@higherdev/cli 0.15.0 → 0.15.2

package/README.md

@@ -39,6 +39,7 @@ workspace-map config shapes are migrated automatically when they are read.
 | `hd workspace new --name NAME --repo OWNER/NAME [options]` | Preflight GitHub, wire the runner, and create a paused workspace |
 | `hd workspace set [options]` | Update settings; max turns uses `--max-turns KIND=N[,KIND=N...]` |
 | `hd workspace rotate-key` | Rotate the shared API key and save it locally |
+| `hd workspace grant-runner-access [--runner-user USER]` | Grant and confirm write-or-better access for the workspace runner |
 | `hd agents` | List agents |
 | `hd agents add ROLE --provider P --model M [options]` | Add an agent |
 | `hd agents rm ROLE\|ID` | Remove an unambiguous agent |
@@ -65,11 +66,18 @@ elsewhere. If the runner environment or service unit already exists, inspect the
 pass `--force` only when replacing that host configuration is intentional.
 
 `hd workspace new` uses the operator's authenticated `gh`, defaults to the repository's real default
-branch, bootstraps an empty repository unless `--no-bootstrap` is set, and invites `mel-ilotus` as an admin unless
-`--runner-user USER` overrides it. On a terminal, missing name or repo flags start a guided wizard. If
+branch, bootstraps an empty repository unless `--no-bootstrap` is set, and invites `mel-ilotus` with push
+access for user-owned repositories or admin for organization-owned repositories unless `--runner-user USER`
+overrides it. On a terminal, missing name or repo flags start a guided wizard. If
 the repository is missing, approve private creation interactively, use `--create` to force it, or
 `--no-create` to fail. Fully flagged calls remain non-interactive for scripts and Mel.
 
+For workspaces created before runner access was wired automatically, run
+`hd workspace grant-runner-access`. It uses the operator's authenticated `gh` account, defaults to
+`mel-ilotus`, grants push on user-owned repositories or admin on organization-owned repositories, and
+confirms write-or-better access through GitHub's collaborator permission endpoint. The old
+`grant-runner-admin` name remains an alias.
+
 `hd env set` and `hd env rm` also update GitHub Actions secrets on the current workspace repository.
 They require the operator's authenticated `gh` account to have repository admin permission. Secret values are sent
 to `gh` through stdin and are never printed.

package/dist/index.js

@@ -7,8 +7,8 @@ import { login, parseLoginFlags } from "./login.js";
 import { loadConfig } from "./config.js";
 import { epicProgressRows, readEpicSpec } from "./epics.js";
 import { banner, c, statusChip, table, truncate, usage } from "./out.js";
-import { WORKSPACE_USAGE, workspaceNew, workspaceRotateKey, workspaceSet, workspaceUse } from "./workspace-commands.js";
-import { defaultGh, requireAdminRepo } from "./workspace-preflight.js";
+import { WORKSPACE_USAGE, workspaceGrantRunnerAccess, workspaceNew, workspaceRotateKey, workspaceSet, workspaceUse } from "./workspace-commands.js";
+import { defaultGh, hasWriteRepoPermission, HDX_RUNNER_GH_USER, requireAdminRepo, runnerRepoPermission } from "./workspace-preflight.js";
 function fail(message) {
     console.error(message);
     process.exit(1);
@@ -258,6 +258,11 @@ async function cmdWorkspace(argv, deps = {}) {
         console.log(`${workspace.slug}  ${workspace.name}  ${workspace.repo}`);
         return;
     }
+    if (action === "grant-runner-access" || action === "grant-runner-admin") {
+        const result = await workspaceGrantRunnerAccess(rest, deps);
+        console.log(`${result.runnerUser}  ${result.permission}  ${result.repo}`);
+        return;
+    }
     if (action === "rotate-key") {
         if (rest.length)
             fail(WORKSPACE_USAGE);
@@ -269,6 +274,13 @@ async function cmdWorkspace(argv, deps = {}) {
     if (action === "set") {
         const workspace = await workspaceSet(rest);
         console.log(`${workspace.slug}  ${workspace.name}  ${workspace.repo}`);
+        try {
+            const permission = await runnerRepoPermission(workspace.repo, HDX_RUNNER_GH_USER, deps.gh ?? defaultGh);
+            if (!hasWriteRepoPermission(permission)) {
+                console.log(`hint: runner ${HDX_RUNNER_GH_USER} has ${permission} permission; run hd workspace grant-runner-access`);
+            }
+        }
+        catch { }
         return;
     }
     if (action !== "new")

package/dist/out.js

@@ -67,7 +67,7 @@ export function usage() {
         `  ${c.blue("hd ticket list | show | new | queue | cancel")} ticket operations`,
         `  ${c.blue("hd epic new PATH | list | approve | rm")} epic operations`,
         `  ${c.blue("hd plan")}                           use /architect in the TUI`,
-        `  ${c.blue("hd workspace ls | use | new | set | rotate-key")} workspace operations`,
+        `  ${c.blue("hd workspace ls | use | new | set | rotate-key | grant-runner-access")} workspace operations`,
         `  ${c.blue("hd agents [add | rm | set]")}         manage agents`,
         `  ${c.blue("hd caps [set PROVIDER N]")}           provider concurrency`,
         `  ${c.blue("hd env ls | set | rm")}               workspace environment`,

package/dist/workspace-commands.js

@@ -1,8 +1,8 @@
 import { createWorkspace, listWorkspaces, rotateWorkspaceApiKey, updateWorkspace } from "./api.js";
 import { loadConfig, switchWorkspace, writeHdConfig } from "./config.js";
 import { promptOnStdin } from "./prompt.js";
-import { defaultGh, HDX_RUNNER_GH_USER, preflightWorkspace } from "./workspace-preflight.js";
-export const WORKSPACE_USAGE = "usage: hd workspace ls | use SLUG | new --name NAME --repo OWNER/NAME [--create|--no-create] [flags] | set [flags] | rotate-key";
+import { defaultGh, hasWriteRepoPermission, HDX_RUNNER_GH_USER, preflightWorkspace, runnerAccessForRepoOwner, runnerRepoPermission } from "./workspace-preflight.js";
+export const WORKSPACE_USAGE = "usage: hd workspace ls | use SLUG | new --name NAME --repo OWNER/NAME [--create|--no-create] [flags] | set [flags] | rotate-key | grant-runner-access [--runner-user USER]";
 function flags(argv) {
     const opts = {};
     const bools = new Set();
@@ -165,6 +165,33 @@ export async function workspaceUse(argv) {
     switchWorkspace(selected.slug);
     return selected;
 }
+export async function workspaceGrantRunnerAccess(argv, deps = {}) {
+    const { opts, bools, rest } = flags(argv);
+    if (rest.length || bools.size || Object.keys(opts).some((name) => name !== "runner-user")) {
+        throw new Error(WORKSPACE_USAGE);
+    }
+    const runnerUser = opts["runner-user"] ?? HDX_RUNNER_GH_USER;
+    const current = loadConfig().slug;
+    const workspace = (await listWorkspaces()).find((item) => item.slug === current);
+    if (!workspace)
+        throw new Error(`No workspace ${current}.`);
+    const gh = deps.gh ?? defaultGh;
+    try {
+        await gh(["--version"]);
+    }
+    catch {
+        throw new Error("GitHub CLI is unavailable. Install it if needed, then run `gh auth login`.");
+    }
+    const access = await runnerAccessForRepoOwner(workspace.repo, gh);
+    await gh(["api", "-X", "PUT", `repos/${workspace.repo}/collaborators/${runnerUser}`,
+        "-f", `permission=${access}`]);
+    const permission = await runnerRepoPermission(workspace.repo, runnerUser, gh);
+    if (!hasWriteRepoPermission(permission)) {
+        throw new Error(`Runner ${runnerUser} has ${permission} permission on ${workspace.repo}, expected write or better.`);
+    }
+    return { repo: workspace.repo, runnerUser, permission, requestedPermission: access };
+}
+export const workspaceGrantRunnerAdmin = workspaceGrantRunnerAccess;
 export async function workspaceRotateKey() {
     const config = loadConfig();
     const { api_key } = await rotateWorkspaceApiKey(config);

package/dist/workspace-preflight.js

@@ -52,6 +52,25 @@ export async function requireAdminRepo(repo, gh = defaultGh) {
         throw new Error(`Repository admin permission is required; viewer has ${permission || "none"}.`);
     }
 }
+export async function runnerRepoPermission(repo, runnerUser = HDX_RUNNER_GH_USER, gh = defaultGh) {
+    try {
+        const result = JSON.parse(await gh(["api", `repos/${repo}/collaborators/${runnerUser}/permission`]));
+        return result.permission ?? "none";
+    }
+    catch (error) {
+        if (/404|not found/i.test(errorMessage(error)))
+            return "none";
+        throw error;
+    }
+}
+export function hasWriteRepoPermission(permission) {
+    return ["admin", "maintain", "write", "push"].includes(permission.toLowerCase());
+}
+export async function runnerAccessForRepoOwner(repo, gh = defaultGh) {
+    const owner = repo.split("/")[0];
+    const ownerType = (await gh(["api", `users/${owner}`, "--jq", ".type"])).trim();
+    return ownerType.toLowerCase() === "organization" ? "admin" : "push";
+}
 async function repoView(repo, gh) {
     return JSON.parse(await gh(["repo", "view", repo, "--json", "defaultBranchRef,isEmpty,viewerPermission"]));
 }
@@ -82,18 +101,11 @@ export async function preflightWorkspace(input, gh = defaultGh) {
     if (!branch)
         throw new Error(`GitHub repository ${input.repo} has no default branch.`);
     const runnerUser = input.runnerUser || HDX_RUNNER_GH_USER;
-    let permission = "none";
-    try {
-        const result = JSON.parse(await gh(["api", `repos/${input.repo}/collaborators/${runnerUser}/permission`]));
-        permission = result.permission ?? "none";
-    }
-    catch (error) {
-        if (!/404|not found/i.test(errorMessage(error)))
-            throw error;
-    }
-    const invitationPending = permission.toLowerCase() !== "admin";
+    const permission = await runnerRepoPermission(input.repo, runnerUser, gh);
+    const invitationPending = !hasWriteRepoPermission(permission);
     if (invitationPending) {
-        await gh(["api", "-X", "PUT", `repos/${input.repo}/collaborators/${runnerUser}`, "-f", "permission=admin"]);
+        const access = await runnerAccessForRepoOwner(input.repo, gh);
+        await gh(["api", "-X", "PUT", `repos/${input.repo}/collaborators/${runnerUser}`, "-f", `permission=${access}`]);
     }
     return { branch, invitationPending };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@higherdev/cli",
-  "version": "0.15.0",
+  "version": "0.15.2",
   "type": "module",
   "bin": {
     "hd": "dist/index.js"