@h-rig/cli 0.0.6-alpha.9 → 0.0.6-alpha.91

package/dist/src/commands/github.js

@@ -1,15 +1,24 @@
 // @bun
 // packages/cli/src/commands/github.ts
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync } from "child_process";
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, resolve as resolve3 } from "path";
 
 // packages/cli/src/runner.ts
 import { EventBus } from "@rig/runtime/control-plane/runtime/events";
-import { CliError } from "@rig/runtime/control-plane/errors";
+import { CliError as RuntimeCliError } from "@rig/runtime/control-plane/errors";
 import { evaluate, loadPolicy, resolveAction } from "@rig/runtime/control-plane/runtime/guard";
-import { PluginManager } from "@rig/runtime/control-plane/runtime/plugins";
-import { loadRuntimeContextFromEnv } from "@rig/runtime/control-plane/runtime/context";
 import { buildBinary } from "@rig/runtime/control-plane/runtime/isolation";
-import { CliError as CliError2 } from "@rig/runtime/control-plane/errors";
+
+class CliError extends RuntimeCliError {
+  hint;
+  constructor(message, exitCode = 1, options = {}) {
+    super(message, exitCode);
+    if (options.hint?.trim()) {
+      this.hint = options.hint.trim();
+    }
+  }
+}
 function takeOption(args, option) {
   const rest = [];
   let value;
@@ -18,7 +27,7 @@ function takeOption(args, option) {
     if (current === option) {
       const next = args[index + 1];
       if (!next || next.startsWith("-")) {
-        throw new CliError(`Missing value for ${option}`);
+        throw new CliError(`Missing value for ${option}`, 1, { hint: `Provide a value after ${option}, e.g. \`${option} <value>\`.` });
       }
       value = next;
       index += 1;
@@ -31,27 +40,53 @@ function takeOption(args, option) {
   return { value, rest };
 }
 
-// packages/cli/src/commands/_server-client.ts
-import { spawnSync } from "child_process";
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { resolve as resolve2 } from "path";
-import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
+// packages/cli/src/commands/_inprocess-services.ts
+import { resolve } from "path";
+import {
+  beginGitHubDeviceFlow,
+  checkGitHubRepoPermissions,
+  createGitHubAuthStore,
+  listGitHubProjects,
+  pollGitHubDeviceFlow,
+  resolveGitHubAuthStatus,
+  resolveProjectStatusField,
+  saveGitHubTokenForProject
+} from "@rig/runtime/control-plane/github/index";
+var scopedGitHubBearerTokens = new Map;
+function cleanToken(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : null;
+}
+function oauthClientId() {
+  return cleanToken(process.env.RIG_GITHUB_OAUTH_CLIENT_ID);
+}
+function setGitHubBearerTokenForCurrentProcess(token, projectRoot) {
+  scopedGitHubBearerTokens.set(resolve(projectRoot ?? process.cwd()), cleanToken(token));
+}
+async function getGitHubAuthStatusInProcess(context) {
+  return { ok: true, ...resolveGitHubAuthStatus({ projectRoot: context.projectRoot, oauthConfigured: Boolean(oauthClientId()) }) };
+}
+async function postGitHubTokenInProcess(context, token, options = {}) {
+  const targetRoot = options.projectRoot?.trim() || context.projectRoot;
+  const result = await saveGitHubTokenForProject({
+    projectRoot: targetRoot,
+    token,
+    tokenSource: "manual-token",
+    selectedRepo: options.selectedRepo ?? null
+  });
+  const store = createGitHubAuthStore(targetRoot);
+  const session = store.createApiSession();
+  if (targetRoot !== context.projectRoot) {
+    store.copyToLocalProjectRoot(context.projectRoot);
+  }
+  return { ...result, authenticated: result.signedIn, apiSessionToken: session.token };
+}
 
 // packages/cli/src/commands/_connection-state.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { dirname, resolve } from "path";
-function resolveGlobalConnectionsPath(env = process.env) {
-  const explicit = env.RIG_CONNECTIONS_FILE?.trim();
-  if (explicit)
-    return resolve(explicit);
-  const stateDir = env.RIG_GLOBAL_STATE_DIR?.trim();
-  if (stateDir)
-    return resolve(stateDir, "connections.json");
-  return resolve(homedir(), ".rig", "connections.json");
-}
+import { dirname, resolve as resolve2 } from "path";
 function resolveRepoConnectionPath(projectRoot) {
-  return resolve(projectRoot, ".rig", "state", "connection.json");
+  return resolve2(projectRoot, ".rig", "state", "connection.json");
 }
 function readJsonFile(path) {
   if (!existsSync(path))
@@ -59,37 +94,8 @@ function readJsonFile(path) {
   try {
     return JSON.parse(readFileSync(path, "utf8"));
   } catch (error) {
-    throw new CliError2(`Invalid Rig connection state at ${path}: ${error instanceof Error ? error.message : String(error)}`, 1);
-  }
-}
-function normalizeConnection(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    return null;
-  const record = value;
-  if (record.kind === "local")
-    return { kind: "local", mode: "auto" };
-  if (record.kind === "remote" && typeof record.baseUrl === "string" && record.baseUrl.trim()) {
-    const baseUrl = record.baseUrl.trim().replace(/\/+$/, "");
-    return { kind: "remote", baseUrl };
-  }
-  return null;
-}
-function readGlobalConnections(options = {}) {
-  const path = resolveGlobalConnectionsPath(options.env ?? process.env);
-  const payload = readJsonFile(path);
-  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
-    return { connections: {} };
-  }
-  const rawConnections = payload.connections;
-  const connections = {};
-  if (rawConnections && typeof rawConnections === "object" && !Array.isArray(rawConnections)) {
-    for (const [alias, raw] of Object.entries(rawConnections)) {
-      const connection = normalizeConnection(raw);
-      if (connection)
-        connections[alias] = connection;
-    }
+    throw new CliError(`Invalid Rig connection state at ${path}: ${error instanceof Error ? error.message : String(error)}`, 1, { hint: "Fix or delete that file, then re-select a server with `rig server use <alias|local>`." });
   }
-  return { connections };
 }
 function readRepoConnection(projectRoot) {
   const payload = readJsonFile(resolveRepoConnectionPath(projectRoot));
@@ -102,139 +108,130 @@ function readRepoConnection(projectRoot) {
   return {
     selected,
     project: typeof record.project === "string" ? record.project : undefined,
-    linkedAt: typeof record.linkedAt === "string" ? record.linkedAt : undefined
+    linkedAt: typeof record.linkedAt === "string" ? record.linkedAt : undefined,
+    serverProjectRoot: typeof record.serverProjectRoot === "string" && record.serverProjectRoot.trim() ? record.serverProjectRoot.trim() : undefined,
+    serverProjectRootAlias: typeof record.serverProjectRootAlias === "string" && record.serverProjectRootAlias.trim() ? record.serverProjectRootAlias.trim() : undefined,
+    serverProjectRootBaseUrl: typeof record.serverProjectRootBaseUrl === "string" && record.serverProjectRootBaseUrl.trim() ? record.serverProjectRootBaseUrl.trim().replace(/\/+$/, "") : undefined
   };
 }
-function resolveSelectedConnection(projectRoot, options = {}) {
-  const repo = readRepoConnection(projectRoot);
-  if (!repo)
-    return null;
-  if (repo.selected === "local")
-    return { alias: "local", connection: { kind: "local", mode: "auto" } };
-  const global = readGlobalConnections(options);
-  const connection = global.connections[repo.selected];
-  if (!connection) {
-    throw new CliError2(`Selected Rig connection "${repo.selected}" was not found. Run \`rig connect list\` or \`rig connect use local\`.`, 1);
-  }
-  return { alias: repo.selected, connection };
-}
 
-// packages/cli/src/commands/_server-client.ts
-var cachedGitHubBearerToken;
-function cleanToken(value) {
-  const trimmed = value?.trim();
-  return trimmed ? trimmed : null;
+// packages/cli/src/commands/_async-ui.ts
+import pc from "picocolors";
+
+// packages/cli/src/commands/_spinner.ts
+var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+function createTtySpinner(input) {
+  const output = input.output ?? process.stdout;
+  const isTty = output.isTTY === true;
+  const frames = input.frames && input.frames.length > 0 ? input.frames : SPINNER_FRAMES;
+  let label = input.label;
+  let frame = 0;
+  let paused = false;
+  let stopped = false;
+  let lastPrintedLabel = "";
+  const render = () => {
+    if (stopped || paused)
+      return;
+    if (!isTty) {
+      if (label !== lastPrintedLabel) {
+        output.write(`${label}
+`);
+        lastPrintedLabel = label;
+      }
+      return;
+    }
+    frame = (frame + 1) % frames.length;
+    const glyph = frames[frame] ?? frames[0] ?? "";
+    output.write(`\r\x1B[2K${input.styleFrame ? input.styleFrame(glyph) : glyph} ${label}`);
+  };
+  const clearLine = () => {
+    if (isTty)
+      output.write("\r\x1B[2K");
+  };
+  render();
+  const timer = isTty ? setInterval(render, input.intervalMs ?? 16) : null;
+  return {
+    setLabel(next) {
+      label = next;
+      render();
+    },
+    pause() {
+      paused = true;
+      clearLine();
+    },
+    resume() {
+      if (stopped)
+        return;
+      paused = false;
+      render();
+    },
+    stop(finalLine) {
+      if (stopped)
+        return;
+      stopped = true;
+      if (timer)
+        clearInterval(timer);
+      clearLine();
+      if (finalLine)
+        output.write(`${finalLine}
+`);
+    }
+  };
 }
-function readPrivateRemoteSessionToken(projectRoot) {
-  const path = resolve2(projectRoot, ".rig", "state", "github-auth.json");
-  if (!existsSync2(path))
-    return null;
-  try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
-  } catch {
-    return null;
+
+// packages/cli/src/commands/_async-ui.ts
+var FRAMES = ["\u25D0", "\u25D3", "\u25D1", "\u25D2"];
+var DONE_SYMBOL = pc.green("\u25C7");
+var FAIL_SYMBOL = pc.red("\u25A0");
+var activeUpdate = null;
+async function withSpinner(label, work, options = {}) {
+  if (options.outputMode === "json") {
+    return work(() => {
+      return;
+    });
   }
-}
-function readGitHubBearerTokenForRemote(projectRoot) {
-  if (cachedGitHubBearerToken !== undefined)
-    return cachedGitHubBearerToken;
-  const privateSession = readPrivateRemoteSessionToken(projectRoot);
-  if (privateSession) {
-    cachedGitHubBearerToken = privateSession;
-    return cachedGitHubBearerToken;
+  if (activeUpdate) {
+    activeUpdate(label);
+    return work(activeUpdate);
   }
-  const envToken = cleanToken(process.env.RIG_GITHUB_TOKEN) ?? cleanToken(process.env.GITHUB_TOKEN) ?? cleanToken(process.env.GH_TOKEN);
-  if (envToken) {
-    cachedGitHubBearerToken = envToken;
-    return cachedGitHubBearerToken;
+  const output = options.output ?? process.stderr;
+  const isTty = output.isTTY === true;
+  let lastLabel = label;
+  if (!isTty) {
+    output.write(`${label}
+`);
+    const update2 = (next) => {
+      lastLabel = next;
+    };
+    activeUpdate = update2;
+    try {
+      return await work(update2);
+    } finally {
+      activeUpdate = null;
+    }
   }
-  const result = spawnSync("gh", ["auth", "token"], {
-    encoding: "utf8",
-    timeout: 5000,
-    stdio: ["ignore", "pipe", "ignore"]
+  const spinner = createTtySpinner({
+    label,
+    output,
+    frames: FRAMES,
+    styleFrame: (frame) => pc.cyan(frame)
   });
-  cachedGitHubBearerToken = result.status === 0 ? cleanToken(result.stdout) : null;
-  return cachedGitHubBearerToken;
-}
-async function ensureServerForCli(projectRoot) {
+  const update = (next) => {
+    lastLabel = next;
+    spinner.setLabel(next);
+  };
+  activeUpdate = update;
   try {
-    const selected = resolveSelectedConnection(projectRoot);
-    if (selected?.connection.kind === "remote") {
-      return {
-        baseUrl: selected.connection.baseUrl,
-        authToken: readGitHubBearerTokenForRemote(projectRoot),
-        connectionKind: "remote"
-      };
-    }
-    const connection = await ensureLocalRigServerConnection(projectRoot);
-    return {
-      baseUrl: connection.baseUrl,
-      authToken: connection.authToken,
-      connectionKind: "local"
-    };
+    const result = await work(update);
+    spinner.stop(options.doneLabel ? `${DONE_SYMBOL} ${options.doneLabel}` : undefined);
+    return result;
   } catch (error) {
-    if (error instanceof Error) {
-      throw new CliError2(error.message, 1);
-    }
+    spinner.stop(`${FAIL_SYMBOL} ${lastLabel}`);
     throw error;
+  } finally {
+    activeUpdate = null;
   }
 }
-function mergeHeaders(headers, authToken) {
-  const merged = new Headers(headers);
-  if (authToken) {
-    merged.set("authorization", `Bearer ${authToken}`);
-  }
-  return merged;
-}
-function diagnosticMessage(payload) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
-    return null;
-  const record = payload;
-  const diagnostics = Array.isArray(record.diagnostics) ? record.diagnostics : [];
-  const messages = diagnostics.flatMap((entry) => {
-    if (!entry || typeof entry !== "object" || Array.isArray(entry))
-      return [];
-    const diagnostic = entry;
-    const kind = typeof diagnostic.kind === "string" ? diagnostic.kind : "task-source";
-    const message = typeof diagnostic.message === "string" ? diagnostic.message : null;
-    return message ? [`${kind}: ${message}`] : [];
-  });
-  return messages.length > 0 ? messages.join("; ") : null;
-}
-async function requestServerJson(context, pathname, init = {}) {
-  const server = await ensureServerForCli(context.projectRoot);
-  const response = await fetch(`${server.baseUrl}${pathname}`, {
-    ...init,
-    headers: mergeHeaders(init.headers, server.authToken)
-  });
-  const text = await response.text();
-  const payload = text.trim().length > 0 ? (() => {
-    try {
-      return JSON.parse(text);
-    } catch {
-      return null;
-    }
-  })() : null;
-  if (!response.ok) {
-    const diagnostics = diagnosticMessage(payload);
-    const detail = diagnostics ?? (text || response.statusText);
-    throw new CliError2(`Rig server request failed (${response.status}): ${detail}`, 1);
-  }
-  return payload;
-}
-async function getGitHubAuthStatusViaServer(context) {
-  const payload = await requestServerJson(context, "/api/github/auth/status");
-  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
-}
-async function postGitHubTokenViaServer(context, token, options = {}) {
-  const payload = await requestServerJson(context, "/api/github/auth/token", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ token, selectedRepo: options.selectedRepo, projectRoot: options.projectRoot })
-  });
-  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
-}
 
 // packages/cli/src/commands/github.ts
 function printPayload(context, payload, fallback) {
@@ -243,50 +240,101 @@ function printPayload(context, payload, fallback) {
   else
     console.log(fallback);
 }
+function apiSessionTokenFrom(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return null;
+  return payloadString(payload, "apiSessionToken");
+}
+function payloadString(payload, key) {
+  const value = Reflect.get(payload, key);
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function payloadRecord(payload, key) {
+  const value = Reflect.get(payload, key);
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function remoteNamespaceMetadata(result) {
+  const namespace = payloadRecord(result, "userNamespace");
+  return {
+    ...payloadString(result, "login") ? { login: payloadString(result, "login") } : {},
+    ...payloadString(result, "userId") ? { userId: payloadString(result, "userId") } : {},
+    ...namespace && payloadString(namespace, "key") ? { userNamespaceKey: payloadString(namespace, "key") } : {},
+    ...namespace && payloadString(namespace, "root") ? { userNamespaceRoot: payloadString(namespace, "root") } : {},
+    ...namespace && payloadString(namespace, "checkoutBaseDir") ? { checkoutBaseDir: payloadString(namespace, "checkoutBaseDir") } : {},
+    ...namespace && payloadString(namespace, "snapshotBaseDir") ? { snapshotBaseDir: payloadString(namespace, "snapshotBaseDir") } : {}
+  };
+}
+function persistRemoteAuthSession(context, source, result, fallbackToken) {
+  const apiSessionToken = result.apiSessionToken || apiSessionTokenFrom(result);
+  setGitHubBearerTokenForCurrentProcess(apiSessionToken ?? fallbackToken, context.projectRoot);
+  if (!apiSessionToken)
+    return;
+  const repo = readRepoConnection(context.projectRoot);
+  const path = resolve3(context.projectRoot, ".rig", "state", "github-auth.json");
+  mkdirSync2(dirname2(path), { recursive: true });
+  writeFileSync2(path, `${JSON.stringify({
+    authenticated: true,
+    source,
+    storedOnServer: true,
+    ...repo?.project ? { selectedRepo: repo.project } : {},
+    ...remoteNamespaceMetadata(result),
+    apiSessionToken,
+    updatedAt: new Date().toISOString()
+  }, null, 2)}
+`, "utf8");
+}
+function isSignedIn(status) {
+  return status.signedIn === true;
+}
 function readGhToken() {
-  const result = spawnSync2("gh", ["auth", "token"], { encoding: "utf8" });
+  const result = spawnSync("gh", ["auth", "token"], { encoding: "utf8" });
   if (result.status !== 0) {
     const detail = result.stderr?.trim() || result.stdout?.trim() || "gh auth token failed";
-    throw new CliError2(`Could not import GitHub token from gh: ${detail}`, 1);
+    throw new CliError(`Could not import GitHub token from gh: ${detail}`, 1, { hint: "Sign in first with `gh auth login`, or store a token directly: `rig github auth token --token <token>`." });
   }
   const token = result.stdout.trim();
   if (!token)
-    throw new CliError2("gh auth token returned an empty token.", 1);
+    throw new CliError("gh auth token returned an empty token.", 1, { hint: "Sign in with `gh auth login`, then re-run `rig github auth import-gh`." });
   return token;
 }
 async function executeGithub(context, args) {
   const [group, command, ...rest] = args;
   if (group !== "auth") {
-    throw new CliError2("Usage: rig github auth <status|import-gh|token>", 1);
+    throw new CliError("Usage: rig github auth <status|import-gh|token>", 1);
   }
   switch (command) {
     case "status": {
       if (rest.length > 0)
-        throw new CliError2("Usage: rig github auth status", 1);
-      const status = await getGitHubAuthStatusViaServer(context);
-      printPayload(context, status, `GitHub auth: ${status.authenticated ? "authenticated" : "unauthenticated"}`);
+        throw new CliError("Usage: rig github auth status", 1);
+      const status = await withSpinner("Checking GitHub auth on the server\u2026", () => getGitHubAuthStatusInProcess(context), { outputMode: context.outputMode });
+      printPayload(context, status, `GitHub auth: ${isSignedIn(status) ? "authenticated" : "unauthenticated"}`);
       return { ok: true, group: "github", command: "auth status", details: status };
     }
     case "token": {
       const parsed = takeOption(rest, "--token");
       if (parsed.rest.length > 0)
-        throw new CliError2("Usage: rig github auth token --token <token>", 1);
+        throw new CliError("Usage: rig github auth token --token <token>", 1);
       const token = parsed.value?.trim();
       if (!token)
-        throw new CliError2("Missing --token value.", 1);
-      const result = await postGitHubTokenViaServer(context, token);
-      printPayload(context, result, "GitHub token stored on the selected Rig server.");
+        throw new CliError("Missing --token value.", 1, { hint: "Re-run as `rig github auth token --token <token>`." });
+      const repo = readRepoConnection(context.projectRoot);
+      const result = await withSpinner("Storing GitHub token on the server\u2026", () => postGitHubTokenInProcess(context, token, repo?.project ? { selectedRepo: repo.project } : {}), { outputMode: context.outputMode });
+      persistRemoteAuthSession(context, "token", result, token);
+      printPayload(context, result, "GitHub token stored on the selected server.");
       return { ok: true, group: "github", command: "auth token", details: result };
     }
     case "import-gh": {
       if (rest.length > 0)
-        throw new CliError2("Usage: rig github auth import-gh", 1);
-      const result = await postGitHubTokenViaServer(context, readGhToken());
-      printPayload(context, result, "GitHub token imported from gh and stored on the selected Rig server.");
+        throw new CliError("Usage: rig github auth import-gh", 1);
+      const importedToken = readGhToken();
+      const repo = readRepoConnection(context.projectRoot);
+      const result = await withSpinner("Storing GitHub token on the server\u2026", () => postGitHubTokenInProcess(context, importedToken, repo?.project ? { selectedRepo: repo.project } : {}), { outputMode: context.outputMode });
+      persistRemoteAuthSession(context, "gh", result, importedToken);
+      printPayload(context, result, "GitHub token imported from gh and stored on the selected server.");
       return { ok: true, group: "github", command: "auth import-gh", details: result };
     }
     default:
-      throw new CliError2("Usage: rig github auth <status|import-gh|token>", 1);
+      throw new CliError("Usage: rig github auth <status|import-gh|token>", 1);
   }
 }
 export {

package/dist/src/commands/inbox.d.ts

@@ -0,0 +1,28 @@
+import { type RunnerContext } from "../runner";
+import type { CommandOutcome } from "@rig/runtime";
+import { type RunProjectionRecord } from "./_run-projection";
+export type InboxKind = "approvals" | "inputs";
+export interface InboxFilters {
+    readonly run?: string;
+    readonly task?: string;
+}
+export interface InboxRecord {
+    readonly runId: string;
+    readonly taskId: string | null;
+    readonly requestId: string;
+    readonly status: "pending";
+    readonly prompt: string;
+    readonly requestedAt: string;
+    readonly payload: unknown;
+}
+/** Every pending inbox request across discoverable runs, optionally filtered by run/task. */
+export interface InboxDeps {
+    readonly listRuns?: (projectRoot: string) => Promise<RunProjectionRecord[]>;
+}
+export declare function listInboxRecords(context: Pick<RunnerContext, "projectRoot">, kind: InboxKind, filters?: InboxFilters, deps?: InboxDeps): Promise<InboxRecord[]>;
+/** Pending-gate counts for proactive surfacing; null-safe for footer callers. */
+export declare function readPendingInboxCounts(context: Pick<RunnerContext, "projectRoot">): Promise<{
+    approvals: number;
+    inputs: number;
+} | null>;
+export declare function executeInbox(context: RunnerContext, args: string[], deps?: InboxDeps): Promise<CommandOutcome>;