@sequenceholdings/studio-cli 0.1.18 → 0.1.22

package/dist/repos/commands.js

@@ -16,7 +16,8 @@ import { existsSync, readdirSync, rmSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { resolve, sep } from 'node:path';
 import { materializeRepo, resolveCommitSha, resolveRepo, } from '@sequenceholdings/artifact-studio/git-service-client';
-import { deleteNoContent, getJson, postJson } from '../atlas-client.js';
+import { z } from 'zod';
+import { AtlasApiError, deleteNoContent, getJson, getJsonOr404, postJson, } from '../atlas-client.js';
 import { printCliError } from '../cli-errors.js';
 import { PREVIEW_DOMAIN } from '../preview.js';
 import { confirmYes } from '../prompt.js';
@@ -468,6 +469,257 @@ function defaultOutFromCloneTarget({ url, id, }) {
     const match = /\/repos\/([^/]+)\/git\/?$/.exec(new URL(url).pathname);
     return match?.[1] ?? 'repo';
 }
+/**
+ * Mirror of atlas `ci-discover` Zod contract so `repos ci show` fails closed
+ * on the same invalid `.seq/ci.json` shapes the runner rejects (`ci/config`).
+ * Keep in sync with `atlas/src/server/services/git-service/ci-discover.ts`.
+ */
+const CiPhaseSchema = z.enum(['check', 'test']);
+const CiJsonEntrySchema = z
+    .object({
+    phase: CiPhaseSchema,
+    name: z
+        .string()
+        .min(1)
+        .max(64)
+        .regex(/^[a-z][a-z0-9._/-]*$/)
+        .optional(),
+    script: z.string().min(1).max(128).optional(),
+    command: z.array(z.string().min(1).max(256)).min(1).max(32).optional(),
+})
+    .superRefine((entry, ctx) => {
+    const hasScript = entry.script != null;
+    const hasCommand = entry.command != null;
+    if (hasScript === hasCommand) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'each check must specify exactly one of script or command',
+            path: hasScript ? ['command'] : ['script'],
+        });
+    }
+});
+const CiJsonSchema = z.object({
+    checks: z.array(CiJsonEntrySchema).max(16),
+});
+/** Match atlas `ci-discover` defaultNameForPhase (per-phase index, not array index). */
+function defaultNameForPhase(phase, indexInPhase) {
+    if (indexInPhase === 0)
+        return `ci/${phase}`;
+    return `ci/${phase}-${indexInPhase + 1}`;
+}
+/**
+ * Pure discovery shared by `repos ci show` / `import`. Mirrors atlas
+ * `discoverCiChecks` / `parseCiJson` so CLI preview matches execution.
+ */
+export function discoverCliChecks({ ciJson, packageScripts, }) {
+    if (ciJson !== undefined) {
+        const parsed = CiJsonSchema.safeParse(ciJson);
+        if (!parsed.success) {
+            const detail = parsed.error.issues
+                .map((i) => `${i.path.join('.') || '(root)'}: ${i.message}`)
+                .slice(0, 3)
+                .join('; ');
+            return { ok: false, error: `Invalid .seq/ci.json: ${detail}` };
+        }
+        const phaseCounts = new Map();
+        const seenNames = new Set();
+        const checks = [];
+        for (const entry of parsed.data.checks) {
+            const indexInPhase = phaseCounts.get(entry.phase) ?? 0;
+            phaseCounts.set(entry.phase, indexInPhase + 1);
+            const name = entry.name ?? defaultNameForPhase(entry.phase, indexInPhase);
+            if (seenNames.has(name)) {
+                return {
+                    ok: false,
+                    error: `Invalid .seq/ci.json: duplicate check name "${name}"`,
+                };
+            }
+            seenNames.add(name);
+            const check = {
+                name,
+                source: 'ci.json',
+            };
+            if (entry.script != null)
+                check.script = entry.script;
+            if (entry.command != null)
+                check.command = entry.command;
+            checks.push(check);
+        }
+        return { ok: true, checks };
+    }
+    const checks = [];
+    if (packageScripts) {
+        for (const candidate of ['lint', 'typecheck', 'check']) {
+            if (packageScripts[candidate]?.trim()) {
+                checks.push({ name: 'ci/check', script: candidate, source: 'autodiscover' });
+                break;
+            }
+        }
+        if (packageScripts.test?.trim()) {
+            checks.push({ name: 'ci/test', script: 'test', source: 'autodiscover' });
+        }
+    }
+    return { ok: true, checks };
+}
+function decodeFileContent(file) {
+    return file.encoding === 'base64'
+        ? Buffer.from(file.content, 'base64').toString('utf8')
+        : file.content;
+}
+/**
+ * Load `.seq/ci.json` / `package.json` for CI preview.
+ *
+ * Matches the runner: only a true 404 means "file absent". Invalid JSON and
+ * non-404 API errors fail closed (no silent package.json fallback over a bad
+ * `.seq/ci.json`).
+ */
+export async function loadRemoteCiSources({ ctx, repoId, ref, }) {
+    let ciJson;
+    try {
+        const file = await getJsonOr404({
+            ...clientOptions(ctx),
+            path: `/api/git-service/repos/${repoId}/contents/.seq/ci.json?ref=${encodeURIComponent(ref)}`,
+        });
+        if (file != null) {
+            try {
+                ciJson = JSON.parse(decodeFileContent(file));
+            }
+            catch {
+                return { ok: false, error: 'invalid .seq/ci.json: not valid JSON' };
+            }
+        }
+    }
+    catch (err) {
+        if (err instanceof AtlasApiError) {
+            return { ok: false, error: `failed to fetch .seq/ci.json: ${err.message}` };
+        }
+        throw err;
+    }
+    // When ci.json is present (including empty checks), skip package.json —
+    // discovery never falls through to autodiscover in that case.
+    if (ciJson !== undefined) {
+        return { ok: true, ciJson };
+    }
+    let packageScripts;
+    try {
+        const file = await getJsonOr404({
+            ...clientOptions(ctx),
+            path: `/api/git-service/repos/${repoId}/contents/package.json?ref=${encodeURIComponent(ref)}`,
+        });
+        if (file != null) {
+            let pkg;
+            try {
+                pkg = JSON.parse(decodeFileContent(file));
+            }
+            catch {
+                return { ok: false, error: 'invalid package.json: not valid JSON' };
+            }
+            if (pkg.scripts && typeof pkg.scripts === 'object') {
+                packageScripts = {};
+                for (const [key, value] of Object.entries(pkg.scripts)) {
+                    if (typeof value === 'string')
+                        packageScripts[key] = value;
+                }
+            }
+        }
+    }
+    catch (err) {
+        if (err instanceof AtlasApiError) {
+            return { ok: false, error: `failed to fetch package.json: ${err.message}` };
+        }
+        throw err;
+    }
+    return { ok: true, packageScripts };
+}
+/**
+ * Discover CI checks from a remote repo tip (pure preview — no Settings write).
+ * Uses the same autodiscovery rules as the platform runner (PLA-378).
+ */
+export async function reposCiShowCommand(args) {
+    const { namespace, name } = parseRepoPath(args.positional[0]);
+    const ctx = await reposContext(args);
+    const resolved = await resolveRepo({ ...clientOptions(ctx), namespace, name });
+    const repo = await getJson({
+        ...clientOptions(ctx),
+        path: `/api/git-service/repos/${resolved.id}`,
+    });
+    const ref = stringFlag(args.flags, 'ref') ?? repo.defaultBranch;
+    const required = new Set(repo.reviewPolicy?.requiredChecks ?? []);
+    const sources = await loadRemoteCiSources({ ctx, repoId: resolved.id, ref });
+    if (!sources.ok) {
+        console.error(`${LOG} ${sources.error} on ${namespace}/${name}@${ref}`);
+        return 1;
+    }
+    const discovered = discoverCliChecks(sources);
+    if (!discovered.ok) {
+        console.error(`${LOG} ${discovered.error} on ${namespace}/${name}@${ref}`);
+        return 1;
+    }
+    console.log(`${LOG} CI for ${namespace}/${name}@${ref} on ${ctx.env.name}:`);
+    if (discovered.checks.length === 0) {
+        console.log('  (no checks discovered)');
+        return 0;
+    }
+    for (const check of discovered.checks) {
+        const how = check.script != null
+            ? `script=${check.script}`
+            : check.command != null
+                ? `command=${JSON.stringify(check.command)}`
+                : '';
+        console.log(`  ${check.name}  ${how}  source=${check.source}  required=${required.has(check.name)}`);
+    }
+    return 0;
+}
+const REQUIRED_CHECKS_WRITE_DISABLED = `${LOG} writing requiredChecks is disabled until the sandboxed CI runner is live ` +
+    `(discovery posts neutral check-runs that cannot satisfy the merge gate). ` +
+    `Use \`seq-studio repos ci show\` to preview discovered names.`;
+/** Add a check-run name to Settings `requiredChecks` (merge-blocking). */
+export async function reposCiRequireCommand(args) {
+    const check = stringFlag(args.flags, 'check');
+    if (!check) {
+        console.error('usage: seq-studio repos ci require <ns>/<name> --check <name> -e <env>');
+        return 1;
+    }
+    console.error(REQUIRED_CHECKS_WRITE_DISABLED);
+    return 1;
+}
+/**
+ * Set requiredChecks to every check discovered on the tip (opt-in bulk require).
+ */
+export async function reposCiImportCommand(args) {
+    // Still run show so authors can preview names, then refuse the write.
+    const code = await reposCiShowCommand(args);
+    if (code !== 0)
+        return code;
+    console.error(REQUIRED_CHECKS_WRITE_DISABLED);
+    return 1;
+}
+export async function reposCiCommand(args) {
+    const [action] = args.positional;
+    const rest = {
+        ...args,
+        positional: args.positional.slice(1),
+    };
+    switch (action) {
+        case 'show':
+            return reposCiShowCommand(rest);
+        case 'require':
+            return reposCiRequireCommand(rest);
+        case 'import':
+            return reposCiImportCommand(rest);
+        case 'help':
+        case undefined:
+            console.log(`usage:
+  seq-studio repos ci show <ns>/<name> -e <env> [--ref r]           preview discovered CI checks
+  seq-studio repos ci require <ns>/<name> --check <name> -e <env>   reserved (refuses write until sandboxed runner)
+  seq-studio repos ci import <ns>/<name> -e <env> [--ref r]         reserved (refuses write until sandboxed runner)
+`);
+            return action ? 0 : 1;
+        default:
+            console.error(`unknown repos ci command: ${action}`);
+            return 1;
+    }
+}
 export async function reposDeleteCommand(args) {
     const { namespace, name } = parseRepoPath(args.positional[0]);
     const ctx = await reposContext(args);
@@ -505,6 +757,9 @@ export const REPOS_USAGE = `usage:
   seq-studio repos pull <ns>/<name> -e <env> [--ref r] [--out dir] [--force]
                                                                     materialize the tree at a ref (JSON API)
   seq-studio repos delete <ns>/<name> -e <env> [--yes]              delete a repo (confirm prompt)
+  seq-studio repos ci show <ns>/<name> -e <env> [--ref r]           preview discovered CI checks
+  seq-studio repos ci require <ns>/<name> --check <name> -e <env>   reserved (refuses write until sandboxed runner)
+  seq-studio repos ci import <ns>/<name> -e <env> [--ref r]         reserved (refuses write until sandboxed runner)
 
   Flags: -e/--env <env> (required; see: seq-studio envs list)
 
@@ -534,6 +789,8 @@ export async function runReposCommand(sub, args) {
                 return await reposPullCommand(args);
             case 'delete':
                 return await reposDeleteCommand(args);
+            case 'ci':
+                return await reposCiCommand(args);
             case 'help':
             case '--help':
             case '-h':

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sequenceholdings/studio-cli",
-  "version": "0.1.18",
-  "description": "Unified Sequence Studio CLI — `seq-studio process` (Lattice), `seq-studio artifact` (Artifact Studio), `seq-studio functions` / `secrets`, `seq-studio repos` (platform git-service), and `seq-studio auth pat` (git-service PATs). Includes Auth0 browser login shared with seqapi.",
+  "version": "0.1.22",
+  "description": "Unified Sequence Studio CLI — `seq-studio agents` (typed agent definitions), `seq-studio process` (Lattice), `seq-studio artifact` (Artifact Studio), `seq-studio functions` / `secrets`, `seq-studio repos` (platform git-service), and `seq-studio auth pat` (git-service PATs). Includes Auth0 browser login shared with seqapi.",
   "license": "UNLICENSED",
   "repository": {
     "type": "git",
@@ -40,12 +40,13 @@
     "smol-toml": "^1.4.2",
     "tsx": "^4.20.3",
     "zod": "^4.1.13",
-    "@sequenceholdings/artifact-studio": "0.1.15",
+    "@sequenceholdings/agent-spec": "0.1.0",
+    "@sequenceholdings/artifact-studio": "0.2.0",
     "@sequenceholdings/lattice": "0.1.2"
   },
   "peerDependencies": {
-    "@sequenceholdings/pipeline-spec": "0.1.0",
-    "@sequenceholdings/orm": "0.1.1"
+    "@sequenceholdings/orm": "0.1.2",
+    "@sequenceholdings/pipeline-spec": "0.1.0"
   },
   "peerDependenciesMeta": {
     "@sequenceholdings/orm": {
@@ -60,7 +61,7 @@
     "@types/node": "^22.0.0",
     "typescript": "^5.6.0",
     "vitest": "^4.1.5",
-    "@sequenceholdings/orm": "0.1.1",
+    "@sequenceholdings/orm": "0.1.2",
     "@sequenceholdings/pipeline-spec": "0.1.0"
   },
   "engines": {
@@ -70,6 +71,7 @@
     "studio",
     "sequence",
     "lattice",
+    "agents",
     "process",
     "artifact",
     "cli"