@coderook/cli 0.39.0 → 0.41.0

package/dist/cli/src/community_command.js

@@ -1,4 +1,7 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.commandFork = commandFork;
 exports.commandSecurity = commandSecurity;
@@ -12,7 +15,10 @@ exports.commandSecurity = commandSecurity;
  *
  *   cbx security report sam/editor --title "…" [--severity high] [--body "…"]
  *   cbx security list | view S-3 | reply S-3 -m "…" | mark S-3 fixed
+ *   cbx security policy [--on | --off] [--text <file or text>] [--clear]
  */
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
 const api_js_1 = require("./api.js");
 const colour_js_1 = require("./colour.js");
 const project_commands_js_1 = require("./project_commands.js");
@@ -86,6 +92,8 @@ async function commandSecurity(parsed) {
     const project = await (0, project_commands_js_1.resolveProject)(flagText(parsed, "project"));
     if (!project)
         return 1;
+    if (sub === "policy")
+        return securityPolicy(parsed, project);
     const base = `/v1/repositories/${encodeURIComponent(project.id)}/security-reports`;
     if (sub === "list") {
         const { reports } = await (0, api_js_1.callApi)(base);
@@ -131,6 +139,51 @@ async function commandSecurity(parsed) {
         console.log((0, colour_js_1.green)(`S-${number} is ${state}. Whoever reported it is told.`));
         return 0;
     }
-    console.error((0, colour_js_1.red)(`cbx security has no "${sub}". `) + "Try: report, list, view, reply, mark");
+    console.error((0, colour_js_1.red)(`cbx security has no "${sub}". `) + "Try: report, list, view, reply, mark, policy");
     return 1;
 }
+/**
+ * `cbx security policy` — whether the project takes private reports, and what
+ * it tells people who want to send one. The website's Security section.
+ *
+ * --text takes a file when one by that name exists, because a policy is a
+ * page of prose and nobody wants to type it as an argument; anything else is
+ * used as the text itself.
+ */
+async function securityPolicy(parsed, project) {
+    const route = `/v1/repositories/${encodeURIComponent(project.id)}/security-policy`;
+    const on = parsed.flags.has("on");
+    const off = parsed.flags.has("off");
+    if (on && off) {
+        console.error((0, colour_js_1.red)("Pick one: --on or --off."));
+        return 1;
+    }
+    const change = {};
+    if (on || off)
+        change.enabled = on;
+    if (parsed.flags.has("clear"))
+        change.policy = null;
+    const given = parsed.flags.get("text");
+    if (given !== undefined) {
+        if (typeof given !== "string" || !given.trim()) {
+            console.error((0, colour_js_1.red)("What should it say? --text SECURITY.md, or --text \"Email security@…\""));
+            return 1;
+        }
+        const file = node_path_1.default.resolve(given);
+        change.policy = (0, node_fs_1.existsSync)(file) && (0, node_fs_1.statSync)(file).isFile() ? (0, node_fs_1.readFileSync)(file, "utf8") : given;
+    }
+    if (Object.keys(change).length) {
+        await (0, api_js_1.callApi)(route, { method: "PUT", body: change });
+        console.log((0, colour_js_1.green)(`Saved ${project.name}'s security policy.`));
+    }
+    const policy = await (0, api_js_1.callApi)(route);
+    console.log(`${(0, colour_js_1.bold)(project.name)} ${policy.enabled ? (0, colour_js_1.green)("takes private vulnerability reports") : (0, colour_js_1.dim)("does not take private vulnerability reports")}`);
+    if (policy.policy?.trim()) {
+        console.log("");
+        console.log(policy.policy.trim());
+    }
+    else {
+        console.log((0, colour_js_1.dim)("  No reporting policy written. Add one: cbx security policy --text SECURITY.md"));
+    }
+    return 0;
+}

package/dist/cli/src/help.js

@@ -15,33 +15,48 @@
  * afford whole sentences and examples.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.listedUsage = exports.USAGE_COLUMN = void 0;
 exports.renderHelp = renderHelp;
 exports.renderCommandHelp = renderCommandHelp;
 exports.renderUnknown = renderUnknown;
 const registry_js_1 = require("./registry.js");
 const colour_js_1 = require("./colour.js");
-/** Longest visible name, so the summary column lines up across every group. */
+/** The widest the usage column may be; a longer usage needs a `brief`. */
+exports.USAGE_COLUMN = 30;
+/** What the command list shows in the usage column. */
+const listedUsage = (spec) => spec.brief ?? spec.usage;
+exports.listedUsage = listedUsage;
+/** Longest visible usage, so the summary column lines up across every group. */
 function nameColumn(specs) {
-    return specs.reduce((widest, spec) => Math.max(widest, spec.usage.length), 0);
+    return specs.reduce((widest, spec) => Math.max(widest, (0, exports.listedUsage)(spec).length), 0);
+}
+/** Where a command sits inside its group: by LISTING_ORDER, then as declared. */
+function rank(spec, declared) {
+    const at = registry_js_1.LISTING_ORDER.indexOf(spec.name);
+    return at === -1 ? registry_js_1.LISTING_ORDER.length + declared : at;
 }
 function renderHelp(registry, version) {
     const listed = registry.specs.filter((spec) => !spec.deprecatedBy);
-    const column = Math.min(nameColumn(listed), 34);
+    const column = Math.min(nameColumn(listed), exports.USAGE_COLUMN);
     const lines = [
         `${(0, colour_js_1.bold)("cbx")} ${(0, colour_js_1.dim)(version)} — the CodeBox engine, for CodeRook`,
         "",
     ];
     for (const group of registry_js_1.GROUP_ORDER) {
-        const inGroup = listed.filter((spec) => spec.group === group);
+        const inGroup = listed
+            .map((spec, declared) => ({ spec, order: rank(spec, declared) }))
+            .filter(({ spec }) => spec.group === group)
+            .sort((a, b) => a.order - b.order)
+            .map(({ spec }) => spec);
         if (!inGroup.length)
             continue;
         lines.push((0, colour_js_1.bold)(group));
         for (const spec of inGroup) {
-            lines.push(`  ${spec.usage.padEnd(column)}  ${spec.summary}`);
+            lines.push(`  ${(0, exports.listedUsage)(spec).padEnd(column)}  ${spec.summary}`);
         }
         lines.push("");
     }
-    lines.push((0, colour_js_1.dim)("cbx help <command>   what one command does, in full"), (0, colour_js_1.dim)("CODEROOK_TOKEN is used when set, so automated runs need nothing on disk."), (0, colour_js_1.dim)("CODEROOK_API_URL points at another service."));
+    lines.push((0, colour_js_1.dim)("cbx help <command>   the full usage, options and examples for one command"), (0, colour_js_1.dim)("CODEROOK_TOKEN       used instead of the stored sign-in, for automated runs"), (0, colour_js_1.dim)("CODEROOK_API_URL     point at another service"));
     return lines.join("\n");
 }
 function renderCommandHelp(spec) {

package/dist/cli/src/issue_command.js

@@ -11,7 +11,10 @@ exports.commandIssue = commandIssue;
  *   cbx issue label 12 bug,ui [--remove]
  *   cbx issue assign 12 sam | none
  *   cbx issue labels [--starter]           the project's labels
- *   cbx issue rules                        the project's issue rules
+ *   cbx issue labels add|change|remove <name> [--colour #hex] [--description …] [--name …]
+ *   cbx issue rules                        the project's issue rules, numbered
+ *   cbx issue rules add <auto-label|auto-assign|welcome|stale> [settings]
+ *   cbx issue rules on|off|change|remove <n>
  *
  * Listing and opening issues stays with `cbx issues` and `cbx issues --new`.
  * Inside a run, CODEROOK_TOKEN and CODEROOK_PROJECT make these work with no
@@ -20,6 +23,155 @@ exports.commandIssue = commandIssue;
 const api_js_1 = require("./api.js");
 const colour_js_1 = require("./colour.js");
 const project_commands_js_1 = require("./project_commands.js");
+const RULE_KINDS = ["auto_label", "auto_assign", "welcome", "stale"];
+function flagValue(parsed, ...names) {
+    for (const name of names) {
+        const value = parsed.flags.get(name);
+        if (typeof value === "string")
+            return value;
+    }
+    return undefined;
+}
+/**
+ * `cbx issue labels add|change|remove <name>`. Answers 0 when the list should
+ * follow, as it does after a change.
+ */
+async function changeLabel(parsed, base, action) {
+    const name = parsed.positional[2]?.trim();
+    if (!["add", "change", "remove"].includes(action)) {
+        console.error((0, colour_js_1.red)(`cbx issue labels has no "${action}". `) + "Try: add, change, remove");
+        return 1;
+    }
+    if (!name) {
+        console.error((0, colour_js_1.red)(`Which label? cbx issue labels ${action} bug`));
+        return 1;
+    }
+    const route = `${base}/issue-labels/${encodeURIComponent(name)}`;
+    if (action === "remove") {
+        await (0, api_js_1.callApi)(route, { method: "DELETE" });
+        console.log((0, colour_js_1.green)(`Removed the label ${name}. Issues that had it keep everything else.`));
+        return 0;
+    }
+    const { labels } = await (0, api_js_1.callApi)(`${base}/issue-labels`);
+    const exists = labels.some((label) => label.name === name);
+    /*
+      The service creates a label it does not have and changes one it does,
+      through the same request. Asked first here so a typo in `change` is not
+      quietly a new label, and `add` of an existing one is not a quiet edit.
+    */
+    if (action === "add" && exists) {
+        console.error((0, colour_js_1.red)(`There is already a label called ${name}. Change it: cbx issue labels change ${name} --colour d73a4a`));
+        return 1;
+    }
+    if (action === "change" && !exists) {
+        console.error((0, colour_js_1.red)(`No label called ${name}. Add it: cbx issue labels add ${name}`));
+        return 1;
+    }
+    const change = {};
+    const rename = flagValue(parsed, "name");
+    const colour = flagValue(parsed, "colour", "color");
+    const description = flagValue(parsed, "description");
+    if (rename !== undefined)
+        change.name = rename.trim();
+    if (colour !== undefined)
+        change.colour = colour.trim().startsWith("#") ? colour.trim() : `#${colour.trim()}`;
+    if (description !== undefined)
+        change.description = description.trim() || null;
+    if (action === "change" && !Object.keys(change).length) {
+        console.error((0, colour_js_1.red)("Change what? --name, --colour or --description"));
+        return 1;
+    }
+    await (0, api_js_1.callApi)(route, { method: "PUT", body: change });
+    console.log((0, colour_js_1.green)(action === "add" ? `Added the label ${name}.` : `Changed the label ${name}${change.name && change.name !== name ? ` (now ${change.name})` : ""}.`));
+    return 0;
+}
+/** A rule's settings from the flags, over what it had. */
+function ruleConfig(parsed, kind, current) {
+    const config = { ...current };
+    const list = (value) => value.split(",").map((one) => one.trim()).filter(Boolean);
+    const words = flagValue(parsed, "words");
+    const label = flagValue(parsed, "label");
+    const where = flagValue(parsed, "in");
+    const assignees = flagValue(parsed, "assignees");
+    const message = flagValue(parsed, "m", "message");
+    const days = flagValue(parsed, "days");
+    const closeAfter = flagValue(parsed, "close-after");
+    const exempt = flagValue(parsed, "exempt");
+    if (kind === "auto_label") {
+        if (words !== undefined)
+            config.words = list(words);
+        if (label !== undefined)
+            config.label = label.trim();
+        if (where !== undefined)
+            config.in = where.trim();
+    }
+    else if (kind === "auto_assign") {
+        if (assignees !== undefined)
+            config.assignees = list(assignees).map((one) => one.replace(/^@/, ""));
+        if (label !== undefined)
+            config.label = label.trim() || null;
+    }
+    else if (kind === "welcome") {
+        if (message !== undefined)
+            config.message = message;
+    }
+    else {
+        if (days !== undefined)
+            config.days = Number(days);
+        if (closeAfter !== undefined)
+            config.closeAfterDays = Number(closeAfter);
+        if (label !== undefined)
+            config.label = label.trim();
+        if (message !== undefined)
+            config.message = message;
+        if (exempt !== undefined)
+            config.exemptLabels = list(exempt);
+    }
+    return config;
+}
+/**
+ * `cbx issue rules add <kind> …`, and `on|off|change|remove <n>`, where n is
+ * the number the list shows (or the rule's id). Answers 0 when the list
+ * should follow.
+ */
+async function changeRule(parsed, base, action) {
+    if (action === "add") {
+        const kind = (parsed.positional[2] ?? "").replace("-", "_");
+        if (!RULE_KINDS.includes(kind)) {
+            console.error((0, colour_js_1.red)("Which kind? auto-label, auto-assign, welcome or stale."));
+            return 1;
+        }
+        await (0, api_js_1.callApi)(`${base}/issue-rules`, { method: "POST", body: { kind, config: ruleConfig(parsed, kind, {}) } });
+        console.log((0, colour_js_1.green)(`Added a ${kind.replace("_", "-")} rule.`));
+        return 0;
+    }
+    if (!["on", "off", "change", "remove"].includes(action)) {
+        console.error((0, colour_js_1.red)(`cbx issue rules has no "${action}". `) + "Try: add, on, off, change, remove");
+        return 1;
+    }
+    const wanted = (parsed.positional[2] ?? "").replace(/^#/, "").trim();
+    const { rules } = await (0, api_js_1.callApi)(`${base}/issue-rules`);
+    const index = /^\d+$/.test(wanted) ? Number(wanted) - 1 : -1;
+    const rule = rules[index] ?? rules.find((one) => one.id === wanted);
+    if (!rule) {
+        console.error((0, colour_js_1.red)(wanted ? `No rule ${wanted}. cbx issue rules lists them, numbered.` : `Which rule? cbx issue rules ${action} 2`));
+        return 1;
+    }
+    const route = `${base}/issue-rules/${encodeURIComponent(rule.id)}`;
+    if (action === "remove") {
+        await (0, api_js_1.callApi)(route, { method: "DELETE" });
+        console.log((0, colour_js_1.green)(`Removed the ${rule.kind.replace("_", "-")} rule.`));
+        return 0;
+    }
+    if (action === "change") {
+        await (0, api_js_1.callApi)(route, { method: "PATCH", body: { config: ruleConfig(parsed, rule.kind, rule.config) } });
+    }
+    else {
+        await (0, api_js_1.callApi)(route, { method: "PATCH", body: { enabled: action === "on" } });
+    }
+    console.log((0, colour_js_1.green)(action === "change" ? `Changed the ${rule.kind.replace("_", "-")} rule.` : `The ${rule.kind.replace("_", "-")} rule is ${action}.`));
+    return 0;
+}
 function text(parsed) {
     const message = parsed.flags.get("m") ?? parsed.flags.get("message");
     return typeof message === "string" && message.trim() ? message : null;
@@ -58,6 +210,12 @@ async function commandIssue(parsed) {
         return 1;
     const base = `/v1/repositories/${encodeURIComponent(project.id)}`;
     if (sub === "labels") {
+        const action = parsed.positional[1];
+        if (action) {
+            const changed = await changeLabel(parsed, base, action);
+            if (changed !== 0)
+                return changed;
+        }
         if (parsed.flags.has("starter")) {
             const { added } = await (0, api_js_1.callApi)(`${base}/issue-labels/starter`, { method: "POST" });
             console.log((0, colour_js_1.green)(added ? `Added ${added} labels.` : "The usual labels are already there."));
@@ -73,14 +231,22 @@ async function commandIssue(parsed) {
         return 0;
     }
     if (sub === "rules") {
+        const action = parsed.positional[1];
+        if (action) {
+            const changed = await changeRule(parsed, base, action);
+            if (changed !== 0)
+                return changed;
+        }
         const { rules } = await (0, api_js_1.callApi)(`${base}/issue-rules`);
         if (!rules.length) {
-            console.log(`${(0, colour_js_1.bold)(project.slug)} has no issue rules. ${(0, colour_js_1.dim)("Add them in the project's Settings, under Issue rules.")}`);
+            console.log(`${(0, colour_js_1.bold)(project.slug)} has no issue rules. ${(0, colour_js_1.dim)('Add one: cbx issue rules add welcome -m "Thanks for the report!"')}`);
             return 0;
         }
-        for (const rule of rules) {
-            console.log(`  ${rule.enabled ? (0, colour_js_1.green)("on ") : (0, colour_js_1.dim)("off")} ${(0, colour_js_1.accent)(rule.kind.padEnd(12))} ${(0, colour_js_1.dim)(JSON.stringify(rule.config))}`);
-        }
+        rules.forEach((rule, index) => {
+            console.log(`  ${(0, colour_js_1.accent)(String(index + 1).padStart(2))} ${rule.enabled ? (0, colour_js_1.green)("on ") : (0, colour_js_1.dim)("off")} ${(0, colour_js_1.accent)(rule.kind.padEnd(12))} ${(0, colour_js_1.dim)(JSON.stringify(rule.config))}`);
+        });
+        if (!action)
+            console.log((0, colour_js_1.dim)("\n  Change one by its number: cbx issue rules off 2, cbx issue rules remove 2"));
         return 0;
     }
     const number = Number((parsed.positional[1] ?? "").replace(/^#/, ""));

package/dist/cli/src/project_commands.js

@@ -13,6 +13,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveProject = resolveProject;
+exports.aiChangeAttempted = aiChangeAttempted;
 exports.commandAi = commandAi;
 exports.readLevel = readLevel;
 exports.splitVisibility = splitVisibility;
@@ -83,45 +84,47 @@ const AI_SWITCHES = [
     ],
 ];
 /**
- * Show or change what a project says about machines.
+ * The flags `cbx ai` used to take, named when somebody types one.
  *
- * The one part of the product with no command at all. Showing is the default
- * because most of the time the question is "what is this set to", and a
- * command that needs arguments to answer that is one people stop using.
+ * Returned rather than printed so the refusal can be checked without a
+ * service: it must happen before anything is asked of one.
+ */
+function aiChangeAttempted(parsed) {
+    return AI_SWITCHES.map(([name]) => name).filter((name) => parsed.flags.has(name));
+}
+/**
+ * Show what a project says about machines.
+ *
+ * Read only. What AI may do with a project is changed by a person, on the
+ * website or in the desktop app, and the service refuses the change from any
+ * token — which is what this tool, the MCP servers, runs and assistants all
+ * hold. An assistant able to switch off the rule that keeps it out would make
+ * the rule decoration, so the old switches are refused here, plainly, before
+ * anything is sent.
  */
 async function commandAi(parsed) {
+    const attempted = aiChangeAttempted(parsed);
+    if (attempted.length) {
+        console.error((0, colour_js_1.red)(`AI access cannot be changed from the command line (${attempted.map((name) => "--" + name).join(", ")}).`));
+        console.error("A person changes it on the website, in the project's Settings → Access & AI, or in the desktop app.");
+        console.error((0, colour_js_1.dim)("  cbx ai shows what it is set to now."));
+        return 1;
+    }
     const project = await resolveProject(parsed.positional[0]);
     if (!project)
         return 1;
-    const change = {};
-    for (const [name, field] of AI_SWITCHES) {
-        const value = parsed.flags.get(name);
-        if (value === undefined)
-            continue;
-        /*
-          `--read off` and `--read=false` both read naturally, and a bare `--read`
-          means on, because that is what a flag without a value means everywhere
-          else in this tool.
-        */
-        const text = typeof value === "string" ? value.trim().toLowerCase() : "";
-        change[field] =
-            value === true ? true : !["off", "false", "no", "n", "0"].includes(text);
-    }
-    if (Object.keys(change).length) {
-        await (0, api_js_1.setAiAccess)(project.id, change);
-        console.log((0, colour_js_1.green)(`Updated ${project.name}.`));
-    }
     const access = await (0, api_js_1.aiAccess)(project.id);
     console.log("");
     console.log((0, colour_js_1.bold)(project.name));
-    for (const [name, field, question, meaning] of AI_SWITCHES) {
+    for (const [, field, question, meaning] of AI_SWITCHES) {
         const mark = access[field] ? (0, colour_js_1.green)("allowed") : (0, colour_js_1.red)("refused");
-        console.log(`  ${question.padEnd(30)} ${mark}  ${(0, colour_js_1.dim)("--" + name)}`);
+        console.log(`  ${question.padEnd(30)} ${mark}`);
         console.log(`  ${(0, colour_js_1.dim)(meaning)}`);
     }
     console.log("");
-    console.log((0, colour_js_1.dim)("Everything is allowed until you say otherwise. Turning reading off is the"));
-    console.log((0, colour_js_1.dim)("one that refuses model training."));
+    console.log((0, colour_js_1.dim)("Everything is allowed until somebody says otherwise. Reading off is the one"));
+    console.log((0, colour_js_1.dim)("that refuses model training."));
+    console.log((0, colour_js_1.dim)("Change these on the website (Settings → Access & AI) or in the desktop app."));
     return 0;
 }
 /**

package/dist/cli/src/registry.js

@@ -12,20 +12,44 @@
  * command added without a summary is a type error rather than an omission.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GROUP_ORDER = void 0;
+exports.LISTING_ORDER = exports.GROUP_ORDER = void 0;
 exports.buildRegistry = buildRegistry;
 exports.nearestCommand = nearestCommand;
 /** The order groups appear in help, which is the order somebody meets them. */
 exports.GROUP_ORDER = [
     "Getting started",
-    "Working with a folder",
+    "Saving work",
     "History on this machine",
-    "Your projects",
-    "People",
-    "When somebody saved first",
-    "Bundles",
-    "Actions",
-    "Other",
+    "Lines, merges and pull requests",
+    "Versions and releases",
+    "Project settings",
+    "Issues",
+    "Actions and builds",
+    "Workspaces",
+    "Mods and bundles",
+    "For assistants",
+];
+/**
+ * The order commands appear inside their group in `cbx help`.
+ *
+ * Kept apart from where the commands are declared, which follows the history
+ * of the file rather than what somebody looks for first. A command missing
+ * from this list still appears, after the ones that are in it.
+ */
+exports.LISTING_ORDER = [
+    "sign-in", "whoami", "sign-out", "doctor", "projects", "clone", "link", "unlink", "import", "transfer",
+    "status", "submit", "diff", "get", "track", "ignore", "licence",
+    "init", "save", "log", "restore", "switch", "push", "pull",
+    "tracks", "line-rules", "merges", "merge", "propose", "proposals", "pr",
+    "versions", "mark", "notes", "labels", "promote", "release", "releases", "attach", "held", "review", "undo",
+    "take-down", "verify", "deps",
+    "about", "features", "visibility", "ai", "private", "upload-rules", "people", "watch", "hooks", "secret", "assistant",
+    "security", "pages", "fork", "hand-over", "delete",
+    "issues", "issue",
+    "actions", "runs", "logs", "cancel", "rerun", "approve", "runner", "build", "machines",
+    "workspace",
+    "mods", "bundle", "unbundle", "inspect",
+    "mcp", "skill", "tokens",
 ];
 function buildRegistry(specs) {
     const lookup = new Map();

package/dist/cli/src/service_commands.js

@@ -308,6 +308,56 @@ async function commandCollaborators(parsed) {
     const project = await (0, project_commands_js_1.resolveProject)(parsed.positional[0]);
     if (!project)
         return 1;
+    /*
+      Changing a role, taking somebody off, and withdrawing an invite: the rest
+      of the website's Collaborators screen. Each names the person by email or
+      display name, which is what the listing below shows.
+    */
+    const changing = parsed.flags.get("change");
+    const removing = parsed.flags.get("remove");
+    const cancelling = parsed.flags.get("cancel-invite");
+    if (changing !== undefined || removing !== undefined || cancelling !== undefined) {
+        const wanted = changing ?? removing ?? cancelling;
+        if (typeof wanted !== "string" || !wanted.trim()) {
+            console.error((0, colour_js_1.red)("Who? Name them by email address or display name."));
+            return 1;
+        }
+        const who = wanted.trim().toLowerCase();
+        const people = await (0, api_js_1.collaborators)(project.id);
+        if (cancelling !== undefined) {
+            const pending = people.invites.find((one) => one.email.toLowerCase() === who || one.id === wanted.trim());
+            if (!pending) {
+                console.error((0, colour_js_1.red)(`No invite waiting for ${wanted.trim()} on ${project.name}.`));
+                return 1;
+            }
+            await (0, api_js_1.revokeInvite)(project.id, pending.id);
+            console.log((0, colour_js_1.green)(`Withdrew the invite to ${pending.email}. Its link no longer works.`));
+            return 0;
+        }
+        const person = people.collaborators.find((one) => one.email.toLowerCase() === who ||
+            one.displayName.toLowerCase() === who ||
+            one.userId === wanted.trim());
+        if (!person) {
+            console.error((0, colour_js_1.red)(`${wanted.trim()} is not one of ${project.name}'s people.`));
+            console.error((0, colour_js_1.dim)(`  See who is: cbx people ${project.slug}`));
+            return 1;
+        }
+        const label = person.displayName || person.email;
+        if (removing !== undefined) {
+            await (0, api_js_1.removeCollaborator)(project.id, person.userId);
+            console.log((0, colour_js_1.green)(`${label} is no longer on ${project.name}.`));
+            return 0;
+        }
+        const flag = parsed.flags.get("role");
+        const role = typeof flag === "string" ? flag.trim().toLowerCase() : "";
+        if (!["write", "read", "admin"].includes(role)) {
+            console.error((0, colour_js_1.red)(role ? `"${role}" is not a role. Use write, read or admin.` : "Which role? Add --role write, read or admin."));
+            return 1;
+        }
+        await (0, api_js_1.setCollaboratorRole)(project.id, person.userId, role);
+        console.log((0, colour_js_1.green)(`${label} now has ${role} access to ${project.name}.`));
+        return 0;
+    }
     const email = parsed.flags.get("invite");
     if (email === true) {
         console.error((0, colour_js_1.red)("Whose address? Try: --invite someone@example.com"));
@@ -807,6 +857,76 @@ async function commandHooks(parsed) {
         }
         return 0;
     }
+    /*
+      Everything else the website's Webhooks card does to one hook: send a test,
+      read what was delivered, send one again, change its events, switch it back
+      on. Each names the hook by id or address, as --remove does.
+    */
+    const tested = parsed.flags.get("test");
+    const history = parsed.flags.get("deliveries");
+    const resend = parsed.flags.get("redeliver");
+    const resume = parsed.flags.get("on");
+    const named = parsed.flags.get("hook");
+    const changingEvents = parsed.flags.has("events");
+    if (tested !== undefined || history !== undefined || resend !== undefined || resume !== undefined || changingEvents) {
+        const wanted = [tested, history, resume, named].find((value) => typeof value === "string" && value.trim());
+        const hook = await whichHook(project.id, project.name, typeof wanted === "string" ? wanted.trim() : null);
+        if (!hook)
+            return 1;
+        if (tested !== undefined) {
+            const delivery = await (0, api_js_1.testWebhook)(project.id, hook.id);
+            console.log(`Sent a test to ${hook.url}.`);
+            console.log(`  ${deliveryLine(delivery)}`);
+            return delivery.state === "delivered" ? 0 : 1;
+        }
+        if (history !== undefined) {
+            const found = await (0, api_js_1.webhookDeliveries)(project.id, hook.id);
+            if (!found.length) {
+                console.log((0, colour_js_1.dim)(`Nothing has been sent to ${hook.url} yet. Send a test: cbx hooks --test ${hook.id}`));
+                return 0;
+            }
+            console.log((0, colour_js_1.bold)(hook.url));
+            for (const delivery of found)
+                console.log(`  ${deliveryLine(delivery)}`);
+            console.log("");
+            console.log((0, colour_js_1.dim)(`  Send one again: cbx hooks --redeliver <delivery> --hook ${hook.id}`));
+            return 0;
+        }
+        if (resend !== undefined) {
+            if (typeof resend !== "string" || !resend.trim()) {
+                console.error((0, colour_js_1.red)("Which delivery?") + (0, colour_js_1.dim)(`  cbx hooks --deliveries ${hook.id} lists them`));
+                return 1;
+            }
+            /* The start of an id is enough, as long as it picks out one. */
+            const prefix = resend.trim().toLowerCase();
+            const matches = (await (0, api_js_1.webhookDeliveries)(project.id, hook.id)).filter((one) => one.id.toLowerCase().startsWith(prefix));
+            if (matches.length !== 1) {
+                console.error((0, colour_js_1.red)(matches.length ? `${resend.trim()} matches more than one delivery; give more of its id.` : `No recent delivery ${resend.trim()} for ${hook.url}.`));
+                return 1;
+            }
+            const delivery = await (0, api_js_1.redeliverWebhook)(project.id, hook.id, matches[0].id);
+            console.log(`Sent ${matches[0].event} to ${hook.url} again.`);
+            console.log(`  ${deliveryLine(delivery)}`);
+            return delivery.state === "delivered" ? 0 : 1;
+        }
+        if (changingEvents) {
+            const value = parsed.flags.get("events");
+            const text = typeof value === "string" ? value.trim() : "";
+            const events = text === "all" ? [] : text.split(",").map((one) => one.trim()).filter(Boolean);
+            if (!events.length && text !== "all") {
+                console.error((0, colour_js_1.red)("Which events? A comma separated list, or all.") + (0, colour_js_1.dim)("  cbx hooks --hook <id> --events version.published"));
+                return 1;
+            }
+            await (0, api_js_1.updateWebhook)(project.id, hook.id, { events });
+        }
+        if (resume !== undefined) {
+            await (0, api_js_1.updateWebhook)(project.id, hook.id, { active: true });
+        }
+        const after = (await (0, api_js_1.webhooks)(project.id)).find((one) => one.id === hook.id) ?? hook;
+        console.log((0, colour_js_1.green)(`Updated ${hook.url}.`));
+        console.log(`  ${after.active ? (0, colour_js_1.green)("on") : (0, colour_js_1.red)("off")}  ${(0, colour_js_1.dim)(after.events.length ? after.events.join(", ") : "everything")}`);
+        return 0;
+    }
     const removing = parsed.flags.get("remove");
     if (removing !== undefined) {
         if (typeof removing !== "string" || !removing.trim()) {
@@ -847,5 +967,39 @@ async function commandHooks(parsed) {
         console.log(`    ${(0, colour_js_1.dim)(hook.id)}  ${health}` +
             (hook.events.length ? `  ${(0, colour_js_1.dim)(hook.events.join(", "))}` : `  ${(0, colour_js_1.dim)("everything")}`));
     }
+    if (found.some((hook) => !hook.active)) {
+        console.log("");
+        console.log((0, colour_js_1.dim)("  Switch one back on: cbx hooks --on <id>"));
+    }
     return 0;
 }
+/**
+ * The hook a command is about: named by id or address, or the only one.
+ *
+ * Naming none is fine when there is exactly one, which is the usual case and
+ * the one where asking "which?" would be a question with one answer.
+ */
+async function whichHook(projectId, projectName, wanted) {
+    const found = await (0, api_js_1.webhooks)(projectId);
+    if (!wanted) {
+        if (found.length === 1)
+            return found[0];
+        console.error((0, colour_js_1.red)(found.length ? `${projectName} has ${found.length} webhooks. Say which: --hook <id>` : `${projectName} notifies nothing.`));
+        return null;
+    }
+    const hook = found.find((one) => one.id === wanted || one.url === wanted);
+    if (!hook)
+        console.error((0, colour_js_1.red)(`${projectName} has no webhook called ${wanted}.`));
+    return hook ?? null;
+}
+/** One delivery on one line: when, what, how it went, and its id. */
+function deliveryLine(delivery) {
+    const when = new Date(delivery.createdAt).toLocaleString();
+    const how = delivery.state === "delivered"
+        ? (0, colour_js_1.green)(`delivered${delivery.status ? ` (${delivery.status})` : ""}`)
+        : delivery.state === "pending"
+            ? (0, colour_js_1.dim)(`waiting, ${delivery.attempts} ${delivery.attempts === 1 ? "try" : "tries"} so far`)
+            : (0, colour_js_1.red)(`${delivery.state}${delivery.status ? ` (${delivery.status})` : ""}`);
+    const detail = delivery.detail && delivery.state !== "delivered" ? (0, colour_js_1.dim)(`  ${delivery.detail}`) : "";
+    return `${(0, colour_js_1.dim)(delivery.id.slice(0, 8))}  ${when.padEnd(22)} ${delivery.event.padEnd(24)} ${how}${detail}`;
+}