@impeccable/reviews 0.1.0

package/dist/vercel-bypass.js

@@ -0,0 +1,136 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+/**
+ * Getting past Vercel's Deployment Protection the way Vercel documents it for tools: Protection Bypass for Automation, a
+ * secret of the project that a request sends in the x-vercel-protection-bypass header (every plan has it; a team member
+ * or a project administrator makes one). The Vercel CLI on this machine, signed in as the person, reads and makes it in
+ * the command's own process: what those commands print is the secret, so the agent's shell never runs them (fence.ts),
+ * and no secret goes back to the model. The person consents once, on the tool's screen, before one is made; a secret
+ * opens the locked address before anything saves it.
+ */
+/** The header Vercel reads the secret from. */
+export const BYPASS_HEADER = 'x-vercel-protection-bypass';
+/** The label the secret carries in the project's settings, so the person knows whose it is and can revoke it. */
+export const SECRET_NOTE = 'Impeccable reviews';
+/** Vercel makes its secrets of 32 letters and digits, and takes no other. */
+export const isBypassSecret = (value) => typeof value === 'string' && /^[A-Za-z0-9]{32}$/.test(value);
+/** The CLI's read of the linked project's protection: `protectionBypass` maps each secret to its note and creation time. */
+export const READ = ['project', 'protection', '--format', 'json', '--non-interactive'];
+/** The CLI's own way to make a secret, which carries no label, for a CLI without `api`. */
+export const MAKE_CLI = ['project', 'protection', 'enable', '--protection-bypass', '--non-interactive'];
+/** `vercel api` (beta) for PATCH /v1/projects/{id}/protection-bypass with `generate.note`, so the secret carries the label; a team's project needs its team on the request. */
+export const makeApi = (link) => [
+    'api',
+    `/v1/projects/${encodeURIComponent(link.projectId)}/protection-bypass${link.orgId.startsWith('team_') ? `?teamId=${encodeURIComponent(link.orgId)}` : ''}`,
+    '--method', 'PATCH',
+    '--field', `generate=${JSON.stringify({ note: SECRET_NOTE })}`,
+    '--raw', '--non-interactive',
+];
+const record = (value) => (value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined);
+export async function readLink(cwd) {
+    try {
+        const link = record(JSON.parse(await readFile(join(cwd, '.vercel', 'project.json'), 'utf8')));
+        return typeof link?.projectId === 'string' && typeof link.orgId === 'string' ? { projectId: link.projectId, orgId: link.orgId } : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The linked project's name and automation secrets; null when the CLI could not say: signed out, not linked, or the role does not allow it. */
+async function readProject(run) {
+    let settings;
+    try {
+        const printed = await run(READ);
+        settings = record(JSON.parse(printed.slice(printed.indexOf('{'), printed.lastIndexOf('}') + 1)));
+    }
+    catch {
+        return null;
+    }
+    if (typeof settings?.projectId !== 'string')
+        return null;
+    const secrets = Object.entries(record(settings.protectionBypass) ?? {}).flatMap(([value, meta]) => {
+        const m = record(meta);
+        return isBypassSecret(value) && m?.scope === 'automation-bypass' ? [{ value, ...(typeof m.note === 'string' ? { note: m.note } : {}), createdAt: Number(m.createdAt) || 0 }] : [];
+    });
+    return { name: typeof settings.name === 'string' ? settings.name : '', secrets };
+}
+/** Impeccable's secret among the project's: the newest labelled for it; else, after the CLI made one without a label, the newest of those that were not there `before`. */
+function pick(secrets, before) {
+    const newest = (list) => [...list].sort((a, b) => b.createdAt - a.createdAt)[0];
+    return newest(secrets.filter((s) => s.note === SECRET_NOTE)) ?? (before && newest(secrets.filter((s) => !before.has(s.value))));
+}
+/** Makes the secret with the label through `vercel api`; a CLI without `api` (or one Vercel refuses) falls back to its own command, which the same role check stops. */
+async function make(run, link) {
+    if (link) {
+        try {
+            await run(makeApi(link));
+            return true;
+        }
+        catch {
+            // The CLI's own command below fails the same way when the role is missing, and works when `api` is the one missing.
+        }
+    }
+    try {
+        await run(MAKE_CLI);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Gets a bypass secret in place for the address Vercel's login stands in front of, and saves only one that opens it. The
+ * project's own labelled secret needs no question; with none, the person's yes has the CLI make one, read back by its
+ * label (or, from the CLI's own command, as the one that was not there before); when the CLI cannot read or make one, or
+ * what it gave opens nothing, the person may paste one.
+ */
+export async function passVercelLogin(deps) {
+    const project = await readProject(deps.run);
+    const from = project?.name ? { project: project.name } : {};
+    const finish = async (secret, how) => {
+        deps.remember(secret);
+        const proof = await deps.prove(secret);
+        if (!proof.proven)
+            return { reason: proof.reason ?? 'The address did not open with the secret.' };
+        const failed = await deps.save(secret);
+        return failed ? { status: 'save-failed', reason: failed, ...from } : { status: 'saved', secret: how, ...from, value: secret };
+    };
+    /** Why the CLI's way ended without a secret that opens the preview, for the paste screen's skip. */
+    let stopped;
+    if (!project)
+        stopped = 'The Vercel CLI could not read the project: it is signed out, this folder is not linked to the project, or the role does not allow it.';
+    else {
+        const own = pick(project.secrets);
+        if (own) {
+            const done = await finish(own.value, 'existing');
+            if ('status' in done)
+                return done;
+            stopped = done.reason;
+        }
+        else {
+            if (!(await deps.consent()))
+                return { status: 'skipped', reason: 'The person skipped creating a bypass secret.', ...from };
+            const before = new Set(project.secrets.map((s) => s.value));
+            if (!(await make(deps.run, await deps.link())))
+                stopped = 'The Vercel CLI could not make a bypass secret on the project: that takes the Member role or Project Administrator.';
+            else {
+                const ours = pick((await readProject(deps.run))?.secrets ?? [], before);
+                if (!ours)
+                    stopped = 'The secret the Vercel CLI made could not be read back.';
+                else {
+                    const done = await finish(ours.value, 'created');
+                    if ('status' in done)
+                        return done;
+                    stopped = done.reason;
+                }
+            }
+        }
+    }
+    const typed = await deps.paste();
+    if (typed === undefined)
+        return { status: 'skipped', reason: stopped, ...from };
+    if (!isBypassSecret(typed))
+        return { status: 'refused', reason: 'What was typed is not a Vercel bypass secret: Vercel makes them of 32 letters and digits.', ...from };
+    const done = await finish(typed, 'typed');
+    return 'status' in done ? done : { status: 'refused', reason: done.reason, ...from };
+}

package/dist/vercel.js

@@ -0,0 +1,70 @@
+import { setTimeout as sleep } from 'node:timers/promises';
+/** `vercel whoami`: the CLI prints the username, or says it has no credentials and exits 1. */
+export async function vercelStatus(vercel) {
+    try {
+        const user = (await vercel(['whoami'])).trim().split('\n').at(-1)?.trim() ?? '';
+        return /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(user) ? { cli: 'signed-in', user } : { cli: 'unknown' };
+    }
+    catch (err) {
+        if (err.missing)
+            return { cli: 'missing' };
+        const said = String(err.stdout ?? '') + String(err.stderr ?? '');
+        return /credentials|log ?in|logged out/i.test(said) ? { cli: 'signed-out' } : { cli: 'unknown' };
+    }
+}
+/**
+ * `vercel teams ls --json`: the teams the person is a member of, each by its slug (what `--team` takes) and name, and
+ * which one is the CLI's current scope. The JSON is on stdout; the table the CLI prints otherwise goes to stderr.
+ */
+export async function vercelTeams(vercel) {
+    try {
+        const listed = JSON.parse(await vercel(['teams', 'ls', '--json'])).teams;
+        return (Array.isArray(listed) ? listed : []).flatMap((team) => typeof team.slug === 'string' && /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(team.slug)
+            ? [{ value: team.slug, label: typeof team.name === 'string' && team.name ? team.name.slice(0, 100) : team.slug, current: team.current === true }]
+            : []);
+    }
+    catch {
+        return [];
+    }
+}
+/** Where Vercel's GitHub app is installed or given more repositories. */
+export const VERCEL_APP_PAGE = 'https://github.com/apps/vercel/installations/new';
+/**
+ * `vercel git connect` in the linked folder: it connects the Git remote (exit 0), says the repository is connected to
+ * the project already (exit 1), or fails to connect it, which is Vercel's GitHub app not reaching the repository
+ * ("Make sure … that you have access to the repository").
+ */
+export async function connectVercelProject(vercel) {
+    let said;
+    try {
+        await vercel(['git', 'connect']);
+        return { connected: true };
+    }
+    catch (err) {
+        if (err.missing)
+            return { connected: false, reason: 'The Vercel CLI is not installed.' };
+        said = String(err.stdout ?? '') + String(err.stderr ?? '');
+    }
+    if (/already connected to your project/i.test(said))
+        return { connected: true };
+    if (/failed to connect|access to the repository|install github app/i.test(said))
+        return { connected: false, access: VERCEL_APP_PAGE, reason: "Vercel's GitHub app cannot reach the repository." };
+    return { connected: false, reason: 'Vercel did not connect the repository.' };
+}
+/** Tries the connection again every `wait.everyMs` until it is made or `wait.totalMs` has passed (or the run stopped): the person is giving Vercel's GitHub app access meanwhile. */
+export async function waitForVercelAccess(vercel, deps) {
+    const now = deps.now ?? Date.now;
+    let result = { connected: false, access: VERCEL_APP_PAGE };
+    for (const end = now() + deps.wait.totalMs; !deps.signal?.aborted;) {
+        result = await connectVercelProject(vercel);
+        if (result.connected || !result.access || now() >= end)
+            return result;
+        try {
+            await (deps.sleep ?? ((ms) => sleep(ms, undefined, { signal: deps.signal })))(deps.wait.everyMs);
+        }
+        catch {
+            return result;
+        }
+    }
+    return result;
+}

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@impeccable/reviews",
+  "version": "0.1.0",
+  "description": "Set up a repository for Impeccable for PRs from your terminal.",
+  "license": "UNLICENSED",
+  "private": false,
+  "type": "module",
+  "bin": {
+    "impeccable-reviews": "dist/bin.js"
+  },
+  "files": [
+    "dist",
+    "!dist/smoke.js",
+    "!dist/eval"
+  ],
+  "engines": {
+    "node": ">=22.19.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json && tsc -p eval/tsconfig.json && node scripts/copy-static.mjs",
+    "prepack": "npm run build",
+    "test": "vitest run --dir test",
+    "smoke": "npm run build && node dist/smoke.js",
+    "eval": "npm run build && node dist/eval/main.js"
+  },
+  "dependencies": {
+    "@earendil-works/pi-coding-agent": "~0.87.1",
+    "@earendil-works/pi-tui": "~0.87.1"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.4",
+    "playwright": "~1.63.0",
+    "typescript": "^5.9.3",
+    "vitest": "^5.0.2"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}