@gitset-dev/cli 2.2.0 → 2.3.3

package/index.js

@@ -38,6 +38,7 @@ ${theme.bold('Local tools')} (no AI):
   template          Manage local templates (~/.gitset/templates), edit <tool> to customize
   init              Scaffold local templates
   feedback          Report a bug, suggest a feature, or share feedback
+  auth              Check GitHub access, or sync org permissions (auth sync)
 
 ${theme.bold('Setup')}:
   config                                interactive setup wizard
@@ -115,7 +116,9 @@ Manage & apply a label pack (local pack + gh).
   --apply          create/update the labels in the current repo via gh
   --init           write the default pack to ~/.gitset/labels.md
   --add --name <x> --color <hex> --description "..."   add a label
-  --sync           pull the repo's labels into the local pack`,
+  --from-repo      import the current repo's labels (name, color,
+                   description) into the pack; --yes to overwrite
+                   without asking (--sync is an alias)`,
   dependabot: `Usage: gitset dependabot [--resolve] [--dry-run] [--save-dev]
 Resolve Dependabot alerts for the current repo (local + gh).`,
   status: `Usage: gitset status
@@ -131,6 +134,12 @@ Scaffold the local template directory.`,
   feedback: `Usage: gitset feedback
 Interactively submit a bug report, feature suggestion, or general feedback.
 Filed as a GitHub issue in gitset-dev/gitset via your own \`gh\` auth.`,
+  auth: `Usage: gitset auth [status|sync]
+  status (default)  show your GitHub CLI auth status and access guidance
+  sync              re-run GitHub authorization to approve additional
+                    organizations or scopes (wraps \`gh auth refresh\`)
+Gitset uses your own gh authentication locally — there is no Gitset account.
+Web app permissions: gitset.dev/dashboard → GitHub connection.`,
   config: `Usage: gitset config [set|list|remove|theme|path]
   (no args)        interactive setup wizard
   set              interactive wizard, or: set <provider> --key <key> [--model m] [--base-url u] [--default]
@@ -209,7 +218,10 @@ async function main() {
     case 'feedback':
       code = (await require('./src/commands/feedback')()) || 0; break;
 
-    case 'auth': case 'verify': case 'logout':
+    case 'auth':
+      code = require('./src/commands/auth')(rest) || 0; break;
+
+    case 'verify': case 'logout':
       code = deprecatedAuth(command); break;
 
     case 'help': case '--help': case '-h': case undefined:

package/lib/manifest/index.js

@@ -0,0 +1,127 @@
+// VENDORED from gitset-core-v2/lib/manifest — do not edit here. Run `pnpm sync:ai`.
+'use strict';
+
+const MANIFESTS = [
+  { type: 'npm', file: 'package.json', label: 'package.json (npm)' },
+  { type: 'cargo', file: 'Cargo.toml', label: 'Cargo.toml (Cargo)' },
+  { type: 'python', file: 'pyproject.toml', label: 'pyproject.toml (Python)' },
+  { type: 'gemspec', file: null, label: '*.gemspec (RubyGems)' },
+];
+
+function listSupported() {
+  return MANIFESTS.map(({ type, label }) => ({ type, label }));
+}
+
+function detectManifestFile(fileNames) {
+  const names = Array.isArray(fileNames) ? fileNames : [];
+  for (const m of MANIFESTS) {
+    if (m.file && names.includes(m.file)) return { type: m.type, file: m.file };
+  }
+  const gem = names.find((f) => f.endsWith('.gemspec'));
+  if (gem) return { type: 'gemspec', file: gem };
+  return null;
+}
+
+function normalizeVersion(tagName) {
+  if (typeof tagName !== 'string') return null;
+  const trimmed = tagName.trim();
+  return trimmed.replace(/^v/i, '') || null;
+}
+
+function detectIndent(text) {
+  const m = text.match(/^[ \t]+(?=")/m);
+  return m ? m[0] : '  ';
+}
+
+function findTomlSection(content, sectionName) {
+  const escaped = sectionName.replace(/\./g, '\\.');
+  const headerRe = new RegExp(`^\\[${escaped}\\][ \\t]*$`, 'm');
+  const m = headerRe.exec(content);
+  if (!m) return null;
+  const bodyStart = m.index + m[0].length;
+  const rest = content.slice(bodyStart);
+  const next = rest.match(/^\[[^\]]+\][ \t]*$/m);
+  const bodyEnd = next ? bodyStart + next.index : content.length;
+  return { bodyStart, bodyEnd };
+}
+
+const TOML_VERSION_LINE_RE = /^([ \t]*version[ \t]*=[ \t]*)(["'])([^"']+)\2([ \t]*)$/m;
+
+function readTomlSectionVersion(content, sectionName) {
+  const sec = findTomlSection(content, sectionName);
+  if (!sec) return null;
+  const body = content.slice(sec.bodyStart, sec.bodyEnd);
+  const m = TOML_VERSION_LINE_RE.exec(body);
+  return m ? m[3] : null;
+}
+
+function bumpTomlSectionVersion(content, sectionName, newVersion) {
+  const sec = findTomlSection(content, sectionName);
+  if (!sec) return null;
+  const body = content.slice(sec.bodyStart, sec.bodyEnd);
+  if (!TOML_VERSION_LINE_RE.test(body)) return null;
+  const newBody = body.replace(TOML_VERSION_LINE_RE, (_full, pre, quote, _old, trail) => `${pre}${quote}${newVersion}${quote}${trail}`);
+  return content.slice(0, sec.bodyStart) + newBody + content.slice(sec.bodyEnd);
+}
+
+const GEMSPEC_VERSION_LINE_RE = /^([ \t]*[\w.]+\.version[ \t]*=[ \t]*)(["'])([^"']+)\2([ \t]*)$/m;
+
+function readGemspecVersion(content) {
+  const m = GEMSPEC_VERSION_LINE_RE.exec(content);
+  return m ? m[3] : null;
+}
+
+function bumpGemspecVersion(content, newVersion) {
+  if (!GEMSPEC_VERSION_LINE_RE.test(content)) return null;
+  return content.replace(GEMSPEC_VERSION_LINE_RE, (_full, pre, quote, _old, trail) => `${pre}${quote}${newVersion}${quote}${trail}`);
+}
+
+function readVersion(type, content) {
+  switch (type) {
+    case 'npm': {
+      const parsed = JSON.parse(content);
+      return typeof parsed.version === 'string' ? parsed.version : null;
+    }
+    case 'cargo':
+      return readTomlSectionVersion(content, 'package');
+    case 'python':
+      return readTomlSectionVersion(content, 'project') || readTomlSectionVersion(content, 'tool.poetry');
+    case 'gemspec':
+      return readGemspecVersion(content);
+    default:
+      throw new Error(`Unsupported manifest type: ${type}`);
+  }
+}
+
+function bumpNpmVersion(content, newVersion) {
+  const parsed = JSON.parse(content);
+  if (typeof parsed.version !== 'string') return null;
+  parsed.version = newVersion;
+  const indent = detectIndent(content);
+  let out = JSON.stringify(parsed, null, indent);
+  if (content.endsWith('\n')) out += '\n';
+  return out;
+}
+
+function bumpVersion(type, content, newVersion) {
+  switch (type) {
+    case 'npm':
+      return bumpNpmVersion(content, newVersion);
+    case 'cargo':
+      return bumpTomlSectionVersion(content, 'package', newVersion);
+    case 'python':
+      return bumpTomlSectionVersion(content, 'project', newVersion) || bumpTomlSectionVersion(content, 'tool.poetry', newVersion);
+    case 'gemspec':
+      return bumpGemspecVersion(content, newVersion);
+    default:
+      throw new Error(`Unsupported manifest type: ${type}`);
+  }
+}
+
+module.exports = {
+  listSupported,
+  detectManifestFile,
+  normalizeVersion,
+  readVersion,
+  bumpVersion,
+};

package/lib/prompts/defaults.js

@@ -98,7 +98,13 @@ const release = {
         'headings, ordering, and tone closely — treat it as the format to reproduce. ' +
         'Never invent a repository path (e.g. placeholders like "your-project/your-repo" ' +
         'or "user/repo") for a "Full Changelog" or compare link — only include such a link ' +
-        'when the real repository is given below, using that exact path; otherwise omit it.',
+        'when the real repository is given below, using that exact path; otherwise omit it. ' +
+        'Never attribute a change to a person (e.g. "by @username") — a commit author\'s ' +
+        'display name (e.g. "Jane Smith") is NOT their GitHub username and must never be ' +
+        'guessed into one (e.g. never invent "@jane-smith"). If a commit message already ' +
+        'ends in a real PR reference like "(#123)", you may link directly to that PR using ' +
+        'the given repository path (e.g. https://github.com/<repo>/pull/123), but state only ' +
+        'what changed — no author mention.',
       user: [
         repo && `Repository: ${clip(repo, 200)}`,
         tag && `Release: ${clip(tag, 100)}`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gitset-dev/cli",
-  "version": "2.2.0",
+  "version": "2.3.3",
   "description": "Gitset CLI — drafts commits, PRs, issues, READMEs and release notes with your own AI key. Fully local: your code and keys never touch a Gitset server. Draft. Refine. Ship.",
   "type": "commonjs",
   "bin": {

package/src/commands/auth.js

@@ -0,0 +1,54 @@
+const { execFileSync } = require('child_process');
+const { log } = require('../utils/ui');
+const theme = require('../utils/theme');
+
+function ghAvailable() {
+    try { execFileSync('gh', ['--version'], { stdio: 'ignore' }); return true; }
+    catch { return false; }
+}
+
+function showStatus() {
+    console.log(`\n=== Gitset Auth (via GitHub CLI) ===\n`);
+    try {
+        execFileSync('gh', ['auth', 'status'], { stdio: 'inherit' });
+    } catch {
+        log('\nYou are not logged in with the GitHub CLI. Run: gh auth login', 'yellow');
+    }
+    console.log(`
+${theme.bold('How Gitset access works')}
+  Locally, Gitset uses your own ${theme.accent('gh')} authentication for every GitHub
+  action (issues, PRs, releases, labels). No Gitset account is involved.
+
+  ${theme.bold('Missing an organization or repository?')}
+  - Local CLI:   run ${theme.accent('gitset auth sync')} to re-run GitHub's authorization
+                 and approve additional organizations or scopes.
+  - Web app:     open ${theme.accent('https://gitset.dev/dashboard')} → GitHub connection →
+                 Manage organization access.
+`);
+    return 0;
+}
+
+function sync() {
+    console.log(`\n=== Gitset Auth Sync ===\n`);
+    log('Re-running GitHub authorization. Approve any missing organizations when your browser opens.', 'dim');
+    try {
+        execFileSync('gh', ['auth', 'refresh'], { stdio: 'inherit' });
+        log('\n✔ GitHub access refreshed. Newly granted organizations are now available.', 'green');
+        return 0;
+    } catch {
+        log('\nAuthorization was not completed. You can retry with `gitset auth sync` or run `gh auth refresh` directly.', 'red');
+        return 1;
+    }
+}
+
+module.exports = function commandAuth(rest = []) {
+    if (!ghAvailable()) {
+        log('The `gh` CLI is required (https://cli.github.com). Gitset uses your own gh authentication — no Gitset account exists.', 'red');
+        return 1;
+    }
+    const sub = (rest[0] || 'status').toLowerCase();
+    if (sub === 'sync' || sub === 'refresh') return sync();
+    if (sub === 'status') return showStatus();
+    log(`Unknown subcommand "${sub}". Use: gitset auth [status|sync]`, 'red');
+    return 1;
+};

package/src/commands/labelspack.js

@@ -4,14 +4,15 @@
  * `gitset labelspack` — manage & apply a label pack. Local pack +
  * the user's `gh` CLI only. No backend, injection-safe (arg-array exec).
  *
- *   gitset labelspack            list the pack
- *   gitset labelspack --apply    create/update those labels in the repo via gh
- *   gitset labelspack --init     write the default pack to ~/.gitset/labels.md
+ *   gitset labelspack             list the pack
+ *   gitset labelspack --apply     create/update those labels in the repo via gh
+ *   gitset labelspack --init      write the default pack to ~/.gitset/labels.md
+ *   gitset labelspack --from-repo import the current repo's labels into the pack
  *   gitset labelspack --add --name x --color hex --description "..."
  */
 const { execFileSync } = require('child_process');
 const readline = require('readline');
-const { getLabels, addLabel, writeDefaultPack, getRepoLabels } = require('../utils/labels');
+const { getLabels, addLabel, writeDefaultPack, writePack, getRepoLabels } = require('../utils/labels');
 
 const tty = () => process.stdout.isTTY;
 const c = (code, s) => (tty() ? `\x1b[${code}m${s}\x1b[0m` : s);
@@ -35,6 +36,36 @@ async function runLabelspackCommand(argv) {
     return 0;
   }
 
+  if (argv.includes('--from-repo') || argv.includes('--sync')) {
+    if (!ghAvailable()) {
+      console.error(`${c('31', '✗')} GitHub CLI \`gh\` not found / not authenticated.`);
+      return 1;
+    }
+    const repoLabels = getRepoLabels();
+    if (repoLabels.length === 0) {
+      console.error(`${c('31', '✗')} No labels found — run this inside a repository your \`gh\` account can access.`);
+      return 1;
+    }
+    const { source, labels: current } = getLabels();
+    if (source.startsWith('local') && !argv.includes('--yes') && !argv.includes('-y')) {
+      if (!process.stdin.isTTY) {
+        console.error(`${c('31', '✗')} A label pack already exists (${current.length} labels). Pass --yes to overwrite.`);
+        return 1;
+      }
+      const ok = (await ask(`Overwrite your existing pack (${current.length} labels) with ${repoLabels.length} labels from this repo? [y/N] `)).toLowerCase();
+      if (ok !== 'y') { console.log('Aborted.'); return 0; }
+    }
+    const imported = repoLabels.map((l) => ({
+      name: l.name,
+      color: String(l.color || '').replace('#', ''),
+      description: l.description || '',
+    }));
+    const f = writePack(imported);
+    console.log(`${c('32', '✓')} Imported ${imported.length} labels from this repository → ${f}`);
+    console.log(c('90', 'Apply them to any other repo:  cd <repo> && gitset labelspack --apply'));
+    return 0;
+  }
+
   if (argv.includes('--add')) {
     let name = flag(argv, '--name');
     let color = flag(argv, '--color');
@@ -53,7 +84,7 @@ async function runLabelspackCommand(argv) {
 
   const { source, labels } = getLabels();
 
-  if (!argv.includes('--apply') && !argv.includes('--sync')) {
+  if (!argv.includes('--apply')) {
     console.log(c('1', `\nLabel pack (${source}) — ${labels.length} labels\n`));
     for (const l of labels) {
       console.log(`  ${c('36', l.name)}${l.description ? `  ${c('90', l.description)}` : ''}`);

package/src/commands/release.js

@@ -4,6 +4,7 @@ const path = require('path');
 const os = require('os');
 const { log, askQuestion, selectOption } = require('../utils/ui');
 const genLocal = require('../../lib/generate-local');
+const manifestLib = require('../../lib/manifest');
 
 function execCommand(cmd) {
     try {
@@ -32,11 +33,102 @@ function getCurrentBranch() {
     return execCommand('git rev-parse --abbrev-ref HEAD') || 'HEAD';
 }
 
+function getRepoOwnerName() {
+    const remoteUrl = execCommand('git config --get remote.origin.url');
+    if (!remoteUrl) return '';
+    const match = remoteUrl.match(/[:/]([^/]+)\/([^/.]+)(?:\.git)?$/);
+    return match ? `${match[1]}/${match[2]}` : '';
+}
+
 function commitsToText(commits) {
     if (!commits || commits.length === 0) return '';
     return commits.map(c => `- ${c.hash || ''} ${c.message || ''} (${c.author || ''})`).join('\n');
 }
 
+async function syncManifestVersion(tagName) {
+    const newVersion = manifestLib.normalizeVersion(tagName);
+    if (!newVersion) return;
+
+    let fileNames;
+    try {
+        fileNames = fs.readdirSync(process.cwd());
+    } catch {
+        return;
+    }
+
+    const found = manifestLib.detectManifestFile(fileNames);
+    if (!found) return;
+
+    const filePath = path.join(process.cwd(), found.file);
+    let content;
+    try {
+        content = fs.readFileSync(filePath, 'utf8');
+    } catch {
+        return;
+    }
+
+    let oldVersion;
+    try {
+        oldVersion = manifestLib.readVersion(found.type, content);
+    } catch (err) {
+        log(`\nCould not parse ${found.file}, skipping version sync (${err.message}).`, 'yellow');
+        return;
+    }
+
+    if (!oldVersion) {
+        log(`\n${found.file} has no static top-level version field, skipping version sync.`, 'dim');
+        return;
+    }
+
+    if (oldVersion === newVersion) return;
+
+    let newContent;
+    try {
+        newContent = manifestLib.bumpVersion(found.type, content, newVersion);
+    } catch (err) {
+        log(`\nCould not bump ${found.file}, skipping version sync (${err.message}).`, 'yellow');
+        return;
+    }
+    if (!newContent) return;
+
+    log(`\n${found.file} version differs from this release:`, 'cyan');
+    log(`  - version: ${oldVersion}`, 'red');
+    log(`  + version: ${newVersion}`, 'green');
+    log('  Only the top-level version field changes — dependency versions are left untouched.', 'dim');
+
+    const bumpChoice = await selectOption(`Update ${found.file} to ${newVersion} as part of this release?`, [
+        { label: `Yes, update ${found.file}`, value: 'yes' },
+        { label: 'No, skip', value: 'no' },
+    ]);
+    if (bumpChoice !== 'yes') return;
+
+    try {
+        fs.writeFileSync(filePath, newContent);
+        execFileSync('git', ['add', found.file], { stdio: 'pipe' });
+        execFileSync('git', ['commit', '-m', `chore: bump version to ${newVersion}`], { stdio: 'pipe' });
+        log(`Committed: chore: bump version to ${newVersion}`, 'green');
+    } catch (err) {
+        log(`Failed to commit the version bump: ${err.message}`, 'red');
+        return;
+    }
+
+    log('\nThis commit needs to be pushed before creating the release, otherwise the release tag will not include it.', 'dim');
+    const pushChoice = await selectOption('Push this commit now?', [
+        { label: 'Yes, push', value: 'yes' },
+        { label: 'No, I\'ll push it myself', value: 'no' },
+    ]);
+    if (pushChoice === 'yes') {
+        try {
+            execFileSync('git', ['push'], { stdio: 'inherit' });
+            log('Pushed.', 'green');
+        } catch {
+            log('Failed to push. Push manually before the release tag will reflect this version.', 'red');
+        }
+    } else {
+        log('Not pushed — the release tag will not include this version bump until you push it.', 'yellow');
+    }
+}
+
 module.exports = async function commandRelease(options = {}) {
     console.log('\n=== Gitset Release Manager (BYOAI) ===\n');
 
@@ -100,6 +192,7 @@ module.exports = async function commandRelease(options = {}) {
     }
 
     let currentNotes = '';
+    const repo = getRepoOwnerName();
 
     const generate = async (instr = '') => {
         log('\nGenerating release notes…', 'cyan');
@@ -108,6 +201,7 @@ module.exports = async function commandRelease(options = {}) {
                 tool: 'release',
                 ctx: {
                     tag: tagName,
+                    repo,
                     commits: commitsToText(commits),
                     mode: commits.length === 0 ? 'manual' : 'summary',
                     instruction: instr,
@@ -163,7 +257,10 @@ module.exports = async function commandRelease(options = {}) {
             const notesFile = 'RELEASE_NOTES.md';
             fs.writeFileSync(notesFile, currentNotes);
             log(`Saved notes to ${notesFile}`, 'dim');
-            log('Creating release via gh CLI…', 'cyan');
+
+            await syncManifestVersion(tagName);
+
+            log('\nCreating release via gh CLI…', 'cyan');
             try {
                 execFileSync('gh', ['release', 'create', tagName, '--title', tagName, '--notes-file', notesFile], { stdio: 'inherit' });
                 log('\nRelease created successfully!', 'green');

package/src/utils/labels.js

@@ -96,7 +96,13 @@ function getRepoLabels() {
   }
 }
 
+function writePack(labels) {
+  fs.mkdirSync(DIR, { recursive: true, mode: 0o700 });
+  fs.writeFileSync(LABELS_FILE, serializePack(labels));
+  return LABELS_FILE;
+}
+
 module.exports = {
   LABELS_FILE, DEFAULT_LABELS,
-  getLabels, addLabel, writeDefaultPack, getRepoLabels, parseLabelsYaml,
+  getLabels, addLabel, writeDefaultPack, writePack, getRepoLabels, parseLabelsYaml,
 };

package/src/utils/ui.js

@@ -73,29 +73,31 @@ function askSecret(query) {
             stdin.pause();
         }
         function onData(chunk) {
-            const ch = String(chunk);
-            if (ch === '\r' || ch === '\n') {
-                cleanup();
-                process.stdout.write('\n');
-                resolve(value.trim());
-                return;
-            }
-            if (ch === '\u0003') { // Ctrl+C
-                cleanup();
-                process.stdout.write('\n');
-                reject(new Error('Cancelled.'));
-                return;
-            }
-            if (ch === '\u007f' || ch === '\b') { // backspace (DEL on most terminals, BS on some)
-                if (value.length) {
-                    value = value.slice(0, -1);
-                    process.stdout.write('\b \b');
+            const cleaned = String(chunk).replace(/\x1b\[[0-9;]*[a-zA-Z~]/g, '');
+            for (const c of cleaned) {
+                if (c === '\r' || c === '\n') {
+                    cleanup();
+                    process.stdout.write('\n');
+                    resolve(value.trim());
+                    return;
+                }
+                if (c === '\u0003') { // Ctrl+C
+                    cleanup();
+                    process.stdout.write('\n');
+                    reject(new Error('Cancelled.'));
+                    return;
+                }
+                if (c === '\u007f' || c === '\b') { // backspace (DEL on most terminals, BS on some)
+                    if (value.length) {
+                        value = value.slice(0, -1);
+                        process.stdout.write('\b \b');
+                    }
+                    continue;
                 }
-                return;
+                if (c.charCodeAt(0) < 32) continue; // ignore other control bytes
+                value += c;
+                process.stdout.write('*');
             }
-            if (ch.charCodeAt(0) < 32) return; // ignore other control/escape bytes
-            value += ch;
-            process.stdout.write('*');
         }
         stdin.on('data', onData);
     });