@illuminis/comprism 0.1.3 → 0.1.5

package/out/commands/login.js

@@ -127,15 +127,147 @@ async function post(url, path, body, tenant) {
     catch { /* non-JSON body */ }
     return { status: res.status, json };
 }
+const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
+/** The built in public client the portal accepts for this product's CLI. */
+const CLIENT_ID = 'completionprism-cli';
+function headersFor(tenant) {
+    return tenant ? { 'X-Tenant-ID': tenant } : {};
+}
+/** Whether this workspace's company signs in through its own identity provider. */
+async function usesCompanyLogin(url, tenant) {
+    try {
+        const res = await fetch(`${url}/api/v1/auth/sso/providers`, { headers: headersFor(tenant) });
+        if (!res.ok)
+            return false;
+        const body = await res.json();
+        return (body.providers?.length ?? 0) > 0 && body.password_enabled === false;
+    }
+    catch {
+        return false;
+    }
+}
+function openInBrowser(address) {
+    const { spawn } = require('node:child_process');
+    const [cmd, argv] = process.platform === 'darwin' ? ['open', [address]]
+        : process.platform === 'win32' ? ['cmd', ['/c', 'start', '', address]]
+            : ['xdg-open', [address]];
+    try {
+        spawn(cmd, argv, { stdio: 'ignore', detached: true }).on('error', () => { }).unref();
+    }
+    catch { /* the address is printed as well */ }
+}
+/** The portal's own device sign in: approve in a browser, get a token back. */
+async function approveInBrowser(url, tenant, noBrowser) {
+    const form = (fields) => ({
+        method: 'POST',
+        headers: { ...headersFor(tenant), 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams(fields).toString(),
+    });
+    let started;
+    try {
+        const res = await fetch(`${url}/oauth/device_authorization`, form({ client_id: CLIENT_ID, scope: 'api:read api:write' }));
+        if (!res.ok) {
+            out(ui.fail(res.status === 404 || res.status === 405
+                ? 'That workspace is running a build without browser sign in.'
+                : 'The workspace would not start a browser sign in.'));
+            return '';
+        }
+        started = await res.json();
+    }
+    catch {
+        out(ui.fail(`Could not reach ${url}. Check your connection and try again.`));
+        return '';
+    }
+    out();
+    if (noBrowser) {
+        out(`  On any device, open ${ui.c.bold(started.verification_uri)}`);
+        out(`  and enter the code ${ui.c.bold(started.user_code)}`);
+    }
+    else {
+        out(ui.info('Your company signs in through its own login page. Opening your browser.'));
+        out(`  If it does not open, go to ${started.verification_uri_complete}`);
+        out(`  and confirm the code ${ui.c.bold(started.user_code)}`);
+        openInBrowser(started.verification_uri_complete);
+    }
+    out(ui.c.dim('  waiting for you to approve it there...'));
+    const deadline = Date.now() + Math.max(30, started.expires_in || 600) * 1000;
+    let wait = Math.max(1, started.interval || 5);
+    while (Date.now() < deadline) {
+        await new Promise((r) => setTimeout(r, wait * 1000));
+        let res;
+        try {
+            res = await fetch(`${url}/oauth/token`, form({ grant_type: DEVICE_GRANT, device_code: started.device_code, client_id: CLIENT_ID }));
+        }
+        catch {
+            continue;
+        }
+        const body = await res.json().catch(() => ({}));
+        if (res.ok && body.access_token)
+            return body.access_token;
+        if (body.error === 'authorization_pending')
+            continue;
+        if (body.error === 'slow_down') {
+            wait += 5;
+            continue;
+        }
+        out(ui.fail(body.error === 'access_denied' ? 'The sign in was declined in the browser.'
+            : 'That sign in was not approved.'));
+        return '';
+    }
+    out(ui.fail('That code expired before it was approved. Run comprism login again.'));
+    return '';
+}
 async function runLogin(args) {
-    out(ui.banner('Sign in'));
+    // SIGN IN WITH AN INSTALL KEY (web manual 12.1). The key made on the
+    // Install and setup page is this machine's credential, so setup is the one
+    // command the page shows and nothing is typed. It needs no terminal, because
+    // the install script runs it on a pipe.
+    const keyAt = args.indexOf('--key');
+    if (keyAt >= 0)
+        return loginWithKey(args[keyAt + 1], args);
+    // Password and second factor entry require a person at a terminal. Do not
+    // open readline on a pipe: it can wait forever, or exit successfully at EOF
+    // without signing in. Check before workspace lookup or reading credentials.
+    if (process.stdin.isTTY !== true) {
+        out(ui.fail('Signing in requires an interactive terminal.'));
+        out('  Run comprism login in a terminal, then run your command again.');
+        process.exitCode = 1;
+        return;
+    }
+    // Under the session's own mark when the session is about to open, so the
+    // name is not drawn twice in a row.
+    out(args.includes('--into-session') ? `  ${ui.c.bold('Sign in')}` : ui.banner('Sign in'));
     out();
     // Flags still work, for a script or a second machine. A person gets asked.
     const flag = (name) => {
         const i = args.indexOf(name);
         return i >= 0 ? args[i + 1] : undefined;
     };
-    const username = flag('--username') || flag('--email') || await (0, prompt_1.ask)('  email:    ');
+    // THE LAST PERSON, OFFERED. Signing in again is Enter: the email and the
+    // workspace they used last time, exactly as they were, so a local workspace
+    // stays local instead of being looked up again and sent to production.
+    const { readLast, saveLast, forgetLast, savedPassword, savePassword, forgetPassword, keychainAvailable } = await Promise.resolve().then(() => __importStar(require('../lib/lastlogin')));
+    if (args.includes('--forget')) {
+        forgetLast();
+        out(ui.ok('The last sign in and any saved password on this Mac are forgotten.'));
+        out();
+        return;
+    }
+    const last = flag('--username') || flag('--email') || flag('--workspace') ? null : readLast();
+    if (last) {
+        out(`  ${ui.c.dim('last time')}  ${ui.c.bold(last.email)} ${ui.c.dim('at')} ${ui.c.bold(last.workspace)}`);
+        out(`  ${ui.c.dim('press Enter to sign in as them, or type another email')}`);
+    }
+    const typedEmail = flag('--username') || flag('--email') || await (0, prompt_1.askOrCancel)('  email:    ');
+    // Ctrl+C is "never mind", not "yes, the last person".
+    if (typedEmail === null) {
+        out();
+        out(ui.c.dim('  sign in canceled'));
+        out();
+        return;
+    }
+    const username = typedEmail || last?.email || '';
+    const again = Boolean(last && username === last.email);
     if (!username) {
         out(ui.fail('An email address is needed.'));
         out();
@@ -143,16 +275,21 @@ async function runLogin(args) {
         return;
     }
     // Where this person's workspace is. Asked of the product, not of them.
-    let typedWorkspace = flag('--workspace');
+    let typedWorkspace = flag('--workspace') || (again ? last?.workspace : undefined);
     // Captured BEFORE the email lookup can fill it in. A workspace the product
     // worked out is not a workspace the person typed, and only the second may be
-    // a local address. See the fence in `writeConnection`.
-    const typedByHand = Boolean(typedWorkspace);
+    // a local address. See the fence in `writeConnection`. The last sign in
+    // counts as typed only if it was typed then.
+    const typedByHand = Boolean(flag('--workspace')) || Boolean(again && last?.typed);
     if (!typedWorkspace) {
         const live = new ui.LiveIndicator();
         live.start('finding your workspace');
-        typedWorkspace = (await resolveWorkspace(username)) || undefined;
-        live.stop();
+        try {
+            typedWorkspace = (await resolveWorkspace(username)) || undefined;
+        }
+        finally {
+            live.stop();
+        }
         // The indicator clears its own line but leaves the cursor mid-row, so the
         // next prompt landed after a run of blanks.
         process.stdout.write('\r');
@@ -167,8 +304,27 @@ async function runLogin(args) {
     }
     const url = workspaceUrl(typedWorkspace);
     const tenant = tenantFor(url, typedWorkspace, flag('--tenant'));
-    const password = await (0, prompt_1.askHidden)('  password: ');
-    if (!password) {
+    // Said before the password is asked for, so a person can see which company
+    // they are about to sign in to (manual 1.3).
+    out(`  workspace: ${url}`);
+    // COMPANY LOGIN (manual 1.10). A workspace whose company signs in through
+    // its own identity provider is signed in to in a browser; this tool never
+    // sees that password. `--device` is the same thing for a machine with no
+    // browser: a short code to approve from any other device.
+    const byCompany = args.includes('--device') || args.includes('--browser')
+        || await usesCompanyLogin(url, tenant);
+    const deviceToken = byCompany ? await approveInBrowser(url, tenant, args.includes('--device')) : '';
+    if (byCompany && !deviceToken) {
+        out();
+        process.exitCode = 1;
+        return;
+    }
+    // The keychain first, when the person chose to keep it there last time.
+    const kept = byCompany ? null : savedPassword(username, typedWorkspace);
+    if (kept)
+        out(`  ${ui.c.dim('password: from your Mac keychain')}`);
+    const password = byCompany ? '' : kept || await (0, prompt_1.askHidden)('  password: ');
+    if (!byCompany && !password) {
         out(ui.fail('A password is needed.'));
         out();
         process.exitCode = 1;
@@ -185,7 +341,7 @@ async function runLogin(args) {
     let signInMessage = '';
     {
         let reply = await (0, gateway_1.askAt)(url, {
-            intent: 'sign_in', prompt: username, password,
+            intent: 'sign_in', prompt: username, password, deviceToken,
             machineLabel: `comprism on ${node_os_1.default.hostname()}`,
         }, tenant);
         if (reply.served === false) {
@@ -198,8 +354,9 @@ async function runLogin(args) {
         }
         if (!reply.ok) {
             out();
-            out(ui.fail(`Could not reach ${url}.`));
-            out(`      ${ui.c.dim('check the workspace name, and that you are on the network')}`);
+            out(ui.fail(reply.httpStatus
+                ? (reply.message || 'The service refused the sign in request.')
+                : `Could not reach ${url}. Check your connection and try again.`));
             out();
             process.exitCode = 1;
             return;
@@ -210,7 +367,7 @@ async function runLogin(args) {
         if (reply.sign_in?.needs_second_factor && reply.sign_in.challenge) {
             out();
             out(ui.info('This account uses a second step. Check your authenticator app or your email.'));
-            const code = await (0, prompt_1.ask)('  code:      ');
+            const code = await (0, prompt_1.askHidden)('  code from your authenticator app: ');
             if (!code) {
                 out(ui.fail('A code is needed to finish signing in.'));
                 out();
@@ -231,6 +388,10 @@ async function runLogin(args) {
             }
         }
         if (!reply.sign_in?.token) {
+            // A kept password that no longer works is removed, so the next sign in
+            // asks for the new one instead of failing the same way again.
+            if (kept)
+                forgetPassword(username, typedWorkspace);
             out();
             out(ui.fail(reply.message || 'That username and password were not accepted.'));
             out(`      ${ui.c.dim('check the workspace name too: a right password in the wrong workspace looks the same')}`);
@@ -254,31 +415,10 @@ async function runLogin(args) {
         process.exitCode = 1;
         return;
     }
-    // Enrol the machine while we still hold the session, so signing in is one
-    // step rather than a sign in followed by something else to remember.
-    // The machine credential came back WITH the sign in, from the one service,
-    // which is why there is no second call here any more. An existing one is
-    // kept: signing in twice must not leave two entries in the workspace's own
-    // list of machines.
+    // A previous credential may belong to another account or workspace, or
+    // have been revoked during this sign in. Only retain the newly issued key.
     const existing = (0, connection_1.readConnection)();
-    // The key this sign in just issued wins.
-    //
-    // This used to prefer whatever was already on the machine, so that signing
-    // in twice did not leave two entries in the workspace's own list of
-    // machines. The rule was right for the same person signing in again and
-    // wrong for every other case: sign in as a different account, or into a
-    // different workspace, and the machine carried on holding the OLD key. The
-    // sign in reported success, the header then said the workspace could not be
-    // reached, and nothing anywhere said that the credential belonged to
-    // somebody else. A revoked key behaved the same way.
-    //
-    // The server already ends the previous credential for this machine when it
-    // issues one, so taking the new key does not leave two live. The old one is
-    // kept only when the server issued nothing at all, which is the case where
-    // there is nothing better to hold.
-    const workspaceKey = signedIn?.machine_credential
-        || existing?.workspaceKey
-        || undefined;
+    const workspaceKey = signedIn?.machine_credential || undefined;
     // `typedByHand` is the second half of the fence in `writeConnection`. It is
     // true only when the person put the address on this command line, in this
     // run. A workspace resolved from their email domain, or an address a server
@@ -312,16 +452,39 @@ async function runLogin(args) {
         process.exitCode = 1;
         return;
     }
+    // So a new terminal presents the key just issued, not the last one or none.
+    for (const profile of (await Promise.resolve().then(() => __importStar(require('./install')))).finishSetup())
+        out(`  Finishing setup: added one line to ${profile}`);
+    // Remembered for next time: who, and where, exactly as used now.
+    saveLast({ email: username, workspace: typedWorkspace, typed: typedByHand });
+    if (!byCompany && !kept && password && keychainAvailable()) {
+        const keep = (await (0, prompt_1.ask)('  keep your password in your Mac keychain, so next time is just Enter? (y/n) '))
+            .trim().toLowerCase();
+        if (keep === 'y' || keep === 'yes') {
+            out(savePassword(username, typedWorkspace, password)
+                ? `  ${ui.c.dim('kept in your keychain; remove it with')} ${ui.c.bold('comprism login --forget')}`
+                : `  ${ui.c.dim('the keychain would not take it; you will be asked next time')}`);
+        }
+    }
     out();
-    out(ui.ok(`Signed in to ${ui.c.bold(url)}`));
+    // Where this machine will actually talk to: the address typed, when one was.
+    const where = (typedByHand && url) || signedIn?.workspace_url || url;
+    const onLaptop = /localhost|127\.0\.0\.1/.test(where);
+    out(ui.ok(`Signed in as ${ui.c.bold(username)} ${onLaptop
+        ? `on this laptop (${ui.c.bold(where.replace(/^https?:\/\//, ''))})`
+        : `at ${ui.c.bold(where)}`}.`));
     if (workspaceKey) {
-        out(`      ${ui.c.dim('this machine is enrolled and revocable on its own')}`);
+        out(`      ${ui.c.dim('This machine is enrolled and can be revoked from Administration.')}`);
         // Straight into the welcome screen, so the first thing after signing in is
         // where they are rather than another instruction.
-        const { showWelcome } = await Promise.resolve().then(() => __importStar(require('./welcome')));
-        await showWelcome();
+        // Unless the session is about to open, which draws it itself.
+        if (!args.includes('--into-session')) {
+            const { showWelcome } = await Promise.resolve().then(() => __importStar(require('./welcome')));
+            await showWelcome();
+        }
     }
     else {
+        process.exitCode = 1;
         out(ui.warn('Signed in, but this machine could not be enrolled.'));
         // The workspace's OWN reason, carried back with the sign in. It used to
         // come from a local variable set by a separate call, which meant a blank
@@ -331,6 +494,48 @@ async function runLogin(args) {
     }
     out();
 }
+/** Enrol this machine with an install key: checked with the service, then kept. */
+async function loginWithKey(key, args) {
+    const flag = (name) => {
+        const i = args.indexOf(name);
+        return i >= 0 ? args[i + 1] : undefined;
+    };
+    const typed = flag('--workspace');
+    if (!key || !typed) {
+        out(ui.fail('Signing in with a key needs the key and the workspace: comprism login --key <key> --workspace <address>'));
+        process.exitCode = 1;
+        return;
+    }
+    const url = workspaceUrl(typed);
+    const tenant = tenantFor(url, typed, flag('--tenant'));
+    const { ask: askWith } = await Promise.resolve().then(() => __importStar(require('../lib/gateway')));
+    const existing = (0, connection_1.readConnection)();
+    try {
+        (0, connection_1.writeConnection)({
+            url, token: '', workspaceKey: key, ...(tenant ? { tenant } : {}),
+            everyMinutes: existing?.everyMinutes ?? 5,
+            connectedAt: new Date().toISOString(),
+        }, true);
+    }
+    catch (err) {
+        out(ui.fail(err instanceof Error ? err.message : 'the workspace address was refused'));
+        process.exitCode = 1;
+        return;
+    }
+    const reply = await askWith({ intent: 'catalog', prompt: '' });
+    if (!reply.ok) {
+        if (existing)
+            (0, connection_1.writeConnection)(existing, true);
+        out(ui.fail(reply.message || `That key was not accepted by ${url}.`));
+        out(`      ${ui.c.dim('make a new one on the Install and setup page')}`);
+        process.exitCode = 1;
+        return;
+    }
+    for (const profile of (await Promise.resolve().then(() => __importStar(require('./install')))).finishSetup())
+        out(`  Finishing setup: added one line to ${profile}`);
+    out(ui.ok(`This machine is enrolled at ${ui.c.bold(url)}.`));
+    out(`      ${ui.c.dim('It can be revoked from Developers, Install and setup.')}`);
+}
 /**
  * Which workspace an email belongs to.
  *
@@ -359,8 +564,9 @@ async function resolveWorkspace(email) {
     // because a person looking for their workspace does not have one yet.
     const root = `https://${WORKSPACE_DOMAIN}`;
     const reply = await (0, gateway_1.askAt)(root, { intent: 'resolve_workspace', prompt: email });
-    if (!reply.ok || reply.served === false)
-        return null;
+    if (!reply.ok || reply.served === false || reply.complete === false) {
+        throw new Error(reply.message || 'Your workspace could not be looked up. Try again later.');
+    }
     const url = reply.session?.workspace_url;
     if (!url)
         return null;

package/out/commands/memory.d.ts

@@ -0,0 +1,3 @@
+/** `comprism memory add` and the session word `remember`. */
+export declare function addNote(text: string): Promise<number>;
+export declare function cmdMemory(args: string[]): Promise<number>;

package/out/commands/memory.js

@@ -0,0 +1,113 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.addNote = addNote;
+exports.cmdMemory = cmdMemory;
+/**
+ * `comprism memory` (manual 2.9): this project's notes. They are files under
+ * `.completionprism/memory/`; this command lists them, and adds, removes and
+ * opens them as the service says. Which notes are used, numbering and every
+ * word shown are the service's.
+ */
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const project_ops_1 = require("../lib/project-ops");
+const ui = __importStar(require("../lib/ui"));
+const out = (s = "") => process.stdout.write(s + "\n");
+const FOLDER = ".completionprism/memory";
+const SETTINGS_FILES = [".completionprism/settings.local.json", ".completionprism/settings.json"];
+function notes(root) {
+    let names = [];
+    try {
+        names = fs.readdirSync(path.join(root, FOLDER)).filter((n) => n.endsWith(".md")).sort();
+    }
+    catch { /* none yet */ }
+    return names
+        .map((n) => ({ file: `${FOLDER}/${n}`, text: (0, project_ops_1.readInside)(root, `${FOLDER}/${n}`) ?? "" }))
+        .filter((n) => n.text.trim());
+}
+/** Carry out what the service said to write or delete, inside the project. */
+function apply(facts, data) {
+    const write = data?.write;
+    if (write?.key)
+        (0, project_ops_1.writeSetting)(facts.root, write.file, write.key, write.value);
+    else if (write?.file && typeof write.content === "string") {
+        const full = path.join(facts.root, write.file);
+        fs.mkdirSync(path.dirname(full), { recursive: true });
+        fs.writeFileSync(full, write.content);
+    }
+    const gone = data?.delete;
+    if (typeof gone === "string" && gone.startsWith(`${FOLDER}/`))
+        fs.rmSync(path.join(facts.root, gone), { force: true });
+}
+/** `comprism memory add` and the session word `remember`. */
+async function addNote(text) {
+    const facts = await (0, project_ops_1.currentProject)();
+    const reply = await (0, project_ops_1.call)("memory", "add", { text }, facts);
+    if (!reply)
+        return 1;
+    apply(facts, reply.data);
+    return 0;
+}
+async function cmdMemory(args) {
+    const [verb, ...rest] = args;
+    const facts = await (0, project_ops_1.currentProject)();
+    const base = { notes: notes(facts.root), files: (0, project_ops_1.readSome)(facts.root, SETTINGS_FILES) };
+    if (verb === "add")
+        return addNote(rest.join(" "));
+    if (verb === "edit") {
+        const files = base.notes.map((n) => path.join(facts.root, n.file));
+        if (!files.length) {
+            out(ui.info('No notes yet. Add one with: comprism memory add "<text>"'));
+            return 0;
+        }
+        return (await (0, project_ops_1.openEditor)(files)) ? 0 : 1;
+    }
+    if (verb === "forget" || verb === "on" || verb === "off") {
+        const reply = await (0, project_ops_1.call)("memory", verb, { ...base, number: rest[0] }, facts);
+        if (!reply)
+            return 1;
+        apply(facts, reply.data);
+        return 0;
+    }
+    if (verb) {
+        out(ui.fail(`\`memory ${verb}\` is not a command. Use add, edit, forget N, on or off.`));
+        return 2;
+    }
+    out();
+    const reply = await (0, project_ops_1.call)("memory", "list", base, facts);
+    out();
+    return reply ? 0 : 1;
+}

package/out/commands/permissions.d.ts

@@ -0,0 +1 @@
+export declare function cmdPermissions(args: string[]): Promise<number>;

package/out/commands/permissions.js

@@ -0,0 +1,94 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cmdPermissions = cmdPermissions;
+/**
+ * `comprism permissions` and `comprism permissions why <action> "<target>"`
+ * (manual 4.14).
+ *
+ * This reads the project's settings files and sends their text; the service
+ * decides and writes every line printed, with the same decision the agent's
+ * jobs use, so `why` and a real job can never disagree.
+ */
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const gateway_1 = require("../lib/gateway");
+const ui = __importStar(require("../lib/ui"));
+const sessions_1 = require("../lib/sessions");
+/** The settings files that can hold rules, relative to the project root. The
+ *  service decides which of them count and how. */
+const RULE_FILES = [
+    '.completionprism/settings.json', '.completionprism/settings.local.json',
+    '.comprism/settings.json', '.comprism/settings.local.json',
+];
+const USAGE = 'Usage: comprism permissions, or comprism permissions why <action> "<target>"';
+async function cmdPermissions(args) {
+    const [op, action, ...rest] = args;
+    if (op && op !== 'why') {
+        process.stderr.write(`  ${USAGE}\n`);
+        return 2;
+    }
+    if (op === 'why' && (!action || rest.length === 0)) {
+        process.stderr.write(`  ${USAGE}\n`);
+        return 2;
+    }
+    const { resolveProject, asWire } = await Promise.resolve().then(() => __importStar(require('../lib/project')));
+    const { currentWorkspace } = await Promise.resolve().then(() => __importStar(require('./settings')));
+    const facts = resolveProject(currentWorkspace().path, []);
+    const files = {};
+    for (const rel of RULE_FILES) {
+        try {
+            files[rel] = fs.readFileSync(path.join(facts.root, rel), 'utf8');
+        }
+        catch { /* none */ }
+    }
+    const reply = await (0, gateway_1.ask)({
+        intent: 'permissions',
+        prompt: '',
+        project: asWire(facts),
+        permissionsPayload: {
+            op: op === 'why' ? 'why' : 'list', action, target: rest.join(' '), files,
+        },
+    });
+    const lines = reply.permissions?.lines;
+    if (!reply.ok || !Array.isArray(lines)) {
+        process.stderr.write(ui.fail(reply.served === false
+            ? 'Your workspace is running a build without permission answers yet.'
+            : (0, sessions_1.failure)(reply)) + '\n');
+        return (0, sessions_1.exitFor)(reply);
+    }
+    process.stdout.write(`${lines.join('\n')}\n`);
+    return 0;
+}

package/out/commands/plugins.d.ts

@@ -0,0 +1,4 @@
+/** Every text file in the folder, by path inside it. Never runs anything. */
+export declare function readFolder(dir: string): Record<string, string>;
+export declare const PLUGINS_HELP = "  comprism plugins                       installed plugins and their state\n  comprism plugins install <name|folder> install from your company's catalog or a folder\n      --scope project|personal           skip the question\n  comprism plugins enable <name>         comprism plugins disable <name>\n  comprism plugins update <name>         shows what changes, then asks\n  comprism plugins remove <name>";
+export declare function cmdPlugins(args: string[]): Promise<number>;