@remits/remits-cli 0.1.169 → 0.1.170

package/README.md

@@ -2,6 +2,14 @@
 
 Local CLI for rapid Remits component testing without push/sync cycles.
 
+Builder onboarding: `remits-cli builder setup --account-id <owner> --directory <new-checkout>` uses your
+Remits sign-in to clone the account repository with a short-lived Git credential, select a workspace,
+sync guides and install the Remits Builder Claude Code plugin. No GitHub user account is required.
+
+Review staged changes: `remits-cli components propose --title "Describe the change"` creates or updates a
+GitHub PR from your current staging lane. It applies account landing policy and leaves merging and
+synchronization to the reviewer. Use `components propose --help` for scope and verification options.
+
 ## Install
 
 ```bash

package/index.js

@@ -9,13 +9,13 @@
 - L2802  Account Repos, Guide Sync, And Platform Repo
 - L3701  Component Discovery And HTTP Logging
 - L4484  Skill Delivery And TOC Resolution
-- L4799  Auth And Component Staging
-- L5435  Component Summaries, Status, And Sync Gates
-- L7759  Branches, Promotion, Commit, And Test Runs
-- L10072  Tokens, Tools, Verification, And Config
-- L11589  Service Dashboard And WebSocket Listener
-- L14099  Agent And Ticket Workflows
-- L18869  Help, Auto Update, And Command Dispatch
+- L4849  Auth And Component Staging
+- L5485  Component Summaries, Status, And Sync Gates
+- L7826  Branches, Promotion, Commit, And Test Runs
+- L10139  Tokens, Tools, Verification, And Config
+- L11656  Service Dashboard And WebSocket Listener
+- L14166  Agent And Ticket Workflows
+- L18936  Help, Auto Update, And Command Dispatch
 */
 
 /*
@@ -4795,6 +4795,56 @@ async function installSkillsCommand(flags) {
   }
 }
 
+async function builderCommand(flags, subcommand) {
+  const kit = require('./lib/builder-kit');
+  if (flagEnabled(flags.help) || !subcommand) {
+    console.log('remits-cli builder setup --account-id <owner> --directory <new-checkout> [--base-url <host>]');
+    return;
+  }
+  if (!['setup', 'credential'].includes(subcommand)) throw new Error('Expected builder setup.');
+  // Git appends get/store/erase. Never store a token and never emit ordinary CLI output on this door.
+  const operation = flags._ && flags._[2];
+  if (subcommand === 'credential' && operation !== 'get') return;
+  const context = resolveSessionContext(process.cwd(), flags);
+  const { session, accountId } = context;
+  const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
+  const api = buildAxios(baseUrl, session.token);
+  const fields = subcommand === 'credential' ? kit.credentialRequest(fs.readFileSync(0, 'utf8')) : null;
+  if (fields && (fields.protocol !== 'https' || fields.host !== 'github.com' || !fields.path)) return;
+  // Deliberately bypass request evidence logging: this response is a credential, not tool output.
+  let result;
+  try {
+    result = (await api.post('/cli/builderCredential', { token: session.token, accountId })).data;
+  } catch (_) {
+    throw new Error('Builder repository access was refused. Check your Remits sign-in and owner membership.');
+  }
+  if (!result.success || !result.token) throw new Error('No Builder Kit credential was issued.');
+  if (subcommand === 'credential') {
+    if (!kit.matchesRepository(fields, result.repository)) return;
+    process.stdout.write('username=x-access-token\npassword=' + result.token + '\n\n');
+    return;
+  }
+  const directory = path.resolve(flags.directory || result.repository.split('/')[1]);
+  const helper = kit.helperCommand(process.execPath, __filename, accountId, baseUrl);
+  kit.cloneRepository({ cloneUrl: result.cloneUrl, directory, helper });
+  process.chdir(directory);
+  ensureLocalState(directory);
+  await workspaceCommand({ _: ['workspace', 'use'], auto: true });
+  await ensureGuidesSynced(directory, { ...flags, 'account-id': accountId });
+  const plugin = path.join(directory, '.claude', 'skills', 'remits-builder');
+  const refs = path.join(plugin, 'references');
+  ensureDir(path.join(plugin, '.claude-plugin'));
+  atomicWriteFile(path.join(plugin, '.claude-plugin', 'plugin.json'), JSON.stringify({
+    name: 'remits-builder', version: '1.0.0', author: { name: 'Remits' }, license: 'MIT', skills: '.',
+    description: 'Build and verify Remits components in your own workspace.'
+  }, null, 2) + '\n');
+  atomicWriteFile(path.join(plugin, 'SKILL.md'), buildSkillSourceBody(refs));
+  writeSkillReferences(refs);
+  console.log('Builder Kit ready: ' + directory);
+  // Delivered references contain local paths; keep this installation local to this checkout.
+  fs.appendFileSync(path.join(directory, '.git', 'info', 'exclude'), '\n/.claude/skills/remits-builder/\n');
+}
+
 /*
 ## Auth And Component Staging
 */
@@ -6206,6 +6256,23 @@ async function statusComponentsCommand(flags) {
   return response;
 }
 
+async function proposeComponentsCommand(flags) {
+  const cwd = process.cwd();
+  const context = resolveSessionContext(cwd, flags);
+  requireAccountRepoContext(cwd, flags, 'components propose', context);
+  const { session, accountId } = context;
+  const api = buildAxios(flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL, session.token);
+  const response = await loggedPost(api, cwd, '/cli/components', {
+    token: session.token, accountId, mode: 'propose',
+    branchName: flags.branch || currentBranch(cwd), workspace: resolveWorkspace(cwd, flags),
+    title: flags.title, acknowledge: flags.acknowledge,
+    verificationEnvelopeId: verificationEnvelopeIdForCommand(cwd, flags, context),
+    dataMode: resolveDataMode(flags, session)
+  }).then(r => r.data);
+  if (!response.success) throw new Error(response.message || 'Proposal failed');
+  console.log(flagEnabled(flags.json) ? JSON.stringify(response, null, 2) : response.pullRequest.url);
+}
+
 async function lanesComponentsCommand(flags) {
   const cwd = process.cwd();
   ensureLocalState(cwd);
@@ -19168,7 +19235,13 @@ function printComponentsHelp(subcommand) {
     console.log('--safe also gates the server sync plan before any trunk rows or ComponentVariant overlays are written.');
     return;
   }
-  console.log('Usage: remits-cli components <stage|status|lanes|entries|clear|sync|commit|promotion|branches|branch>');
+  if (subcommand === 'propose') {
+    console.log('Usage: remits-cli components propose [--account-id ID] [--branch BASE] [--workspace NAME] [--title TITLE] [--verify-envelope ID] [--acknowledge TEXT] [--json]');
+    console.log('Creates or updates a GitHub PR from every staged component in your lane. Account landing policy applies.');
+    console.log('Review the PR before merging; this command does not merge or synchronize components.');
+    return;
+  }
+  console.log('Usage: remits-cli components <stage|status|lanes|entries|clear|sync|commit|propose|promotion|branches|branch>');
   console.log('');
   console.log('All staging subcommands accept --workspace NAME to isolate a lane on the same branch,');
   console.log('so several agents can iterate at once. See: remits-cli workspace --help');
@@ -19407,6 +19480,11 @@ async function main() {
   const wantsHelp = args.help === true || subcommand === 'help' || subcommand === '--help' || args._.includes('--help');
   const wantsJson = flagEnabled(args.json);
 
+  if (command === 'builder') {
+    await builderCommand(args, subcommand);
+    return;
+  }
+
   // Inference callbacks must keep one protocol version for the supervisor's lifetime. They do not
   // auto-update, auto-start the support listener, or depend on a component checkout.
   if (command === 'ai') {
@@ -19633,6 +19711,11 @@ async function main() {
     return;
   }
 
+  if (command === 'components' && subcommand === 'propose') {
+    await proposeComponentsCommand(args);
+    return;
+  }
+
   if (command === 'components' && (subcommand === 'lanes' || subcommand === 'lane')) {
     await lanesComponentsCommand(args);
     return;

package/lib/builder-kit.js

@@ -0,0 +1,43 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+function credentialRequest(text) {
+  const fields = {};
+  for (const line of String(text).split(/\r?\n/)) {
+    const split = line.indexOf('=');
+    if (split > 0) fields[line.slice(0, split)] = line.slice(split + 1);
+  }
+  return fields;
+}
+
+function matchesRepository(fields, repository) {
+  return fields.protocol === 'https' && fields.host === 'github.com' &&
+    String(fields.path || '').replace(/\.git$/, '') === repository;
+}
+
+function helperCommand(node, entry, accountId, baseUrl) {
+  const quote = s => "'" + String(s).replace(/'/g, "'\\''") + "'";
+  return '!' + [node, entry, 'builder', 'credential', '--account-id', accountId, '--base-url', baseUrl].map(quote).join(' ');
+}
+
+function cloneRepository({ cloneUrl, directory, helper }) {
+  if (fs.existsSync(directory)) throw new Error('Choose a new directory for Builder Kit setup.');
+  const url = new URL(cloneUrl);
+  if (url.protocol !== 'https:' || url.hostname !== 'github.com' || url.username || url.password) {
+    throw new Error('Invalid Builder Kit repository URL.');
+  }
+  // Disable inherited credential stores for this operation; only our helper sees the issued token.
+  execFileSync('git', ['-c', 'credential.helper=', '-c', 'credential.helper=' + helper,
+    '-c', 'credential.useHttpPath=true', 'clone', '--', cloneUrl, directory],
+  { stdio: 'inherit', env: { ...process.env, GIT_TERMINAL_PROMPT: '0' } });
+  const git = args => execFileSync('git', ['-C', directory, ...args], { stdio: 'pipe' });
+  git(['config', '--local', '--add', 'credential.helper', '']);
+  git(['config', '--local', '--add', 'credential.helper', helper]);
+  git(['config', '--local', 'credential.useHttpPath', 'true']);
+  return path.resolve(directory);
+}
+
+module.exports = { credentialRequest, matchesRepository, helperCommand, cloneRepository };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remits/remits-cli",
-  "version": "0.1.169",
+  "version": "0.1.170",
   "description": "Local CLI for auth, component sync, and live test execution against Remits",
   "license": "MIT",
   "private": false,
@@ -12,6 +12,7 @@
   "files": [
     "index.js",
     "lib/sync-operation.js",
+    "lib/builder-kit.js",
     "lib/local-ai.js",
     "lib/websocket-retry.js",
     "README.md",

package/skills/remits-cli/references/command-reference.md

@@ -8,6 +8,7 @@
 
 ## Table of Contents
 
+- [Builder Kit and review proposals](#builder-kit-and-review-proposals)
 - [Getting Started](#getting-started)
   - [Authentication](#authentication)
   - [Host vs Data Mode](#host-vs-data-mode)
@@ -21,6 +22,22 @@
   - [Staging modes: workset vs full snapshot](#staging-modes-workset-vs-full-snapshot)
   - [Prod banners and retryable failures](#prod-banners-and-retryable-failures)
 
+## Builder Kit and review proposals
+
+`remits-cli builder setup --account-id <owner> --directory <new-directory>` clones the owning account's
+repository using your Remits builder sign-in. Add `--base-url` to use a local server. It installs a Git
+credential helper, chooses your workspace, syncs guides and installs the Remits Builder Claude Code plugin.
+Git credentials stay in memory, are restricted to that repository and expire within one hour; the next
+issuance checks your current membership. Existing branch protections and account policies still apply.
+
+After staging and testing, `remits-cli components propose --title "Describe the change"` creates or updates
+a GitHub PR containing **every staged entry in your current lane**. `--branch` selects the base;
+`--workspace` selects your lane. It preserves component sidecars, records staged hashes and includes a
+verification envelope when available. `--json` returns the PR URL and branch. Landing policy can refuse it.
+The command does not merge, sync, clear staging or commit your local checkout. Review and merge the PR,
+then use the normal sync flow. Start a new workspace after a proposal is closed. If someone edits the PR
+branch directly, reconcile that work before proposing again.
+
 ## Getting Started
 
 ### Authentication