@devdogsuga/devtools 0.1.17 → 0.1.19

package/dist/bws/bw.d.ts

@@ -1,3 +1,12 @@
+/**
+ * The `[command, args]` pair that runs the bundled Bitwarden CLI.
+ *
+ * Runs `build/bw.js` under this Node rather than through a shim, so it works
+ * the same wherever devtools is installed. Falls back to `bw` on PATH when the
+ * package cannot be resolved, which keeps a missing install surfacing as the
+ * ENOENT every caller already handles.
+ */
+export declare function bwCommand(args: string[]): [string, string[]];
 /**
  * Runs the Bitwarden CLI with `args`, then exits with its status.
  *

package/dist/bws/bw.js

@@ -12,12 +12,33 @@
  * `pnpm --filter @devdogsuga/devtools exec bw`, the last script at the
  * workspace root whose whole job was to reach into this package.
  *
- * ⚠️ `cwd` is deliberately NOT overridden, unlike the pnpm spawn in
- * `run/pick.ts`. pnpm puts this package's `node_modules/.bin` on PATH as a
- * relative entry, so moving the working directory would make `bw` unresolvable
- * from the very place it is installed. Bitwarden does not care where it runs.
+ * ⚠️ The binary is resolved from `@bitwarden/cli` itself, never looked up on
+ * PATH. A dependency's bin is only linked into the `node_modules/.bin` of the
+ * package that depends on it, so under `pnpm dlx`, or with devtools installed
+ * in a clone, nothing puts `bw` on PATH and a bare `spawn("bw")` is ENOENT.
  */
 import { spawn } from "node:child_process";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+/**
+ * The `[command, args]` pair that runs the bundled Bitwarden CLI.
+ *
+ * Runs `build/bw.js` under this Node rather than through a shim, so it works
+ * the same wherever devtools is installed. Falls back to `bw` on PATH when the
+ * package cannot be resolved, which keeps a missing install surfacing as the
+ * ENOENT every caller already handles.
+ */
+export function bwCommand(args) {
+    try {
+        const require_ = createRequire(import.meta.url);
+        const pkgPath = require_.resolve("@bitwarden/cli/package.json");
+        const pkg = require_(pkgPath);
+        return [process.execPath, [join(dirname(pkgPath), pkg.bin.bw), ...args]];
+    }
+    catch {
+        return ["bw", args];
+    }
+}
 /**
  * Runs the Bitwarden CLI with `args`, then exits with its status.
  *
@@ -28,7 +49,7 @@ import { spawn } from "node:child_process";
  */
 export function runBw(args) {
     return new Promise(() => {
-        const child = spawn("bw", args, { stdio: "inherit" });
+        const child = spawn(...bwCommand(args), { stdio: "inherit" });
         child.on("error", (err) => {
             // ENOENT here means the dependency is not installed rather than that the
             // user mistyped, so say the thing that fixes it.

package/dist/bws/vault.js

@@ -21,6 +21,7 @@ import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
 import { confirm, log, spinner } from "@clack/prompts";
 import { unwrap } from "../ui.js";
+import { bwCommand } from "./bw.js";
 const run = promisify(execFile);
 /**
  * The item this looks for, and creates.
@@ -33,7 +34,7 @@ export const VAULT_ITEM_NAME = "DevDogs Secrets Manager access token (admin)";
 /** `bw status`, or `unavailable` when the CLI is not installed. */
 export async function vaultStatus() {
     try {
-        const { stdout } = await run("bw", bwArgs(["status", "--response"]), {
+        const { stdout } = await run(...bwCommand(bwArgs(["status", "--response"])), {
             shell: false,
         });
         // `--response` wraps the payload; the bare form is also accepted, so read
@@ -80,7 +81,7 @@ async function session(status) {
     return new Promise((resolve) => {
         // stdin inherited so the master password goes to `bw` and not through here;
         // stdout piped so the session key can be captured rather than printed.
-        const child = spawn("bw", ["unlock", "--raw"], {
+        const child = spawn(...bwCommand(["unlock", "--raw"]), {
             stdio: ["inherit", "pipe", "inherit"],
             shell: false,
         });
@@ -127,7 +128,7 @@ export async function readTokenFromVault() {
     const s = spinner();
     s.start("Looking in your Bitwarden vault");
     try {
-        const { stdout } = await run("bw", bwArgs(["get", "password", VAULT_ITEM_NAME, "--raw"], key), { shell: false });
+        const { stdout } = await run(...bwCommand(bwArgs(["get", "password", VAULT_ITEM_NAME, "--raw"], key)), { shell: false });
         const token = stdout.trim();
         if (token === "") {
             s.stop("Nothing stored in the vault yet");
@@ -172,7 +173,7 @@ export async function saveTokenToVault(token) {
         login: { username: null, password: token, totp: null },
     };
     return new Promise((resolve) => {
-        const child = spawn("bw", bwArgs(["create", "item"], key), {
+        const child = spawn(...bwCommand(bwArgs(["create", "item"], key)), {
             stdio: ["pipe", "ignore", "pipe"],
             shell: false,
         });

package/dist/ci.js

@@ -47,6 +47,7 @@ import { loadRegistry } from "./env/discovery.js";
 import { positionals } from "./args.js";
 import { findCiCommand, subcommandCiNames } from "./commands.js";
 import { isWorkerApp, workerApps } from "./workers.js";
+import { ignoreClosedPipes } from "./pipes.js";
 import { captureDevtoolsError, initDevtoolsTelemetry, reportDevtoolsError, reportDevtoolsFailure, } from "./telemetry.js";
 function flagValue(rest, flag) {
     const index = rest.indexOf(flag);
@@ -288,6 +289,7 @@ export async function main(argv) {
     // any dispatch below. `[first, rest[0]]` names the step (`deploy
     // secrets-file`, `deploy platform`, …) as the `command` tag rather than just
     // "deploy", which every invocation here would otherwise share.
+    ignoreClosedPipes();
     initDevtoolsTelemetry([first, rest[0]].filter(Boolean).join(" ") || "help");
     if (!first || first === "--help" || first === "-h") {
         const steps = subcommandCiNames(["deploy"]);

package/dist/launch-ci.js

@@ -32,10 +32,12 @@ import { findRepoRoot } from "./repo/root.js";
 import { loadEnvLoad, loadEnvSession } from "./repo/peers.js";
 import { stripTierFlag } from "./launch.js";
 import { captureDevtoolsError, initDevtoolsTelemetry } from "./telemetry.js";
+import { ignoreClosedPipes } from "./pipes.js";
 export async function launchCi(argv) {
     const { explicit, rest } = stripTierFlag(argv);
     // See `launch.ts`'s matching call: early, so tier resolution and env entry
     // are covered too. Same tag `ci.ts`'s `main()` would compute.
+    ignoreClosedPipes();
     initDevtoolsTelemetry(rest.slice(0, 2).join(" ") || "help");
     const envLoad = await loadEnvLoad();
     const envSession = await loadEnvSession();

package/dist/launch.js

@@ -55,6 +55,7 @@ import { bareGroupStartPath } from "./menu.js";
 import { discoverRepoRoot, findRepoRoot, RepoNotFoundError } from "./repo/root.js";
 import { loadEnvLoad, loadEnvSession } from "./repo/peers.js";
 import { captureDevtoolsError, initDevtoolsTelemetry } from "./telemetry.js";
+import { ignoreClosedPipes } from "./pipes.js";
 import { errorMessage, unwrap } from "./ui.js";
 /**
  * Pulls a global `--tier <t>` out of `argv`, wherever it sits, leaving every
@@ -144,6 +145,7 @@ export async function launch(argv) {
     // resolving or entering the tier below is reported too. `main()`'s own
     // call is then a no-op (`initDevtoolsTelemetry` is idempotent) and this
     // tag, computed from the same argv `main()` receives, stands.
+    ignoreClosedPipes();
     initDevtoolsTelemetry(rest[0] ?? "menu");
     // Same test `cli.ts`'s own `main()` uses to decide whether a bare command
     // group resumes the wizard instead of dispatching — computed here too so

package/dist/pipes.d.ts

@@ -0,0 +1 @@
+export declare function ignoreClosedPipes(): void;

package/dist/pipes.js

@@ -0,0 +1,25 @@
+/**
+ * Keeps a closed stdout/stderr from crashing devtools.
+ *
+ * When whatever reads devtools' output goes away first (`devtools … | head`,
+ * or a wrapper that stopped listening), the next write fails with EPIPE. The
+ * stream emits that as an `'error'` event nobody handles, so Node throws it as
+ * an uncaught exception and Sentry files it as a fatal. Nobody is left to read
+ * the output, so dropping it is the right outcome. Any other stream error is
+ * rethrown and crashes as it did before.
+ *
+ * Idempotent, because `launch`, `launchCi` and `ci.ts`'s `main` can all run in
+ * one process.
+ */
+let installed = false;
+export function ignoreClosedPipes() {
+    if (installed)
+        return;
+    installed = true;
+    for (const stream of [process.stdout, process.stderr]) {
+        stream.on("error", (err) => {
+            if (err.code !== "EPIPE")
+                throw err;
+        });
+    }
+}

package/dist/telemetry.d.ts

@@ -13,6 +13,16 @@ export declare function devtoolsEnvironment(): "ci" | "local";
  * or between two invocations in the same process, still works).
  */
 export declare function devtoolsTelemetryEnabled(): boolean;
+/**
+ * Whether anyone is actually using devtools in this process. Package-registry
+ * scanners install every published version within minutes and run it in a
+ * throwaway sandbox (random `DESKTOP-xxxxxx` hosts, Firecracker VMs, a fuzzer
+ * that turns `process.exit` into a throw). Left unfiltered, each release filed
+ * the same two issues from them. They run with no DevDogsUGA checkout and no
+ * terminal. A person has at least one of the two (`setup` runs outside a
+ * checkout, but in a terminal), and CI always has a checkout.
+ */
+export declare function hasRealCaller(inRepo: boolean, isTTY: boolean): boolean;
 /**
  * Initializes `@sentry/node` for this CLI process. Safe to call more than
  * once (idempotent) and safe to call with no DSN configured (no-ops via

package/dist/telemetry.js

@@ -29,6 +29,7 @@
 import { readFileSync } from "node:fs";
 import * as Sentry from "@sentry/node";
 import { buildSentryOptions } from "@devdogsuga/telemetry";
+import { discoverRepoRoot } from "./repo/root.js";
 import { ownVersion } from "./version.js";
 /** The DSN baked into this build, or "" if there is none (a source run under
  * tsx, or a build made without `DEVTOOLS_SENTRY_DSN`). */
@@ -63,6 +64,18 @@ export function devtoolsEnvironment() {
 export function devtoolsTelemetryEnabled() {
     return process.env.DEVTOOLS_TELEMETRY !== "0";
 }
+/**
+ * Whether anyone is actually using devtools in this process. Package-registry
+ * scanners install every published version within minutes and run it in a
+ * throwaway sandbox (random `DESKTOP-xxxxxx` hosts, Firecracker VMs, a fuzzer
+ * that turns `process.exit` into a throw). Left unfiltered, each release filed
+ * the same two issues from them. They run with no DevDogsUGA checkout and no
+ * terminal. A person has at least one of the two (`setup` runs outside a
+ * checkout, but in a terminal), and CI always has a checkout.
+ */
+export function hasRealCaller(inRepo, isTTY) {
+    return inRepo || isTTY;
+}
 /**
  * Initializes `@sentry/node` for this CLI process. Safe to call more than
  * once (idempotent) and safe to call with no DSN configured (no-ops via
@@ -78,6 +91,9 @@ export function initDevtoolsTelemetry(command) {
     initialized = true;
     if (!devtoolsTelemetryEnabled())
         return;
+    if (!hasRealCaller(discoverRepoRoot() !== null, process.stdin.isTTY === true)) {
+        return;
+    }
     const options = buildSentryOptions({
         service: "devtools",
         environment: devtoolsEnvironment(),

package/env.ts

@@ -88,6 +88,27 @@ declare({
         example: "61d185ff419ef7bd5bd4b3d314081a49",
       },
     ),
+    // Read only by the deploy workflow's Sentry release step and the deploy
+    // smoke test, never by an app. Without the token, deploys skip the release
+    // and its source-map upload with a warning. With it, a failed upload fails
+    // the deploy.
+    SENTRY_AUTH_TOKEN: define(z.string().min(1).optional(), {
+      doc:
+        "A Sentry organization auth token. Deploys use it to create each " +
+        "release and upload its source maps, and the smoke test uses it to " +
+        "read cron check-ins. One token serves every environment.",
+      scope: "environment",
+      secrecy: "secret",
+      commented: true,
+    }),
+    SENTRY_ORG: define(z.string().min(1).optional(), {
+      doc:
+        "The Sentry organization slug the release step and smoke test " +
+        "address. Identifies, does not authorize.",
+      scope: "default",
+      secrecy: "public",
+      example: "devdogsuga",
+    }),
     // Developer-scoped even though the VALUE is org-wide: only operators
     // running `env pull/push/audit` on their own machines read it, no app and
     // no CI job does, and developer scope is what keeps a purely local input

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devdogsuga/devtools",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "private": false,
   "type": "module",
   "description": "Contributor CLI for a DevDogsUGA checkout: database, env, images, emails, cron, deploy. Ships built JS; run via `pnpm dlx @devdogsuga/devtools` (or the `devtools`/`devtools-ci` bins once installed) from inside a DevDogsUGA clone.",
@@ -66,11 +66,11 @@
     "@vitest/coverage-v8": "^4.1.11",
     "react": "^19.2.8",
     "vitest": "^4.1.11",
-    "@devdogsuga/brand": "0.1.2",
     "@devdogsuga/config": "0.1.1",
+    "@devdogsuga/db": "0.1.1",
     "@devdogsuga/env": "0.1.2",
     "@devdogsuga/events": "0.1.3",
-    "@devdogsuga/db": "0.1.1"
+    "@devdogsuga/brand": "0.1.2"
   },
   "scripts": {
     "build": "tsc && node scripts/write-build-info.mjs",