@doist/doistbot-cli 1.0.0 → 1.0.2

package/dist/input.js

@@ -12,55 +12,29 @@ export function promptInput(prompt) {
     });
 }
 export function promptHiddenInput(prompt) {
-    const input = process.stdin;
-    if (!process.stdin.isTTY || !input.setRawMode) {
+    if (!process.stdin.isTTY) {
         return promptInput(prompt);
     }
-    return new Promise((resolve, reject) => {
-        let value = '';
-        const previousRawMode = input.isRaw === true;
-        const previousEncoding = input.readableEncoding;
-        function cleanup() {
-            input.off('data', onData);
-            input.setRawMode?.(previousRawMode);
-            if (previousEncoding) {
-                input.setEncoding(previousEncoding);
-            }
-            input.pause();
-        }
-        function finish() {
-            cleanup();
-            process.stdout.write('\n');
-            resolve(value);
-        }
-        function cancel() {
-            cleanup();
-            process.stdout.write('\n');
-            reject(new Error('Input cancelled'));
-        }
-        function onData(chunk) {
-            for (const character of chunk) {
-                if (character === '\u0003') {
-                    cancel();
-                    return;
-                }
-                if (character === '\r' || character === '\n') {
-                    finish();
-                    return;
-                }
-                if (character === '\u007F' || character === '\b') {
-                    value = value.slice(0, -1);
-                    continue;
-                }
-                if (character >= ' ') {
-                    value += character;
-                }
-            }
-        }
-        process.stdout.write(prompt);
-        input.setRawMode(true);
-        input.resume();
-        input.setEncoding('utf8');
-        input.on('data', onData);
+    return promptPassword(prompt);
+}
+export async function promptMultiSelect({ message, choices, }) {
+    const { default: checkbox } = await import('@inquirer/checkbox');
+    return (await checkbox({
+        message,
+        choices,
+        required: true,
+        theme: {
+            icon: {
+                checked: ' ●',
+                cursor: '›',
+                unchecked: ' ○',
+            },
+        },
+    }));
+}
+async function promptPassword(prompt) {
+    const { default: password } = await import('@inquirer/password');
+    return await password({
+        message: prompt.trim().replace(/:$/, ''),
     });
 }

package/dist/secure-store.js

@@ -1,59 +1,148 @@
 const SERVICE_NAME = 'doistbot-cli';
-const GEMINI_ACCOUNT_NAME = 'gemini-api-key';
-export const SECURE_STORE_DESCRIPTION = 'system credential manager';
 export class SecureStoreUnavailableError extends Error {
     constructor(message = 'System credential storage is unavailable') {
         super(message);
         this.name = 'SecureStoreUnavailableError';
     }
 }
-export function createGeminiKeyStore() {
-    return createSecureStore(GEMINI_ACCOUNT_NAME);
+export function getSecureStoreLabel(platform = process.platform) {
+    switch (platform) {
+        case 'darwin':
+            return 'macOS Keychain';
+        case 'win32':
+            return 'Windows Credential Manager';
+        default:
+            return 'system keyring';
+    }
+}
+export function describeError(error) {
+    return error instanceof Error ? error.message : String(error);
 }
-function createSecureStore(account) {
+export function createKeyringStore(account) {
+    let cachedUnavailable;
+    function rememberUnavailable(error) {
+        const wrapped = toUnavailableError(error);
+        cachedUnavailable = wrapped;
+        return wrapped;
+    }
     return {
         async getSecret() {
-            const entry = await getEntry(account);
+            if (cachedUnavailable) {
+                throw cachedUnavailable;
+            }
+            const entry = await getEntry(account, rememberUnavailable);
             try {
-                return (await entry.getPassword()) ?? null;
+                const raw = (await entry.getPassword()) ?? null;
+                return raw === null ? { value: null } : { value: raw, backend: 'keyring' };
             }
             catch (error) {
-                throw toUnavailableError(error);
+                throw rememberUnavailable(error);
             }
         },
         async setSecret(secret) {
-            const entry = await getEntry(account);
+            if (cachedUnavailable) {
+                throw cachedUnavailable;
+            }
+            const entry = await getEntry(account, rememberUnavailable);
             try {
                 await entry.setPassword(secret);
+                return 'keyring';
             }
             catch (error) {
-                throw toUnavailableError(error);
+                throw rememberUnavailable(error);
             }
         },
         async deleteSecret() {
-            const entry = await getEntry(account);
+            if (cachedUnavailable) {
+                throw cachedUnavailable;
+            }
+            const entry = await getEntry(account, rememberUnavailable);
             try {
                 return await entry.deleteCredential();
             }
             catch (error) {
-                throw toUnavailableError(error);
+                throw rememberUnavailable(error);
             }
         },
     };
 }
-async function getEntry(account) {
+export function createCompositeStore(keyring, file) {
+    return {
+        async getSecret() {
+            try {
+                const fromKeyring = await keyring.getSecret();
+                if (fromKeyring.value !== null) {
+                    return fromKeyring;
+                }
+            }
+            catch (error) {
+                if (!(error instanceof SecureStoreUnavailableError)) {
+                    throw error;
+                }
+            }
+            return await file.getSecret();
+        },
+        async setSecret(secret) {
+            try {
+                const backend = await keyring.setSecret(secret);
+                await file.deleteSecret().catch(() => undefined);
+                return backend;
+            }
+            catch (keyringError) {
+                if (!(keyringError instanceof SecureStoreUnavailableError)) {
+                    throw keyringError;
+                }
+                try {
+                    return await file.setSecret(secret);
+                }
+                catch (fileError) {
+                    throw combineFailure(keyringError, fileError);
+                }
+            }
+        },
+        async deleteSecret() {
+            let deleted = false;
+            let keyringFailure;
+            try {
+                deleted = (await keyring.deleteSecret()) || deleted;
+            }
+            catch (error) {
+                if (!(error instanceof SecureStoreUnavailableError)) {
+                    throw error;
+                }
+                keyringFailure = error;
+            }
+            try {
+                deleted = (await file.deleteSecret()) || deleted;
+            }
+            catch (fileError) {
+                if (keyringFailure) {
+                    throw combineFailure(keyringFailure, fileError);
+                }
+                throw fileError;
+            }
+            if (keyringFailure) {
+                throw new SecureStoreUnavailableError(`Failed to delete from system keyring (${keyringFailure.message}). File store deletion succeeded but the keyring entry may still exist.`);
+            }
+            return deleted;
+        },
+    };
+}
+async function getEntry(account, rememberUnavailable) {
     try {
         const { AsyncEntry } = await import('@napi-rs/keyring');
         return new AsyncEntry(SERVICE_NAME, account);
     }
     catch (error) {
-        throw toUnavailableError(error);
+        throw rememberUnavailable(error);
     }
 }
 function toUnavailableError(error) {
     if (error instanceof SecureStoreUnavailableError) {
         return error;
     }
-    const message = error instanceof Error ? error.message : 'System credential storage is unavailable';
-    return new SecureStoreUnavailableError(message);
+    return new SecureStoreUnavailableError(describeError(error));
+}
+function combineFailure(keyringError, fileError) {
+    return new SecureStoreUnavailableError(`System keyring unavailable (${keyringError.message}) and file fallback failed (${describeError(fileError)}).`);
 }

package/dist/terminal.js

@@ -1,5 +1,8 @@
 import chalk from 'chalk';
 import yoctoSpinner from 'yocto-spinner';
+export function isInteractiveOutputAllowed({ env = process.env, stream = process.stderr, } = {}) {
+    return env.CI !== 'true' && env.CI !== '1' && stream.isTTY === true;
+}
 export function writeLine(message = '') {
     process.stdout.write(`${message}\n`);
 }
@@ -12,7 +15,7 @@ function getDefaultTerminalConfig() {
             process.env.TERM !== 'dumb' &&
             process.stdout.isTTY === true &&
             chalk.level > 0,
-        isInteractive: process.stderr.isTTY === true && process.env.CI !== 'true',
+        isInteractive: isInteractiveOutputAllowed(),
     };
 }
 function colorize(value, style, terminalConfig) {

package/dist/test-utils/secure-store-mocks.js

@@ -0,0 +1,29 @@
+import { vi } from 'vitest';
+import { SecureStoreUnavailableError, } from '../secure-store.js';
+export function createMemoryStore({ initial = null, backend = 'keyring', } = {}) {
+    let secret = initial;
+    return {
+        getSecret: vi.fn(async () => secret === null ? { value: null } : { value: secret, backend }),
+        setSecret: vi.fn(async (value) => {
+            secret = value;
+            return backend;
+        }),
+        deleteSecret: vi.fn(async () => {
+            if (secret === null) {
+                return false;
+            }
+            secret = null;
+            return true;
+        }),
+    };
+}
+export function createUnavailableStore(message = 'keyring offline') {
+    async function fail() {
+        throw new SecureStoreUnavailableError(message);
+    }
+    return {
+        getSecret: vi.fn(fail),
+        setSecret: vi.fn(fail),
+        deleteSecret: vi.fn(fail),
+    };
+}

package/dist/update-cache-entrypoint.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import { parseArgs } from 'node:util';
+import { refreshCliUpdateCache } from './update-check.js';
+const { values } = parseArgs({
+    options: {
+        'cache-path': { type: 'string' },
+        'current-version': { type: 'string' },
+    },
+});
+if (!values['current-version']) {
+    throw new Error('Missing --current-version');
+}
+await refreshCliUpdateCache({
+    cachePath: values['cache-path'],
+    currentVersion: values['current-version'],
+});

package/dist/update-check.js

@@ -0,0 +1,235 @@
+import { spawn } from 'node:child_process';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import chalk from 'chalk';
+import { isInteractiveOutputAllowed, writeLine } from './terminal.js';
+const PACKAGE_NAME = '@doist/doistbot-cli';
+const REGISTRY_LATEST_URL = `https://registry.npmjs.org/${encodeURIComponent(PACKAGE_NAME)}/latest`;
+const BACKGROUND_FETCH_TIMEOUT_MS = 5_000;
+const FOREGROUND_FETCH_TIMEOUT_MS = 10_000;
+const UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1_000;
+export function getDefaultUpdateCheckCachePath() {
+    const configRoot = process.env.XDG_CACHE_HOME ?? path.join(os.homedir(), '.cache');
+    return path.join(configRoot, 'doistbot-cli', 'update-check.json');
+}
+export function isNewerVersion(latestVersion, currentVersion) {
+    const latest = parseVersion(latestVersion);
+    const current = parseVersion(currentVersion);
+    if (!latest || !current) {
+        return false;
+    }
+    for (const [index, latestPart] of latest.entries()) {
+        const currentPart = current[index] ?? 0;
+        if (latestPart > currentPart) {
+            return true;
+        }
+        if (latestPart < currentPart) {
+            return false;
+        }
+    }
+    return false;
+}
+export async function notifyIfCliUpdateAvailable({ cachePath = getDefaultUpdateCheckCachePath(), currentVersion, fetchLatestVersion = fetchLatestPackageVersion, timeoutMs = FOREGROUND_FETCH_TIMEOUT_MS, writeLine: write = writeLine, }) {
+    const latestVersion = await refreshCliUpdateCache({
+        cachePath,
+        currentVersion,
+        fetchLatestVersion,
+        timeoutMs,
+    });
+    if (!latestVersion) {
+        write('Unable to check for DoistBot CLI updates.');
+        return;
+    }
+    if (!isNewerVersion(latestVersion, currentVersion)) {
+        write(`doistbot ${currentVersion} is up to date.`);
+        return;
+    }
+    write(formatCliUpdateNotice({ currentVersion, latestVersion }));
+}
+export async function notifyAndRefreshCliUpdateCache({ cachePath = getDefaultUpdateCheckCachePath(), currentVersion, env = process.env, now = new Date(), spawnProcess = spawn, stdout = process.stdout, updateCacheEntrypointPath, writeLine: write = writeLine, }) {
+    if (!isUpdateCheckEnabled({ env, stdout })) {
+        return;
+    }
+    const cache = await readUpdateCheckCache(cachePath);
+    writeCachedCliUpdateNotice({ cache, currentVersion, writeLine: write });
+    if (shouldRefreshCliUpdateCache({ cache, now })) {
+        refreshCliUpdateCacheInBackground({
+            cachePath,
+            currentVersion,
+            env,
+            spawnProcess,
+            updateCacheEntrypointPath,
+        });
+    }
+}
+export function isUpdateCheckEnabled({ env = process.env, stdout = process.stdout, } = {}) {
+    return (env.DOISTBOT_DISABLE_UPDATE_CHECK !== 'true' &&
+        env.DOISTBOT_DISABLE_UPDATE_CHECK !== '1' &&
+        isInteractiveOutputAllowed({ env, stream: stdout }));
+}
+export async function refreshCliUpdateCache({ cachePath = getDefaultUpdateCheckCachePath(), fetchLatestVersion = fetchLatestPackageVersion, now = new Date(), timeoutMs = BACKGROUND_FETCH_TIMEOUT_MS, }) {
+    const latestVersion = await fetchLatestVersionWithTimeout(fetchLatestVersion, timeoutMs);
+    const previousCache = await readUpdateCheckCache(cachePath);
+    try {
+        await writeUpdateCheckCache({
+            cachePath,
+            checkedAt: now,
+            latestVersion: latestVersion ?? previousCache?.latestVersion,
+        });
+    }
+    catch {
+        // Cache writes are best-effort; a successful registry lookup should still be usable.
+    }
+    return latestVersion;
+}
+export function formatCliUpdateNotice({ currentVersion, latestVersion, }) {
+    const homebrewCommand = 'brew update && brew upgrade doistbot-cli';
+    const npmCommand = `npm install -g ${PACKAGE_NAME}@latest`;
+    const plainLines = [
+        `Update available: doistbot ${currentVersion} -> ${latestVersion}`,
+        '',
+        'Homebrew',
+        `  ${homebrewCommand}`,
+        '',
+        'npm',
+        `  ${npmCommand}`,
+    ];
+    const innerWidth = Math.max(...plainLines.map((line) => line.length)) + 2;
+    const border = colorizeUpdateNotice(`┌${'─'.repeat(innerWidth + 2)}┐`);
+    const footer = colorizeUpdateNotice(`└${'─'.repeat(innerWidth + 2)}┘`);
+    const renderedLines = plainLines.map((line, index) => renderBoxLine(line, index === 0 ? renderUpdateTitle(currentVersion, latestVersion) : renderUpdateLine(line), innerWidth));
+    return ['', '', border, ...renderedLines, footer].join('\n');
+}
+function renderUpdateTitle(currentVersion, latestVersion) {
+    return [
+        chalk.yellow('Update available: doistbot '),
+        chalk.bold.yellow(currentVersion),
+        chalk.yellow(' -> '),
+        chalk.bold.yellow(latestVersion),
+    ].join('');
+}
+function renderUpdateLine(line) {
+    if (line.startsWith('  ')) {
+        return `  ${chalk.italic.white(line.trim())}`;
+    }
+    return colorizeUpdateNotice(line);
+}
+function renderBoxLine(plainLine, renderedLine, innerWidth) {
+    const padding = ' '.repeat(innerWidth - plainLine.length);
+    const border = colorizeUpdateNotice('│');
+    return `${border} ${renderedLine}${padding} ${border}`;
+}
+function colorizeUpdateNotice(value) {
+    return chalk.yellow(value);
+}
+async function fetchLatestVersionWithTimeout(fetchLatestVersion, timeoutMs) {
+    try {
+        return await fetchLatestVersion(AbortSignal.timeout(timeoutMs));
+    }
+    catch {
+        return undefined;
+    }
+}
+function shouldRefreshCliUpdateCache({ cache, now, }) {
+    if (!cache?.checkedAt) {
+        return true;
+    }
+    return now.getTime() - cache.checkedAt.getTime() >= UPDATE_CHECK_INTERVAL_MS;
+}
+function refreshCliUpdateCacheInBackground({ cachePath, currentVersion, env, spawnProcess, updateCacheEntrypointPath, }) {
+    try {
+        const child = spawnProcess(process.execPath, [
+            updateCacheEntrypointPath,
+            '--cache-path',
+            cachePath,
+            '--current-version',
+            currentVersion,
+        ], {
+            detached: true,
+            env: createUpdateCacheRefreshEnv(env),
+            stdio: 'ignore',
+        });
+        child.on('error', () => undefined);
+        child.unref();
+    }
+    catch {
+        // Background refresh must never fail the foreground CLI command.
+    }
+}
+function createUpdateCacheRefreshEnv(env) {
+    const allowedEnvKeys = [
+        'HOME',
+        'HTTPS_PROXY',
+        'HTTP_PROXY',
+        'LOGNAME',
+        'NODE_EXTRA_CA_CERTS',
+        'NO_PROXY',
+        'PATH',
+        'SHELL',
+        'SSL_CERT_DIR',
+        'SSL_CERT_FILE',
+        'TEMP',
+        'TMP',
+        'TMPDIR',
+        'USER',
+        'XDG_CACHE_HOME',
+        'https_proxy',
+        'http_proxy',
+        'no_proxy',
+    ];
+    const minimalEnv = {};
+    for (const key of allowedEnvKeys) {
+        if (env[key] !== undefined) {
+            minimalEnv[key] = env[key];
+        }
+    }
+    return minimalEnv;
+}
+function writeCachedCliUpdateNotice({ cache, currentVersion, writeLine: write, }) {
+    if (!cache?.latestVersion || !isNewerVersion(cache.latestVersion, currentVersion)) {
+        return;
+    }
+    write(formatCliUpdateNotice({ currentVersion, latestVersion: cache.latestVersion }));
+}
+async function readUpdateCheckCache(cachePath) {
+    try {
+        const cache = JSON.parse(await readFile(cachePath, 'utf8'));
+        const checkedAt = typeof cache.checkedAt === 'string' ? new Date(cache.checkedAt) : undefined;
+        return {
+            checkedAt: checkedAt && Number.isFinite(checkedAt.getTime()) ? checkedAt : undefined,
+            latestVersion: typeof cache.latestVersion === 'string' ? cache.latestVersion : undefined,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+async function writeUpdateCheckCache({ cachePath, checkedAt, latestVersion, }) {
+    await mkdir(path.dirname(cachePath), { recursive: true });
+    const cache = {
+        checkedAt: checkedAt.toISOString(),
+    };
+    if (latestVersion) {
+        cache.latestVersion = latestVersion;
+    }
+    await writeFile(cachePath, `${JSON.stringify(cache, null, 4)}\n`);
+}
+async function fetchLatestPackageVersion(signal) {
+    const response = await fetch(REGISTRY_LATEST_URL, {
+        headers: { accept: 'application/json' },
+        signal,
+    });
+    if (!response.ok) {
+        return undefined;
+    }
+    const body = (await response.json());
+    return typeof body.version === 'string' ? body.version : undefined;
+}
+function parseVersion(version) {
+    const match = version.match(/^v?(\d+)\.(\d+)\.(\d+)/);
+    if (!match) {
+        return undefined;
+    }
+    return [Number(match[1]), Number(match[2]), Number(match[3])];
+}

package/package.json

@@ -1,10 +1,11 @@
 {
     "name": "@doist/doistbot-cli",
-    "version": "1.0.0",
+    "version": "1.0.2",
     "description": "Local self-review CLI for DoistBot",
     "type": "module",
     "main": "dist/index.js",
     "bin": {
+        "db": "dist/index.js",
         "doistbot": "dist/index.js"
     },
     "keywords": [
@@ -39,17 +40,19 @@
         "test": "vitest run src scripts --config ../../config/vitest.base.ts"
     },
     "dependencies": {
-        "@mariozechner/pi-ai": "0.72.0",
-        "@mariozechner/pi-coding-agent": "0.72.0",
-        "@napi-rs/keyring": "1.2.0",
-        "ajv": "8.18.0",
+        "@inquirer/checkbox": "5.1.5",
+        "@inquirer/password": "5.0.13",
+        "@mariozechner/pi-ai": "0.73.1",
+        "@mariozechner/pi-coding-agent": "0.73.1",
+        "@napi-rs/keyring": "1.3.0",
+        "ajv": "8.20.0",
         "chalk": "4.1.2",
         "commander": "14.0.3",
         "js-yaml": "4.1.1",
         "octokit": "5.0.5",
-        "yocto-spinner": "1.1.0"
+        "yocto-spinner": "1.2.0"
     },
     "devDependencies": {
-        "vitest": "4.1.5"
+        "vitest": "4.1.6"
     }
 }

package/sandbox/_node_modules/doistbot-repo-config/dist/index.d.ts

@@ -41,8 +41,11 @@ type FetchFileParams = {
     logger: Logger;
 };
 /**
- * Fetches the repository-specific configuration from .github/doistbot.yml
- * Returns null if no config file exists.
+ * Fetches the repository-specific configuration from .github/doistbot.yml.
+ * Returns null when the file is genuinely absent (404) or the path is not a file.
+ * Throws on transport / authorization errors so callers can distinguish "no
+ * config" from "could not load config" — important when an opt-out flag would
+ * otherwise be silently ignored.
  */
 export declare function getRepoConfig({ octokit, owner, repo, ref, logger, }: Omit<FetchFileParams, 'path'>): Promise<RepoConfig | null>;
 export declare function getLocalRepoConfig({ workspaceDir, logger, }: {

package/sandbox/_node_modules/doistbot-repo-config/dist/index.js

@@ -16,25 +16,17 @@ function resolveWorkspacePath(workspaceDir, repoPath) {
     return resolved;
 }
 async function fetchFileContent({ octokit, owner, repo, path, ref, logger, }) {
+    const params = {
+        owner,
+        repo,
+        path,
+    };
+    if (ref) {
+        params.ref = ref;
+    }
+    let response;
     try {
-        const params = {
-            owner,
-            repo,
-            path,
-        };
-        if (ref) {
-            params.ref = ref;
-        }
-        const { data } = await octokit.rest.repos.getContent(params);
-        if (!('type' in data) || data.type !== 'file' || !('content' in data) || !data.content) {
-            logger.warn('Path exists but is not a file', {
-                component: 'repo-config',
-                repository: `${owner}/${repo}`,
-                path,
-            });
-            return null;
-        }
-        return Buffer.from(data.content, 'base64').toString('utf8');
+        response = await octokit.rest.repos.getContent(params);
     }
     catch (error) {
         if (error instanceof Error && 'status' in error && error.status === 404) {
@@ -45,18 +37,25 @@ async function fetchFileContent({ octokit, owner, repo, path, ref, logger, }) {
             });
             return null;
         }
-        logger.warn('Error fetching file', {
+        throw error;
+    }
+    const { data } = response;
+    if (!('type' in data) || data.type !== 'file' || !('content' in data) || !data.content) {
+        logger.warn('Path exists but is not a file', {
             component: 'repo-config',
             repository: `${owner}/${repo}`,
             path,
-            error: error instanceof Error ? error.message : String(error),
         });
         return null;
     }
+    return Buffer.from(data.content, 'base64').toString('utf8');
 }
 /**
- * Fetches the repository-specific configuration from .github/doistbot.yml
- * Returns null if no config file exists.
+ * Fetches the repository-specific configuration from .github/doistbot.yml.
+ * Returns null when the file is genuinely absent (404) or the path is not a file.
+ * Throws on transport / authorization errors so callers can distinguish "no
+ * config" from "could not load config" — important when an opt-out flag would
+ * otherwise be silently ignored.
  */
 export async function getRepoConfig({ octokit, owner, repo, ref, logger, }) {
     const content = await fetchFileContent({
@@ -105,7 +104,19 @@ export function getLocalRepoConfig({ workspaceDir, logger, }) {
  * Returns null if the file doesn't exist.
  */
 export async function getCustomPrompt({ octokit, owner, repo, path, ref, logger, }) {
-    const content = await fetchFileContent({ octokit, owner, repo, path, ref, logger });
+    let content;
+    try {
+        content = await fetchFileContent({ octokit, owner, repo, path, ref, logger });
+    }
+    catch (error) {
+        logger.warn('Error fetching custom prompt', {
+            component: 'repo-config',
+            repository: `${owner}/${repo}`,
+            path,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return null;
+    }
     if (content !== null) {
         logger.info('Loaded custom prompt', {
             component: 'repo-config',