@higherdev/cli 0.14.3 → 0.14.5

package/README.md

@@ -67,6 +67,10 @@ branch, bootstraps an empty repository unless `--no-bootstrap` is set, and invit
 the repository is missing, approve private creation interactively, use `--create` to force it, or
 `--no-create` to fail. Fully flagged calls remain non-interactive for scripts and Mel.
 
+`hd env set` and `hd env rm` also update GitHub Actions secrets on the current workspace repository.
+They require the operator's authenticated `gh` account to have repository admin permission. Secret values are sent
+to `gh` through stdin and are never printed.
+
 Inside the TUI, use `/board`, `/inbox`, `/ticket`, `/queue`, `/cancel`, `/epic new`,
 `/epic approve`, `/epics`, `/architect` (or `/plan`), `/decide`, `/agents add`, `/agents rm`, `/env`, `/settings`, `/workspace`,
 `/workspace new`, `/workspace set`, `/workspace rotate-key`, `/feed`,

package/dist/index.js

@@ -8,6 +8,7 @@ import { loadConfig } from "./config.js";
 import { epicProgressRows, readEpicSpec } from "./epics.js";
 import { banner, c, statusChip, table, truncate, usage } from "./out.js";
 import { WORKSPACE_USAGE, workspaceNew, workspaceRotateKey, workspaceSet, workspaceUse } from "./workspace-commands.js";
+import { defaultGh, requireAdminRepo } from "./workspace-preflight.js";
 function fail(message) {
     console.error(message);
     process.exit(1);
@@ -349,7 +350,18 @@ async function cmdCaps(argv) {
     const result = await updateCaps({ [provider]: cap });
     console.log(`${provider}  ${result.provider_caps[provider]}`);
 }
-async function cmdEnv(argv) {
+async function currentWorkspaceRepo() {
+    const current = loadConfig().slug;
+    const workspace = (await listWorkspaces()).find((item) => item.slug === current);
+    if (!workspace)
+        throw new Error(`No workspace ${current}.`);
+    return workspace.repo;
+}
+function githubSecretMissing(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return /404|not found|does not exist/i.test(message);
+}
+export async function cmdEnv(argv, deps = {}) {
     const [action, ...args] = argv;
     if (action === "ls") {
         const { env } = await listWorkspaceEnv();
@@ -359,18 +371,43 @@ async function cmdEnv(argv) {
         return;
     }
     if (action === "set" && args.length) {
+        const assignments = [];
         for (const assignment of args) {
             const at = assignment.indexOf("=");
             if (at < 1)
                 fail("usage: hd env set NAME=VALUE [NAME=VALUE...]");
-            await setWorkspaceEnv(assignment.slice(0, at), assignment.slice(at + 1));
+            assignments.push({ name: assignment.slice(0, at), value: assignment.slice(at + 1) });
         }
-        console.log(`set ${args.length} variable${args.length === 1 ? "" : "s"}`);
+        for (const assignment of assignments)
+            await setWorkspaceEnv(assignment.name, assignment.value);
+        const repo = await currentWorkspaceRepo();
+        const gh = deps.gh ?? defaultGh;
+        await requireAdminRepo(repo, gh);
+        for (const assignment of assignments) {
+            try {
+                await gh(["secret", "set", assignment.name, "--repo", repo], assignment.value);
+            }
+            catch {
+                throw new Error(`Workspace has ${assignment.name}, but GitHub Actions on ${repo} does not.`);
+            }
+        }
+        console.log(`synced ${assignments.map(({ name }) => name).join(", ")} to ${repo}`);
         return;
     }
     if (action === "rm" && args.length === 1) {
-        await removeWorkspaceEnv(args[0]);
-        console.log(`removed ${args[0]}`);
+        const name = args[0];
+        await removeWorkspaceEnv(name);
+        const repo = await currentWorkspaceRepo();
+        const gh = deps.gh ?? defaultGh;
+        await requireAdminRepo(repo, gh);
+        try {
+            await gh(["secret", "delete", name, "--repo", repo, "--yes"]);
+        }
+        catch (error) {
+            if (!githubSecretMissing(error))
+                throw new Error(`Workspace removed ${name}, but GitHub Actions on ${repo} may still have it.`);
+        }
+        console.log(`synced removal of ${name} to ${repo}`);
         return;
     }
     fail("usage: hd env ls | set NAME=VALUE [NAME=VALUE...] | rm NAME");
@@ -437,7 +474,7 @@ export async function main(argv = process.argv.slice(2), deps = {}) {
             return;
         }
         if (cmd === "env") {
-            await cmdEnv(rest);
+            await cmdEnv(rest, deps);
             return;
         }
         if (cmd === "pause" || cmd === "off") {

package/dist/tui/App.js

@@ -18,7 +18,8 @@ import { alertOnce } from "./alert.js";
 import { bubbleRows } from "./height.js";
 import { planLayout, splitPanels } from "./layout.js";
 import { parseLine } from "./parse.js";
-import { configuredSlugs, acknowledgeInbox, approveEpic, cancelTicket, createAgent, createEpicFromFile, decisionOptions, deleteAgent, loadLiveEvents, listWorkspaceEnv, loadTicketDetail, pollSnapshot, postAgentMessage, queueTicket, resolveDecision, setWorkspacePaused, switchWorkspace, updateAgent, updateProviderCap, updateWorkspace, } from "./data.js";
+import { configuredSlugs, acknowledgeInbox, approveEpic, cancelTicket, createAgent, createEpicFromFile, decisionOptions, deleteAgent, loadLiveEvents, listWorkspaceEnv, loadTicketDetail, pollSnapshot, postAgentMessage, queueTicket, resolveDecision, setWorkspacePaused, switchWorkspace, updateAgent, updateProviderCap, updateWorkspace, waitForReply, } from "./data.js";
+import { inputActive, promptPlaceholder, QUEUED_STEP, REPLY_WAIT_MS, settleChatReply } from "./chat-wait.js";
 import { editFor, editableKeys, nextValue, seedFor, settingsRows } from "./settings-model.js";
 import { appendLines, runLabels, toStreamLines } from "./stream.js";
 import { UI } from "./theme.js";
@@ -215,30 +216,26 @@ export function App({ initial }) {
             setBusy(false);
         }
     }, [config, say]);
-    const askAgent = useCallback(async (role, text) => {
-        setBusy(true);
+    const askAgent = useCallback((role, text) => {
         const id = nextId();
         setMessages((prior) => [...prior, { id, speaker: role, body: "", pending: true }]);
         const since = new Date().toISOString();
-        try {
-            await postAgentMessage(role, text, config);
-            setMessages((prior) => prior.map((message) => message.id === id
-                ? { ...message, steps: ["· queued, it answers on the next tick"] }
-                : message));
-            const { waitForReply } = await import("./data.js");
-            const reply = await waitForReply(config, role, since, 180_000);
-            setMessages((prior) => prior.map((message) => message.id === id
-                ? { ...message, body: reply ?? "No reply yet. It will land in /inbox.", pending: false, steps: [] }
-                : message));
-        }
-        catch (error) {
-            const body = error instanceof Error ? error.message : String(error);
-            setMessages((prior) => prior.map((message) => message.id === id ? { ...message, body, pending: false } : message));
-        }
-        finally {
-            setMessages((prior) => prior.map((message) => message.id === id ? { ...message, done: true } : message));
-            setBusy(false);
-        }
+        void (async () => {
+            try {
+                await postAgentMessage(role, text, config);
+                setMessages((prior) => prior.map((message) => message.id === id
+                    ? { ...message, steps: [QUEUED_STEP] }
+                    : message));
+                const reply = await waitForReply(config, role, since, REPLY_WAIT_MS);
+                setMessages((prior) => prior.map((message) => message.id === id
+                    ? { ...message, ...settleChatReply(reply) }
+                    : message));
+            }
+            catch (error) {
+                const body = error instanceof Error ? error.message : String(error);
+                setMessages((prior) => prior.map((message) => message.id === id ? { ...message, body, pending: false, done: true } : message));
+            }
+        })();
     }, [config]);
     const run = useCallback(async (raw) => {
         const text = raw.trim();
@@ -281,7 +278,7 @@ export function App({ initial }) {
         if (action.kind === "say") {
             say("you", text);
             if (mode !== "browse")
-                await askAgent(mode, text);
+                askAgent(mode, text);
             else
                 setNotice("Use /architect or /orchestrator before sending a message.");
             return;
@@ -589,7 +586,7 @@ export function App({ initial }) {
                                 setDraft(next);
                                 if (editingRef.current)
                                     setEditing({ key: editingRef.current.key, draft: next });
-                            }, onSubmit: (value) => void run(value), isActive: !busy, placeholder: busy ? "working…" : "message, or /help", prompt: _jsx(Text, { color: mode === "browse" ? UI.dim : UI.cream, children: mode === "browse" ? "> " : `${mode}> ` }), color: UI.text, onCancel: () => {
+                            }, onSubmit: (value) => void run(value), isActive: inputActive({ busy, pendingChats: inFlight.length }), placeholder: promptPlaceholder({ busy, pendingChats: inFlight.length }), prompt: _jsx(Text, { color: mode === "browse" ? UI.dim : UI.cream, children: mode === "browse" ? "> " : `${mode}> ` }), color: UI.text, onCancel: () => {
                                 if (editing) {
                                     setEditing(null);
                                     setDraft("");

package/dist/tui/chat-wait.js

@@ -0,0 +1,18 @@
+/** How long the TUI waits for an architect or orchestrator reply. */
+export const REPLY_WAIT_MS = 180_000;
+/** Shown in the pending bubble when the wait expires. The reply can still land in /inbox. */
+export const NO_REPLY_NOTE = "No reply yet. It will land in /inbox.";
+export const QUEUED_STEP = "· queued, it answers on the next tick";
+/**
+ * The prompt stays live while a chat reply is pending so navigation, /decide,
+ * and a follow-up send still work. `busy` is the only lock.
+ */
+export function inputActive(state) {
+    return !state.busy;
+}
+export function promptPlaceholder(state) {
+    return state.busy ? "working…" : "message, or /help";
+}
+export function settleChatReply(reply) {
+    return { body: reply ?? NO_REPLY_NOTE, pending: false, steps: [], done: true };
+}

package/dist/workspace-preflight.js

@@ -19,14 +19,39 @@ function errorMessage(error) {
     const value = error;
     return value.stderr?.trim() || value.message || String(error);
 }
-export async function defaultGh(args) {
+export async function defaultGh(args, stdin) {
     try {
+        if (stdin !== undefined) {
+            return await new Promise((resolve, reject) => {
+                const child = execFile("gh", args, { encoding: "utf8", maxBuffer: 1024 * 1024 }, (error, stdout, stderr) => error ? reject(new Error(stderr.trim() || error.message)) : resolve(stdout));
+                child.stdin?.end(stdin);
+            });
+        }
         return (await exec("gh", args, { encoding: "utf8", maxBuffer: 1024 * 1024 })).stdout;
     }
     catch (error) {
         throw new Error(errorMessage(error));
     }
 }
+export async function requireAdminRepo(repo, gh = defaultGh) {
+    try {
+        await gh(["--version"]);
+    }
+    catch {
+        throw new Error("GitHub CLI is unavailable. Install it if needed, then run `gh auth login`.");
+    }
+    let view;
+    try {
+        view = JSON.parse(await gh(["repo", "view", repo, "--json", "viewerPermission"]));
+    }
+    catch (error) {
+        throw new Error(`GitHub repository ${repo} was not found or is inaccessible: ${errorMessage(error)}`);
+    }
+    const permission = view.viewerPermission || "";
+    if (permission.toUpperCase() !== "ADMIN") {
+        throw new Error(`Repository admin permission is required; viewer has ${permission || "none"}.`);
+    }
+}
 async function repoView(repo, gh) {
     return JSON.parse(await gh(["repo", "view", repo, "--json", "defaultBranchRef,isEmpty,viewerPermission"]));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@higherdev/cli",
-  "version": "0.14.3",
+  "version": "0.14.5",
   "type": "module",
   "bin": {
     "hd": "dist/index.js"