@higherdev/cli 0.14.4 → 0.15.0

package/README.md

@@ -47,6 +47,9 @@ workspace-map config shapes are migrated automatically when they are read.
 | `hd env ls` | List workspace environment variable names |
 | `hd env set NAME=VALUE [NAME=VALUE...]` | Set workspace environment variables |
 | `hd env rm NAME` | Remove a workspace environment variable |
+| `hd host env ls` | List environment variable names on the workspace's default host |
+| `hd host env set NAME=VALUE [NAME=VALUE...]` | Set host-only environment variables |
+| `hd host env rm NAME` | Remove a host-only environment variable |
 | `hd logs KEY [-f]` | Show or follow run events |
 | `hd msg KEY "message" [--interrupt]` | Message a builder |
 | `hd decide` | List open decisions |
@@ -62,11 +65,18 @@ elsewhere. If the runner environment or service unit already exists, inspect the
 pass `--force` only when replacing that host configuration is intentional.
 
 `hd workspace new` uses the operator's authenticated `gh`, defaults to the repository's real default
-branch, bootstraps an empty repository unless `--no-bootstrap` is set, and invites `mel-ilotus` unless
+branch, bootstraps an empty repository unless `--no-bootstrap` is set, and invites `mel-ilotus` as an admin unless
 `--runner-user USER` overrides it. On a terminal, missing name or repo flags start a guided wizard. If
 the repository is missing, approve private creation interactively, use `--create` to force it, or
 `--no-create` to fail. Fully flagged calls remain non-interactive for scripts and Mel.
 
+`hd env set` and `hd env rm` also update GitHub Actions secrets on the current workspace repository.
+They require the operator's authenticated `gh` account to have repository admin permission. Secret values are sent
+to `gh` through stdin and are never printed.
+
+Use `hd host env set SUPABASE_ACCESS_TOKEN=... SUPABASE_ORG_ID=...` once to let the runner provision
+Supabase for workspaces assigned to that host. Host values are never passed to builder processes.
+
 Inside the TUI, use `/board`, `/inbox`, `/ticket`, `/queue`, `/cancel`, `/epic new`,
 `/epic approve`, `/epics`, `/architect` (or `/plan`), `/decide`, `/agents add`, `/agents rm`, `/env`, `/settings`, `/workspace`,
 `/workspace new`, `/workspace set`, `/workspace rotate-key`, `/feed`,

package/dist/api.js

@@ -114,6 +114,15 @@ export async function setWorkspaceEnv(name, value, config = loadConfig()) {
 export async function removeWorkspaceEnv(name, config = loadConfig()) {
     return request(config, "DELETE", `/api/w/${config.slug}/env`, { name });
 }
+export async function listHostEnv(host, config = loadConfig()) {
+    return request(config, "GET", `/api/hosts/${encodeURIComponent(host)}/env`);
+}
+export async function setHostEnv(host, name, value, config = loadConfig()) {
+    return request(config, "PUT", `/api/hosts/${encodeURIComponent(host)}/env`, { name, value });
+}
+export async function removeHostEnv(host, name, config = loadConfig()) {
+    return request(config, "DELETE", `/api/hosts/${encodeURIComponent(host)}/env`, { name });
+}
 export async function listEpics(config = loadConfig()) {
     return request(config, "GET", `/api/w/${config.slug}/epics`);
 }

package/dist/index.js

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
 import { realpathSync } from "node:fs";
 import { pathToFileURL } from "node:url";
-import { approveEpic, answerDecision, cancelTicket, createAgent, createEpic, createTicket, deleteAgent, deleteEpic, getStatus, listAgents, listEpics, listWorkspaceEnv, listTicketEvents, listTickets, listWorkspaces, postMessage, queueTicket, removeWorkspaceEnv, setPaused, setWorkspaceEnv, showTicket, updateAgent, updateCaps, } from "./api.js";
+import { approveEpic, answerDecision, cancelTicket, createAgent, createEpic, createTicket, deleteAgent, deleteEpic, getStatus, listAgents, listEpics, listHostEnv, listWorkspaceEnv, listTicketEvents, listTickets, listWorkspaces, postMessage, queueTicket, removeWorkspaceEnv, removeHostEnv, setPaused, setWorkspaceEnv, setHostEnv, showTicket, updateAgent, updateCaps, } from "./api.js";
 import { initHost, parseHostFlags } from "./host.js";
 import { login, parseLoginFlags } from "./login.js";
 import { loadConfig } from "./config.js";
 import { epicProgressRows, readEpicSpec } from "./epics.js";
 import { banner, c, statusChip, table, truncate, usage } from "./out.js";
 import { WORKSPACE_USAGE, workspaceNew, workspaceRotateKey, workspaceSet, workspaceUse } from "./workspace-commands.js";
+import { defaultGh, requireAdminRepo } from "./workspace-preflight.js";
 function fail(message) {
     console.error(message);
     process.exit(1);
@@ -349,7 +350,18 @@ async function cmdCaps(argv) {
     const result = await updateCaps({ [provider]: cap });
     console.log(`${provider}  ${result.provider_caps[provider]}`);
 }
-async function cmdEnv(argv) {
+async function currentWorkspaceRepo() {
+    const current = loadConfig().slug;
+    const workspace = (await listWorkspaces()).find((item) => item.slug === current);
+    if (!workspace)
+        throw new Error(`No workspace ${current}.`);
+    return workspace.repo;
+}
+function githubSecretMissing(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return /404|not found|does not exist/i.test(message);
+}
+export async function cmdEnv(argv, deps = {}) {
     const [action, ...args] = argv;
     if (action === "ls") {
         const { env } = await listWorkspaceEnv();
@@ -359,22 +371,77 @@ async function cmdEnv(argv) {
         return;
     }
     if (action === "set" && args.length) {
+        const assignments = [];
         for (const assignment of args) {
             const at = assignment.indexOf("=");
             if (at < 1)
                 fail("usage: hd env set NAME=VALUE [NAME=VALUE...]");
-            await setWorkspaceEnv(assignment.slice(0, at), assignment.slice(at + 1));
+            assignments.push({ name: assignment.slice(0, at), value: assignment.slice(at + 1) });
         }
-        console.log(`set ${args.length} variable${args.length === 1 ? "" : "s"}`);
+        for (const assignment of assignments)
+            await setWorkspaceEnv(assignment.name, assignment.value);
+        const repo = await currentWorkspaceRepo();
+        const gh = deps.gh ?? defaultGh;
+        await requireAdminRepo(repo, gh);
+        for (const assignment of assignments) {
+            try {
+                await gh(["secret", "set", assignment.name, "--repo", repo], assignment.value);
+            }
+            catch {
+                throw new Error(`Workspace has ${assignment.name}, but GitHub Actions on ${repo} does not.`);
+            }
+        }
+        console.log(`synced ${assignments.map(({ name }) => name).join(", ")} to ${repo}`);
         return;
     }
     if (action === "rm" && args.length === 1) {
-        await removeWorkspaceEnv(args[0]);
-        console.log(`removed ${args[0]}`);
+        const name = args[0];
+        await removeWorkspaceEnv(name);
+        const repo = await currentWorkspaceRepo();
+        const gh = deps.gh ?? defaultGh;
+        await requireAdminRepo(repo, gh);
+        try {
+            await gh(["secret", "delete", name, "--repo", repo, "--yes"]);
+        }
+        catch (error) {
+            if (!githubSecretMissing(error))
+                throw new Error(`Workspace removed ${name}, but GitHub Actions on ${repo} may still have it.`);
+        }
+        console.log(`synced removal of ${name} to ${repo}`);
         return;
     }
     fail("usage: hd env ls | set NAME=VALUE [NAME=VALUE...] | rm NAME");
 }
+async function cmdHost(argv) {
+    const [scope, action, ...args] = argv;
+    const usage = "usage: hd host env ls | set NAME=VALUE [NAME=VALUE...] | rm NAME";
+    if (scope !== "env")
+        fail(usage);
+    const host = (await getStatus()).workspace.default_host;
+    if (action === "ls") {
+        const { env } = await listHostEnv(host);
+        if (!env.length)
+            return console.log(c.dim(`No environment variables for host ${host}.`));
+        console.log(table(["NAME", "UPDATED"], env.map((row) => [row.name, row.updated_at])));
+        return;
+    }
+    if (action === "set" && args.length) {
+        for (const assignment of args) {
+            const at = assignment.indexOf("=");
+            if (at < 1)
+                fail(usage);
+            await setHostEnv(host, assignment.slice(0, at), assignment.slice(at + 1));
+        }
+        console.log(`set ${args.length} host variable${args.length === 1 ? "" : "s"} on ${host}`);
+        return;
+    }
+    if (action === "rm" && args.length === 1) {
+        await removeHostEnv(host, args[0]);
+        console.log(`removed ${args[0]} from ${host}`);
+        return;
+    }
+    fail(usage);
+}
 export async function main(argv = process.argv.slice(2), deps = {}) {
     const [cmd, ...rest] = argv;
     try {
@@ -437,7 +504,11 @@ export async function main(argv = process.argv.slice(2), deps = {}) {
             return;
         }
         if (cmd === "env") {
-            await cmdEnv(rest);
+            await cmdEnv(rest, deps);
+            return;
+        }
+        if (cmd === "host") {
+            await cmdHost(rest);
             return;
         }
         if (cmd === "pause" || cmd === "off") {

package/dist/out.js

@@ -71,6 +71,7 @@ export function usage() {
         `  ${c.blue("hd agents [add | rm | set]")}         manage agents`,
         `  ${c.blue("hd caps [set PROVIDER N]")}           provider concurrency`,
         `  ${c.blue("hd env ls | set | rm")}               workspace environment`,
+        `  ${c.blue("hd host env ls | set | rm")}          host environment`,
         `  ${c.blue("hd logs KEY [-f]")}                  run events`,
         `  ${c.blue("hd msg KEY TEXT")}                   message a builder`,
         `  ${c.blue("hd decide [ID --answer TEXT]")}      decisions`,

package/dist/workspace-preflight.js

@@ -19,20 +19,42 @@ function errorMessage(error) {
     const value = error;
     return value.stderr?.trim() || value.message || String(error);
 }
-export async function defaultGh(args) {
+export async function defaultGh(args, stdin) {
     try {
+        if (stdin !== undefined) {
+            return await new Promise((resolve, reject) => {
+                const child = execFile("gh", args, { encoding: "utf8", maxBuffer: 1024 * 1024 }, (error, stdout, stderr) => error ? reject(new Error(stderr.trim() || error.message)) : resolve(stdout));
+                child.stdin?.end(stdin);
+            });
+        }
         return (await exec("gh", args, { encoding: "utf8", maxBuffer: 1024 * 1024 })).stdout;
     }
     catch (error) {
         throw new Error(errorMessage(error));
     }
 }
+export async function requireAdminRepo(repo, gh = defaultGh) {
+    try {
+        await gh(["--version"]);
+    }
+    catch {
+        throw new Error("GitHub CLI is unavailable. Install it if needed, then run `gh auth login`.");
+    }
+    let view;
+    try {
+        view = JSON.parse(await gh(["repo", "view", repo, "--json", "viewerPermission"]));
+    }
+    catch (error) {
+        throw new Error(`GitHub repository ${repo} was not found or is inaccessible: ${errorMessage(error)}`);
+    }
+    const permission = view.viewerPermission || "";
+    if (permission.toUpperCase() !== "ADMIN") {
+        throw new Error(`Repository admin permission is required; viewer has ${permission || "none"}.`);
+    }
+}
 async function repoView(repo, gh) {
     return JSON.parse(await gh(["repo", "view", repo, "--json", "defaultBranchRef,isEmpty,viewerPermission"]));
 }
-function canPush(permission) {
-    return ["admin", "maintain", "write", "push"].includes(permission.toLowerCase());
-}
 export async function preflightWorkspace(input, gh = defaultGh) {
     try {
         await gh(["--version"]);
@@ -69,9 +91,9 @@ export async function preflightWorkspace(input, gh = defaultGh) {
         if (!/404|not found/i.test(errorMessage(error)))
             throw error;
     }
-    const invitationPending = !canPush(permission);
+    const invitationPending = permission.toLowerCase() !== "admin";
     if (invitationPending) {
-        await gh(["api", "-X", "PUT", `repos/${input.repo}/collaborators/${runnerUser}`, "-f", "permission=push"]);
+        await gh(["api", "-X", "PUT", `repos/${input.repo}/collaborators/${runnerUser}`, "-f", "permission=admin"]);
     }
     return { branch, invitationPending };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@higherdev/cli",
-  "version": "0.14.4",
+  "version": "0.15.0",
   "type": "module",
   "bin": {
     "hd": "dist/index.js"