@dotdotdash/afterhours 0.1.0

package/README.md

@@ -0,0 +1,189 @@
+# afterhours
+
+**afterhours** is an autonomous, schedulable system that keeps your Node.js / web projects up-to-date while you sleep. It audits dependencies, applies agent-driven code optimizations, verifies everything still works, opens a pull request, and (optionally) merges and deploys — all hands-free.
+
+---
+
+## Features
+
+- **Dependency audit** — finds vulnerable and outdated packages, upgrades safe deps automatically, uses an LLM agent to fix any breakages
+- **Code optimization** — runs an LLM agent to find and apply code quality improvements, verifies each change with your build + test suite
+- **Deployment** — pushes Docker images, publishes npm packages, creates GitHub Releases, deploys to Vercel or Render
+- **Platform integrations** — GitHub, GitLab, Azure Repos, AWS CodeCommit, Google Cloud Source (PR/MR creation, auto-merge, commenting)
+- **Notifications** — PR comment, email, or webhook on every run
+- **Scheduler adapters** — GitHub Actions, Docker + cron, or bring your own
+
+---
+
+## Install
+
+```bash
+npm install -g @dotdotdash/afterhours
+```
+
+Or use `npx @dotdotdash/afterhours` without installing globally. The CLI command is `afterhours`.
+
+---
+
+## Quick start
+
+```bash
+# 1. Scaffold config
+cd /your/project
+afterhours init --scheduler github
+
+# 2. Add secrets to .env (never commit it)
+cp .env.example .env
+# Fill in GITHUB_TOKEN, ANTHROPIC_API_KEY, etc.
+
+# 3. Verify the setup
+afterhours doctor
+
+# 4. Do a dry run
+afterhours run --dry-run
+```
+
+---
+
+## Configuration
+
+`afterhours init` creates `.afterhours/config.yml`. The full annotated reference is in [`templates/config.yml`](templates/config.yml).
+
+### Minimal config
+
+```yaml
+version: 1
+
+project:
+  type: auto          # auto-detected
+  packageManager: auto
+
+platform:
+  provider: github
+  baseBranch: main
+  autoMerge: false
+
+llm:
+  provider: anthropic
+  model: claude-sonnet-4-5
+  apiKeyEnv: ANTHROPIC_API_KEY
+
+tasks:
+  dependencyAudit:
+    enabled: true
+  codeOptimization:
+    enabled: true
+  deployment:
+    enabled: false
+    targets: []
+  issueTriage:
+    enabled: false        # resolve GitHub issues automatically (branch, PR, close on success)
+    allowedAuthors:
+      - "*"                # or specific usernames, e.g. ["octocat", "hubot"]
+
+notifications:
+  - type: github
+```
+
+Issue triage (`tasks.issueTriage`) requires a platform provider that supports issues (currently GitHub). When enabled, afterhours lists open issues, filters them to `allowedAuthors`, and for each match creates a branch, runs the agent to attempt a fix, and:
+
+- On success: verifies the change, commits, opens a PR (auto-merging if `platform.autoMerge` is set), and closes the issue with a comment.
+- On failure (no changes made, or verify gate fails): leaves the issue open and adds a comment explaining what happened.
+
+### Using a GitHub Copilot seat for the agent
+
+Set `llm.provider: copilot` to drive the agent with a GitHub Copilot subscription instead of a direct LLM API key:
+
+```yaml
+llm:
+  provider: copilot
+  model: gpt-4o             # any Copilot-supported chat model
+  apiKeyEnv: COPILOT_TOKEN  # GitHub token for the Copilot-licensed account
+```
+
+The Copilot account is fully independent from `platform` (repo access) — `apiKeyEnv` here can point to a token for a different GitHub account than `GITHUB_TOKEN`. This lets an org member's Copilot seat drive automated work against a repo (e.g. a client-owned repo) where only a separate PAT has push/PR access. Note that this relies on GitHub's internal Copilot chat-completions API (the same mechanism used by third-party editor integrations); confirm it's compatible with your Copilot license terms before enabling it for unattended/agentic use.
+
+---
+
+## Environment variables
+
+All secrets are read from environment variables — never from config files. The canonical list is in [`.env.example`](.env.example).
+
+| Variable | Used for |
+|---|---|
+| `GITHUB_TOKEN` | GitHub API + auto-merge + notifications |
+| `ANTHROPIC_API_KEY` | LLM agent (Anthropic) |
+| `OPENAI_API_KEY` | LLM agent (OpenAI) |
+| `GEMINI_API_KEY` | LLM agent (Google Gemini) |
+| `COPILOT_TOKEN` | LLM agent (GitHub Copilot); can belong to a different GitHub account than `GITHUB_TOKEN` |
+| `NPM_TOKEN` | npm publish |
+| `REGISTRY_USER` / `REGISTRY_PASS` | Docker registry login |
+| `VERCEL_TOKEN` / `VERCEL_PROJECT_ID` / `VERCEL_ORG_ID` | Vercel deploy |
+| `RENDER_API_KEY` / `RENDER_SERVICE_ID` | Render deploy |
+
+---
+
+## Security
+
+- Secrets are **never** written to disk or logged. All log output is redacted against known env values.
+- Agent file-system tools enforce path-traversal checks (`assertSafePath`).
+- Agent shell-tool has a denylist for dangerous patterns (`rm -rf /`, `dd if=`, etc.).
+- LLM prompts include "minimal changes" and no-secrets guardrails.
+- Dependency upgrades are split into **safe** (patch/minor, non-deprecated) and **risky** (major, deprecated) and the risky set is skipped unless `allowMajor: true`.
+- Every change must pass the full verify gate (build + tests) before it is committed.
+- The PR is opened without auto-merge by default.
+
+### OWASP Top 10 mitigations
+
+| Risk | Mitigation |
+|---|---|
+| Injection | Command denylist; no shell=true; args passed as arrays |
+| Broken access control | Path traversal guard on all agent FS tools |
+| Sensitive data exposure | Secrets redacted from all log/output; env-only secret resolution |
+| Insecure deps | Core task: `npm audit`; automated upgrades with gate |
+
+---
+
+## Scheduler adapters
+
+### GitHub Actions (recommended)
+
+```bash
+afterhours init --scheduler github
+```
+
+Creates `.github/workflows/afterhours.yml`. Add `ANTHROPIC_API_KEY` (or equivalent) as a repository secret.
+
+### Docker + cron
+
+```bash
+afterhours init --scheduler docker-cron
+```
+
+Creates `.afterhours/docker-cron/` — a `Dockerfile` + `crontab`. Build and run:
+
+```bash
+cd .afterhours/docker-cron
+docker build -t afterhours-cron .
+docker run -d --env-file ../../.env -v $(pwd)/../../:/workspace afterhours-cron
+```
+
+---
+
+## CLI reference
+
+```
+afterhours init [--scheduler github|docker-cron|none] [--force]
+afterhours run [--dry-run] [--task <id>] [--no-deploy]
+afterhours doctor [--platform]
+afterhours report [runId]
+afterhours audit     # (planned)
+afterhours optimize  # (planned)
+afterhours deploy    # (planned)
+```
+
+---
+
+## License
+
+MIT

package/dist/chunk-UC2WX3XO.js

@@ -0,0 +1,56 @@
+// src/report/index.ts
+import { mkdirSync, writeFileSync } from "fs";
+import { join } from "path";
+function renderMarkdown(report) {
+  const lines = [
+    `# afterhours Run Report (${report.id})`,
+    "",
+    `**Started:** ${report.startedAt}  `,
+    report.completedAt ? `**Completed:** ${report.completedAt}` : "",
+    "",
+    `**Project:** ${report.projectType} / ${report.projectPackageManager}  `,
+    `**Branch:** ${report.branch}  `,
+    `**Base:** ${report.baseBranch}`,
+    "",
+    "## Tasks",
+    ""
+  ];
+  for (const task of report.tasks) {
+    const icon = task.status === "changed" ? "\u2705" : task.status === "noop" ? "\u23ED" : task.status === "failed" ? "\u274C" : "\u26A0\uFE0F";
+    lines.push(`### ${icon} ${task.title} (${task.status})`);
+    if (task.summary) lines.push(`> ${task.summary}`);
+    if (task.commit) lines.push(`**Commit:** ${task.commit}`);
+    if (task.outstandingReason) lines.push(`**Outstanding:** ${task.outstandingReason}`);
+    lines.push("");
+  }
+  if (report.outstandingWork.length > 0) {
+    lines.push("## Outstanding Work");
+    for (const item of report.outstandingWork) {
+      lines.push(`- ${item}`);
+    }
+    lines.push("");
+  }
+  if (report.pr) {
+    lines.push(`## Pull Request`);
+    lines.push(`[${report.pr.id}](${report.pr.url}) \u2014 ${report.pr.merged ? "merged" : "open"}`);
+    lines.push("");
+  }
+  return lines.filter((l) => l !== void 0).join("\n");
+}
+function renderJson(report) {
+  return JSON.stringify(report, null, 2);
+}
+function writeReports(report, reportsDir) {
+  mkdirSync(reportsDir, { recursive: true });
+  const jsonPath = join(reportsDir, `${report.id}.json`);
+  const mdPath = join(reportsDir, `${report.id}.md`);
+  writeFileSync(jsonPath, renderJson(report), "utf8");
+  writeFileSync(mdPath, renderMarkdown(report), "utf8");
+  return { jsonPath, mdPath };
+}
+
+export {
+  renderMarkdown,
+  renderJson,
+  writeReports
+};

package/dist/index.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node