@coderook/cli 0.43.0 → 0.45.0

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, with cbx or plain git, from Claude Code.",
-  "version": "0.43.0",
+  "version": "0.45.0",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/dist/cli/src/api.js

@@ -427,6 +427,8 @@ async function aiAccess(repositoryId) {
     const allowed = (key) => ai[key] !== false;
     return {
         aiRead: allowed("read"),
+        /* The one answer that starts as no: a service that does not send it has not been asked. */
+        aiTrain: ai.train === true,
         aiDownload: allowed("download"),
         aiContribute: allowed("contribute"),
         aiRequest: allowed("request"),

package/dist/cli/src/cli.js

@@ -33,6 +33,7 @@ const upload_progress_js_1 = require("./upload_progress.js");
 const publish_js_1 = require("./publish.js");
 const attach_command_js_1 = require("./attach_command.js");
 const build_command_js_1 = require("./build_command.js");
+const update_command_js_1 = require("./update_command.js");
 const node_check_js_1 = require("./node_check.js");
 const pages_command_js_1 = require("./pages_command.js");
 const mods_command_js_1 = require("./mods_command.js");
@@ -739,7 +740,7 @@ async function commandImport(parsed) {
         flags: submitFlags,
     });
     if (code === 0 && plan.temporary) {
-        console.log(dim(`The working copy stays at ${plan.folder} until you remove it.
+        console.log(dim(`The working copy stays at ${plan.folder} until you remove it.
 ` +
             `Run ${accent("cbx get " + plan.name)} anywhere to fetch it fresh.`));
     }
@@ -1025,17 +1026,17 @@ async function commandSubmit(parsed) {
     */
     const shielded = (await (0, worktree_js_1.detectPrivateDirectories)(folder)).filter((finding) => [...sending].some((file) => file === finding.path || file.startsWith(`${finding.path}/`)));
     if (shielded.length && !hasFlag(parsed, "allow-private")) {
-        console.log(red(`
+        console.log(red(`
 ${shielded.length} folder${shielded.length === 1 ? "" : "s"} here belong${shielded.length === 1 ? "s" : ""} to a program, not to your project:`));
         for (const finding of shielded) {
             console.log(`  ${finding.path}  ${dim(`— ${finding.because}`)}`);
         }
-        console.log(`
+        console.log(`
 Nothing was sent. To leave them behind:`);
         for (const finding of shielded) {
             console.log(`  ${accent(`echo "${finding.rule}" >> .gitignore`)}`);
         }
-        console.error(`
+        console.error(`
 Or pass ${accent("--allow-private")} if they genuinely belong in the project.`);
         return 1;
     }
@@ -1084,7 +1085,7 @@ Or pass ${accent("--allow-private")} if they genuinely belong in the project.`);
             `rest were not opened.`));
     }
     if (stillPasted.length) {
-        console.log(red(`
+        console.log(red(`
 ${stillPasted.length} file${stillPasted.length === 1 ? " has a credential" : "s have credentials"} inside:`));
         for (const finding of stillPasted.slice(0, 20)) {
             console.log(`  ${finding.path}`);
@@ -1099,11 +1100,11 @@ ${stillPasted.length} file${stillPasted.length === 1 ? " has a credential" : "s
             console.log(dim(`  …and ${stillPasted.length - 20} more`));
         }
         if (!hasFlag(parsed, "allow-secrets")) {
-            console.error(`
+            console.error(`
 Nothing was sent. Move the key into an environment variable, and if` +
                 ` it has ever been published, replace it at the service that issued` +
                 ` it — a key that has leaked stays leaked.` +
-                `
+                `
 Pass ${accent("--allow-secrets")} if these are not real keys.`);
             return 1;
         }
@@ -1309,7 +1310,7 @@ Pass ${accent("--allow-secrets")} if these are not real keys.`);
                 continue;
             }
             if (failure?.kind === "interrupted") {
-                console.error(red(`
+                console.error(red(`
 The connection failed: ${text}`));
                 console.error(`Your work may already have been saved. Run the same command again —` +
                     ` it will not create a second version.`);
@@ -1566,7 +1567,7 @@ async function commandGet(parsed) {
                     `changed while the interrupted fetch was stopped:`));
                 for (const file of changedInTheGap.slice(0, 20))
                     console.error(`  ${file.path}`);
-                console.error(`
+                console.error(`
 Save them with ${accent("cbx submit")}, or finish the fetch and ` +
                     `discard them with ${accent("cbx get --replace")}.`);
                 return 1;
@@ -1849,8 +1850,8 @@ async function suggestRules(folder, apply) {
     const addition = (0, detect_js_1.rulesFromSuggestions)(recommended);
     const shared = rules.shared.trimEnd();
     await (0, worktree_js_1.writeRules)(folder, {
-        shared: shared ? `${shared}
-
+        shared: shared ? `${shared}
+
 ${addition}` : addition,
         local: rules.local,
     });
@@ -2055,7 +2056,7 @@ async function commandMerges(parsed) {
         const counts = merge.conflicts;
         console.log(`${accent(merge.reference)}  ${counts ? `${counts.unresolved} of ${counts.total} still to decide` : ""}  ${dim(new Date(merge.createdAt).toLocaleString())}`);
     }
-    console.log(dim(`
+    console.log(dim(`
 Run cbx merge <reference> to look at one.`));
     return 0;
 }
@@ -2158,7 +2159,7 @@ async function commandMerge(parsed) {
             console.log(dim(`  waiting on ${waiting.map((person) => person.displayName).join(", ")}`));
         }
     }
-    console.log(`
+    console.log(`
 ${accent(now.mergeTrack.reference)} · ` +
         /*
           The combined version is only counted once it can be built; until then
@@ -2177,7 +2178,7 @@ ${accent(now.mergeTrack.reference)} · ` +
             return 1;
         }
         const applied = await (0, api_js_1.applyMerge)(summary.id);
-        console.log(`
+        console.log(`
 Applied as ${accent(`v${applied.version.sequence}`)}.`);
         if (applied.closedIssues?.length) {
             console.log(`Closed ${applied.closedIssues.map((number) => `#${number}`).join(", ")}.`);
@@ -2187,13 +2188,13 @@ Applied as ${accent(`v${applied.version.sequence}`)}.`);
     }
     const stillOpen = now.conflicts.some((conflict) => !conflict.resolvedAt);
     if (!decision && stillOpen) {
-        console.log(dim(`
+        console.log(dim(`
 --mine keeps yours, --theirs keeps what was already saved,` +
-            ` --both keeps theirs and saves yours beside it, --drop removes the file.
+            ` --both keeps theirs and saves yours beside it, --drop removes the file.
 Add --path <file> for one file, then --apply when ready.`));
     }
     else if (now.provisional.ready) {
-        console.log(dim(`
+        console.log(dim(`
 Run cbx merge ${now.mergeTrack.reference} --apply to publish it.`));
     }
     return 0;
@@ -2786,9 +2787,9 @@ const SPECS = [
         name: "workspace",
         group: "Workspaces",
         summary: "edit, save and run a private project remotely without a checkout",
-        usage: "workspace | workspace <usage|open|list|show|read|files|search|diff|patch|put|starter|save|run|logs|cancel|deploy|preview|handoff|close|recipe|assign|assignments|unassign|checkout|say|thread|mute|unmute> <project> [workspace] [job] | workspace put <project> <workspace> <path…> | workspace push [folder] | workspace watch [project] [workspace]",
+        usage: "workspace | workspace <usage|open|list|show|read|files|search|diff|patch|put|starter|review|reviewers|save|run|logs|cancel|deploy|preview|handoff|close|recipe|assign|assignments|unassign|checkout|say|thread|mute|unmute> <project> [workspace] [job] | workspace put <project> <workspace> <path…> | workspace push [folder] | workspace watch [project] [workspace]",
         brief: "workspace <action> <project>",
-        detail: "Works on CodeRook's durable remote draft, never the current local folder. Use --data-file for structured edits or recipe configuration. Mutations need the reviewed --revision and a unique --key; reuse the same key and request when retrying. Recipes reference existing project workflows. Usage reads the shared workspace credits and separate PR allowance without a draft ID. put copies files from this folder into a draft: text as text, images, fonts and other binary files as bytes (up to 1 MiB each), a file that is gone here is removed there, and each file must still be the version the draft holds, so a teammate's edit is never overwritten. starter reads this folder (package.json scripts, Cargo.toml, go.mod, Python) and suggests one check recipe per package so drafts have something to run; --apply adds them, never replacing a recipe that exists. Saving and deploying are separate operations. Run on its own at a terminal, it lists your open workspaces with their unread messages: choose one to see its changes and what is being discussed, and reply, save, run checks, hand it over or close it with one key. say and thread post to and read a workspace's discussion as JSON; a machine signed in to your account can name itself with --as (or CBX_NAME) so its messages and unread count are its own. watch prints each new message, each message addressed to you (@your name, or the name given with --as) and each new saved version as it happens, until stopped; --json gives one JSON object per line for a program.",
+        detail: "Works on CodeRook's durable remote draft, never the current local folder. Use --data-file for structured edits or recipe configuration. Mutations need the reviewed --revision and a unique --key; reuse the same key and request when retrying. Recipes reference existing project workflows. Usage reads the shared workspace credits and separate PR allowance without a draft ID. put copies files from this folder into a draft: text as text, images, fonts and other binary files as bytes (up to 1 MiB each), a file that is gone here is removed there, and each file must still be the version the draft holds, so a teammate's edit is never overwritten. starter reads this folder (package.json scripts, Cargo.toml, go.mod, Python) and suggests one check recipe per package so drafts have something to run; --apply adds them, never replacing a recipe that exists. review shows who must OK a draft before it is saved or deployed; --ok or --changes -m gives your verdict on the current revision, and counts only from the reviewer's own sign-in or token, never a name given with --as. reviewers lists the project's rules, and an administrator sets them with --data-file. Saving and deploying are separate operations. Run on its own at a terminal, it lists your open workspaces with their unread messages: choose one to see its changes and what is being discussed, and reply, save, run checks, hand it over or close it with one key. say and thread post to and read a workspace's discussion as JSON; a machine signed in to your account can name itself with --as (or CBX_NAME) so its messages and unread count are its own. watch prints each new message, each message addressed to you (@your name, or the name given with --as) and each new saved version as it happens, until stopped; --json gives one JSON object per line for a program.",
         options: [
             { flags: "--data-file <path>", description: "read an operation's JSON from this local file" },
             { flags: "--name <name>", description: "name a new workspace" },
@@ -2815,10 +2816,12 @@ const SPECS = [
             { flags: "--after <time>", description: "thread: continue from the next page's time" },
             { flags: "--root <folder>", description: "put/starter: the project folder (default: here)" },
             { flags: "--apply", description: "starter: create the suggested workflows and recipes" },
+            { flags: "--ok", description: "review: approve the draft's current revision" },
+            { flags: "--changes", description: "review: ask for changes (say what with -m)" },
             { flags: "--json", description: "watch: one JSON object per line; starter: the plan as JSON" },
             { flags: "--interval <seconds>", description: "watch: how often to look (default 20, at least 5)" },
         ],
-        examples: ["cbx workspace open my-project --name \"Laptop work\" --key laptop-open-001", "cbx workspace list my-project", "cbx workspace assign my-project <draft> --name Laptop", "cbx workspace checkout my-project <draft>", "cbx workspace push --save -m \"Fix the export dialog\"", "cbx workspace", "cbx workspace say my-project <draft> -m \"Tests updated\" --as GrokBot", "cbx workspace thread my-project <draft> --unread", "cbx workspace watch my-project --as GrokBot --json", "cbx workspace put my-project <draft> website/app/page.tsx website/public/og.png", "cbx workspace starter my-project --apply"],
+        examples: ["cbx workspace open my-project --name \"Laptop work\" --key laptop-open-001", "cbx workspace list my-project", "cbx workspace assign my-project <draft> --name Laptop", "cbx workspace checkout my-project <draft>", "cbx workspace push --save -m \"Fix the export dialog\"", "cbx workspace", "cbx workspace say my-project <draft> -m \"Tests updated\" --as GrokBot", "cbx workspace thread my-project <draft> --unread", "cbx workspace watch my-project --as GrokBot --json", "cbx workspace put my-project <draft> website/app/page.tsx website/public/og.png", "cbx workspace starter my-project --apply", "cbx workspace review my-project <draft> --ok -m \"Matches the concept\""],
         run: workspace_command_js_1.commandWorkspace,
     },
     {
@@ -4048,6 +4051,23 @@ const SPECS = [
         examples: ["claude mcp add coderook -- cbx mcp"],
         run: parsed => parsed.flags.has("workspaces") ? (0, workspace_command_js_1.commandWorkspaceMcp)() : (0, mcp_js_1.commandMcp)(version_js_1.VERSION),
     },
+    {
+        name: "update",
+        aliases: ["upgrade"],
+        group: "Getting started",
+        summary: "install the newest cbx",
+        usage: "update",
+        options: [
+            { flags: "--check", description: "only say whether a newer cbx is out" },
+        ],
+        detail: "Updates cbx itself, not a folder: `cbx get` brings a project's files\n" +
+            "up to date. Asks the npm registry for the newest @coderook/cli and\n" +
+            "installs it the way this copy was installed: globally with npm, or in\n" +
+            "the project whose packages hold it. Through npx there is nothing to\n" +
+            "install. Your folders, sign-in and settings are left as they are.",
+        examples: ["cbx update", "cbx update --check"],
+        run: parsed => (0, update_command_js_1.commandUpdate)(parsed.flags),
+    },
     {
         name: "doctor",
         group: "Getting started",

package/dist/cli/src/project_commands.js

@@ -56,13 +56,19 @@ async function resolveProject(reference) {
     }
     return project;
 }
-/** The four answers, in the order the site shows them. */
+/** The answers, in the order the site shows them. */
 const AI_SWITCHES = [
     [
         "read",
         "aiRead",
         "Can AI read this?",
-        "reading, indexing, summarising and model training",
+        "reading, indexing, summarising and quoting in answers",
+    ],
+    [
+        "train",
+        "aiTrain",
+        "Can AI train on this?",
+        "using what it reads to train a model",
     ],
     [
         "download",
@@ -122,8 +128,8 @@ async function commandAi(parsed) {
         console.log(`  ${(0, colour_js_1.dim)(meaning)}`);
     }
     console.log("");
-    console.log((0, colour_js_1.dim)("Everything is allowed until somebody says otherwise. Reading off is the one"));
-    console.log((0, colour_js_1.dim)("that refuses model training."));
+    console.log((0, colour_js_1.dim)("Everything but training is allowed until somebody says otherwise; training"));
+    console.log((0, colour_js_1.dim)("is refused until the owner allows it, and reading off refuses it too."));
     console.log((0, colour_js_1.dim)("Change these on the website (Settings → Access & AI) or in the desktop app."));
     return 0;
 }

package/dist/cli/src/registry.js

@@ -37,7 +37,7 @@ exports.GROUP_ORDER = [
  * from this list still appears, after the ones that are in it.
  */
 exports.LISTING_ORDER = [
-    "sign-in", "whoami", "sign-out", "doctor", "projects", "clone", "link", "unlink", "import", "transfer",
+    "sign-in", "whoami", "sign-out", "doctor", "update", "projects", "clone", "link", "unlink", "import", "transfer",
     "status", "submit", "diff", "get", "track", "ignore", "licence",
     "init", "save", "log", "restore", "switch", "push", "pull",
     "tracks", "line-rules", "merges", "merge", "propose", "proposals", "pr",

package/dist/cli/src/update_command.js

@@ -0,0 +1,159 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compareVersions = compareVersions;
+exports.installKind = installKind;
+exports.projectFolder = projectFolder;
+exports.commandUpdate = commandUpdate;
+/**
+ * `cbx update` — bring this copy of cbx itself up to the newest release.
+ *
+ * Not the folder: `cbx get` (and `cbx pull`) bring a project's files up to
+ * date. This asks the npm registry for the newest @coderook/cli and installs it
+ * the way this copy was installed, because the right command differs:
+ *
+ *   global npm install   npm install -g @coderook/cli@<newest>, run here
+ *   npx                  nothing to install; npx fetches what it is told to
+ *   a project's packages npm install @coderook/cli@<newest> in that project
+ *   anything else        the command to run, printed rather than guessed at
+ *
+ * Every outward call has a deadline, so a registry or npm that never answers
+ * ends in a message instead of a hang.
+ */
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const node_process_1 = __importDefault(require("node:process"));
+const version_js_1 = require("./version.js");
+const PACKAGE = "@coderook/cli";
+/** A release number and nothing else: it is put on an npm command line. */
+const RELEASE = /^\d{1,6}\.\d{1,6}\.\d{1,6}(?:-[0-9A-Za-z.]{1,40})?$/;
+const REGISTRY = "https://registry.npmjs.org/" + PACKAGE.replace("/", "%2F") + "/latest";
+const colour = node_process_1.default.stdout.isTTY && !node_process_1.default.env.NO_COLOR;
+const paint = (code) => (text) => (colour ? `\x1b[${code}m${text}\x1b[0m` : text);
+const dim = paint(2), accent = paint(33), red = paint(31), green = paint(32);
+/** Compares two release numbers (1.2.3, pre-release tags rank below the release). Negative when a is older. */
+function compareVersions(a, b) {
+    const parse = (v) => {
+        const [core = "", pre = ""] = v.trim().replace(/^v/, "").split("-", 2);
+        return { parts: core.split(".").map((n) => Number.parseInt(n, 10) || 0), pre };
+    };
+    const x = parse(a), y = parse(b);
+    for (let i = 0; i < 3; i += 1) {
+        const d = (x.parts[i] ?? 0) - (y.parts[i] ?? 0);
+        if (d)
+            return d;
+    }
+    if (x.pre === y.pre)
+        return 0;
+    if (!x.pre)
+        return 1;
+    if (!y.pre)
+        return -1;
+    return x.pre < y.pre ? -1 : 1;
+}
+/**
+ * How the running copy was installed, from where its files are.
+ * `globalRoot` is `npm root -g` (null when npm could not say).
+ */
+function installKind(script, globalRoot, platform = node_process_1.default.platform) {
+    const norm = (p) => {
+        const s = p.replace(/\\/g, "/").replace(/\/+$/, "");
+        return platform === "win32" ? s.toLowerCase() : s;
+    };
+    const here = norm(script);
+    if (!here.includes("/node_modules/@coderook/cli/"))
+        return "other";
+    if (/\/_npx\//.test(here))
+        return "npx";
+    if (globalRoot && here.startsWith(norm(globalRoot) + "/"))
+        return "global";
+    return "project";
+}
+/** The folder holding the node_modules this copy sits in (for a project install). */
+function projectFolder(script) {
+    const s = script.replace(/\\/g, "/");
+    const at = s.lastIndexOf("/node_modules/@coderook/cli/");
+    return at < 0 ? node_path_1.default.dirname(script) : s.slice(0, at);
+}
+async function newestRelease() {
+    const response = await fetch(REGISTRY, { signal: AbortSignal.timeout(10_000), headers: { accept: "application/json" } });
+    if (!response.ok)
+        throw new Error(`the npm registry answered ${response.status}`);
+    const body = (await response.json());
+    if (typeof body.version !== "string" || !RELEASE.test(body.version))
+        throw new Error("the npm registry gave no usable version");
+    return body.version;
+}
+/** Runs npm with a deadline; output goes to this terminal when `show` is set. */
+function npm(args, options) {
+    return new Promise((resolve) => {
+        /*
+          npm is npm.cmd on Windows, which Node only starts through a shell, and a
+          shell takes one command line rather than an argument list. Every word
+          here is ours or a release number checked by RELEASE, so joining is safe.
+        */
+        const stdio = options.show ? ["inherit", "inherit", "inherit"] : ["ignore", "pipe", "ignore"];
+        const child = node_process_1.default.platform === "win32"
+            ? (0, node_child_process_1.spawn)(["npm", ...args].join(" "), { cwd: options.cwd, shell: true, stdio })
+            : (0, node_child_process_1.spawn)("npm", args, { cwd: options.cwd, stdio });
+        let out = "";
+        child.stdout?.on("data", (chunk) => { out += chunk.toString(); });
+        const timer = setTimeout(() => { child.kill(); resolve({ code: -1, out }); }, options.deadlineMs);
+        child.on("error", () => { clearTimeout(timer); resolve({ code: -2, out }); });
+        child.on("close", (code) => { clearTimeout(timer); resolve({ code: code ?? 1, out }); });
+    });
+}
+async function commandUpdate(flags) {
+    const checkOnly = flags.has("check");
+    let newest;
+    try {
+        newest = await newestRelease();
+    }
+    catch (error) {
+        console.error(red("Could not find out the newest cbx: " + (error instanceof Error ? error.message : String(error)) + "."));
+        console.error(dim("Check the connection and try again. Nothing was changed."));
+        return 1;
+    }
+    const order = compareVersions(version_js_1.VERSION, newest);
+    if (order >= 0) {
+        console.log(green(`cbx ${version_js_1.VERSION} is the newest.`) + (order > 0 ? dim(` (the registry's newest is ${newest})`) : ""));
+        return 0;
+    }
+    console.log(`cbx ${version_js_1.VERSION} is installed; ${accent(newest)} is out.`);
+    let script = node_process_1.default.argv[1] ?? "";
+    try {
+        script = (0, node_fs_1.realpathSync)(script);
+    }
+    catch { /* keep what we were given */ }
+    const root = await npm(["root", "-g"], { show: false, deadlineMs: 20_000 });
+    const kind = installKind(script, root.code === 0 ? root.out.trim() : null);
+    const target = `${PACKAGE}@${newest}`;
+    if (kind === "npx") {
+        console.log(`This copy runs through npx. Ask for the newest each time with ${accent(`npx ${PACKAGE}@latest`)}.`);
+        return 0;
+    }
+    if (kind === "other") {
+        console.log(`This copy was not installed by npm, so install the newest with ${accent(`npm install -g ${target}`)}.`);
+        return 0;
+    }
+    const folder = kind === "project" ? projectFolder(script) : undefined;
+    const args = kind === "global" ? ["install", "-g", target] : ["install", target];
+    if (checkOnly) {
+        console.log(`Update with ${accent("cbx update")}, or ${accent("npm " + args.join(" "))}${folder ? dim(` in ${folder}`) : ""}.`);
+        return 0;
+    }
+    console.log(dim(`Running npm ${args.join(" ")}${folder ? ` in ${folder}` : ""}…`));
+    const result = await npm(args, { show: true, cwd: folder, deadlineMs: 5 * 60_000 });
+    if (result.code !== 0) {
+        console.error(red(result.code === -1 ? "npm did not finish within five minutes." : result.code === -2 ? "npm could not be started." : `npm stopped with code ${result.code}.`));
+        if (kind === "global")
+            console.error(dim("If it was refused for permissions, run the same command from a terminal that can install global packages."));
+        console.error(dim(`Your current cbx ${version_js_1.VERSION} is untouched.`));
+        return 1;
+    }
+    console.log(green(`cbx is now ${newest}.`) + dim(" Your folders, sign-in and settings are as they were."));
+    return 0;
+}

package/dist/cli/src/workspace_command.js

@@ -10,6 +10,7 @@ const config_js_1 = require("./config.js");
 const workspace_machine_js_1 = require("./workspace_machine.js");
 const workspace_threads_js_1 = require("./workspace_threads.js");
 const workspace_put_js_1 = require("./workspace_put.js");
+const workspace_review_js_1 = require("./workspace_review.js");
 const workspace_starter_js_1 = require("./workspace_starter.js");
 const workspace_watch_js_1 = require("./workspace_watch.js");
 async function commandWorkspace(parsed) {
@@ -30,6 +31,13 @@ async function commandWorkspace(parsed) {
     const root = `/v1/repositories/${encodeURIComponent(project.id)}`;
     if (operation === "starter")
         return (0, workspace_starter_js_1.commandWorkspaceStarter)(parsed, root);
+    if (operation === "reviewers")
+        return (0, workspace_review_js_1.commandWorkspaceReviewers)(parsed, root);
+    if (operation === "review") {
+        if (!workspace)
+            throw new Error("Supply the workspace ID after the project");
+        return (0, workspace_review_js_1.commandWorkspaceReview)(parsed, root, workspace);
+    }
     if (operation === "put") {
         if (!workspace)
             throw new Error("Supply the workspace ID after the project");

package/dist/cli/src/workspace_review.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeReviewer = describeReviewer;
+exports.commandWorkspaceReview = commandWorkspaceReview;
+exports.commandWorkspaceReviewers = commandWorkspaceReviewers;
+/**
+ * cbx workspace review <project> <workspace> --ok [-m "…"] | --changes -m "…"
+ * cbx workspace reviewers <project> [--data-file rules.json]
+ *
+ * The CLI side of the review gate (backend workspace_reviews.ts). A review
+ * counts only from the reviewer's own sign-in or token, so --as is refused
+ * here before the service refuses it, with the reason.
+ */
+const promises_1 = require("node:fs/promises");
+const api_js_1 = require("./api.js");
+const colour_js_1 = require("./colour.js");
+const flag = (parsed, ...names) => {
+    for (const name of names) {
+        const value = parsed.flags.get(name);
+        if (typeof value === "string")
+            return value;
+    }
+    return undefined;
+};
+/** One line per reviewer: a word for where it stands, never only a colour. */
+function describeReviewer(s, revision) {
+    const when = [s.beforeSave && "save", s.beforeDeploy && "deploy"].filter(Boolean).join(" + ");
+    if (!s.applies)
+        return `${(0, colour_js_1.dim)("not needed")}  ${s.label} ${(0, colour_js_1.dim)(`(no changes in its paths)`)}`;
+    const word = s.state === "ok"
+        ? (0, colour_js_1.green)("OK        ")
+        : s.state === "changes"
+            ? (0, colour_js_1.red)("changes   ")
+            : s.state === "outdated"
+                ? "outdated  "
+                : (0, colour_js_1.dim)("waiting   ");
+    const detail = s.state === "outdated"
+        ? `OK was for revision ${s.revision}, draft is at ${revision}`
+        : s.state === "changes" || (s.state === "ok" && s.note)
+            ? s.note
+            : "";
+    return `${word}${(0, colour_js_1.bold)(s.label)} ${(0, colour_js_1.dim)(`before ${when}`)}${detail ? `  ${detail}` : ""}`;
+}
+async function commandWorkspaceReview(parsed, root, workspace) {
+    if (parsed.flags.has("as") || process.env.CBX_NAME)
+        throw new Error("A review counts only from the reviewer's own sign-in or token; run it without --as or CBX_NAME.");
+    const ok = parsed.flags.has("ok");
+    const changes = parsed.flags.has("changes");
+    const draft = `${root}/workspaces/${encodeURIComponent(workspace)}`;
+    if (ok === changes) {
+        /* Neither: show where the draft stands. */
+        const shown = await (0, api_js_1.callApi)(draft);
+        const review = shown.review ?? [];
+        if (parsed.flags.has("json"))
+            console.log(JSON.stringify({ revision: shown.workspace.revision, review }, null, 2));
+        else if (!review.length)
+            console.log("This project names no reviewers. An administrator sets them with cbx workspace reviewers.");
+        else
+            for (const s of review)
+                console.log(describeReviewer(s, shown.workspace.revision));
+        return 0;
+    }
+    const note = flag(parsed, "m", "message") ?? "";
+    if (changes && !note.trim())
+        throw new Error('Say what needs to change: --changes -m "…"');
+    const revision = parsed.flags.has("revision")
+        ? Number(parsed.flags.get("revision"))
+        : (await (0, api_js_1.callApi)(draft)).workspace.revision;
+    const out = await (0, api_js_1.callApi)(`${draft}/reviews`, {
+        method: "POST",
+        body: { verdict: ok ? "ok" : "changes", note, expectedRevision: revision },
+    });
+    if (parsed.flags.has("json"))
+        console.log(JSON.stringify(out, null, 2));
+    else {
+        console.log(`${ok ? (0, colour_js_1.green)("OK") : (0, colour_js_1.red)("Changes asked")} on revision ${revision}.`);
+        for (const s of out.review)
+            console.log(`  ${describeReviewer(s, revision)}`);
+    }
+    return 0;
+}
+async function commandWorkspaceReviewers(parsed, root) {
+    const source = flag(parsed, "data-file");
+    const rules = source
+        ? (await (0, api_js_1.callApi)(`${root}/workspace-review-rules`, {
+            method: "PUT",
+            body: { rules: JSON.parse(await (0, promises_1.readFile)(source, "utf8")) },
+        })).rules
+        : (await (0, api_js_1.callApi)(`${root}/workspace-review-rules`)).rules;
+    if (parsed.flags.has("json") || source)
+        console.log(JSON.stringify({ rules }, null, 2));
+    else if (!rules.length)
+        console.log(`No reviewers. Set them from a JSON list with ${(0, colour_js_1.accent)("cbx workspace reviewers <project> --data-file rules.json")}:\n` +
+            (0, colour_js_1.dim)('  [{"reviewer":"token:<id>","label":"UX Bot","paths":["website/"],"beforeSave":true,"beforeDeploy":false,"ownerMayOverride":false}]'));
+    else
+        for (const r of rules)
+            console.log(`${(0, colour_js_1.bold)(r.label)} ${(0, colour_js_1.dim)(r.reviewer)}  ${r.paths.length ? r.paths.join(", ") : "every path"}  ${(0, colour_js_1.dim)(`before ${[r.beforeSave && "save", r.beforeDeploy && "deploy"].filter(Boolean).join(" + ")}${r.ownerMayOverride ? "; owner may go ahead without" : ""}`)}`);
+    return 0;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.43.0",
+  "version": "0.45.0",
   "description": "The command line for CodeRook (coderook.com): version control and project hosting for projects of any size. Every save is a compressed snapshot, private or public, never used to train AI.",
   "license": "Apache-2.0",
   "homepage": "https://coderook.com",