@impeccable/reviews 0.1.5 → 0.1.7

package/dist/ui/bridge.js

@@ -1,10 +1,24 @@
 import { createInterface } from 'node:readline';
 import { Writable } from 'node:stream';
-import { noteSensitiveAnswer } from './sensitive.js';
+import { noteSensitiveAnswer, plainText } from './sensitive.js';
 let mounted = null;
+/** A question as the person sees it: every line of it plain text. */
+function shown(q) {
+    const out = { ...q, prompt: plainText(q.prompt) };
+    for (const key of ['title', 'hint', 'prefill', 'caution', 'confirmLabel', 'skipLabel']) {
+        const text = q[key];
+        if (text !== undefined)
+            out[key] = plainText(text);
+    }
+    if (q.fields)
+        out.fields = [plainText(q.fields[0]), plainText(q.fields[1])];
+    if (q.options)
+        out.options = q.options.map((o) => ({ ...o, label: plainText(o.label) }));
+    return out;
+}
 /** Asks the person: the question on the screen, or printed with one line read from stdin. */
 export async function askPerson(q) {
-    const answer = await (mounted ? mounted.ask(q) : askOnStdin(q));
+    const answer = await (mounted ? mounted.ask(shown(q)) : askOnStdin(shown(q)));
     if (q.sensitive)
         for (const value of [answer.value, ...(answer.values ?? [])])
             if (value)
@@ -15,11 +29,11 @@ export async function askPerson(q) {
 }
 /** A status line for the status band. */
 export function reportStatus(line) {
-    mounted?.status(line);
+    mounted?.status(plainText(line));
 }
 /** Replaces the task list. */
 export function reportTasks(tasks) {
-    mounted?.tasks(tasks);
+    mounted?.tasks(tasks.map((t) => ({ ...t, title: plainText(t.title) })));
 }
 /** The run waits on something outside it (a host's build): the screen counts the time up beside the status line until `null` ends it. */
 export function reportWait(wait) {

package/dist/ui/look.js

@@ -304,7 +304,7 @@ function pageOf(f, inner) {
                 heading: scene.again ? 'Sign in again' : START.heading,
                 text: said(scene.again ? AGAIN[scene.again] : 'Sign in with GitHub in your browser, then approve this repository.', inner, st),
                 rule: divider(inner, st),
-                action: [...checkout, ...link, ...(under ? ['', center(st.full(under), inner)] : []), ...(scene.copied === false ? ['', copyWay(inner, st)] : [])],
+                action: [...checkout, ...link, ...(under ? ['', center(st.full(under), inner)] : []), ...(scene.copied ? [] : ['', copyWay(inner, st)])],
             };
         }
         case 'run':

package/dist/ui/screens.js

@@ -7,6 +7,7 @@ import { mountUi } from './bridge.js';
 import { createFrameWriter, frameState } from './frames.js';
 import { CLOSES_AFTER_MINUTES, drawFrame, OUTCOME, PRODUCT, palette } from './look.js';
 import { RunState } from './run-state.js';
+import { plainText } from './sensitive.js';
 /** What the command does before a screen ends it at once (Ctrl+C before a run, or a signal): report the stop (main.ts), briefly. */
 let beforeExit = async () => { };
 export function onScreenExit(fn) {
@@ -439,7 +440,7 @@ export function showIntro(repository, note) {
 }
 /**
  * The sign-in screen, in place of whatever is showing, until `close`: the
- * link, put on the clipboard as it opens (`onCopy`, and again on C), and a way
+ * link, put on the clipboard only when the person presses C (`onCopy`), and a way
  * to paste the code from a remote shell (P calls `onPaste`, and a null from it
  * says the code was wrong); Esc calls `onCancel`. Over a run it asks to sign
  * in again.
@@ -453,7 +454,6 @@ export function showSignIn(link, opts) {
     }
     const view = { kind: 'signin', link, opts, pasting: false, again: screen.views.some((v) => v.kind === 'run') && (opts.why ?? 'ran-out') };
     screen.push(view);
-    screen.copy(view);
     return { close: () => screen.remove(view) };
 }
 /**
@@ -505,7 +505,9 @@ export async function showPullRequest(url, hand) {
     });
 }
 /** The last screen: what happened, what is left, any warnings and its pull request (handed over as it appears) or the links, until a key other than ↑↓ PgUp PgDn is pressed, or for 20 minutes. Its summary then stays in the scrollback. */
-export async function showOutro(o, hand) {
+export async function showOutro(outro, hand) {
+    // What is left and why it stopped can be the model's words, which reach the scrollback after the clipboard holds the pull request.
+    const o = { ...outro, result: plainText(outro.result), todo: outro.todo.map(plainText), warnings: outro.warnings.map(plainText) };
     const screen = host();
     if (screen) {
         const copied = o.link && hand ? await handOver(o.link, hand) : false;

package/dist/ui/sensitive.js

@@ -12,3 +12,13 @@ export function noteSensitiveAnswer(value) {
     for (const listener of listeners)
         listener(value);
 }
+/**
+ * What makes a terminal act rather than show text: an escape sequence (CSI, OSC, a string such as DCS, or two characters) or a control
+ * character other than a tab or a newline. OSC 52 writes the clipboard, OSC 0 the window's title, OSC 8 links words to another address.
+ * An OSC or a string that is never ended runs to the next escape, as the terminal reads it.
+ */
+const CONTROL = /\x1b(?:\[[0-?]*[ -/]*[@-~]|[\]PX^_][^\x07\x1b]*(?:\x07|\x1b\\)?|[ -/]*[0-~])?|[\x00-\x08\x0b-\x1f\x7f-\x9f]/g;
+/** `text` without what CONTROL matches: the model's words, and the repository's through them, as the screen and the scrollback show them. */
+export function plainText(text) {
+    return text.replace(CONTROL, '');
+}

package/dist/vercel-bypass.js

@@ -27,17 +27,21 @@ export const makeApi = (link) => [
     '--raw', '--non-interactive',
 ];
 const record = (value) => (value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined);
+/** The ids as Vercel makes them, and nothing else goes into a request's path: the file is in the checkout, which the repository and the sandboxed agent write. */
+const PROJECT_ID = /^prj_[A-Za-z0-9]+$/;
+const ORG_ID = /^(?:team_)?[A-Za-z0-9]+$/;
+/** The link as the file has it; null with no file, or ids that are not Vercel's. What project the ids name is the CLI's to confirm (readOwnProject in vercel.ts). */
 export async function readLink(cwd) {
     try {
         const link = record(JSON.parse(await readFile(join(cwd, '.vercel', 'project.json'), 'utf8')));
-        return typeof link?.projectId === 'string' && typeof link.orgId === 'string' ? { projectId: link.projectId, orgId: link.orgId } : null;
+        return typeof link?.projectId === 'string' && PROJECT_ID.test(link.projectId) && typeof link.orgId === 'string' && ORG_ID.test(link.orgId) ? { projectId: link.projectId, orgId: link.orgId } : null;
     }
     catch {
         return null;
     }
 }
-/** The linked project's name and automation secrets; null when the CLI could not say: signed out, not linked, or the role does not allow it. */
-async function readProject(run) {
+/** The linked project's name and automation secrets; null when the CLI could not say: signed out, not linked, or the role does not allow it; or when what it read is not the project `link` names. */
+async function readProject(run, link) {
     let settings;
     try {
         const printed = await run(READ);
@@ -46,7 +50,7 @@ async function readProject(run) {
     catch {
         return null;
     }
-    if (typeof settings?.projectId !== 'string')
+    if (typeof settings?.projectId !== 'string' || (link && settings.projectId !== link.projectId))
         return null;
     const secrets = Object.entries(record(settings.protectionBypass) ?? {}).flatMap(([value, meta]) => {
         const m = record(meta);
@@ -85,7 +89,8 @@ async function make(run, link) {
  * what it gave opens nothing, the person may paste one.
  */
 export async function passVercelLogin(deps) {
-    const project = await readProject(deps.run);
+    const link = await deps.link();
+    const project = await readProject(deps.run, link);
     const from = project?.name ? { project: project.name } : {};
     const finish = async (secret, how) => {
         deps.remember(secret);
@@ -111,10 +116,10 @@ export async function passVercelLogin(deps) {
             if (!(await deps.consent()))
                 return { status: 'skipped', reason: 'The person skipped creating a bypass secret.', ...from };
             const before = new Set(project.secrets.map((s) => s.value));
-            if (!(await make(deps.run, await deps.link())))
+            if (!(await make(deps.run, link)))
                 stopped = 'The Vercel CLI could not make a bypass secret on the project: that takes the Member role or Project Administrator.';
             else {
-                const ours = pick((await readProject(deps.run))?.secrets ?? [], before);
+                const ours = pick((await readProject(deps.run, link))?.secrets ?? [], before);
                 if (!ours)
                     stopped = 'The secret the Vercel CLI made could not be read back.';
                 else {

package/dist/vercel.js

@@ -1,4 +1,8 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
 import { setTimeout as sleep } from 'node:timers/promises';
+import { matchesBranch, TEST_DRIVE_BRANCH } from './host-previews.js';
+import { readLink } from './vercel-bypass.js';
 /** `vercel whoami`: the CLI prints the username, or says it has no credentials and exits 1. */
 export async function vercelStatus(vercel) {
     try {
@@ -80,6 +84,8 @@ const projectApi = (link, change) => [
     '--raw', '--non-interactive',
 ];
 export const readProjectApi = (link) => projectApi(link);
+/** `vercel api` reading one deployment by its host, GET /v13/deployments/{idOrUrl} (https://vercel.com/docs/rest-api/deployments/get-a-deployment), which names the project it belongs to; a team's deployment needs its team on the request. */
+export const readDeploymentApi = (link, host) => ['api', `/v13/deployments/${encodeURIComponent(host)}${link.orgId.startsWith('team_') ? `?teamId=${encodeURIComponent(link.orgId)}` : ''}`, '--raw', '--non-interactive'];
 /**
  * Vercel Authentication on All Deployments: Vercel's login in front of every address of the project, its production
  * domains included (https://vercel.com/docs/deployment-protection#all-deployments), as the endpoint takes it
@@ -92,39 +98,126 @@ const printedProject = async (vercel, args) => {
     return record(JSON.parse(printed.slice(printed.indexOf('{'), printed.lastIndexOf('}') + 1)));
 };
 const scope = (project) => record(project?.ssoProtection)?.deploymentType;
-/** The linked project as `vercel api` prints it: its production deployment (the production target, or one among the latest) unless every one failed or was cancelled, its Git link's production branch, its protection and its deployments' hosts. Null when the CLI could not read it. */
+/** The linked project as `vercel api` prints it: its production deployment (the production target, or one among the latest) unless every one failed or was cancelled, its Git link's repository and production branch, its protection and its deployments' hosts. Null when the CLI could not read it. */
 export async function readVercelProject(vercel, link) {
+    const project = await readLinkedProject(vercel, link);
+    return project === 'missing' ? null : project;
+}
+/** Vercel's answer for a project it has no record of: the API's error, or the CLI's word for it. */
+const NOT_FOUND = /"code"\s*:\s*"not_found"|project not found/i;
+/** The linked project as readVercelProject reads it, or `missing` when Vercel answers that no such project exists (the link file names one that was deleted, or another team's), as told from a read that failed, which says nothing either way. */
+export async function readLinkedProject(vercel, link) {
     let project;
     try {
         project = await printedProject(vercel, readProjectApi(link));
     }
-    catch {
-        return null;
+    catch (err) {
+        const said = String(err.stdout ?? '') + String(err.stderr ?? '');
+        return NOT_FOUND.test(said) ? 'missing' : null;
     }
+    if (record(project?.error)?.code === 'not_found')
+        return 'missing';
     if (project?.id !== link.projectId)
         return null;
     const target = record(record(project.targets)?.production);
     const latest = (Array.isArray(project.latestDeployments) ? project.latestDeployments : []).map(record).filter((d) => d !== undefined);
     const failed = (d) => d.readyState === 'ERROR' || d.readyState === 'CANCELED';
     const exists = (target !== undefined && !failed(target)) || latest.some((d) => d.target === 'production' && !failed(d));
-    const branch = record(project.link)?.productionBranch;
+    const git = record(project.link);
+    const branch = git?.productionBranch;
+    const repository = git?.type === 'github' && typeof git.org === 'string' && typeof git.repo === 'string' && git.org && git.repo ? `${git.org}/${git.repo}`.toLowerCase() : undefined;
     const protection = scope(project);
+    // Each method is an object while on, null or absent while off (https://vercel.com/docs/rest-api/projects/update-an-existing-project); every scope but Trusted IPs' "production" covers the preview addresses.
+    const ips = record(project.trustedIps);
+    const previewsProtected = record(project.ssoProtection) !== undefined || record(project.passwordProtection) !== undefined || (ips !== undefined && ips.deploymentType !== 'production');
+    const hostname = (value) => (typeof value === 'string' && /^(https?:\/\/)?[a-z0-9.-]{1,253}$/i.test(value) ? value.replace(/^https?:\/\//, '').toLowerCase() : undefined);
     const hosts = [target, ...latest].flatMap((d) => (typeof d?.url === 'string' && d.url ? [d.url.replace(/^https?:\/\//, '').toLowerCase()] : []));
-    return { ...(typeof project.name === 'string' && project.name ? { name: project.name } : {}), production: exists ? 'exists' : 'none', ...(typeof branch === 'string' && branch ? { productionBranch: branch } : {}), protection: typeof protection === 'string' ? protection : null, deploymentHosts: new Set(hosts) };
+    const ignore = project.commandForIgnoringBuildStep;
+    // The live app: the production deployment's first alias, the project's own domain, as Vercel lists them (its automatic aliases follow). Its own hashed address is one build's, which the next production deployment leaves behind: never the before.
+    const live = target && !failed(target) ? (Array.isArray(target.alias) ? target.alias : []).map(hostname).find(Boolean) : undefined;
+    return { ...(typeof project.name === 'string' && project.name ? { name: project.name } : {}), production: exists ? 'exists' : 'none', ...(typeof branch === 'string' && branch ? { productionBranch: branch } : {}), ...(live ? { productionUrl: `https://${live}` } : {}), protection: typeof protection === 'string' ? protection : null, previewsProtected, deploymentHosts: new Set(hosts), ...(repository ? { repository } : {}), ignoredBuildStep: typeof ignore === 'string' && ignore.trim().length > 0, githubDeployments: record(project.gitProviderOptions)?.createDeployments !== 'disabled' };
+}
+/**
+ * The linked project as this repository's: read now, and connected to the repository on Vercel, which its Git link
+ * says. The link file names whatever project the person can administer (the repository, or the sandboxed agent, writes
+ * it), so the run locks, and sends the secrets of, only a project this read vouches for; `reason` says what stopped it.
+ */
+export async function readOwnProject(vercel, link, repository) {
+    const project = await readVercelProject(vercel, link);
+    if (!project)
+        return { reason: 'The Vercel CLI could not read the project (vercel api): it is signed out, or this CLI has no api command.' };
+    if (project.repository !== repository.toLowerCase())
+        return { reason: `The Vercel project this folder is linked to${project.name ? ` (${project.name})` : ''} is not connected to this repository on Vercel.` };
+    return project;
+}
+/**
+ * Whether the project made the deployment at `host`: one of its latest, as the project read lists them; else, since a
+ * project lists its newest deployments alone while an older pull request's preview stays served, the deployment read
+ * on its own by its host, as the person, which names its project. False when that read fails: another team's, or none.
+ */
+export async function projectMadeDeployment(vercel, link, project, host) {
+    if (project.deploymentHosts.has(host))
+        return true;
+    try {
+        return (await printedProject(vercel, readDeploymentApi(link, host)))?.projectId === link.projectId;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Whether Vercel builds the test drive's branch at all, as the checkout's vercel.json
+ * (https://vercel.com/docs/project-configuration/git-configuration#git.deploymentenabled: `git.deploymentEnabled` false
+ * turns every automatic deployment off, and a branch rule, in minimatch syntax, turns its branches off unless a rule
+ * says true) and the linked project say: an Ignored Build Step decides commit by commit, so the answer is unknown; with
+ * Vercel's GitHub deployments off, Impeccable finds no preview. The linked project counts only as this repository's
+ * (readOwnProject): another repository's settings are never the fact. Nothing here changes Vercel: the fact is reported.
+ * Undefined where the checkout names no Vercel setting and is linked to no project.
+ */
+export async function vercelPreviewsFact(cwd, repository, vercel) {
+    let setting;
+    try {
+        setting = record(record(JSON.parse(await readFile(join(cwd, 'vercel.json'), 'utf8')))?.git)?.deploymentEnabled;
+    }
+    catch {
+        // No vercel.json, or none that reads as JSON: Vercel's default, every branch.
+    }
+    const link = await readLink(cwd);
+    if (setting === undefined && !link)
+        return undefined;
+    // The CLI runs only for a linked project, and only this repository's own counts.
+    const own = link ? await readOwnProject(vercel(), link, repository) : null;
+    const project = own && !('reason' in own) ? own : null;
+    const fact = { project: project?.name ?? '', enabled: true, ...(project?.productionBranch ? { productionBranch: project.productionBranch } : {}) };
+    if (setting === false)
+        return { ...fact, enabled: false, reason: `vercel.json turns automatic deployments off for every branch (git.deploymentEnabled: false), so a push of ${TEST_DRIVE_BRANCH} builds nothing.` };
+    const branches = record(setting);
+    if (branches) {
+        const matched = Object.entries(branches).filter(([rule]) => matchesBranch(rule, TEST_DRIVE_BRANCH, true));
+        if (matched.length && !matched.some(([, on]) => on === true))
+            return { ...fact, enabled: false, reason: `vercel.json turns automatic deployments off for ${TEST_DRIVE_BRANCH} (git.deploymentEnabled: "${matched[0][0]}": false).` };
+    }
+    if (own && 'reason' in own)
+        return { ...fact, enabled: 'unknown', reason: own.reason };
+    if (project && !project.githubDeployments)
+        return { ...fact, enabled: false, reason: 'The project records no deployments on GitHub (Vercel GitHub deployments are off), and GitHub\'s record is where Impeccable finds Vercel\'s previews.' };
+    if (project?.ignoredBuildStep)
+        return { ...fact, enabled: 'unknown', reason: 'An Ignored Build Step is set on the project (Settings → Git), which decides commit by commit whether a push builds.' };
+    return fact;
 }
 /**
  * The linked project before its first push: read through `vercel api`, and, with no production deployment, locked
  * behind Vercel's login at every address, since Vercel makes a new project's first deployment Production whatever
  * branch it builds and Standard Protection serves production domains to anyone. A project that deploys production
- * already (live or building), or is locked already, is left as it is.
+ * already (live or building), or is locked already, is left as it is, and so is one not connected to `repository`.
  */
-export async function prepareFirstDeployment(vercel, link, lock = true) {
-    const project = await readVercelProject(vercel, link);
-    if (!project)
-        return { production: 'unknown', locked: false, reason: 'The Vercel CLI could not read the project (vercel api): it is signed out, or this CLI has no api command.' };
+export async function prepareFirstDeployment(vercel, link, repository, lock = true) {
+    const project = await readOwnProject(vercel, link, repository);
+    if ('reason' in project)
+        return { production: 'unknown', locked: false, reason: project.reason };
     const branch = { ...(project.productionBranch ? { productionBranch: project.productionBranch } : {}), ...(project.name ? { project: project.name } : {}) };
     if (project.production === 'exists')
-        return { production: 'exists', ...branch };
+        return { production: 'exists', ...branch, ...(project.productionUrl ? { productionUrl: project.productionUrl } : {}) };
     if (project.protection === 'all')
         return { production: 'none', locked: true, ...branch };
     if (!lock)
@@ -146,9 +239,9 @@ export function vercelProjectPage(page, team, project) {
     return team && project ? `https://vercel.com/${encodeURIComponent(team)}/${encodeURIComponent(project)}/${page}` : `https://vercel.com/d?to=${encodeURIComponent(`/[team]/[project]/${page}`)}`;
 }
 /** Reads the project again every `wait.everyMs` until Vercel's login stands in front of every address of it, or it deploys production, or `wait.totalMs` has passed (a read that failed counts as neither): the person is locking it meanwhile. */
-export async function waitForVercelLock(vercel, link, deps) {
+export async function waitForVercelLock(vercel, link, repository, deps) {
     for (const end = Date.now() + deps.wait.totalMs;;) {
-        const first = await prepareFirstDeployment(vercel, link, false);
+        const first = await prepareFirstDeployment(vercel, link, repository, false);
         // A read that failed says nothing yet, so the wait goes on.
         if (first.production === 'exists' || first.locked || Date.now() >= end || deps.signal?.aborted)
             return first;
@@ -163,9 +256,9 @@ export async function waitForVercelLock(vercel, link, deps) {
 /**
  * The hosts of the linked project's deployments while Vercel's login stands in front of every address of it, read
  * now: a Production deployment GitHub lists for a pushed branch is its preview only when it is one of these. Empty
- * when the project is not locked at every address, or could not be read.
+ * when the project is not locked at every address, is not this repository's, or could not be read.
  */
-export async function lockedDeploymentHosts(vercel, link) {
-    const project = await readVercelProject(vercel, link);
-    return project?.protection === 'all' ? project.deploymentHosts : new Set();
+export async function lockedDeploymentHosts(vercel, link, repository) {
+    const project = await readOwnProject(vercel, link, repository);
+    return !('reason' in project) && project.protection === 'all' ? project.deploymentHosts : new Set();
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impeccable/reviews",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Set up a repository for Impeccable for PRs from your terminal.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,