@letterstory/cli 0.121.1 → 0.121.3

package/lib/cli.mjs

@@ -60,7 +60,7 @@ import {
 } from "./commands.mjs";
 
 // Keep in sync with cli/package.json.
-export const VERSION = "0.121.1";
+export const VERSION = "0.121.3";
 
 // Flags that never take a value. Listing them explicitly means `deploy get --json <id>`
 // can't accidentally swallow the id as --json's value. Every `type: "bool"` flag (and its
@@ -1261,7 +1261,14 @@ Repo changes (Claude Code edits your repo in a sandbox; the Letterstory GitHub A
   repo set-site --repo <owner/name> --site <host> [--not] [--branch <name>|none]
                                                        Say which site a repo builds (--not: correct a wrong label)
   repo reset-site --repo <owner/name> --site <host>    Back to automatic detection
+  repo secrets --repo <owner/name>                     Preview secrets: names and when set (never values)
+  repo set-secret --repo <owner/name> --secret <KEY> --value <v> | --value-file <path|->
+                                                       Set an env var the preview site gets (use test credentials:
+                                                       the preview URL is public to anyone with the link)
+  repo delete-secret --repo <owner/name> --secret <KEY>
+                                                       Delete one
   repo status <run-id>                                 Phase, spend, PR link and Claude's summary
+  repo activity <run-id> [--follow]                    What the sandbox is doing, line by line (--follow: until it stops)
   repo list [--status running|succeeded|no_changes|failed|cancelled] [--limit n] [--audit <id>]
              [--source site_audit_issue|site_quick_check|letterprove_install]
   repo publish <run-id>                                Make PR on a preview in review

package/lib/commands/repo.mjs

@@ -1,11 +1,14 @@
 // `repo` — changes to the org's own repos, made by Claude Code in a sandbox and opened as a
 // pull request by the Letterstory GitHub App (src/lib/repo-changes). One subcommand per tool:
 //   repo start   → start_repo_change     repo status → get_repo_change
+//   repo activity → get_repo_change_activity (what the sandbox is doing; --follow polls)
 //   repo list    → list_repo_changes     repo cancel → cancel_repo_change
 //   repo publish → publish_repo_change (Make PR on a preview)
 //   repo repos   → list_github_app_repos  repo branches → list_repo_branches
 //   repo prs     → list_open_pull_requests (every open PR, whoever opened it)
 //   repo install-letterprove → letterprove_open_install_pr
+//   repo secrets → list_repo_preview_secrets  repo set-secret → set_repo_preview_secret
+//   repo delete-secret → delete_repo_preview_secret
 //   repo suggestions → list_suggested_fixes
 //   repo settings → get_repo_change_settings, or set_repo_change_settings with --action / --branch
 //   repo slack-targets → list_slack_fix_targets   repo slack-test → send_slack_test_message
@@ -24,6 +27,14 @@ import {
 	refuseUnknownFlags,
 } from "./shared.mjs";
 
+/** `--value <v>` or `--value-file <path|->`; a file's single trailing newline is dropped. */
+function secretValue(flags) {
+	const inline = flagStr(flags.value);
+	const value = readTextInput(flags, "value", "value-file");
+	if (value === undefined) throw new CliError("Pass the value with --value <value> or --value-file <path|->.");
+	return inline === undefined ? value.replace(/\r?\n$/, "") : value;
+}
+
 /** `--repo owner/name` → the two schema keys; --owner/--name also work. */
 function splitRepo(flags) {
 	const full = flagStr(flags.repo);
@@ -68,6 +79,21 @@ const ARGS = {
 		repo_name: { value: (flags) => splitRepo(flags).name },
 		site_host: { flag: "site", required: true },
 	},
+	list_repo_preview_secrets: {
+		repo_owner: { value: (flags) => splitRepo(flags).owner },
+		repo_name: { value: (flags) => splitRepo(flags).name },
+	},
+	set_repo_preview_secret: {
+		repo_owner: { value: (flags) => splitRepo(flags).owner },
+		repo_name: { value: (flags) => splitRepo(flags).name },
+		key: { flag: "secret", required: true },
+		value: { value: (flags) => secretValue(flags) },
+	},
+	delete_repo_preview_secret: {
+		repo_owner: { value: (flags) => splitRepo(flags).owner },
+		repo_name: { value: (flags) => splitRepo(flags).name },
+		key: { flag: "secret", required: true },
+	},
 	fix_audit_issue: {
 		// --issue <type>, repeatable or comma-separated: several go into one PR (issue_types).
 		issue_type: { value: (flags) => (issueList(flags).length === 1 ? issueList(flags)[0] : undefined) },
@@ -138,6 +164,7 @@ const ARGS = {
 		autopilot_min_severity: { flag: "autopilot-severity", enum: ["critical", "warning"] },
 	},
 	get_repo_change: { run_id: { positional: 0, required: true, label: "run-id" } },
+	get_repo_change_activity: { run_id: { positional: 0, required: true, label: "run-id" } },
 	cancel_repo_change: { run_id: { positional: 0, required: true, label: "run-id" } },
 	publish_repo_change: { run_id: { positional: 0, required: true, label: "run-id" } },
 	list_repo_changes: {
@@ -184,6 +211,8 @@ export async function cmdRepo(ctx) {
 			return repoStart(rest);
 		case "status":
 			return repoStatus(rest);
+		case "activity":
+			return repoActivity(rest);
 		case "fix-audit":
 			return repoFixAudit(rest);
 		case "install-letterprove":
@@ -194,6 +223,12 @@ export async function cmdRepo(ctx) {
 			return repoSetSite(rest);
 		case "reset-site":
 			return repoResetSite(rest);
+		case "secrets":
+			return repoSecrets(rest);
+		case "set-secret":
+			return repoSetSecret(rest);
+		case "delete-secret":
+			return repoDeleteSecret(rest);
 		case "list":
 			return repoList(rest);
 		case "cancel":
@@ -216,7 +251,7 @@ export async function cmdRepo(ctx) {
 			return repoSlackTest(rest);
 		default:
 			throw new CliError(
-				`Unknown repo subcommand: ${sub ?? "(none)"}. Try: start, fix-audit, install-letterprove, sites, set-site, reset-site, status, list, publish, cancel, repos, branches, prs, settings, suggestions, slack-targets, slack-test`
+				`Unknown repo subcommand: ${sub ?? "(none)"}. Try: start, fix-audit, install-letterprove, sites, set-site, reset-site, secrets, set-secret, delete-secret, status, list, publish, cancel, repos, branches, prs, settings, suggestions, slack-targets, slack-test`
 			);
 	}
 }
@@ -396,6 +431,45 @@ async function repoResetSite(ctx) {
 	return 0;
 }
 
+/** `repo secrets --repo owner/name`: the repo's preview secrets, names and when each was set (never values). */
+async function repoSecrets(ctx) {
+	const { client, flags, io } = ctx;
+	refuseUnknownFlags(ctx, {}, ["repo", "owner", "name"]);
+	const result = await client.callTool(
+		"list_repo_preview_secrets",
+		argsFromFlags(ARGS.list_repo_preview_secrets, flags)
+	);
+	printResult(io, flags, result, (r) =>
+		r.secrets.length
+			? r.secrets.map((s) => `${s.key}  (set ${s.updatedAt})`).join("\n")
+			: "No preview secrets for this repo."
+	);
+	return 0;
+}
+
+/** `repo set-secret --repo owner/name --secret KEY --value v | --value-file path|-`: set or overwrite one. */
+async function repoSetSecret(ctx) {
+	const { client, flags, io } = ctx;
+	refuseUnknownFlags(ctx, {}, ["repo", "owner", "name", "secret", "value", "value-file"]);
+	const result = await client.callTool("set_repo_preview_secret", argsFromFlags(ARGS.set_repo_preview_secret, flags));
+	ok(ctx, result.message);
+	printResult(io, flags, result.secret);
+	return 0;
+}
+
+/** `repo delete-secret --repo owner/name --secret KEY`: delete one. */
+async function repoDeleteSecret(ctx) {
+	const { client, flags, io } = ctx;
+	refuseUnknownFlags(ctx, {}, ["repo", "owner", "name", "secret"]);
+	const result = await client.callTool(
+		"delete_repo_preview_secret",
+		argsFromFlags(ARGS.delete_repo_preview_secret, flags)
+	);
+	ok(ctx, result.message);
+	printResult(io, flags, result);
+	return 0;
+}
+
 async function repoStatus(ctx) {
 	const { client, flags, io } = ctx;
 	const result = await client.callTool(
@@ -407,6 +481,39 @@ async function repoStatus(ctx) {
 	return 0;
 }
 
+const ACTIVITY_MARK = { progress: "·", stage: "▸", say: "»", tool: "$", error: "!" };
+
+/** `repo activity <run-id> [--follow]`: the build's feed; --follow prints new lines until it stops. */
+async function repoActivity(ctx) {
+	const { client, flags, io } = ctx;
+	refuseUnknownFlags(ctx, {}, ["follow"]);
+	const args = argsFromFlags(ARGS.get_repo_change_activity, flags, ctx.positionals);
+	const line = (l) => `${l.at.slice(11, 19)} ${ACTIVITY_MARK[l.kind] ?? " "} ${l.text}`;
+	let { activity } = await client.callTool("get_repo_change_activity", args);
+	if (flags.json && !flags.follow) {
+		printResult(io, flags, activity);
+		return 0;
+	}
+	let seen = 0;
+	const print = () => {
+		for (const l of activity.lines.slice(seen)) io.log(flags.json ? JSON.stringify(l) : line(l));
+		seen = activity.lines.length;
+	};
+	print();
+	if (!flags.follow) return 0;
+	await followJob(
+		io,
+		async () => {
+			({ activity } = await client.callTool("get_repo_change_activity", args));
+			print();
+			return { done: !activity.live, value: activity };
+		},
+		{ intervalMs: 3000, ceilingMs: 60 * 60 * 1000 }
+	);
+	ok(ctx, `Run ${activity.runId} is ${activity.status} (${activity.phase}).`);
+	return 0;
+}
+
 async function repoList(ctx) {
 	const { client, flags, io } = ctx;
 	const result = await client.callTool(

package/lib/documents.mjs

@@ -83,6 +83,8 @@ export const JSON_ARG_FLAG_PAIRS = [
 	["csv", "csv-file"],
 	// A site proposal's tool input, parsed as JSON (site.mjs proposalInput).
 	["input", "input-file"],
+	// A preview secret's value, sent byte for byte (repo.mjs `repo set-secret`); never extracted.
+	["value", "value-file"],
 	// A Vercel API token read verbatim, so it stays out of shell history (outbound.mjs mail vercel-key set).
 	["token", "token-file"],
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@letterstory/cli",
-	"version": "0.121.1",
+	"version": "0.121.3",
 	"description": "Spin up and manage Letterstory phantom blogs from your terminal.",
 	"type": "module",
 	"license": "UNLICENSED",