@coderook/cli 0.38.2 → 0.40.0

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, with cbx or plain git, from Claude Code.",
-  "version": "0.38.2",
+  "version": "0.40.0",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/README.md

@@ -258,6 +258,26 @@ command refuses rather than waiting. Going private never asks.
 A public project's page offers only its named versions that have not been
 hidden (see `cbx promote` and `cbx mark --hide`).
 
+## Project settings
+
+Everything on the website's Settings screen has a command, and each one shows
+what is set when given nothing to change:
+
+```
+cbx about --name "Night Owl Diner" --description "…"   name and description
+cbx line-rules main --protect --approvals 1 --checks build,test --code-owners on
+cbx upload-rules --ignore .coderookignore --encrypt on --warn-large 512
+cbx assistant automated --review on --describe on      the pull-request assistant
+cbx hooks --test | --deliveries | --redeliver <id> | --on <id>
+cbx people --change sam@example.com --role admin       or --remove, --cancel-invite
+cbx security policy --on --text SECURITY.md
+cbx hand-over sam my-project                           offer it to another owner
+```
+
+The one exception is AI access. `cbx ai` shows what a project lets AI do;
+changing it is for a person, on the website (Settings → Access & AI) or in
+the desktop app. The service refuses the change from any token.
+
 ## Pages
 
 A public project can be served as a website: a Unity WebGL build, a Godot web
@@ -519,6 +539,9 @@ cbx issue close 12 --duplicate-of 9        or --reason not-planned
 cbx issue label 12 bug,ui                  --remove to take them off
 cbx issue assign 12 sam                    or none
 cbx issue labels --starter
+cbx issue labels add crash --colour d73a4a      or change, remove
+cbx issue rules add auto-label --words crash,freeze --label crash
+cbx issue rules off 2                      on, change, remove by number
 ```
 
 ## Forks and security reports
@@ -529,6 +552,7 @@ cbx fork offer fix-export --title "…"      offer a line back as a pull request
 cbx fork sync                              the original's latest, on "upstream"
 cbx security report sam/editor --title "…" --severity high
 cbx security list | view S-3 | reply S-3 -m "…" | mark S-3 fixed
+cbx security policy --on --text SECURITY.md
 ```
 
 ## Releases and app downloads

package/dist/cli/src/api.js

@@ -21,7 +21,6 @@ exports.resolveMergeConflict = resolveMergeConflict;
 exports.applyMerge = applyMerge;
 exports.cancelMerge = cancelMerge;
 exports.aiAccess = aiAccess;
-exports.setAiAccess = setAiAccess;
 exports.updateProject = updateProject;
 exports.pages = pages;
 exports.setPages = setPages;
@@ -37,6 +36,9 @@ exports.createIssue = createIssue;
 exports.releases = releases;
 exports.collaborators = collaborators;
 exports.invite = invite;
+exports.setCollaboratorRole = setCollaboratorRole;
+exports.removeCollaborator = removeCollaborator;
+exports.revokeInvite = revokeInvite;
 exports.acceptInvite = acceptInvite;
 exports.watch = watch;
 exports.setWatch = setWatch;
@@ -63,6 +65,10 @@ exports.undoTo = undoTo;
 exports.webhooks = webhooks;
 exports.addWebhook = addWebhook;
 exports.removeWebhook = removeWebhook;
+exports.updateWebhook = updateWebhook;
+exports.webhookDeliveries = webhookDeliveries;
+exports.testWebhook = testWebhook;
+exports.redeliverWebhook = redeliverWebhook;
 exports.collisionCheck = collisionCheck;
 /** The small part of the API the command-line tool needs directly. */
 const network_js_1 = require("./network.js");
@@ -425,24 +431,16 @@ async function aiAccess(repositoryId) {
         aiRequest: allowed("request"),
     };
 }
-/**
- * Change one answer.
- *
- * One at a time, matching the site: each is a separate decision, and sending
- * all four would make turning off downloads look like it needed a view about
- * indexing as well.
- */
-async function setAiAccess(repositoryId, change) {
-    await call(`/v1/repositories/${encodeURIComponent(repositoryId)}`, {
-        method: "PATCH",
-        body: change,
-    });
-}
+/*
+  There is no setter for these. What AI may do with a project is changed by a
+  person on the website or in the desktop app; the service refuses it from
+  any token (ai_access_person_only), and this tool only ever holds one.
+*/
 /**
  * Change what a project says about itself.
  *
- * The same PATCH the AI switches use, which is where these live: a handful of
- * columns on the repository rather than a resource of their own.
+ * A PATCH on the repository, which is where these live: a handful of columns
+ * rather than a resource of their own.
  */
 async function updateProject(repositoryId, change) {
     await call(`/v1/repositories/${encodeURIComponent(repositoryId)}`, {
@@ -700,11 +698,13 @@ async function collaborators(repositoryId) {
     const body = await call(`/v1/repositories/${encodeURIComponent(repositoryId)}/collaborators`);
     return {
         collaborators: (body.collaborators ?? []).map((row) => ({
+            userId: String(row.userId ?? ""),
             displayName: String(row.displayName ?? ""),
             email: String(row.email ?? ""),
             role: String(row.role ?? "member"),
         })),
         invites: (body.invites ?? []).map((row) => ({
+            id: String(row.id ?? ""),
             email: String(row.email ?? ""),
             role: String(row.role ?? "member"),
             expiresAt: String(row.expiresAt ?? row.expires_at ?? ""),
@@ -715,6 +715,18 @@ async function invite(repositoryId, input) {
     const row = await call(`/v1/repositories/${encodeURIComponent(repositoryId)}/invites`, { method: "POST", body: input });
     return typeof row?.inviteUrl === "string" ? { inviteUrl: row.inviteUrl } : {};
 }
+/** Give one of the project's people another role. Admins only. */
+async function setCollaboratorRole(repositoryId, userId, role) {
+    await call(`/v1/repositories/${encodeURIComponent(repositoryId)}/collaborators/${encodeURIComponent(userId)}`, { method: "PATCH", body: { role } });
+}
+/** Take somebody off the project. Admins only. */
+async function removeCollaborator(repositoryId, userId) {
+    await call(`/v1/repositories/${encodeURIComponent(repositoryId)}/collaborators/${encodeURIComponent(userId)}`, { method: "DELETE" });
+}
+/** Withdraw an invite nobody has accepted yet. */
+async function revokeInvite(repositoryId, inviteId) {
+    await call(`/v1/repositories/${encodeURIComponent(repositoryId)}/invites/${encodeURIComponent(inviteId)}`, { method: "DELETE" });
+}
 /** Join a project from an invite link (or the token inside it). */
 async function acceptInvite(token) {
     return call("/v1/invites/accept", {
@@ -936,6 +948,26 @@ async function addWebhook(repositoryId, url, events) {
 async function removeWebhook(repositoryId, webhookId) {
     await call(`/v1/repositories/${encodeURIComponent(repositoryId)}/webhooks/${encodeURIComponent(webhookId)}`, { method: "DELETE" });
 }
+const webhookRoute = (repositoryId, webhookId) => `/v1/repositories/${encodeURIComponent(repositoryId)}/webhooks/${encodeURIComponent(webhookId)}`;
+/** Which events a webhook gets (empty is every one), or switch it back on. */
+async function updateWebhook(repositoryId, webhookId, change) {
+    await call(webhookRoute(repositoryId, webhookId), { method: "PATCH", body: change });
+}
+/** The twenty most recent, newest first. */
+async function webhookDeliveries(repositoryId, webhookId) {
+    const body = await call(`${webhookRoute(repositoryId, webhookId)}/deliveries`);
+    return body.deliveries ?? [];
+}
+/** Send a signed "ping" now and say how the receiver answered. */
+async function testWebhook(repositoryId, webhookId) {
+    const body = await call(`${webhookRoute(repositoryId, webhookId)}/test`, { method: "POST" });
+    return body.delivery;
+}
+/** Send an earlier delivery's event again, as a new delivery. */
+async function redeliverWebhook(repositoryId, webhookId, deliveryId) {
+    const body = await call(`${webhookRoute(repositoryId, webhookId)}/deliveries/${encodeURIComponent(deliveryId)}/redeliver`, { method: "POST" });
+    return body.delivery;
+}
 /**
  * What would collide if this folder published right now.
  *