@mesh-tech/mesh-cli 0.20.1 → 0.20.3

package/dist/src/commands/vcs/common.js

@@ -1,34 +1,12 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 export const execFileAsync = promisify(execFile);
-/** Strip a bearer token out of an error before it is surfaced.
- *
- * The vcs git calls authenticate by putting the token in argv
- * (`-c http.extraHeader=Authorization: Bearer <jwt>`), and `execFile` puts the
- * whole argv into the message it throws. So an ordinary mistake — a wrong repo
- * name, a typo'd host — prints a live credential into the terminal, the CI log,
- * or an agent transcript — a `mesh vcs clone` against a mistyped host would
- * otherwise emit the full JWT.
- *
- * Folds `stderr` into the message on the way, because that is where git's
- * actual reason lives ("repository not found", "Authentication failed") and it
- * can carry the token too.
- *
- * @example
- * try {
- *   await execFileAsync("git", ["-c", `http.extraHeader=Authorization: Bearer ${token}`, "clone", url]);
- * } catch (err) {
- *   throw redactToken(err, token); // the JWT reads as `<redacted-token>`
- * }
- */
 export function redactToken(err, token) {
     const base = err instanceof Error ? err.message : String(err);
     const stderr = typeof err?.stderr === "string"
         ? err.stderr.trim()
         : "";
     const combined = stderr && !base.includes(stderr) ? `${base}\n${stderr}` : base;
-    // Guard: splitting on "" inserts the marker between every character, turning
-    // a token-free failure into unreadable confetti.
     const message = token ? combined.split(token).join("<redacted-token>") : combined;
     const out = new Error(message);
     const code = err?.code;
@@ -36,15 +14,6 @@ export function redactToken(err, token) {
         out.code = code;
     return out;
 }
-/**
- * Run git with a bearer token in argv, redacting it from any failure.
- *
- * @example
- * const { stdout } = await gitWithAuth(
- *   ["-c", `http.extraHeader=Authorization: Bearer ${token}`, "ls-remote", url],
- *   token,
- * );
- */
 export async function gitWithAuth(args, token, cwd) {
     try {
         return await execFileAsync("git", args, cwd ? { cwd } : {});
@@ -53,18 +22,11 @@ export async function gitWithAuth(args, token, cwd) {
         throw redactToken(err, token);
     }
 }
-/** https://host/git/<repo> (origin remote) → { baseUrl: https://host, repo }. */
 export function parseRemote(remoteUrl) {
     const m = remoteUrl.trim().match(/^(https?:\/\/[^/]+)\/git\/([^/]+?)(?:\.git)?$/);
     return m ? { baseUrl: m[1], repo: m[2] } : null;
 }
 export async function resolveTarget(opts) {
-    // An explicit base URL (flag or env) overrides only the BASE URL — it must
-    // not suppress origin-derived repo resolution. Commands like `propose` carry
-    // no repo argument and rely on the clone's origin remote; returning early
-    // here with `repo: undefined` (the prior behaviour) broke them whenever
-    // VCS_URL/--url was set. So resolve the repo independently: explicit repo →
-    // origin-derived → undefined.
     const explicitBase = opts.url ?? process.env.VCS_URL;
     let originTarget = null;
     try {
@@ -74,7 +36,6 @@ export async function resolveTarget(opts) {
         originTarget = parseRemote(stdout);
     }
     catch {
-        // not in a clone
     }
     const baseUrl = (explicitBase ?? originTarget?.baseUrl)?.replace(/\/$/, "");
     if (!baseUrl) {
@@ -95,7 +56,6 @@ export async function resolveToken(opts) {
     }
     throw new Error("no token: pass --token, set VCS_TOKEN, or pass --context <platform-context> (after mesh login)");
 }
-/** Minimal authenticated JSON call against the vcs API. */
 export async function vcsApi(baseUrl, token, path, method = "GET", body) {
     const res = await fetch(`${baseUrl}${path}`, {
         method,
@@ -111,4 +71,3 @@ export async function vcsApi(baseUrl, token, path, method = "GET", body) {
     }
     return data;
 }
-//# sourceMappingURL=common.js.map

package/dist/src/commands/vcs/drafts.d.ts

@@ -10,4 +10,3 @@ export declare function draftsSubmitCommand(repo: string, draftId: string, opts:
     note?: string;
 }): Promise<void>;
 export declare function draftsDiscardCommand(repo: string, draftId: string, opts: CommonOpts): Promise<void>;
-//# sourceMappingURL=drafts.d.ts.map

package/dist/src/commands/vcs/drafts.js

@@ -42,4 +42,3 @@ export async function draftsDiscardCommand(repo, draftId, opts) {
     const d = (await call(opts, repo, `/drafts/${draftId}/discard`, "POST", {}));
     console.log(`draft ${d.draftId} discarded`);
 }
-//# sourceMappingURL=drafts.js.map

package/dist/src/commands/vcs/get.d.ts

@@ -5,4 +5,3 @@ interface GetOpts extends CommonOpts {
 }
 export declare function getCommand(repo: string, path: string, opts: GetOpts): Promise<void>;
 export {};
-//# sourceMappingURL=get.d.ts.map

package/dist/src/commands/vcs/get.js

@@ -1,13 +1,3 @@
-/**
- * `mesh vcs get <repo> <path>` — read a SPECIFIC path (a file or subtree) from
- * a repo, never the whole repo. The discretionary doc-pull the conversation
- * `references[]` catalog points at: a `pull` bundle lists which repos/docs a
- * conversation touched, and this fetches just the ones the agent/user wants.
- *
- * Resolves the vcs service either from an agent target (`--target`, via the
- * shared agent-targets registry → derived `vcs.<baseDomain>` + mesh-login
- * token) or directly (`--url` + `--token`/`--context`).
- */
 import { writeFile, mkdir } from "node:fs/promises";
 import { join, dirname } from "node:path";
 import { createVcsFolderReader, deriveVcsBaseUrl } from "@mesh-tech/agent-targets";
@@ -58,4 +48,3 @@ export async function getCommand(repo, path, opts) {
         await reader.cleanup();
     }
 }
-//# sourceMappingURL=get.js.map

package/dist/src/commands/vcs/index.d.ts

@@ -1,3 +1,2 @@
 import type { Command } from "commander";
 export declare function registerVcsCommands(program: Command): void;
-//# sourceMappingURL=index.d.ts.map

package/dist/src/commands/vcs/index.js

@@ -61,4 +61,3 @@ export function registerVcsCommands(program) {
         .option("--note <note>", "note to reviewers")).action(draftsSubmitCommand);
     withCommon(drafts.command("discard <repo> <id>").description("Discard a draft")).action(draftsDiscardCommand);
 }
-//# sourceMappingURL=index.js.map

package/dist/src/commands/vcs/propose.d.ts

@@ -3,32 +3,7 @@ export interface FileChange {
     status: string;
     path: string;
 }
-/** Parse `git status --porcelain -z` output into adds/modifies/deletes.
- *
- * Porcelain -z format: records are NUL-terminated. Normal record: `XY PATH`.
- * Rename/copy record (X or Y is R/C): `XY PATH\0ORIGPATH` — the FOLLOWING NUL
- * field is the source/original path. Renames expand to a delete of the old path
- * plus a write of the new path. Copies only emit a write of the new path (the
- * source still exists on disk). This stateful walk avoids mis-parsing the bare
- * orig-path token as a status-prefixed record.
- */
 export declare function parseStatus(out: string): FileChange[];
-/** Build one write operation, choosing an encoding by what the bytes actually are.
- *
- *  The test is a UTF-8 round trip, not a file-extension list: a file is text
- *  precisely when decoding and re-encoding reproduces it byte for byte. Reading
- *  everything as `"utf8"` does not fail on a PNG — it replaces every invalid byte
- *  with U+FFFD and proposes a corrupt file that looks perfectly normal in the
- *  diff.
- *
- *  Text files send a plain UTF-8 string; binary files send base64.
- *
- *  @example
- *  await writeOp(process.cwd(), "docs/note.md");
- *  // → { op: "write", path: "docs/note.md", content: "# Note\n" }
- *  await writeOp(process.cwd(), "img/logo.png");
- *  // → { op: "write", path: "img/logo.png", content: "iVBORw0…", encoding: "base64" }
- */
 export declare function writeOp(cwd: string, path: string): Promise<{
     op: "write";
     path: string;
@@ -42,4 +17,3 @@ export interface ProposeOpts extends CommonOpts {
     mergeParent?: string;
 }
 export declare function proposeCommand(opts: ProposeOpts): Promise<void>;
-//# sourceMappingURL=propose.d.ts.map

package/dist/src/commands/vcs/propose.js

@@ -1,15 +1,6 @@
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { execFileAsync, resolveTarget, resolveToken, vcsApi, } from "./common.js";
-/** Parse `git status --porcelain -z` output into adds/modifies/deletes.
- *
- * Porcelain -z format: records are NUL-terminated. Normal record: `XY PATH`.
- * Rename/copy record (X or Y is R/C): `XY PATH\0ORIGPATH` — the FOLLOWING NUL
- * field is the source/original path. Renames expand to a delete of the old path
- * plus a write of the new path. Copies only emit a write of the new path (the
- * source still exists on disk). This stateful walk avoids mis-parsing the bare
- * orig-path token as a status-prefixed record.
- */
 export function parseStatus(out) {
     const tokens = out.split("\0");
     const changes = [];
@@ -18,15 +9,15 @@ export function parseStatus(out) {
         const entry = tokens[i];
         if (!entry) {
             i++;
-            continue; // trailing empty from the final NUL
+            continue;
         }
-        const status = entry.slice(0, 2); // XY — do NOT trim before classifying
+        const status = entry.slice(0, 2);
         const newPath = entry.slice(3);
         const isRename = status[0] === "R" || status[1] === "R";
         const isCopy = !isRename && (status[0] === "C" || status[1] === "C");
         if (isRename || isCopy) {
             const origPath = tokens[i + 1] ?? "";
-            i += 2; // consume the orig-path field too
+            i += 2;
             if (isRename && origPath && !origPath.endsWith("/")) {
                 changes.push({ status: "D", path: origPath });
             }
@@ -42,22 +33,6 @@ export function parseStatus(out) {
     }
     return changes;
 }
-/** Build one write operation, choosing an encoding by what the bytes actually are.
- *
- *  The test is a UTF-8 round trip, not a file-extension list: a file is text
- *  precisely when decoding and re-encoding reproduces it byte for byte. Reading
- *  everything as `"utf8"` does not fail on a PNG — it replaces every invalid byte
- *  with U+FFFD and proposes a corrupt file that looks perfectly normal in the
- *  diff.
- *
- *  Text files send a plain UTF-8 string; binary files send base64.
- *
- *  @example
- *  await writeOp(process.cwd(), "docs/note.md");
- *  // → { op: "write", path: "docs/note.md", content: "# Note\n" }
- *  await writeOp(process.cwd(), "img/logo.png");
- *  // → { op: "write", path: "img/logo.png", content: "iVBORw0…", encoding: "base64" }
- */
 export async function writeOp(cwd, path) {
     const buf = await readFile(join(cwd, path));
     const asUtf8 = buf.toString("utf8");
@@ -73,9 +48,6 @@ export async function proposeCommand(opts) {
         throw new Error("could not determine repo from the origin remote (pass --url from a clone)");
     }
     const token = await resolveToken(opts);
-    // --untracked-files=all: a brand-new directory otherwise collapses to a
-    // single "?? dir/" entry, which parseStatus skips — silently dropping the
-    // new files inside it from the proposal.
     const { stdout: statusOut } = await execFileAsync("git", ["status", "--porcelain", "-z", "--untracked-files=all"], { cwd });
     const changes = parseStatus(statusOut);
     if (changes.length === 0) {
@@ -85,8 +57,6 @@ export async function proposeCommand(opts) {
     const operations = await Promise.all(changes.map(async (c) => c.status.startsWith("D")
         ? { op: "delete", path: c.path }
         : await writeOp(cwd, c.path)));
-    // New proposals diff against the clone's HEAD; revisions against the
-    // proposal's current head (the author proposed from this clone).
     let baseCommit;
     if (opts.revise) {
         const state = (await vcsApi(target.baseUrl, token, `/v1/repos/${target.repo}/proposals/${opts.revise}`));
@@ -111,4 +81,3 @@ export async function proposeCommand(opts) {
     const data = (await vcsApi(target.baseUrl, token, path, "POST", body));
     console.log(`proposal ${data.proposalId} @ ${data.sha.slice(0, 8)} — review: mesh vcs show ${target.repo} ${data.proposalId} --url ${target.baseUrl}`);
 }
-//# sourceMappingURL=propose.js.map

package/dist/src/commands/vcs/review.d.ts

@@ -12,4 +12,3 @@ export declare function commentCommand(repo: string, id: string, text: string, o
 export declare function requestChangesCommand(repo: string, id: string, opts: CommonOpts & {
     note?: string;
 }): Promise<void>;
-//# sourceMappingURL=review.d.ts.map

package/dist/src/commands/vcs/review.js

@@ -32,4 +32,3 @@ export async function requestChangesCommand(repo, id, opts) {
     await call(opts, repo, `/proposals/${id}/request-changes`, "POST", { note: opts.note });
     console.log(`changes requested on ${id}`);
 }
-//# sourceMappingURL=review.js.map

package/dist/src/commands/vcs/rm.d.ts

@@ -1,18 +1,7 @@
 import { type CommonOpts } from "./common.js";
-/** Resolve the caller's paths against the repo's actual file list.
- *
- * A path may name a file or a directory. Directory matches are taken on a path
- * SEGMENT boundary — `products/foo` must not sweep in `products/foo-v2/`, which
- * is what a bare `startsWith` would do and is not recoverable once merged.
- *
- * A path that matches nothing throws rather than being skipped: a delete that
- * silently drops one of its arguments is worse than one that refuses, because
- * the proposal still looks successful.
- */
 export declare function expandPathsToDeletions(repoFiles: string[], requested: string[]): string[];
 export interface RmOpts extends CommonOpts {
     message?: string;
     dryRun?: boolean;
 }
 export declare function rmCommand(repo: string, paths: string[], opts: RmOpts): Promise<void>;
-//# sourceMappingURL=rm.d.ts.map

package/dist/src/commands/vcs/rm.js

@@ -2,20 +2,9 @@ import { mkdtemp, rm as rmrf } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { gitWithAuth, resolveToken, vcsApi } from "./common.js";
-/** Strip the cosmetic bits git and shells add: `./` prefix, trailing slashes. */
 function normalize(p) {
     return p.trim().replace(/^\.\//, "").replace(/\/+$/, "");
 }
-/** Resolve the caller's paths against the repo's actual file list.
- *
- * A path may name a file or a directory. Directory matches are taken on a path
- * SEGMENT boundary — `products/foo` must not sweep in `products/foo-v2/`, which
- * is what a bare `startsWith` would do and is not recoverable once merged.
- *
- * A path that matches nothing throws rather than being skipped: a delete that
- * silently drops one of its arguments is worse than one that refuses, because
- * the proposal still looks successful.
- */
 export function expandPathsToDeletions(repoFiles, requested) {
     const out = new Set();
     for (const raw of requested) {
@@ -44,8 +33,6 @@ export async function rmCommand(repo, paths, opts) {
     if (!baseUrl)
         throw new Error("rm requires --url or VCS_URL");
     const token = await resolveToken(opts);
-    // Blobless + no checkout: we only need the tree listing and HEAD's sha, so
-    // don't pay for file contents we are about to delete.
     const dir = await mkdtemp(join(tmpdir(), "mesh-vcs-rm-"));
     try {
         const git = (args, cwd) => gitWithAuth(args, token, cwd);
@@ -85,4 +72,3 @@ export async function rmCommand(repo, paths, opts) {
         await rmrf(dir, { recursive: true, force: true });
     }
 }
-//# sourceMappingURL=rm.js.map

package/dist/src/commands/vcs-enrich.d.ts

@@ -1,15 +1,3 @@
-/**
- * Builds the `enrichVcs` dep for `mesh conversations pull` by resolving a
- * token + vcs URL for the target, then delegating to the shared
- * `createVcsFolderReader` in `@mesh-tech/agent-targets` (same folder logic the
- * MCP `agent_pull_conversation` tool uses).
- */
 import { type VcsFolderReader } from "@mesh-tech/agent-targets";
 import type { AgentApiTarget } from "./agent-api-client.js";
-/**
- * Resolve a token + vcs base URL for `target`, returning a `VcsFolderReader`
- * ({ enrichVcs, cleanup }) or `undefined` (with a warning) when no token or vcs
- * URL can be derived — so the pull proceeds IR-only rather than failing.
- */
 export declare function buildVcsEnricher(target: AgentApiTarget): Promise<VcsFolderReader | undefined>;
-//# sourceMappingURL=vcs-enrich.d.ts.map

package/dist/src/commands/vcs-enrich.js

@@ -1,17 +1,6 @@
-/**
- * Builds the `enrichVcs` dep for `mesh conversations pull` by resolving a
- * token + vcs URL for the target, then delegating to the shared
- * `createVcsFolderReader` in `@mesh-tech/agent-targets` (same folder logic the
- * MCP `agent_pull_conversation` tool uses).
- */
 import { createVcsFolderReader, deriveVcsBaseUrl } from "@mesh-tech/agent-targets";
 import { getValidToken } from "./login.js";
 import { logWarn } from "../utils/log.js";
-/**
- * Resolve a token + vcs base URL for `target`, returning a `VcsFolderReader`
- * ({ enrichVcs, cleanup }) or `undefined` (with a warning) when no token or vcs
- * URL can be derived — so the pull proceeds IR-only rather than failing.
- */
 export async function buildVcsEnricher(target) {
     const vcsBaseUrl = deriveVcsBaseUrl(target.apiBaseUrl);
     if (!vcsBaseUrl) {
@@ -25,4 +14,3 @@ export async function buildVcsEnricher(target) {
     }
     return createVcsFolderReader({ vcsBaseUrl, token });
 }
-//# sourceMappingURL=vcs-enrich.js.map

package/dist/src/commands/vpn/index.d.ts

@@ -1,24 +1,7 @@
-/**
- * mesh vpn — Headscale VPN management commands
- *
- * Commands:
- *   mesh vpn connect <context>   Connect to VPN via Tailscale + OIDC
- *   mesh vpn disconnect          Disconnect from VPN
- *   mesh vpn status              Show VPN control plane status
- *   mesh vpn api-key             Create a Headscale API key
- *   mesh vpn pre-auth-key        Create a pre-authentication key for a user
- *   mesh vpn users               List registered VPN users
- *
- * All commands shell out to kubectl. The user must have kubeconfig
- * configured for the target cluster (e.g., via `aws eks update-kubeconfig`).
- */
 import { Command } from "commander";
-/** Split a platform context ("mesh.dev") into its tenant + env. Pure. */
 export declare function parseContextTenantEnv(context: string): {
     tenant: string;
     env: string;
 };
-/** Return Tailscale's BackendState, or null if tailscale is not running. */
 export declare function tailscaleBackendState(): string | null;
 export declare function registerVpnCommands(program: Command): void;
-//# sourceMappingURL=index.d.ts.map