>/<repo> [folder]   make the token, write the workflow\n" +
-            "  sync [--repo <owner>/<repo>]    mirror and report once (what the workflow runs)\n\n" +
-            "Use a GitHub repository nothing else pushes to: the mirror only moves\n" +
-            "forward, and a branch changed on GitHub is left alone and reported.",
+        summary: "files and folders only the project's own people may see",
+        usage: "private [list|add|remove|set] [pattern…] [--project <project>]",
+        detail: "Keeps chosen files out of sight in a public project: visitors, the\n" +
+            "public API, git clone, zips, Pages and search leave them out, while\n" +
+            "members see everything. Patterns work like a .gitignore:\n\n" +
+            "  design/          a folder of that name, anywhere\n" +
+            "  *.psd            every file of a type\n" +
+            "  docs/internal    a path from the top of the project\n" +
+            "  src/**/*.key     any depth in between\n\n" +
+            "The list is kept on the project, not in a file, so it covers every\n" +
+            "version at once, old ones included, and a save cannot undo it. Only the\n" +
+            "project's owner or an admin can change it.",
         options: [
-            { flags: "--repo <owner/repo>", description: "sync: the GitHub repository (default: the one the workflow runs in)" },
-            { flags: "--project <slug>", description: "sync: the CodeRook project (default: this folder's)" },
-            { flags: "--required <names>", description: "checks that must pass, e.g. \"github/build,review/coderabbitai[bot]\"" },
-            { flags: "--force", description: "setup: write the workflow again" },
+            { flags: "--project <project>", description: "a project other than this folder's" },
         ],
         examples: [
-            "cbx github setup my-name/my-game-mirror",
-            "cbx submit",
-            "cbx github sync --repo my-name/my-game-mirror",
+            'cbx private add "design/" "*.psd"',
+            "cbx private list",
+            'cbx private remove "*.psd"',
         ],
-        run: github_bridge_js_1.commandGithub,
+        run: private_command_js_1.commandPrivate,
     },
     {
         name: "mods",
@@ -2911,6 +2940,34 @@ const SPECS = [
         ],
         run: service_commands_js_1.commandIssues,
     },
+    {
+        name: "issue",
+        group: "Your projects",
+        summary: "read, answer, close, label or assign one issue",
+        usage: "issue view|comment|close|reopen|label|assign <number> … | issue labels | issue rules",
+        detail: "Closing says why: completed (the default), --reason not-planned, or\n" +
+            "--duplicate-of <n>. Labels and assignment need write access; replying\n" +
+            "needs only read access, as on the website.\n\n" +
+            "Inside a run, CODEROOK_TOKEN and CODEROOK_PROJECT are set, so a workflow\n" +
+            "can comment on or label the issue that started it with no setup.",
+        options: [
+            { flags: "-m, --message <text>", description: "what to say (comment, or a note when closing)" },
+            { flags: "--reason <completed|not-planned>", description: "why it is closed" },
+            { flags: "--duplicate-of <n>", description: "close as a duplicate of another issue" },
+            { flags: "--remove", description: "take the labels off instead" },
+            { flags: "--starter", description: "with labels: add the usual set" },
+            { flags: "--project <name>", description: "which project" },
+        ],
+        examples: [
+            "cbx issue view 12",
+            'cbx issue comment 12 -m "Fixed in v41"',
+            "cbx issue close 12 --duplicate-of 9",
+            "cbx issue label 12 bug,ui",
+            "cbx issue assign 12 sam",
+            "cbx issue labels --starter",
+        ],
+        run: issue_command_js_1.commandIssue,
+    },
     {
         name: "releases",
         aliases: ["tags"],
@@ -2939,7 +2996,9 @@ const SPECS = [
             "The signing secret is generated by the service and shown once, when\n" +
             "the hook is added — no route hands it back afterwards.\n\n" +
             "Events: version.published, merge.opened, merge.applied, merge.cancelled,\n" +
-            "check.reported, change_request.opened, change_request.reviewed.\n" +
+            "check.reported, change_request.opened, change_request.reviewed,\n" +
+            "issue.opened, issue.closed, issue.reopened, issue.commented,\n" +
+            "issue.labeled, run.finished, run.failed, release.published.\n" +
             "Naming none of them sends all of them.",
         options: [
             { flags: "--add <url>", description: "notify this address; https only" },
@@ -3189,16 +3248,96 @@ const SPECS = [
         options: [
             { flags: "--version <n>", description: "name this version instead of the newest" },
             { flags: "--notes <text>", description: "what changed, for the release page" },
+            { flags: "--generate-notes", description: "write the notes from what changed since the last release" },
+            { flags: "--draft", description: "save it as a draft: nothing is public until cbx release publish" },
+            { flags: "--prerelease", description: "keep it off the default update feed" },
+            { flags: "--channel <name>", description: "the update channel, like beta or nightly (stable by default)" },
             { flags: "--downloads <public|private>", description: "who can take what is attached, apart from the source" },
         ],
         examples: [
             "cbx release v1.0",
+            "cbx release v2.0 --draft --generate-notes",
+            "cbx release publish --version 41",
+            "cbx release v2.1.0-beta.1 --prerelease --channel beta",
             'cbx release v1.2 --version 41 --notes "Fixes the export dialog"',
             "cbx release 1.4.0 --downloads public",
             "cbx release --downloads private --version 41",
         ],
         run: service_commands_js_1.commandRelease,
     },
+    {
+        name: "fork",
+        group: "Your projects",
+        summary: "your own copy of somebody's project, and offering work back",
+        usage: "fork <owner/project> [--name <slug>] | fork offer [line] --title <text> | fork sync",
+        detail: "A fork is a private project under your account with the original's latest\n" +
+            "public version (its private files left out). Nothing is uploaded again.\n\n" +
+            "Inside a fork, `cbx fork offer <line>` offers that line to the original as\n" +
+            "a pull request (offered again, the same pull request moves to your newest\n" +
+            "save). Its runs there wait for the project's approval and get none of its\n" +
+            "secrets. `cbx fork sync` brings the original's latest into an `upstream`\n" +
+            "line of your fork, to merge when you choose.",
+        options: [
+            { flags: "--name <slug>", description: "what to call your copy" },
+            { flags: "--title <text>", description: "offer: the pull request's title" },
+            { flags: "--body <text>", description: "offer: its description" },
+            { flags: "--project <name>", description: "offer/sync: which fork" },
+        ],
+        examples: ["cbx fork sam/editor", 'cbx fork offer fix-export --title "Fix the export dialog"', "cbx fork sync"],
+        run: community_command_js_1.commandFork,
+    },
+    {
+        name: "security",
+        group: "Your projects",
+        summary: "report a vulnerability privately, or handle reports",
+        usage: "security report <owner/project> --title <text> | security list | view|reply|mark S-<n>",
+        detail: "A report is seen only by the project's owner and admins, and by whoever\n" +
+            "sent it. Please use this rather than a public issue for anything that\n" +
+            "could hurt people using the project.",
+        options: [
+            { flags: "--title <text>", description: "report: what is wrong" },
+            { flags: "--body <text>", description: "report: details and how to reproduce it" },
+            { flags: "--severity <level>", description: "report: low, medium, high or critical" },
+            { flags: "-m, --message <text>", description: "reply: what to say" },
+            { flags: "--project <name>", description: "list/view/reply/mark: which project" },
+        ],
+        examples: [
+            'cbx security report sam/editor --title "Path traversal in export" --severity high',
+            "cbx security list",
+            'cbx security reply S-3 -m "Confirmed; fix in 2.0.1"',
+            "cbx security mark S-3 fixed",
+        ],
+        run: community_command_js_1.commandSecurity,
+    },
+    {
+        name: "verify",
+        group: "Your projects",
+        summary: "check a download against its release's signed manifest",
+        usage: "verify <owner/project> <release> <file…>",
+        detail: "Every public release has a manifest listing each file with its size and\n" +
+            "SHA-256, signed with CodeRook's release key. This checks the signature,\n" +
+            "then the files you downloaded. A mismatch means do not run it.",
+        options: [{ flags: "--key <base64>", description: "pin the release key instead of the one cbx knows" }],
+        examples: ["cbx verify sam/editor v2.0.0 ./editor-setup.exe"],
+        run: verify_command_js_1.commandVerify,
+    },
+    {
+        name: "deps",
+        group: "Your projects",
+        summary: "known vulnerabilities in a save's dependencies",
+        usage: "deps [version]",
+        detail: "Reads the lockfiles in the save (package-lock.json, yarn.lock,\n" +
+            "requirements.txt, poetry.lock, Pipfile.lock, Cargo.lock, go.sum,\n" +
+            "composer.lock, Gemfile.lock) and asks OSV about every pinned version.\n" +
+            "Only names and versions are sent, never code. Pull requests carry the\n" +
+            "same answer as the coderook/dependencies check.",
+        options: [
+            { flags: "--fresh", description: "ask OSV again rather than reading the kept report" },
+            { flags: "--project <name>", description: "which project" },
+        ],
+        examples: ["cbx deps", "cbx deps 41 --fresh"],
+        run: verify_command_js_1.commandDeps,
+    },
     {
         name: "actions",
         aliases: ["workflows"],
@@ -3211,7 +3350,10 @@ const SPECS = [
             "ran against, so a passing build becomes a download without anybody\n" +
             "opening the website. --ship turns that on for one action.\n\n" +
             "Attaching is publishing: what an action ships onto a public version\n" +
-            "is a download anybody can take, from the moment the run passes.",
+            "is a download anybody can take, from the moment the run passes.\n\n" +
+            "cbx actions check [files…] checks workflow files (.rook/workflows)\n" +
+            "before you save them. cbx actions set <action> changes one made on the\n" +
+            "website: --schedule, --timeout, --approval, --concurrency.",
         options: [
             { flags: "--ship <action>", description: "its builds become downloads on the version" },
             { flags: "--no-ship <action>", description: "keep its files without attaching them" },
@@ -3219,15 +3361,123 @@ const SPECS = [
             { flags: "--on-proposal <action>", description: "run it on proposals; its result becomes a check" },
             { flags: "--by-hand <action>", description: "run it only when somebody starts it" },
             { flags: "--project <name>", description: "which project" },
+            { flags: "--schedule <cron>", description: "with set: run it on a schedule (UTC); off to stop" },
+            { flags: "--timeout <minutes>", description: "with set: stop a run that takes longer; off to stop" },
+            { flags: "--approval <on|off>", description: "with set: each run waits for somebody to approve it" },
+            { flags: "--concurrency <group>", description: "with set: one run of the group at a time; off to stop" },
+            { flags: "--cancel-old", description: "with set: a new run cancels the group's older ones" },
+            { flags: "--keep-old", description: "with set: a new run waits its turn" },
         ],
         examples: [
             "cbx actions",
+            "cbx actions check",
+            'cbx actions set "Nightly" --schedule "0 3 * * *" --timeout 30',
+            'cbx actions set Deploy --approval on --concurrency deploy --cancel-old',
             'cbx actions --ship "Windows installer"',
             'cbx actions --no-ship "Windows installer"',
             'cbx actions --on-proposal Tests',
         ],
         run: service_commands_js_1.commandWorkflows,
     },
+    {
+        name: "pr",
+        group: "Working with a folder",
+        summary: "pull requests: list, read, review, comment, merge",
+        usage: "pr <list|view|files|comment|approve|request-changes|ask|label|title|ready|draft|retarget|close|reopen|merge> [M-3] …",
+        detail: "A pull request is a line offered to another line (cbx propose opens one).\n" +
+            "This is the Pull requests tab of the website, from here:\n\n" +
+            "  list [--all|--state merged] [--mine] [--label bug]   the project's pull requests\n" +
+            "  view M-3                       description, reviews, checks, conversation, blockers\n" +
+            "  files M-3                      what it changes\n" +
+            "  comment M-3 -m \"…\" [--line path:12]   a comment, or one on a line\n" +
+            "  approve M-3 [-m \"…\"]           approve it\n" +
+            "  request-changes M-3 -m \"…\"     ask for changes\n" +
+            "  ask M-3 sam,priya              ask people to review it\n" +
+            "  label M-3 bug,ui               set its labels\n" +
+            "  title M-3 \"New title\"          rename it\n" +
+            "  ready M-3 | draft M-3          ready for review, or back to draft\n" +
+            "  retarget M-3 release           land it on another line\n" +
+            "  close M-3 | reopen M-3         close without merging, or reopen\n" +
+            "  merge M-3                      merge it, once nothing stands in the way\n\n" +
+            "An approval stops counting when new saves land on the line: it was of the\n" +
+            "code somebody looked at. A draft cannot be merged until it is marked ready.",
+        options: [
+            { flags: "-m, --message <text>", description: "comment, review or title text" },
+            { flags: "--line <path:line>", description: "comment: on this line of a changed file" },
+            { flags: "--project <project>", description: "a project other than this folder's" },
+            { flags: "--state <state>", description: "list: open, merged, closed or all" },
+            { flags: "--label <name>", description: "list: only those with this label" },
+            { flags: "--author <username>", description: "list: only those opened by this person" },
+            { flags: "--all", description: "list: every state" },
+            { flags: "--mine", description: "list: only those waiting on your review" },
+            { flags: "--squash", description: "merge / auto-merge: land as one save, without the line's own saves" },
+            { flags: "--off", description: "auto-merge: stop waiting to merge by itself" },
+        ],
+        examples: [
+            "cbx pr list",
+            "cbx pr view M-3",
+            'cbx pr comment M-3 --line src/app.ts:42 -m "This can be null"',
+            "cbx pr approve M-3",
+            "cbx pr merge M-3",
+            "cbx pr merge M-3 --squash",
+            "cbx pr auto-merge M-3",
+        ],
+        run: pr_command_js_1.commandPr,
+    },
+    {
+        name: "cancel",
+        group: "Actions",
+        summary: "stop a run that is waiting or working",
+        usage: "cancel <number> [project]",
+        detail: "Marks the run cancelled at once. A runner working on it is told at its next\n" +
+            "heartbeat and stops the work, including anything the command started.",
+        examples: ["cbx cancel 12"],
+        run: service_commands_js_1.commandCancel,
+    },
+    {
+        name: "rerun",
+        group: "Actions",
+        summary: "run a finished run again",
+        usage: "rerun <number> [project]",
+        detail: "Queues the same action against the same save. When the run was checking a\n" +
+            "pull request that is still open, its check goes back to waiting.",
+        examples: ["cbx rerun 12"],
+        run: service_commands_js_1.commandRerun,
+    },
+    {
+        name: "approve",
+        group: "Actions",
+        summary: "let a run that waits for approval start",
+        usage: "approve <number> [project]",
+        detail: "An action marked as needing approval (often one that publishes) waits\n" +
+            "after it is set off until somebody who can change the project approves it.",
+        examples: ["cbx approve 12"],
+        run: actions_command_js_1.commandApprove,
+    },
+    {
+        name: "secret",
+        aliases: ["secrets"],
+        group: "Actions",
+        summary: "values runs need that must not be in the files",
+        usage: "secret list | set <NAME> | remove <NAME>",
+        detail: "A secret is handed to each run as an environment variable of the same\n" +
+            "name, but only to runs started by people who can change the project.\n" +
+            "Run logs show *** in its place. Its value is never shown again.\n\n" +
+            "The value is read from what is piped in, from another variable with\n" +
+            "--from-env, or typed at a hidden prompt; never from an argument, which\n" +
+            "would stay in your shell history.",
+        options: [
+            { flags: "--from-env <VAR>", description: "take the value from this environment variable" },
+            { flags: "--project <name>", description: "which project" },
+        ],
+        examples: [
+            "cbx secret list",
+            "cbx secret set DEPLOY_TOKEN",
+            "cbx secret set SIGNING_KEY < key.pem",
+            "cbx secret remove DEPLOY_TOKEN",
+        ],
+        run: actions_command_js_1.commandSecret,
+    },
     {
         name: "runs",
         group: "Actions",
@@ -3254,6 +3504,7 @@ const SPECS = [
             "stderr is shown in red. Exits 1 when the run failed, so this can be\n" +
             "the last line of a script.",
         examples: ["cbx logs 12", "cbx logs #12 my-project"],
+        options: [{ flags: "--follow", description: "keep printing as it runs, until it ends" }],
         run: service_commands_js_1.commandLogs,
     },
     {
@@ -3447,7 +3698,8 @@ const SPECS = [
         name: "mcp",
         group: "Other",
         summary: "serve CodeRook to Claude Code, Codex and other assistants",
-        usage: "mcp",
+        usage: "mcp [--workspaces]",
+        options: [{ flags: "--workspaces", description: "opt into the remote connector's write/run/deploy tools and workspace permissions" }],
         detail: "Speaks the Model Context Protocol on stdin and stdout, so an assistant\n" +
             "can look at your projects while it works. Not run by hand — point the\n" +
             "assistant at it and it starts and stops the process itself.\n" +
@@ -3468,7 +3720,7 @@ const SPECS = [
             "A project whose owner has turned off machine reading is refused, in\n" +
             "words rather than as a status code.\n",
         examples: ["claude mcp add coderook -- cbx mcp"],
-        run: () => (0, mcp_js_1.commandMcp)(version_js_1.VERSION),
+        run: parsed => parsed.flags.has("workspaces") ? (0, workspace_command_js_1.commandWorkspaceMcp)() : (0, mcp_js_1.commandMcp)(version_js_1.VERSION),
     },
     {
         name: "doctor",
@@ -3511,6 +3763,7 @@ SPECS.push({
         "a command of your own, describe the build in coderook.build.json\n" +
         "(cbx build init writes one), which is saved with the project.",
     options: [
+        { flags: "--docker", description: "allow a Docker container as a last resort (never used otherwise)" },
         { flags: "-t, --target <list>", description: "windows-x64, linux-arm64, macos-arm64 … or win, linux, mac, all" },
         { flags: "--plan", description: "say how each target would be built, build nothing" },
         { flags: "--preset <name>", description: "go, bun, deno, rust, dotnet, electron, pyinstaller, python or custom" },