@gitset-dev/cli 1.2.1 → 2.0.1

package/src/commands/template.js

@@ -0,0 +1,92 @@
+'use strict';
+
+/**
+ * `gitset template` — manage LOCAL templates in ~/.gitset/templates.
+ * No remote template library (that was the old hosted system).
+ *   gitset template list
+ *   gitset template show <name>
+ *   gitset template edit <name>
+ *   gitset template path
+ */
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const theme = require('../utils/theme');
+
+const DIR = process.env.GITSET_CONFIG_DIR || path.join(os.homedir(), '.gitset');
+const TPL_DIR = path.join(DIR, 'templates');
+const KNOWN_TOOLS = ['commit', 'pr', 'issue', 'readme', 'release'];
+
+const DEFAULTS = {
+  'commit.md': `# Commit style\nUse Conventional Commits. Imperative subject <= 72 chars.\nBody explains the WHY for non-trivial changes.\n`,
+  'pr.md': `## Summary\n\n## Changes\n\n## Testing\n`,
+  'issue.md': `## Summary\n\n## Steps / Acceptance criteria\n\n## Scope\n`,
+  'readme.md': `# {{project}}\n\n> short description\n\n## Install\n\n## Usage\n`,
+  'release.md': `## Highlights\n\n## Features\n\n## Fixes\n`,
+};
+
+function listFiles() {
+  try { return fs.readdirSync(TPL_DIR).filter((f) => f.endsWith('.md')).sort(); }
+  catch { return []; }
+}
+
+function runTemplateCommand(argv) {
+  const sub = argv[0] || 'list';
+
+  if (sub === 'path') { console.log(TPL_DIR); return 0; }
+
+  if (sub === 'list') {
+    const files = listFiles();
+    if (files.length === 0) {
+      console.log(`No local templates. Run ${theme.accent('gitset init')} to scaffold them, or ${theme.accent('gitset template edit <tool>')} to create one now.`);
+      return 0;
+    }
+    console.log(theme.bold(`Local templates (${TPL_DIR}):`));
+    for (const f of files) console.log(`  ${f.replace(/\.md$/, '')}`);
+    console.log();
+    console.log(theme.dim('gitset template edit <name>   open one in your editor'));
+    return 0;
+  }
+
+  if (sub === 'show') {
+    const name = argv[1];
+    if (!name) { console.error(`${theme.error('✗')} Usage: gitset template show <name>`); return 1; }
+    const f = path.join(TPL_DIR, name.endsWith('.md') ? name : `${name}.md`);
+    if (!fs.existsSync(f)) { console.error(`${theme.error('✗')} No template "${name}". Try: gitset template list`); return 1; }
+    process.stdout.write(fs.readFileSync(f, 'utf8'));
+    return 0;
+  }
+
+  if (sub === 'edit') {
+    const name = argv[1];
+    if (!name) {
+      console.error(`${theme.error('✗')} Usage: gitset template edit <${KNOWN_TOOLS.join('|')}>`);
+      return 1;
+    }
+    const base = name.endsWith('.md') ? name : `${name}.md`;
+    const f = path.join(TPL_DIR, base);
+    if (!fs.existsSync(f)) {
+      fs.mkdirSync(TPL_DIR, { recursive: true, mode: 0o700 });
+      fs.writeFileSync(f, DEFAULTS[base] || `# ${name} template\n`);
+      console.log(theme.dim(`Created ${f} from the default.`));
+    }
+    const editor = process.env.VISUAL || process.env.EDITOR;
+    if (!editor) {
+      console.log(`No $EDITOR set. Open it yourself:\n  ${f}`);
+      return 0;
+    }
+    const result = spawnSync(editor, [f], { stdio: 'inherit' });
+    if (result.error) {
+      console.error(`${theme.error('✗')} Could not launch "${editor}". Edit the file directly:\n  ${f}`);
+      return 1;
+    }
+    console.log(`${theme.success('✓')} Saved ${base.replace(/\.md$/, '')} template.`);
+    return 0;
+  }
+
+  console.error(`${theme.error('✗')} Unknown subcommand "${sub}". Use: list | show <name> | edit <name> | path`);
+  return 1;
+}
+
+module.exports = { runTemplateCommand };

package/src/commands/tree.js

@@ -0,0 +1,77 @@
+'use strict';
+
+/**
+ * `gitset tree` — local repo structure visualizer. No backend, no AI.
+ * Flags: --all (include dotfiles) --depth <n> --exclude <pat> (repeatable)
+ *        --no-gitignore (don't honor .gitignore)
+ */
+const fs = require('fs');
+const path = require('path');
+
+const tty = () => process.stdout.isTTY;
+const c = (code, s) => (tty() ? `\x1b[${code}m${s}\x1b[0m` : s);
+
+function loadGitignore(root) {
+  const f = path.join(root, '.gitignore');
+  if (!fs.existsSync(f)) return [];
+  return fs.readFileSync(f, 'utf8').split('\n')
+    .map((l) => l.trim()).filter((l) => l && !l.startsWith('#'))
+    .map((l) => l.replace(/\/$/, ''));
+}
+
+function makeExcluder(patterns) {
+  const set = new Set(['.git', ...patterns]);
+  return (name) => {
+    if (set.has(name)) return true;
+    for (const p of patterns) {
+      if (p.startsWith('*.') && name.endsWith(p.slice(1))) return true;
+      if (p === name) return true;
+    }
+    return false;
+  };
+}
+
+function walk(dir, prefix, opts, depth, stats) {
+  if (opts.maxDepth >= 0 && depth > opts.maxDepth) return;
+  let entries;
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+  entries = entries
+    .filter((e) => opts.all || !e.name.startsWith('.') || e.name === '.github' || e.name === '.gitignore')
+    .filter((e) => !opts.exclude(e.name))
+    .sort((a, b) => (a.isDirectory() === b.isDirectory() ? a.name.localeCompare(b.name) : a.isDirectory() ? -1 : 1));
+
+  entries.forEach((e, i) => {
+    const last = i === entries.length - 1;
+    const branch = last ? '└── ' : '├── ';
+    if (e.isDirectory()) {
+      stats.dirs++;
+      console.log(prefix + branch + c('36', e.name + '/'));
+      walk(path.join(dir, e.name), prefix + (last ? '    ' : '│   '), opts, depth + 1, stats);
+    } else {
+      stats.files++;
+      console.log(prefix + branch + e.name);
+    }
+  });
+}
+
+function runTreeCommand(argv) {
+  const root = process.cwd();
+  const exclude = [];
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === '--exclude' && argv[i + 1]) { exclude.push(argv[i + 1]); i++; }
+  }
+  const depthIdx = argv.indexOf('--depth');
+  const maxDepth = depthIdx !== -1 && argv[depthIdx + 1] ? parseInt(argv[depthIdx + 1], 10) : -1;
+  const useGitignore = !argv.includes('--no-gitignore');
+  const patterns = [...exclude, ...(useGitignore ? loadGitignore(root) : [])];
+
+  const opts = { all: argv.includes('--all'), maxDepth, exclude: makeExcluder(patterns) };
+  const stats = { dirs: 0, files: 0 };
+
+  console.log(c('1', path.basename(root) + '/'));
+  walk(root, '', opts, 0, stats);
+  console.log(c('90', `\n${stats.dirs} directories, ${stats.files} files`));
+  return 0;
+}
+
+module.exports = { runTreeCommand };

package/src/utils/dependabot-analyzer.js

@@ -0,0 +1,101 @@
+class DependabotAnalyzer {
+    constructor() {
+        this.RISK_LEVELS = {
+            NONE: 'RISK_NONE',
+            LOW: 'RISK_LOW_BEHAVIORAL',
+            MODERATE: 'RISK_MODERATE_API',
+            HIGH: 'RISK_HIGH_BREAKING'
+        };
+    }
+
+    parseSemver(version) {
+        const cleanVersion = version.replace(/^v/, '');
+        const parts = cleanVersion.split('.').map(Number);
+
+        while (parts.length < 3) {
+            parts.push(0);
+        }
+
+        return {
+            major: parts[0],
+            minor: parts[1],
+            patch: parts[2],
+            original: version
+        };
+    }
+
+    getUpdateType(current, target) {
+        const v1 = this.parseSemver(current);
+        const v2 = this.parseSemver(target);
+
+        if (v1.major === v2.major && v1.minor === v2.minor && v1.patch === v2.patch) return 'EQUAL';
+        if (v2.major > v1.major) return 'MAJOR';
+        if (v2.minor > v1.minor) return 'MINOR';
+        if (v2.patch > v1.patch) return 'PATCH';
+        return 'UNKNOWN';
+    }
+
+    analyzeRisk(alert) {
+        const dependency = alert.dependency.package.name;
+        const ecosystem = alert.dependency.package.ecosystem;
+
+        const patchedVersion = alert.security_advisory.patched_versions
+            ? alert.security_advisory.patched_versions[0]
+            : null;
+
+        if (!patchedVersion) {
+            return {
+                level: this.RISK_LEVELS.HIGH,
+                reason: 'Could not determine patched version',
+                updateType: 'UNKNOWN'
+            };
+        }
+
+        return {
+            level: this.RISK_LEVELS.HIGH,
+            targetVersion: patchedVersion.identifier,
+            reason: 'Pending local file analysis'
+        };
+    }
+
+    calculateRisk(currentVersion, targetVersion, ecosystem) {
+        const updateType = this.getUpdateType(currentVersion, targetVersion);
+        let risk = this.RISK_LEVELS.HIGH;
+        let reason = '';
+
+        switch (updateType) {
+            case 'EQUAL':
+                risk = this.RISK_LEVELS.NONE;
+                reason = 'Already on patched version';
+                break;
+            case 'MAJOR':
+                risk = this.RISK_LEVELS.HIGH;
+                reason = 'Major version update - likely breaking changes';
+                break;
+            case 'MINOR':
+
+                if (ecosystem === 'npm' || ecosystem === 'pip') {
+                    risk = this.RISK_LEVELS.LOW;
+                } else {
+                    risk = this.RISK_LEVELS.MODERATE;
+                }
+                reason = 'Minor version update - check changelog for behavioral changes';
+                break;
+            case 'PATCH':
+                risk = this.RISK_LEVELS.NONE;
+                reason = 'Patch update - bug fixes only';
+                break;
+            default:
+                risk = this.RISK_LEVELS.HIGH;
+                reason = 'Unknown update type';
+        }
+
+        return {
+            level: risk,
+            reason,
+            updateType
+        };
+    }
+}
+
+module.exports = DependabotAnalyzer;

package/src/utils/labels.js

@@ -0,0 +1,102 @@
+'use strict';
+
+/**
+ * Local label-pack util. No backend, no gitset_key — the old remote
+ * /api/issue label CRUD has been removed. Source of truth is a local
+ * ~/.gitset/labels.md (a fenced ```yaml block) or a built-in default set.
+ * Live repo labels are read via the user's authenticated `gh` CLI.
+ */
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+const DIR = process.env.GITSET_CONFIG_DIR || path.join(os.homedir(), '.gitset');
+const LABELS_FILE = path.join(DIR, 'labels.md');
+
+const DEFAULT_LABELS = [
+  { name: 'bug', color: 'd73a4a', description: "Something isn't working" },
+  { name: 'enhancement', color: 'a2eeef', description: 'New feature or request' },
+  { name: 'documentation', color: '0075ca', description: 'Documentation changes' },
+  { name: 'question', color: 'd876e3', description: 'Further information requested' },
+  { name: 'good first issue', color: '7057ff', description: 'Good for newcomers' },
+  { name: 'help wanted', color: '008672', description: 'Extra attention is needed' },
+  { name: 'dependencies', color: '0366d6', description: 'Dependency updates' },
+  { name: 'security', color: 'b60205', description: 'Security-related' },
+  { name: 'refactor', color: 'fbca04', description: 'Code refactor, no behavior change' },
+  { name: 'wontfix', color: 'ffffff', description: 'This will not be worked on' },
+  { name: 'duplicate', color: 'cfd3d7', description: 'Already exists' },
+];
+
+function parseLabelsYaml(content) {
+  const labels = [];
+  let cur = null;
+  for (let line of String(content).split('\n')) {
+    line = line.trim();
+    if (!line || line.startsWith('#')) continue;
+    if (line.startsWith('- name:')) {
+      if (cur) labels.push(cur);
+      cur = { name: unquote(line.replace('- name:', '').trim()) };
+    } else if (cur && line.startsWith('color:')) {
+      cur.color = unquote(line.replace('color:', '').trim());
+    } else if (cur && line.startsWith('description:')) {
+      cur.description = unquote(line.replace('description:', '').trim());
+    }
+  }
+  if (cur) labels.push(cur);
+  return labels;
+}
+function unquote(s) {
+  return (s.startsWith('"') && s.endsWith('"')) || (s.startsWith("'") && s.endsWith("'")) ? s.slice(1, -1) : s;
+}
+
+function serializePack(labels) {
+  const body = labels.map((l) =>
+    `  - name: "${l.name}"\n    color: "${(l.color || '').replace('#', '')}"\n    description: "${l.description || ''}"`).join('\n');
+  return `# Gitset label pack — edit freely.\n\n\`\`\`yaml\n${body}\n\`\`\`\n`;
+}
+
+function getLabels() {
+  if (fs.existsSync(LABELS_FILE)) {
+    const content = fs.readFileSync(LABELS_FILE, 'utf8');
+    const m = content.match(/```ya?ml([\s\S]*?)```/);
+    const labels = m ? parseLabelsYaml(m[1]) : parseLabelsYaml(content);
+    if (labels.length) return { source: `local ${path.relative(os.homedir(), LABELS_FILE) || LABELS_FILE}`, labels };
+  }
+  return { source: 'built-in default pack', labels: DEFAULT_LABELS };
+}
+
+function writeDefaultPack() {
+  fs.mkdirSync(DIR, { recursive: true, mode: 0o700 });
+  fs.writeFileSync(LABELS_FILE, serializePack(DEFAULT_LABELS));
+  return LABELS_FILE;
+}
+
+function addLabel(label) {
+  if (!label || !label.name) return false;
+  const { labels } = fs.existsSync(LABELS_FILE) ? getLabels() : { labels: [...DEFAULT_LABELS] };
+  if (labels.some((l) => l.name === label.name)) {
+    const i = labels.findIndex((l) => l.name === label.name);
+    labels[i] = { ...labels[i], ...label };
+  } else {
+    labels.push({ name: label.name, color: (label.color || '').replace('#', ''), description: label.description || '' });
+  }
+  fs.mkdirSync(DIR, { recursive: true, mode: 0o700 });
+  fs.writeFileSync(LABELS_FILE, serializePack(labels));
+  return true;
+}
+
+function getRepoLabels() {
+  try {
+    const out = execFileSync('gh', ['label', 'list', '--limit', '200', '--json', 'name,color,description'],
+      { encoding: 'utf8', stdio: ['pipe', 'pipe', 'ignore'] });
+    return JSON.parse(out);
+  } catch {
+    return [];
+  }
+}
+
+module.exports = {
+  LABELS_FILE, DEFAULT_LABELS,
+  getLabels, addLabel, writeDefaultPack, getRepoLabels, parseLabelsYaml,
+};

package/src/utils/theme.js

@@ -0,0 +1,70 @@
+'use strict';
+
+/**
+ * Shared terminal color system — same teal accent as the Gitset web app
+ * (see gitset-web/DESIGN.md), split into a dark-terminal tone and a
+ * light-terminal tone because a bright cyan is unreadable on a white
+ * background. Respects NO_COLOR (https://no-color.org) and non-TTY output.
+ */
+const config = require('../../lib/config');
+
+const tty = () => Boolean(process.stdout.isTTY) && !process.env.NO_COLOR;
+
+// Same hue family (~178°) as the web's --brand token, at two lightness
+// levels per mode so there's still hierarchy (primary vs. quieter accent)
+// even in a small terminal palette.
+const PALETTE = {
+  dark: {
+    accent: [108, 224, 219], // #6CE0DB
+    accentDim: [79, 173, 168],
+  },
+  light: {
+    accent: [25, 118, 114], // #197672
+    accentDim: [15, 83, 80],
+  },
+};
+
+function detectDefaultMode() {
+  // Many terminals set COLORFGBG as "fg;bg" (0-15 ANSI index). A light
+  // background index means a light theme; anything else, assume dark —
+  // by far the more common terminal default.
+  const fgbg = process.env.COLORFGBG;
+  if (fgbg) {
+    const bg = parseInt(fgbg.split(';').pop(), 10);
+    if (!Number.isNaN(bg) && bg >= 7) return 'light';
+  }
+  return 'dark';
+}
+
+function mode() {
+  const stored = config.getTheme();
+  return stored === 'light' ? 'light' : stored === 'dark' ? 'dark' : detectDefaultMode();
+}
+
+function rgb(triplet, s) {
+  if (!tty()) return s;
+  const [r, g, b] = triplet;
+  return `\x1b[38;2;${r};${g};${b}m${s}\x1b[0m`;
+}
+function code(n, s) {
+  return tty() ? `\x1b[${n}m${s}\x1b[0m` : s;
+}
+
+const accent = (s) => rgb(PALETTE[mode()].accent, s);
+const accentDim = (s) => rgb(PALETTE[mode()].accentDim, s);
+const bold = (s) => code('1', s);
+const dim = (s) => code('2', s);
+const error = (s) => code('31', s);
+const warn = (s) => code('33', s);
+// No separate "success" hue, mirroring the web decision: the brand accent
+// IS the affirmative color everywhere, not a second green.
+const success = (s) => accent(s);
+
+// Highlights the bracketed letter of a menu hint in accent+bold and leaves
+// the rest of the word plain, e.g. key('a', 'ccept') -> "[a]ccept" with
+// only "[a]" colored — makes the actionable keystroke pop at a glance.
+function key(letter, rest) {
+  return `${accent(bold(`[${letter}]`))}${rest}`;
+}
+
+module.exports = { mode, accent, accentDim, bold, dim, error, warn, success, key, tty };

package/src/utils/ui.js

@@ -0,0 +1,173 @@
+const readline = require('readline');
+const theme = require('./theme');
+
+const tty = () => process.stdout.isTTY;
+
+// Legacy color names kept so existing call sites don't need to change, now
+// routed through the shared teal theme (see theme.js) instead of a fixed
+// palette that only worked on dark backgrounds. 'green' and 'cyan' both
+// resolve to the same brand hue (matching the web decision: no separate
+// "success" color) at two lightness tiers, which also keeps the severity
+// ladder in dependabot-resolver.js (red > yellow > cyan > green) visually
+// distinct without a fifth hue. Each value is a paint FUNCTION (not a raw
+// ANSI prefix string) since the color depends on the live theme setting.
+const colors = {
+    reset: (s) => s,
+    green: theme.accent,
+    yellow: theme.warn,
+    red: theme.error,
+    cyan: theme.accentDim,
+    blue: theme.dim,
+    pink: theme.warn,
+    dim: theme.dim,
+};
+
+function log(msg, color = 'reset') {
+    const paint = colors[color] || ((s) => s);
+    console.log(paint(msg));
+}
+
+function askQuestion(query) {
+    if (!process.stdin.isTTY) {
+        return Promise.reject(new Error(
+            'This step needs an interactive terminal. Re-run in a terminal, or pass explicit flags to skip prompts.',
+        ));
+    }
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+
+    return new Promise((resolve, reject) => {
+        let answered = false;
+        rl.question(query, (ans) => {
+            answered = true;
+            rl.close();
+            resolve(ans.trim());
+        });
+        rl.on('close', () => {
+            if (!answered) reject(new Error('Input closed before answering.'));
+        });
+    });
+}
+
+// Masks input as it's typed (for API keys) instead of echoing it in plain
+// text. Falls back to visible input if the terminal doesn't support raw
+// mode (e.g. some CI wrappers) rather than failing outright.
+function askSecret(query) {
+    if (!process.stdin.isTTY || typeof process.stdin.setRawMode !== 'function') {
+        return askQuestion(query);
+    }
+    return new Promise((resolve, reject) => {
+        process.stdout.write(query);
+        const stdin = process.stdin;
+        const wasRaw = stdin.isRaw;
+        stdin.setRawMode(true);
+        stdin.resume();
+        stdin.setEncoding('utf8');
+
+        let value = '';
+        function cleanup() {
+            stdin.removeListener('data', onData);
+            stdin.setRawMode(wasRaw || false);
+            stdin.pause();
+        }
+        function onData(chunk) {
+            const ch = String(chunk);
+            if (ch === '\r' || ch === '\n') {
+                cleanup();
+                process.stdout.write('\n');
+                resolve(value.trim());
+                return;
+            }
+            if (ch === '\u0003') { // Ctrl+C
+                cleanup();
+                process.stdout.write('\n');
+                reject(new Error('Cancelled.'));
+                return;
+            }
+            if (ch === '\u007f' || ch === '\b') { // backspace (DEL on most terminals, BS on some)
+                if (value.length) {
+                    value = value.slice(0, -1);
+                    process.stdout.write('\b \b');
+                }
+                return;
+            }
+            if (ch.charCodeAt(0) < 32) return; // ignore other control/escape bytes
+            value += ch;
+            process.stdout.write('*');
+        }
+        stdin.on('data', onData);
+    });
+}
+
+async function selectOption(title, options) {
+    log(`\n${title}`, 'reset');
+    options.forEach((opt, i) => {
+        log(`${i + 1}. ${opt.label}`, 'cyan');
+    });
+
+    while (true) {
+        const answer = await askQuestion('\nSelect an option (number): ');
+        const index = parseInt(answer) - 1;
+        if (index >= 0 && index < options.length) {
+            return options[index].value;
+        }
+        log('Invalid selection', 'red');
+    }
+}
+
+async function selectMultipleOptions(title, options) {
+    log(`\n${title}`, 'reset');
+    options.forEach((opt, i) => {
+        log(`${i + 1}. ${opt.label}`, 'cyan');
+    });
+    log('0. Done / Confirm Selection', 'green');
+    log('C. Cancel', 'red');
+
+    const selectedValues = new Set();
+
+    while (true) {
+        const currentSelection = options
+            .filter(opt => selectedValues.has(opt.value))
+            .map(opt => opt.label)
+            .join(', ');
+
+        if (currentSelection) {
+            log(`\nCurrent selection: ${currentSelection}`, 'yellow');
+        }
+
+        const answer = await askQuestion('\nSelect options (enter number to toggle, 0 to confirm, C to cancel): ');
+        const index = parseInt(answer) - 1;
+
+        if (answer === '0') {
+            return Array.from(selectedValues);
+        }
+
+        if (answer.toLowerCase() === 'c') {
+            return null;
+        }
+
+        if (index >= 0 && index < options.length) {
+            const value = options[index].value;
+            if (selectedValues.has(value)) {
+                selectedValues.delete(value);
+                log(`Removed: ${options[index].label}`, 'red');
+            } else {
+                selectedValues.add(value);
+                log(`Added: ${options[index].label}`, 'green');
+            }
+        } else {
+            log('Invalid selection', 'red');
+        }
+    }
+}
+
+module.exports = {
+    log,
+    askQuestion,
+    askSecret,
+    selectOption,
+    selectMultipleOptions,
+    colors
+};

package/.github/workflows/npm_publish.yml

@@ -1,38 +0,0 @@
-name: Publish to GitHub Packages
-
-on:
-  workflow_dispatch:
-  push:
-    tags:
-      - 'v*'
-
-jobs:
-  publish-gpr:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - uses: actions/checkout@v4
-      
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '18'
-          registry-url: 'https://npm.pkg.github.com'
-          scope: '@gitset-dev'
-      
-      - name: Update package name for GitHub Packages
-        run: |
-          cp package.json package.json.backup
-          npm pkg set name=@gitset-dev/gitset-cli
-      
-      - name: Publish to GitHub Packages
-        run: |
-          echo "registry=https://npm.pkg.github.com" > .npmrc
-          echo "//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}" >> .npmrc
-          npm publish --registry=https://npm.pkg.github.com
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.PAT_GITHUB }}
-          
-      - name: Restore original package.json
-        run: mv package.json.backup package.json