@coderook/cli 0.38.2 → 0.40.0

package/dist/cli/src/community_command.js

@@ -1,4 +1,7 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.commandFork = commandFork;
 exports.commandSecurity = commandSecurity;
@@ -12,7 +15,10 @@ exports.commandSecurity = commandSecurity;
  *
  *   cbx security report sam/editor --title "…" [--severity high] [--body "…"]
  *   cbx security list | view S-3 | reply S-3 -m "…" | mark S-3 fixed
+ *   cbx security policy [--on | --off] [--text <file or text>] [--clear]
  */
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
 const api_js_1 = require("./api.js");
 const colour_js_1 = require("./colour.js");
 const project_commands_js_1 = require("./project_commands.js");
@@ -86,6 +92,8 @@ async function commandSecurity(parsed) {
     const project = await (0, project_commands_js_1.resolveProject)(flagText(parsed, "project"));
     if (!project)
         return 1;
+    if (sub === "policy")
+        return securityPolicy(parsed, project);
     const base = `/v1/repositories/${encodeURIComponent(project.id)}/security-reports`;
     if (sub === "list") {
         const { reports } = await (0, api_js_1.callApi)(base);
@@ -131,6 +139,51 @@ async function commandSecurity(parsed) {
         console.log((0, colour_js_1.green)(`S-${number} is ${state}. Whoever reported it is told.`));
         return 0;
     }
-    console.error((0, colour_js_1.red)(`cbx security has no "${sub}". `) + "Try: report, list, view, reply, mark");
+    console.error((0, colour_js_1.red)(`cbx security has no "${sub}". `) + "Try: report, list, view, reply, mark, policy");
     return 1;
 }
+/**
+ * `cbx security policy` — whether the project takes private reports, and what
+ * it tells people who want to send one. The website's Security section.
+ *
+ * --text takes a file when one by that name exists, because a policy is a
+ * page of prose and nobody wants to type it as an argument; anything else is
+ * used as the text itself.
+ */
+async function securityPolicy(parsed, project) {
+    const route = `/v1/repositories/${encodeURIComponent(project.id)}/security-policy`;
+    const on = parsed.flags.has("on");
+    const off = parsed.flags.has("off");
+    if (on && off) {
+        console.error((0, colour_js_1.red)("Pick one: --on or --off."));
+        return 1;
+    }
+    const change = {};
+    if (on || off)
+        change.enabled = on;
+    if (parsed.flags.has("clear"))
+        change.policy = null;
+    const given = parsed.flags.get("text");
+    if (given !== undefined) {
+        if (typeof given !== "string" || !given.trim()) {
+            console.error((0, colour_js_1.red)("What should it say? --text SECURITY.md, or --text \"Email security@…\""));
+            return 1;
+        }
+        const file = node_path_1.default.resolve(given);
+        change.policy = (0, node_fs_1.existsSync)(file) && (0, node_fs_1.statSync)(file).isFile() ? (0, node_fs_1.readFileSync)(file, "utf8") : given;
+    }
+    if (Object.keys(change).length) {
+        await (0, api_js_1.callApi)(route, { method: "PUT", body: change });
+        console.log((0, colour_js_1.green)(`Saved ${project.name}'s security policy.`));
+    }
+    const policy = await (0, api_js_1.callApi)(route);
+    console.log(`${(0, colour_js_1.bold)(project.name)} ${policy.enabled ? (0, colour_js_1.green)("takes private vulnerability reports") : (0, colour_js_1.dim)("does not take private vulnerability reports")}`);
+    if (policy.policy?.trim()) {
+        console.log("");
+        console.log(policy.policy.trim());
+    }
+    else {
+        console.log((0, colour_js_1.dim)("  No reporting policy written. Add one: cbx security policy --text SECURITY.md"));
+    }
+    return 0;
+}

package/dist/cli/src/help.js

@@ -15,33 +15,48 @@
  * afford whole sentences and examples.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.listedUsage = exports.USAGE_COLUMN = void 0;
 exports.renderHelp = renderHelp;
 exports.renderCommandHelp = renderCommandHelp;
 exports.renderUnknown = renderUnknown;
 const registry_js_1 = require("./registry.js");
 const colour_js_1 = require("./colour.js");
-/** Longest visible name, so the summary column lines up across every group. */
+/** The widest the usage column may be; a longer usage needs a `brief`. */
+exports.USAGE_COLUMN = 30;
+/** What the command list shows in the usage column. */
+const listedUsage = (spec) => spec.brief ?? spec.usage;
+exports.listedUsage = listedUsage;
+/** Longest visible usage, so the summary column lines up across every group. */
 function nameColumn(specs) {
-    return specs.reduce((widest, spec) => Math.max(widest, spec.usage.length), 0);
+    return specs.reduce((widest, spec) => Math.max(widest, (0, exports.listedUsage)(spec).length), 0);
+}
+/** Where a command sits inside its group: by LISTING_ORDER, then as declared. */
+function rank(spec, declared) {
+    const at = registry_js_1.LISTING_ORDER.indexOf(spec.name);
+    return at === -1 ? registry_js_1.LISTING_ORDER.length + declared : at;
 }
 function renderHelp(registry, version) {
     const listed = registry.specs.filter((spec) => !spec.deprecatedBy);
-    const column = Math.min(nameColumn(listed), 34);
+    const column = Math.min(nameColumn(listed), exports.USAGE_COLUMN);
     const lines = [
         `${(0, colour_js_1.bold)("cbx")} ${(0, colour_js_1.dim)(version)} — the CodeBox engine, for CodeRook`,
         "",
     ];
     for (const group of registry_js_1.GROUP_ORDER) {
-        const inGroup = listed.filter((spec) => spec.group === group);
+        const inGroup = listed
+            .map((spec, declared) => ({ spec, order: rank(spec, declared) }))
+            .filter(({ spec }) => spec.group === group)
+            .sort((a, b) => a.order - b.order)
+            .map(({ spec }) => spec);
         if (!inGroup.length)
             continue;
         lines.push((0, colour_js_1.bold)(group));
         for (const spec of inGroup) {
-            lines.push(`  ${spec.usage.padEnd(column)}  ${spec.summary}`);
+            lines.push(`  ${(0, exports.listedUsage)(spec).padEnd(column)}  ${spec.summary}`);
         }
         lines.push("");
     }
-    lines.push((0, colour_js_1.dim)("cbx help <command>   what one command does, in full"), (0, colour_js_1.dim)("CODEROOK_TOKEN is used when set, so automated runs need nothing on disk."), (0, colour_js_1.dim)("CODEROOK_API_URL points at another service."));
+    lines.push((0, colour_js_1.dim)("cbx help <command>   the full usage, options and examples for one command"), (0, colour_js_1.dim)("CODEROOK_TOKEN       used instead of the stored sign-in, for automated runs"), (0, colour_js_1.dim)("CODEROOK_API_URL     point at another service"));
     return lines.join("\n");
 }
 function renderCommandHelp(spec) {

package/dist/cli/src/issue_command.js

@@ -11,7 +11,10 @@ exports.commandIssue = commandIssue;
  *   cbx issue label 12 bug,ui [--remove]
  *   cbx issue assign 12 sam | none
  *   cbx issue labels [--starter]           the project's labels
- *   cbx issue rules                        the project's issue rules
+ *   cbx issue labels add|change|remove <name> [--colour #hex] [--description …] [--name …]
+ *   cbx issue rules                        the project's issue rules, numbered
+ *   cbx issue rules add <auto-label|auto-assign|welcome|stale> [settings]
+ *   cbx issue rules on|off|change|remove <n>
  *
  * Listing and opening issues stays with `cbx issues` and `cbx issues --new`.
  * Inside a run, CODEROOK_TOKEN and CODEROOK_PROJECT make these work with no
@@ -20,6 +23,155 @@ exports.commandIssue = commandIssue;
 const api_js_1 = require("./api.js");
 const colour_js_1 = require("./colour.js");
 const project_commands_js_1 = require("./project_commands.js");
+const RULE_KINDS = ["auto_label", "auto_assign", "welcome", "stale"];
+function flagValue(parsed, ...names) {
+    for (const name of names) {
+        const value = parsed.flags.get(name);
+        if (typeof value === "string")
+            return value;
+    }
+    return undefined;
+}
+/**
+ * `cbx issue labels add|change|remove <name>`. Answers 0 when the list should
+ * follow, as it does after a change.
+ */
+async function changeLabel(parsed, base, action) {
+    const name = parsed.positional[2]?.trim();
+    if (!["add", "change", "remove"].includes(action)) {
+        console.error((0, colour_js_1.red)(`cbx issue labels has no "${action}". `) + "Try: add, change, remove");
+        return 1;
+    }
+    if (!name) {
+        console.error((0, colour_js_1.red)(`Which label? cbx issue labels ${action} bug`));
+        return 1;
+    }
+    const route = `${base}/issue-labels/${encodeURIComponent(name)}`;
+    if (action === "remove") {
+        await (0, api_js_1.callApi)(route, { method: "DELETE" });
+        console.log((0, colour_js_1.green)(`Removed the label ${name}. Issues that had it keep everything else.`));
+        return 0;
+    }
+    const { labels } = await (0, api_js_1.callApi)(`${base}/issue-labels`);
+    const exists = labels.some((label) => label.name === name);
+    /*
+      The service creates a label it does not have and changes one it does,
+      through the same request. Asked first here so a typo in `change` is not
+      quietly a new label, and `add` of an existing one is not a quiet edit.
+    */
+    if (action === "add" && exists) {
+        console.error((0, colour_js_1.red)(`There is already a label called ${name}. Change it: cbx issue labels change ${name} --colour d73a4a`));
+        return 1;
+    }
+    if (action === "change" && !exists) {
+        console.error((0, colour_js_1.red)(`No label called ${name}. Add it: cbx issue labels add ${name}`));
+        return 1;
+    }
+    const change = {};
+    const rename = flagValue(parsed, "name");
+    const colour = flagValue(parsed, "colour", "color");
+    const description = flagValue(parsed, "description");
+    if (rename !== undefined)
+        change.name = rename.trim();
+    if (colour !== undefined)
+        change.colour = colour.trim().startsWith("#") ? colour.trim() : `#${colour.trim()}`;
+    if (description !== undefined)
+        change.description = description.trim() || null;
+    if (action === "change" && !Object.keys(change).length) {
+        console.error((0, colour_js_1.red)("Change what? --name, --colour or --description"));
+        return 1;
+    }
+    await (0, api_js_1.callApi)(route, { method: "PUT", body: change });
+    console.log((0, colour_js_1.green)(action === "add" ? `Added the label ${name}.` : `Changed the label ${name}${change.name && change.name !== name ? ` (now ${change.name})` : ""}.`));
+    return 0;
+}
+/** A rule's settings from the flags, over what it had. */
+function ruleConfig(parsed, kind, current) {
+    const config = { ...current };
+    const list = (value) => value.split(",").map((one) => one.trim()).filter(Boolean);
+    const words = flagValue(parsed, "words");
+    const label = flagValue(parsed, "label");
+    const where = flagValue(parsed, "in");
+    const assignees = flagValue(parsed, "assignees");
+    const message = flagValue(parsed, "m", "message");
+    const days = flagValue(parsed, "days");
+    const closeAfter = flagValue(parsed, "close-after");
+    const exempt = flagValue(parsed, "exempt");
+    if (kind === "auto_label") {
+        if (words !== undefined)
+            config.words = list(words);
+        if (label !== undefined)
+            config.label = label.trim();
+        if (where !== undefined)
+            config.in = where.trim();
+    }
+    else if (kind === "auto_assign") {
+        if (assignees !== undefined)
+            config.assignees = list(assignees).map((one) => one.replace(/^@/, ""));
+        if (label !== undefined)
+            config.label = label.trim() || null;
+    }
+    else if (kind === "welcome") {
+        if (message !== undefined)
+            config.message = message;
+    }
+    else {
+        if (days !== undefined)
+            config.days = Number(days);
+        if (closeAfter !== undefined)
+            config.closeAfterDays = Number(closeAfter);
+        if (label !== undefined)
+            config.label = label.trim();
+        if (message !== undefined)
+            config.message = message;
+        if (exempt !== undefined)
+            config.exemptLabels = list(exempt);
+    }
+    return config;
+}
+/**
+ * `cbx issue rules add <kind> …`, and `on|off|change|remove <n>`, where n is
+ * the number the list shows (or the rule's id). Answers 0 when the list
+ * should follow.
+ */
+async function changeRule(parsed, base, action) {
+    if (action === "add") {
+        const kind = (parsed.positional[2] ?? "").replace("-", "_");
+        if (!RULE_KINDS.includes(kind)) {
+            console.error((0, colour_js_1.red)("Which kind? auto-label, auto-assign, welcome or stale."));
+            return 1;
+        }
+        await (0, api_js_1.callApi)(`${base}/issue-rules`, { method: "POST", body: { kind, config: ruleConfig(parsed, kind, {}) } });
+        console.log((0, colour_js_1.green)(`Added a ${kind.replace("_", "-")} rule.`));
+        return 0;
+    }
+    if (!["on", "off", "change", "remove"].includes(action)) {
+        console.error((0, colour_js_1.red)(`cbx issue rules has no "${action}". `) + "Try: add, on, off, change, remove");
+        return 1;
+    }
+    const wanted = (parsed.positional[2] ?? "").replace(/^#/, "").trim();
+    const { rules } = await (0, api_js_1.callApi)(`${base}/issue-rules`);
+    const index = /^\d+$/.test(wanted) ? Number(wanted) - 1 : -1;
+    const rule = rules[index] ?? rules.find((one) => one.id === wanted);
+    if (!rule) {
+        console.error((0, colour_js_1.red)(wanted ? `No rule ${wanted}. cbx issue rules lists them, numbered.` : `Which rule? cbx issue rules ${action} 2`));
+        return 1;
+    }
+    const route = `${base}/issue-rules/${encodeURIComponent(rule.id)}`;
+    if (action === "remove") {
+        await (0, api_js_1.callApi)(route, { method: "DELETE" });
+        console.log((0, colour_js_1.green)(`Removed the ${rule.kind.replace("_", "-")} rule.`));
+        return 0;
+    }
+    if (action === "change") {
+        await (0, api_js_1.callApi)(route, { method: "PATCH", body: { config: ruleConfig(parsed, rule.kind, rule.config) } });
+    }
+    else {
+        await (0, api_js_1.callApi)(route, { method: "PATCH", body: { enabled: action === "on" } });
+    }
+    console.log((0, colour_js_1.green)(action === "change" ? `Changed the ${rule.kind.replace("_", "-")} rule.` : `The ${rule.kind.replace("_", "-")} rule is ${action}.`));
+    return 0;
+}
 function text(parsed) {
     const message = parsed.flags.get("m") ?? parsed.flags.get("message");
     return typeof message === "string" && message.trim() ? message : null;
@@ -58,6 +210,12 @@ async function commandIssue(parsed) {
         return 1;
     const base = `/v1/repositories/${encodeURIComponent(project.id)}`;
     if (sub === "labels") {
+        const action = parsed.positional[1];
+        if (action) {
+            const changed = await changeLabel(parsed, base, action);
+            if (changed !== 0)
+                return changed;
+        }
         if (parsed.flags.has("starter")) {
             const { added } = await (0, api_js_1.callApi)(`${base}/issue-labels/starter`, { method: "POST" });
             console.log((0, colour_js_1.green)(added ? `Added ${added} labels.` : "The usual labels are already there."));
@@ -73,14 +231,22 @@ async function commandIssue(parsed) {
         return 0;
     }
     if (sub === "rules") {
+        const action = parsed.positional[1];
+        if (action) {
+            const changed = await changeRule(parsed, base, action);
+            if (changed !== 0)
+                return changed;
+        }
         const { rules } = await (0, api_js_1.callApi)(`${base}/issue-rules`);
         if (!rules.length) {
-            console.log(`${(0, colour_js_1.bold)(project.slug)} has no issue rules. ${(0, colour_js_1.dim)("Add them in the project's Settings, under Issue rules.")}`);
+            console.log(`${(0, colour_js_1.bold)(project.slug)} has no issue rules. ${(0, colour_js_1.dim)('Add one: cbx issue rules add welcome -m "Thanks for the report!"')}`);
             return 0;
         }
-        for (const rule of rules) {
-            console.log(`  ${rule.enabled ? (0, colour_js_1.green)("on ") : (0, colour_js_1.dim)("off")} ${(0, colour_js_1.accent)(rule.kind.padEnd(12))} ${(0, colour_js_1.dim)(JSON.stringify(rule.config))}`);
-        }
+        rules.forEach((rule, index) => {
+            console.log(`  ${(0, colour_js_1.accent)(String(index + 1).padStart(2))} ${rule.enabled ? (0, colour_js_1.green)("on ") : (0, colour_js_1.dim)("off")} ${(0, colour_js_1.accent)(rule.kind.padEnd(12))} ${(0, colour_js_1.dim)(JSON.stringify(rule.config))}`);
+        });
+        if (!action)
+            console.log((0, colour_js_1.dim)("\n  Change one by its number: cbx issue rules off 2, cbx issue rules remove 2"));
         return 0;
     }
     const number = Number((parsed.positional[1] ?? "").replace(/^#/, ""));

package/dist/cli/src/machine.js

@@ -0,0 +1,80 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.machineIdentity = machineIdentity;
+exports.checkIn = checkIn;
+/**
+ * This machine, as a project's Actions page shows it (backend machines.ts).
+ *
+ * Each machine gets a random id the first time cbx runs there, kept in its
+ * settings folder, and is named after the computer. When cbx works in a
+ * folder linked to a project, or on a draft handed to this machine, it says
+ * so: which version it holds, which line it saves to, how many files it has
+ * not saved. Only the folder's name goes, never its path.
+ *
+ * Saying so is best effort. It never delays a command by more than a moment,
+ * never fails one, and is skipped when CODEROOK_NO_PRESENCE is set.
+ */
+const node_crypto_1 = require("node:crypto");
+const promises_1 = require("node:fs/promises");
+const node_os_1 = require("node:os");
+const node_path_1 = __importDefault(require("node:path"));
+const identify_js_1 = require("../../cbx/src/core/identify.js");
+const config_js_1 = require("./config.js");
+let cached = null;
+/** This machine's id and name, made once and kept. */
+async function machineIdentity() {
+    if (cached)
+        return cached;
+    const file = node_path_1.default.join((0, config_js_1.configDirectory)(), "machine.json");
+    let id = "";
+    try {
+        const saved = JSON.parse(await (0, promises_1.readFile)(file, "utf8"));
+        if (typeof saved.id === "string" && /^[A-Za-z0-9_-]{8,64}$/.test(saved.id))
+            id = saved.id;
+    }
+    catch {
+        /* First run on this machine, or the file was removed. */
+    }
+    if (!id) {
+        id = (0, node_crypto_1.randomBytes)(12).toString("base64url");
+        await (0, promises_1.mkdir)(node_path_1.default.dirname(file), { recursive: true }).catch(() => undefined);
+        await (0, promises_1.writeFile)(file, JSON.stringify({ id }, null, 2) + "\n").catch(() => undefined);
+    }
+    cached = { id, name: (process.env.CODEROOK_MACHINE_NAME || (0, node_os_1.hostname)() || "This machine").slice(0, 120) };
+    return cached;
+}
+/** Tell the project this machine is here. Never throws, and gives up after a moment. */
+async function checkIn(repositoryId, state) {
+    if (!repositoryId || process.env.CODEROOK_NO_PRESENCE)
+        return;
+    try {
+        const token = await (0, config_js_1.loadToken)();
+        if (!token)
+            return;
+        const me = await machineIdentity();
+        const client = (0, identify_js_1.clientHeaders)()["x-coderook-client"] ?? "";
+        await fetch(`${(0, config_js_1.apiOrigin)()}/v1/repositories/${encodeURIComponent(repositoryId)}/machines`, {
+            method: "POST",
+            headers: { authorization: `Bearer ${token}`, "content-type": "application/json", ...(0, identify_js_1.clientHeaders)() },
+            body: JSON.stringify({
+                machineId: me.id,
+                name: me.name,
+                kind: state.kind,
+                platform: `${(0, node_os_1.platform)()} ${(0, node_os_1.release)()}`.slice(0, 80),
+                clientVersion: client.startsWith("cli/") ? client.slice(4) : null,
+                folderName: state.folder ? node_path_1.default.basename(node_path_1.default.resolve(state.folder)) : null,
+                track: state.track ?? null,
+                baseVersionId: state.baseVersionId ?? null,
+                changedFiles: state.changedFiles ?? null,
+                workspaceId: state.workspaceId ?? null,
+            }),
+            signal: AbortSignal.timeout(2500),
+        });
+    }
+    catch {
+        /* Offline, signed out or slow: the command's own work is what matters. */
+    }
+}

package/dist/cli/src/project_commands.js

@@ -13,6 +13,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveProject = resolveProject;
+exports.aiChangeAttempted = aiChangeAttempted;
 exports.commandAi = commandAi;
 exports.readLevel = readLevel;
 exports.splitVisibility = splitVisibility;
@@ -83,45 +84,47 @@ const AI_SWITCHES = [
     ],
 ];
 /**
- * Show or change what a project says about machines.
+ * The flags `cbx ai` used to take, named when somebody types one.
  *
- * The one part of the product with no command at all. Showing is the default
- * because most of the time the question is "what is this set to", and a
- * command that needs arguments to answer that is one people stop using.
+ * Returned rather than printed so the refusal can be checked without a
+ * service: it must happen before anything is asked of one.
+ */
+function aiChangeAttempted(parsed) {
+    return AI_SWITCHES.map(([name]) => name).filter((name) => parsed.flags.has(name));
+}
+/**
+ * Show what a project says about machines.
+ *
+ * Read only. What AI may do with a project is changed by a person, on the
+ * website or in the desktop app, and the service refuses the change from any
+ * token — which is what this tool, the MCP servers, runs and assistants all
+ * hold. An assistant able to switch off the rule that keeps it out would make
+ * the rule decoration, so the old switches are refused here, plainly, before
+ * anything is sent.
  */
 async function commandAi(parsed) {
+    const attempted = aiChangeAttempted(parsed);
+    if (attempted.length) {
+        console.error((0, colour_js_1.red)(`AI access cannot be changed from the command line (${attempted.map((name) => "--" + name).join(", ")}).`));
+        console.error("A person changes it on the website, in the project's Settings → Access & AI, or in the desktop app.");
+        console.error((0, colour_js_1.dim)("  cbx ai shows what it is set to now."));
+        return 1;
+    }
     const project = await resolveProject(parsed.positional[0]);
     if (!project)
         return 1;
-    const change = {};
-    for (const [name, field] of AI_SWITCHES) {
-        const value = parsed.flags.get(name);
-        if (value === undefined)
-            continue;
-        /*
-          `--read off` and `--read=false` both read naturally, and a bare `--read`
-          means on, because that is what a flag without a value means everywhere
-          else in this tool.
-        */
-        const text = typeof value === "string" ? value.trim().toLowerCase() : "";
-        change[field] =
-            value === true ? true : !["off", "false", "no", "n", "0"].includes(text);
-    }
-    if (Object.keys(change).length) {
-        await (0, api_js_1.setAiAccess)(project.id, change);
-        console.log((0, colour_js_1.green)(`Updated ${project.name}.`));
-    }
     const access = await (0, api_js_1.aiAccess)(project.id);
     console.log("");
     console.log((0, colour_js_1.bold)(project.name));
-    for (const [name, field, question, meaning] of AI_SWITCHES) {
+    for (const [, field, question, meaning] of AI_SWITCHES) {
         const mark = access[field] ? (0, colour_js_1.green)("allowed") : (0, colour_js_1.red)("refused");
-        console.log(`  ${question.padEnd(30)} ${mark}  ${(0, colour_js_1.dim)("--" + name)}`);
+        console.log(`  ${question.padEnd(30)} ${mark}`);
         console.log(`  ${(0, colour_js_1.dim)(meaning)}`);
     }
     console.log("");
-    console.log((0, colour_js_1.dim)("Everything is allowed until you say otherwise. Turning reading off is the"));
-    console.log((0, colour_js_1.dim)("one that refuses model training."));
+    console.log((0, colour_js_1.dim)("Everything is allowed until somebody says otherwise. Reading off is the one"));
+    console.log((0, colour_js_1.dim)("that refuses model training."));
+    console.log((0, colour_js_1.dim)("Change these on the website (Settings → Access & AI) or in the desktop app."));
     return 0;
 }
 /**

package/dist/cli/src/registry.js

@@ -12,20 +12,44 @@
  * command added without a summary is a type error rather than an omission.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GROUP_ORDER = void 0;
+exports.LISTING_ORDER = exports.GROUP_ORDER = void 0;
 exports.buildRegistry = buildRegistry;
 exports.nearestCommand = nearestCommand;
 /** The order groups appear in help, which is the order somebody meets them. */
 exports.GROUP_ORDER = [
     "Getting started",
-    "Working with a folder",
+    "Saving work",
     "History on this machine",
-    "Your projects",
-    "People",
-    "When somebody saved first",
-    "Bundles",
-    "Actions",
-    "Other",
+    "Lines, merges and pull requests",
+    "Versions and releases",
+    "Project settings",
+    "Issues",
+    "Actions and builds",
+    "Workspaces",
+    "Mods and bundles",
+    "For assistants",
+];
+/**
+ * The order commands appear inside their group in `cbx help`.
+ *
+ * Kept apart from where the commands are declared, which follows the history
+ * of the file rather than what somebody looks for first. A command missing
+ * from this list still appears, after the ones that are in it.
+ */
+exports.LISTING_ORDER = [
+    "sign-in", "whoami", "sign-out", "doctor", "projects", "clone", "link", "unlink", "import", "transfer",
+    "status", "submit", "diff", "get", "track", "ignore", "licence",
+    "init", "save", "log", "restore", "switch", "push", "pull",
+    "tracks", "line-rules", "merges", "merge", "propose", "proposals", "pr",
+    "versions", "mark", "notes", "labels", "promote", "release", "releases", "attach", "held", "review", "undo",
+    "take-down", "verify", "deps",
+    "about", "visibility", "ai", "private", "upload-rules", "people", "watch", "hooks", "secret", "assistant",
+    "security", "pages", "fork", "hand-over", "delete",
+    "issues", "issue",
+    "actions", "runs", "logs", "cancel", "rerun", "approve", "runner", "build", "machines",
+    "workspace",
+    "mods", "bundle", "unbundle", "inspect",
+    "mcp", "skill", "tokens",
 ];
 function buildRegistry(specs) {
     const lookup = new Map();