@stringsync/splates 0.0.53 → 0.0.55

package/creds.test.ts

@@ -1,336 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it } from "bun:test";
-import { Testing } from "@stringsync/splates-server/testing";
-import { Duration, sleep } from "webappwiz/time";
-import { splates } from "./splates";
-
-const WHY = "To read the build logs through the dashboard's API.";
-const HOW = "Open the dashboard, create a token, and paste it here.";
-
-/** Long enough that a test only reaches it when waiting is genuinely stuck. */
-const PATIENT = { timeout: Duration.secs(5), poll: Duration.ms(5) };
-
-describe("creds", () => {
-	let deps: Testing;
-
-	beforeEach(async () => {
-		deps = await Testing.open();
-	});
-
-	afterEach(() => deps.disposeAsync());
-
-	it("records a request, with what for and how to get it, for the page to show", async () => {
-		await deps.creds.request("API_TOKEN", {
-			scope: "device",
-			purpose: WHY,
-			instructions: HOW,
-			task: "alpha",
-		});
-
-		expect(await deps.creds.requests()).toMatchObject([
-			{
-				name: "API_TOKEN",
-				scope: "device",
-				purpose: WHY,
-				instructions: HOW,
-				task: "alpha",
-				status: "open",
-			},
-		]);
-	});
-
-	it("asks nothing for a cred already kept, unless told the kept one fails", async () => {
-		await deps.projectStore.set("API_TOKEN", "old");
-		const ask = {
-			scope: "project" as const,
-			purpose: WHY,
-			instructions: HOW,
-			task: null,
-		};
-
-		expect(await deps.creds.request("API_TOKEN", ask)).toBeNull();
-		expect(
-			await deps.creds.request("API_TOKEN", { ...ask, replace: true }),
-		).toMatchObject({ status: "open" });
-	});
-
-	it("replaces with the last request's purpose and instructions when left off", async () => {
-		const ask = {
-			scope: "project" as const,
-			purpose: WHY,
-			instructions: HOW,
-			task: null,
-		};
-		await deps.creds.request("API_TOKEN", ask);
-		await deps.projectStore.set("API_TOKEN", "old");
-
-		expect(
-			await deps.creds.request("API_TOKEN", {
-				scope: "project",
-				purpose: "",
-				instructions: "",
-				task: null,
-				replace: true,
-			}),
-		).toMatchObject({ purpose: WHY, instructions: HOW, status: "open" });
-	});
-
-	it("refuses a request that says nothing of what it is for", async () => {
-		await expect(
-			deps.creds.request("API_TOKEN", {
-				scope: "project",
-				purpose: " ",
-				instructions: HOW,
-				task: null,
-			}),
-		).toBail("usage");
-	});
-
-	it("refuses a request that says nothing of how to get it", async () => {
-		await expect(
-			deps.creds.request("API_TOKEN", {
-				scope: "project",
-				purpose: WHY,
-				instructions: " ",
-				task: null,
-			}),
-		).toBail("usage");
-	});
-
-	it("refuses a name no environment variable could have", async () => {
-		await expect(
-			deps.creds.request("api-token", {
-				scope: "project",
-				purpose: WHY,
-				instructions: HOW,
-				task: null,
-			}),
-		).toBail("usage");
-	});
-
-	it("keeps a value in the store its request asked for, and fills it", async () => {
-		await deps.creds.request("API_TOKEN", {
-			scope: "device",
-			purpose: WHY,
-			instructions: HOW,
-			task: null,
-		});
-
-		expect(await deps.creds.save("API_TOKEN", " secret \n")).toBe("device");
-
-		expect(await deps.deviceStore.get("API_TOKEN")).toBe("secret");
-		expect(await deps.projectStore.get("API_TOKEN")).toBeUndefined();
-		expect((await deps.creds.requests())[0]?.status).toBe("saved");
-		expect(await deps.creds.credentials.require("API_TOKEN")).toBe("secret");
-	});
-
-	it("never writes a value into its record", async () => {
-		await deps.creds.request("API_TOKEN", {
-			scope: "project",
-			purpose: WHY,
-			instructions: HOW,
-			task: null,
-		});
-		await deps.creds.save("API_TOKEN", "hunter2", { by: "a tool" });
-
-		expect(await deps.fs.read(`${deps.splatesDir}/creds.json`)).not.toContain(
-			"hunter2",
-		);
-	});
-
-	it("ends a wait once the value is saved", async () => {
-		await deps.creds.request("API_TOKEN", {
-			scope: "project",
-			purpose: WHY,
-			instructions: HOW,
-			task: null,
-		});
-
-		const waiting = deps.creds.wait("API_TOKEN", PATIENT);
-		await sleep(Duration.ms(20));
-		await deps.creds.save("API_TOKEN", "secret");
-
-		expect(await waiting).toBe("saved");
-	});
-
-	it("ends a wait once the request is dismissed", async () => {
-		await deps.creds.request("API_TOKEN", {
-			scope: "project",
-			purpose: WHY,
-			instructions: HOW,
-			task: null,
-		});
-		await deps.creds.dismiss("API_TOKEN");
-
-		expect(await deps.creds.wait("API_TOKEN", PATIENT)).toBe("dismissed");
-	});
-
-	it("gives up waiting on a request nobody fills", async () => {
-		await deps.creds.request("API_TOKEN", {
-			scope: "project",
-			purpose: WHY,
-			instructions: HOW,
-			task: null,
-		});
-
-		await expect(
-			deps.creds.wait("API_TOKEN", {
-				timeout: Duration.ms(20),
-				poll: Duration.ms(5),
-			}),
-		).toBail("timeout");
-	});
-
-	it("refuses to wait on a cred nothing requested", async () => {
-		await expect(deps.creds.wait("API_TOKEN", PATIENT)).toBail("not_found");
-	});
-
-	it("lists what each store keeps, and what a tool saved itself", async () => {
-		await deps.projectStore.set("DATABASE_URL", "x");
-		await deps.creds.save("TUNNEL_TOKEN", "y", {
-			scope: "device",
-			by: "splates tunnel setup",
-		});
-
-		expect(await deps.creds.kept()).toEqual([
-			{
-				name: "DATABASE_URL",
-				scope: "project",
-				provider: "system",
-				savedBy: null,
-			},
-			{
-				name: "TUNNEL_TOKEN",
-				scope: "device",
-				provider: "system",
-				savedBy: "splates tunnel setup",
-			},
-		]);
-	});
-
-	it("removes a kept cred from its store", async () => {
-		await deps.creds.save("TUNNEL_TOKEN", "y", { scope: "device", by: "t" });
-
-		expect(await deps.creds.remove("TUNNEL_TOKEN", "device")).toBe(true);
-		expect(await deps.creds.kept()).toEqual([]);
-	});
-
-	it("says the system keeps no secrets when its store cannot be reached", async () => {
-		deps.projectStore.names = () => Promise.reject(new Error("no daemon"));
-
-		await expect(deps.creds.kept()).toBail("no_secret_store", {
-			message: "secret service",
-		});
-	});
-});
-
-// scry-ignore simple-test-setup: one describe per command, as the file groups the CLI's cases
-describe("splates creds", () => {
-	let env: Testing;
-	let deps: Parameters<typeof splates.run>[0];
-
-	beforeEach(async () => {
-		env = await Testing.open();
-		env.ps.cd(env.root);
-		deps = {
-			log: env.log,
-			fs: env.fs,
-			ps: env.ps,
-			assets: env.assets,
-			secrets: env.secrets,
-		};
-	});
-
-	afterEach(() => env.disposeAsync());
-
-	it("requests a cred, then waits until a person saves it", async () => {
-		await splates.run(deps, [
-			"creds",
-			"request",
-			"API_TOKEN",
-			"--purpose",
-			WHY,
-			"--instructions",
-			HOW,
-			"--device",
-		]);
-		expect(env.out()).toContain(`requested API_TOKEN  ${WHY}`);
-
-		const waiting = splates.run(deps, ["creds", "wait", "API_TOKEN"]);
-		await sleep(Duration.ms(20));
-		await env.creds.save("API_TOKEN", "secret");
-		await waiting;
-
-		expect(env.out()).toContain("saved API_TOKEN");
-		expect(await env.deviceStore.get("API_TOKEN")).toBe("secret");
-	});
-
-	it("exits dismissed when the person turns the request down", async () => {
-		await splates.run(deps, [
-			"creds",
-			"request",
-			"API_TOKEN",
-			"--purpose",
-			WHY,
-			"--instructions",
-			HOW,
-		]);
-		await env.creds.dismiss("API_TOKEN");
-
-		await splates.run(deps, ["creds", "wait", "API_TOKEN"]);
-
-		expect(env.proc.exits).toEqual([22]);
-	});
-
-	it("lists requests and kept creds by name, never a value", async () => {
-		await env.projectStore.set("DATABASE_URL", "postgres://secret");
-		await splates.run(deps, [
-			"creds",
-			"request",
-			"API_TOKEN",
-			"--purpose",
-			WHY,
-			"--instructions",
-			HOW,
-		]);
-
-		await splates.run(deps, ["creds", "list", "--json"]);
-
-		const listed = String(env.log.entries.at(-1)?.message);
-		expect(JSON.parse(listed)).toMatchObject({
-			requested: [{ name: "API_TOKEN", status: "open" }],
-			kept: [{ name: "DATABASE_URL", scope: "project" }],
-		});
-		expect(listed).not.toContain("postgres://secret");
-	});
-});
-
-// scry-ignore simple-test-setup: copyLegacy reads a store the other commands never touch
-describe("copyLegacy", () => {
-	let deps: Testing;
-
-	beforeEach(async () => {
-		deps = await Testing.open();
-	});
-
-	afterEach(() => deps.disposeAsync());
-
-	it("keeps each of arbor's creds under splates's name too, in the same store", async () => {
-		await deps.deviceStore.set("ARBOR_CLOUDFLARE_API_TOKEN", "secret");
-
-		await deps.creds.copyLegacy();
-
-		expect(await deps.deviceStore.names()).toEqual([
-			"ARBOR_CLOUDFLARE_API_TOKEN",
-			"SPLATES_CLOUDFLARE_API_TOKEN",
-		]);
-	});
-
-	it("leaves a cred splates already keeps", async () => {
-		await deps.deviceStore.set("ARBOR_TUNNEL_TOKEN", "old");
-		await deps.deviceStore.set("SPLATES_TUNNEL_TOKEN", "new");
-
-		await deps.creds.copyLegacy();
-
-		expect(await deps.deviceStore.get("SPLATES_TUNNEL_TOKEN")).toBe("new");
-	});
-});

package/creds.ts

@@ -1,144 +0,0 @@
-import { DEFAULT_TIMEOUT, PROVIDERS } from "@stringsync/splates-server/creds";
-import { fail } from "@stringsync/splates-server/exit";
-import { repository } from "@stringsync/splates-server/records";
-import type { SplatesDeps } from "@stringsync/splates-server/server";
-import { untilAfter } from "@stringsync/splates-server/tasks";
-import { cli } from "webappwiz/cmd";
-import { color } from "webappwiz/log";
-import { Duration } from "webappwiz/time";
-import { z } from "zod";
-import { here } from "./flags";
-
-/** `splates creds`, which the root cli mounts after `splates lane`. */
-export const splatesCreds = cli<SplatesDeps>("creds").description(
-	"creds an agent needs a person for, such as an API token: request one saying what it is for, with instructions for getting it, which the Creds page of `splates server` shows for the person to paste, then wait for it; the value goes into the system's store (the macOS Keychain, Windows Credential Manager, a Linux secret service), never to the agent, and code reads it through webappwiz/creds",
-);
-
-splatesCreds
-	.command("request")
-	.use(repository({ needs: "own" }))
-	.description(
-		"ask a person for a cred, saying why it is needed and what it will be used for, with markdown instructions for getting it; returns at once, and does nothing when the store already keeps it unless --replace; run from a worktree, it records the task asking",
-	)
-	.arg("name", z.string(), {
-		description: "what it is kept as, an environment variable's name",
-	})
-	.option("purpose", z.string(), {
-		default: "",
-		description:
-			"why it is needed and what it will be used for, in a sentence the person reads before getting it",
-	})
-	.option("instructions", z.string(), {
-		default: "",
-		description:
-			"how to get it, in markdown: where to go, what to pick, what to paste",
-	})
-	.option("device", z.boolean(), {
-		default: false,
-		description:
-			"keep it for every project on this device, as for a person's own account, rather than this project alone",
-	})
-	.option("provider", z.optional(z.enum(PROVIDERS)), {
-		description:
-			"who keeps it: `system`, the machine's own store, or `ssm`, AWS Parameter Store, where that is offered",
-	})
-	.option("replace", z.boolean(), {
-		default: false,
-		description:
-			"ask again although one is kept, since the kept one does not work; --purpose and --instructions left off are those of the last request",
-	})
-	.action(async (opts, ctx) => {
-		const scope = opts.device ? "device" : "project";
-		const provider = opts.provider ?? "system";
-		const request = await ctx.journal.record(
-			"creds request",
-			null,
-			async () =>
-				ctx.creds.request(opts.name, {
-					scope,
-					provider,
-					purpose: opts.purpose,
-					instructions: opts.instructions,
-					task: await here(ctx),
-					replace: opts.replace,
-				}),
-			(asked) => ({ name: opts.name, asked: asked !== null }),
-		);
-		if (request === null) {
-			ctx.log.info(
-				`${color.green("kept")} ${opts.name} in ${ctx.creds.label(scope, provider)}: nothing to ask`,
-			);
-			return;
-		}
-		ctx.log.info(
-			`${color.yellow("requested")} ${opts.name}  ${color.dim(request.purpose)}`,
-		);
-		ctx.log.error(
-			`It shows on the Creds page of \`splates server\`. \`splates creds wait ${opts.name}\` until it is saved.`,
-		);
-	});
-
-splatesCreds
-	.command("wait")
-	.use(repository({ needs: "own" }))
-	.description(
-		"block until a person saves the cred requested, or dismisses the request (`dismissed`); gives up with `timeout` rather than waiting forever",
-	)
-	.arg("name", z.string(), { description: "the cred requested" })
-	.option("timeout-secs", z.coerce.number(), {
-		default: DEFAULT_TIMEOUT.secs,
-		description: "how long to wait before giving up",
-	})
-	.action(async (opts, ctx) => {
-		const timeout = Duration.secs(opts["timeout-secs"]);
-		await ctx.journal.waiting(
-			"creds wait",
-			null,
-			{ name: opts.name, until: untilAfter(timeout) },
-			async () => {
-				const ended = await ctx.creds.wait(opts.name, { timeout });
-				if (ended === "dismissed") {
-					fail(
-						"dismissed",
-						`${opts.name} was dismissed: carry on without it, or ask the person why`,
-						{ name: opts.name },
-					);
-				}
-			},
-		);
-		ctx.log.info(`${color.green("saved")} ${opts.name}`);
-	});
-
-splatesCreds
-	.command("list")
-	.use(repository({ needs: "read" }))
-	.description(
-		"the creds requested and still open, with what each is for, and every cred the project's store and the device's keep, by name; never a value",
-	)
-	.option("json", z.boolean(), { default: false, description: "emit JSON" })
-	.action(async (opts, ctx) => {
-		const open = (await ctx.creds.requests()).filter(
-			(each) => each.status === "open",
-		);
-		const kept = await ctx.creds.kept();
-		if (opts.json) {
-			ctx.log.info(JSON.stringify({ requested: open, kept }, null, 2));
-			return;
-		}
-		for (const each of open) {
-			ctx.log.info(
-				`${color.yellow("requested")} ${each.name}  ${color.dim(each.scope)}${each.task === null ? "" : color.dim(`  by ${each.task}`)}`,
-			);
-			if (each.purpose !== "") {
-				ctx.log.info(`          ${each.purpose}`);
-			}
-		}
-		for (const each of kept) {
-			ctx.log.info(
-				`${color.green("kept")}      ${each.name}  ${color.dim(`${each.provider} ${each.scope}`)}${each.savedBy === null ? "" : color.dim(`  saved by ${each.savedBy}`)}`,
-			);
-		}
-		if (open.length === 0 && kept.length === 0) {
-			ctx.log.info(color.dim("no creds requested or kept"));
-		}
-	});

package/dev/dev.ts

@@ -1,86 +0,0 @@
-import type { SplatesDeps } from "@stringsync/splates-server/server";
-import type { Cli } from "webappwiz/cmd";
-import { z } from "zod";
-import { evalSkill } from "./eval";
-import { fix } from "./fix";
-import { PROOFS, prove } from "./prove";
-import { ship } from "./ship";
-import { test } from "./test";
-
-/** Adds `splates dev`, the commands for working on this repository, to `program`. */
-export function mountDev(program: Cli<SplatesDeps>): void {
-	// Only `checkout.ts`, the entry `bin/splates` runs, calls this, so the
-	// published cli never carries these: a release bundles what its `bin` and
-	// `exports` entries import, and `index.ts` imports none of this.
-	const dev = program
-		.group("dev")
-		.description("work on the splates repository");
-
-	dev
-		.command("eval")
-		.description(
-			"compare versions of the splates skill by running agents on it; uses tokens billed to an API key or counted against a Claude plan, so run it only when asked",
-		)
-		.rest("args", z.string(), {
-			description:
-				"[fast|list|report] [--probe id] [--target agent:model] [--parallel n], or explicit e2e [run|report]",
-		})
-		.allowUnknownOption()
-		.action((opts, { ps }) => evalSkill({ ...opts, ps }));
-
-	dev
-		.command("fix")
-		.description("format, check, and typecheck the repository")
-		.option("check", z.boolean(), {
-			default: false,
-			description: "report problems without writing fixes (for CI)",
-		})
-		.option("code-only", z.boolean(), {
-			default: false,
-			description: "run Scry code rules without credentials or model calls",
-		})
-		.action(({ "code-only": codeOnly, ...opts }, { log, ps }) =>
-			fix({ ...opts, codeOnly, log, ps }),
-		);
-
-	dev
-		.command("prove")
-		.description(
-			"prove splates on Linux end to end with Docker, nothing of yours used: `coordinator` runs the server in a Debian container as the user splates, as the AWS box will, with this machine as its worker, and drives a task, a restart, an archive and a cred through it; `worker` runs a container as a worker of a server here. Read docker/prove-<which>.sh for what each checks",
-		)
-		.arg("proof", z.enum(PROOFS), {
-			description: "coordinator or worker",
-		})
-		.rest("args", z.string(), {
-			description:
-				"handed to the script: a port, and for `worker` --agent <id> --model <model> to hand the task to a roster agent",
-		})
-		.allowUnknownOption()
-		.action(({ proof, args }, { log, ps }) => prove({ proof, args, log, ps }));
-
-	dev
-		.command("ship")
-		.description("release the package, with its skill stamped at its version")
-		.action((_opts, { log, fs, ps }) => ship({ log, fs, ps }));
-
-	dev
-		.command("test")
-		.description("run the package's tests; eval harness tests are separate")
-		.option("evals", z.boolean(), {
-			default: false,
-			description: "run only free eval harness tests (no model calls)",
-		})
-		.option("all", z.boolean(), {
-			default: false,
-			description: "run the package's and the eval harness's tests together",
-		})
-		.option("linux", z.boolean(), {
-			default: false,
-			description:
-				"run them on Linux, in a Docker container built from the checkout, as the box and the workers run; needs Docker",
-		})
-		.rest("files", z.string(), {
-			description: "run only the test files whose path has one of these",
-		})
-		.action((opts, { log, ps }) => test({ ...opts, log, ps }));
-}

package/dev/eval.ts

@@ -1,21 +0,0 @@
-import { NodePs, type Ps } from "webappwiz/system";
-import { ROOT } from "./root";
-
-export interface EvalOptions {
-	/** What splates's evals entry is given: fast selection, report, or explicit e2e, then its arguments. */
-	args: string[];
-	ps?: Ps;
-}
-
-/** Run the focused suite by default; legacy end-to-end evaluation requires `e2e`. */
-export async function evalSkill(opts: EvalOptions): Promise<void> {
-	const ps = opts.ps ?? new NodePs();
-	const args = opts.args.length ? opts.args : ["fast"];
-	const { exitCode } = await ps.spawn(
-		["bun", "evals/splates-skill/index.ts", ...args],
-		{ cwd: ROOT },
-	);
-	if (exitCode !== 0) {
-		throw new Error("The evals failed");
-	}
-}

package/dev/fix.ts

@@ -1,63 +0,0 @@
-import { ConsoleLogger, color, type Logger } from "webappwiz/log";
-import { NodePs, type Ps } from "webappwiz/system";
-import { ROOT } from "./root";
-
-export interface FixOptions {
-	/** Report problems without writing fixes, as CI wants it. */
-	check: boolean;
-	/** Check only code rules, without credentials or model calls. */
-	codeOnly?: boolean;
-	/** Skip Scry when checking a release that was already reviewed. */
-	skipScry?: boolean;
-	log?: Logger;
-	ps?: Ps;
-}
-
-/**
- * Runs biome, the type checker, then scry on what changed since main, in
- * that order. Scry leaves off each model its budget no longer covers, so a
- * spent budget narrows the check rather than fail it.
- */
-export async function fix(opts: FixOptions): Promise<void> {
-	const log = opts.log ?? new ConsoleLogger();
-	const ps = opts.ps ?? new NodePs();
-
-	// Every step says how it went and the first failure ends the run, so the
-	// verdict a person reads last is the one that stopped them.
-	const step = (name: string, ok: boolean, failure: string): void => {
-		log.info(`${name}: ${ok ? color.green("success") : color.red("failed")}`);
-		if (!ok) {
-			throw new Error(failure);
-		}
-	};
-
-	const flags = opts.check ? [] : ["--write", "--unsafe"];
-	const biome = await ps.spawn(["bunx", "biome", "check", ...flags, "."], {
-		cwd: ROOT,
-	});
-	step("biome", biome.exitCode === 0, "Biome check failed");
-
-	const typecheck = await ps.spawn(["bunx", "tsc", "--noEmit"], {
-		cwd: ROOT,
-	});
-	step("typecheck", typecheck.exitCode === 0, "Typechecking failed");
-
-	if (opts.skipScry) {
-		return;
-	}
-
-	const scry = await ps.spawn(
-		[
-			"bunx",
-			"@webappwiz/cli",
-			"scry",
-			"check",
-			"--since",
-			"main",
-			"--disable-over-budget",
-			...(opts.codeOnly ? ["--disable", "som", "--disable", "llm"] : []),
-		],
-		{ cwd: ROOT },
-	);
-	step("scry", scry.exitCode === 0, "Scry check failed");
-}

package/dev/index.ts

@@ -1 +0,0 @@
-export { mountDev } from "./dev";

package/dev/prove.ts

@@ -1,38 +0,0 @@
-import { join } from "node:path";
-import { ConsoleLogger, type Logger } from "webappwiz/log";
-import { NodePs, type Ps } from "webappwiz/system";
-import { ROOT } from "./root";
-
-/** The proofs, each a script in `docker/`. */
-export const PROOFS = ["coordinator", "worker"] as const;
-export type Proof = (typeof PROOFS)[number];
-
-export interface ProveOptions {
-	proof: Proof;
-	/** What the script takes after its name, such as a port or `--agent`. */
-	args?: string[];
-	ps?: Ps;
-	log?: Logger;
-}
-
-/**
- * Runs a proof of splates on Linux end to end: `coordinator` runs the server
- * in a Docker container with this machine as its worker, and `worker` the
- * inverse. Each prints what it checked and fails on the first thing wrong.
- */
-export async function prove(opts: ProveOptions): Promise<void> {
-	const ps = opts.ps ?? new NodePs();
-	const log = opts.log ?? new ConsoleLogger();
-	log.info(`proving the ${opts.proof} on Linux; needs Docker`);
-	const { exitCode } = await ps.spawn(
-		[
-			"sh",
-			join(ROOT, "docker", `prove-${opts.proof}.sh`),
-			...(opts.args ?? []),
-		],
-		{ cwd: ROOT },
-	);
-	if (exitCode !== 0) {
-		throw new Error(`The ${opts.proof} proof failed`);
-	}
-}

package/dev/root.ts

@@ -1,7 +0,0 @@
-import { join } from "node:path";
-
-/**
- * The checkout this `splates dev` runs from, which `bin/_run` picks as the one you
- * are standing in: a git worktree's own copy, so testing it tests your work.
- */
-export const ROOT = join(import.meta.dir, "../../..");