@earntori/cli 0.2.18 → 0.2.19

package/dist/index.js

@@ -56,7 +56,7 @@ function out(o, human) { console.log(json ? JSON.stringify(o, null, 2) : human);
 function die(msg) { console.error(json ? JSON.stringify({ error: msg }) : `\u2717 ${msg}`); process.exit(1); }
 const usd = (c) => `$${(c / 100).toFixed(2)}`;
 async function api(cfg, method, path, body) {
-    const r = await fetch(`${cfg.base}${path}`, { method, headers: { Authorization: `Bearer ${cfg.token}`, "Content-Type": "application/json", "User-Agent": "@earntori/cli/0.2.10" }, body: body ? JSON.stringify(body) : undefined });
+    const r = await fetch(`${cfg.base}${path}`, { method, headers: { Authorization: `Bearer ${cfg.token}`, "Content-Type": "application/json", "User-Agent": userAgent() }, body: body ? JSON.stringify(body) : undefined });
     const t = await r.text();
     let j = null;
     try {
@@ -162,8 +162,9 @@ function writeJson(p, o) { mkdirSync(dirname(resolve(p)), { recursive: true });
 // (Claude Code and Cursor: always; Codex: when it is installed or present in the repo, or --codex);
 // `install` writes that harness's files and returns their paths. Add a harness = add a row.
 // Pinned package versions written into agent config (B1b). CLI version = this package's own;
-// MCP version is a constant: bump it in the same commit as a @earntori/mcp release.
-const TORI_MCP_VERSION = "0.1.9";
+// MCP version is a constant: bump it in the same commit as a @earntori/mcp release. Spec rev 97:
+// scripts/check-pins.mjs fails `test` and `prepublishOnly` when it differs from packages/mcp's version.
+const TORI_MCP_VERSION = "0.1.12";
 function cliVersion(cliBin) {
     try {
         return JSON.parse(readFileSync(resolve(dirname(realpathSync(cliBin)), "..", "package.json"), "utf8")).version ?? "latest";
@@ -172,6 +173,13 @@ function cliVersion(cliBin) {
         return "latest";
     }
 }
+/** Spec rev 97: the User-Agent carries this package's own version, read once per process. */
+let uaCache;
+function userAgent() {
+    if (!uaCache)
+        uaCache = `@earntori/cli/${cliVersion(resolve(process.argv[1] ?? ""))}`;
+    return uaCache;
+}
 const withHarness = (mcp, id) => ({ ...mcp, env: { TORI_HARNESS: id } });
 function mergeMcpJson(file, mcp) { const j = readJson(file) ?? {}; j.mcpServers = { ...(j.mcpServers ?? {}), tori: mcp }; writeJson(file, j); return file; }
 function hookPresent(h, c) { return typeof h?.command === "string" && (/@earntori\/cli(@[^\s]+)? check/.test(h.command) || (c.local && h.command.includes(c.cliBin))); }
@@ -296,12 +304,20 @@ function repoIndex() { try {
 catch {
     return undefined;
 } }
-function envExample() { try {
-    return existsSync(".env.example") ? readFileSync(".env.example", "utf8").slice(0, 20000) : undefined;
+/** Spec rev 97 (amends rev 86): `.env.example` is skipped when it matches an ignore pattern, and when it is
+ *  read only variable names leave the machine, never values. Names are taken with the same pattern the one
+ *  rule that uses them applies, so the check is unchanged. */
+function envExample() {
+    try {
+        if (!existsSync(".env.example") || isIgnored(".env.example", ignorePatterns(process.cwd())))
+            return undefined;
+        const names = readFileSync(".env.example", "utf8").match(/^\s*[A-Z][A-Z0-9_]+\s*=/gm) ?? [];
+        return names.map((l) => l.replace(/\s*=.*$/, "").trim() + "=").join("\n").slice(0, 20000);
+    }
+    catch {
+        return undefined;
+    }
 }
-catch {
-    return undefined;
-} }
 const CODE_EXT = /\.(ts|tsx|js|jsx|mjs|cjs|py|go|rb|php|java|kt|cs)$/i;
 function projectId() {
     try {
@@ -446,7 +462,7 @@ async function check() {
     try {
         const body0 = { files, project: projectId(), repo_index: repoIndex(), env_example: envExample() };
         dbg(`request: ${JSON.stringify(body0).length} bytes, index ${body0.repo_index?.length ?? 0} paths -> ${cfg.base}`);
-        const res = await fetch(`${cfg.base}/api/v1/checks/run`, { method: "POST", headers: { Authorization: `Bearer ${cfg.token}`, "Content-Type": "application/json", "User-Agent": "@earntori/cli/check" }, body: JSON.stringify(body0) });
+        const res = await fetch(`${cfg.base}/api/v1/checks/run`, { method: "POST", headers: { Authorization: `Bearer ${cfg.token}`, "Content-Type": "application/json", "User-Agent": userAgent() }, body: JSON.stringify(body0) });
         dbg(`response: ${res.status}`);
         const t = await res.text();
         if (!res.ok)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@earntori/cli",
-  "version": "0.2.18",
+  "version": "0.2.19",
   "description": "Tori CLI — holds your coding agent to a standard: checks before it calls a task done, each finding with its fix, on a signed record you can verify offline.",
   "license": "MIT",
   "type": "module",
@@ -17,7 +17,8 @@
   "scripts": {
     "build": "tsc -p tsconfig.json && chmod +x dist/index.js",
     "typecheck": "tsc --noEmit -p tsconfig.json",
-    "test": "echo no tests"
+    "test": "node scripts/check-pins.mjs",
+    "prepublishOnly": "node scripts/check-pins.mjs"
   },
   "devDependencies": {
     "@types/node": "^20.19.43",