@nanocollective/roster 0.1.0-alpha.24 → 0.1.0-alpha.25

package/dist/cli.js

@@ -140,7 +140,7 @@ async function createApp(spec2, opts = {}) {
         res.end(
           page(
             `${app.slug} created`,
-            "The private key went straight into the repository's secrets and was never written to disk. You can close this tab; the terminal has the next step."
+            "Its keys are saved in the repository's secrets. You can close this tab; the terminal has the next step."
           )
         );
         finish(() => resolve6(app));
@@ -210,7 +210,8 @@ async function open(url) {
 // src/lib/install.ts
 import { existsSync, readFileSync } from "fs";
 import { join } from "path";
-function installTargets(ws, org, parseYaml, handle, spec2) {
+function installTargets(ws, org, parseYaml, handle, spec2, scope = "private") {
+  if (scope === "public") return [...new Set(spec2.worksIn)];
   const peers = [];
   for (const s of org.staff ?? []) {
     if (s.handle === handle) continue;
@@ -222,7 +223,8 @@ function installTargets(ws, org, parseYaml, handle, spec2) {
     } catch {
     }
   }
-  return [.../* @__PURE__ */ new Set([spec2.brain, ...spec2.worksIn, ...peers])];
+  const ops = org.org ? [`${org.org}/${ws.opsName}`] : [];
+  return [.../* @__PURE__ */ new Set([spec2.brain, ...ops, ...spec2.worksIn, ...peers])];
 }
 function installUrl(slug, targetId, repoIds = []) {
   const base2 = `https://github.com/apps/${encodeURIComponent(slug)}/installations/new`;
@@ -538,7 +540,14 @@ async function appCommand(argv) {
 `);
     return 2;
   }
-  const targets = installTargets(ws, org, parseYaml, handle, spec2);
+  const targets = installTargets(
+    ws,
+    org,
+    parseYaml,
+    handle,
+    spec2,
+    opts.public ? "public" : "private"
+  );
   const existing = await api(`/apps/${name}`);
   if (existing.ok) {
     const install2 = await preselectedInstall(existing.data?.slug ?? name, org.org, targets);
@@ -6480,7 +6489,14 @@ async function portalCommand(argv) {
         res.end(JSON.stringify({ error: `staff.yaml declares no ${payload.scope} app` }));
         return;
       }
-      const targets = installTargets(ws, org, parseYaml, entry.handle, spec2);
+      const targets = installTargets(
+        ws,
+        org,
+        parseYaml,
+        entry.handle,
+        spec2,
+        isPublic ? "public" : "private"
+      );
       const existing = await api(`/apps/${name}`);
       if (existing.ok) {
         const install = await preselectedInstall(existing.data?.slug ?? name, org.org, targets);
@@ -6817,7 +6833,7 @@ async function portalCommand(argv) {
           });
           res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
           res.end(
-            `<body style="font:15px/1.6 system-ui;max-width:34rem;margin:14vh auto;padding:0 1.4rem"><h1 style="font-size:1.3rem">${app.slug} created</h1><p>Its id and private key went straight into ${pending.brain}'s secrets. The key was never written to disk.</p><p><b>It still has to be installed</b>, and granted every tracker this staff member writes to \u2014 not just their own.</p><p>Close this tab; the portal has the link.</p></body>`
+            `<body style="font:15px/1.6 system-ui;max-width:34rem;margin:14vh auto;padding:0 1.4rem"><h1 style="font-size:1.3rem">${app.slug} created</h1><p>Its keys are saved in ${pending.brain}'s secrets.</p><p><b>Next: install it.</b> Go back to the portal and press Install.</p><p>You can close this tab.</p></body>`
           );
         }).catch((err) => {
           appResults.set(state, { ok: false, error: err.message });

package/docs/manual-steps.md

@@ -45,8 +45,9 @@ hand. roster says so if it happens.
 ## 3. Confirm the App's install
 
 **Do:** press **Install it** in the portal, or open the link `roster app` prints. The page opens
-with the organisation and the repos this staff member needs already selected: its brain, each
-peer's tracker, and the product repos. Check the list and confirm.
+with the organisation and the repos this staff member needs already selected: its brain, the
+ops repo (every run checks it out first), each peer's tracker, and the product repos. Check the
+list and confirm. Choosing **All repositories** instead also works.
 
 **Why not automated:** installing is a grant of access to specific repositories, and GitHub asks
 a person to confirm it. That is correct and should not be worked around.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanocollective/roster",
-  "version": "0.1.0-alpha.24",
+  "version": "0.1.0-alpha.25",
   "description": "An agent-run org, powered by GitHub. Scaffold AI staff members whose brain is a repo.",
   "type": "module",
   "bin": {

package/templates/portal/js/views/app.js

@@ -27,8 +27,7 @@ export function appPanel(opts) {
     }),
     el("p", {
       textContent:
-        "A tab opens, GitHub asks you to confirm, and the App's id and private key go straight " +
-        "into the repo's secrets. The key is held in memory and never written to disk.",
+        "A GitHub tab opens. Confirm there, then come back here to install it.",
     }),
   );