@thallylabs/cli 0.5.5 → 0.5.7

package/dist/index.js

@@ -278,7 +278,7 @@ async function runDeploy(args) {
 import { readFileSync as readFileSync3 } from "fs";
 import Anthropic from "@anthropic-ai/sdk";
 
-// ../agent/dist/chunk-7RSLSWEK.js
+// ../agent/dist/chunk-MZM56AWR.js
 import fs from "fs";
 import path3 from "path";
 import { AGENT_BRANCH_PREFIX, DOCS_PREVIEW_LABEL, buildTrackInstruction } from "@thallylabs/mcp/track";
@@ -289,14 +289,14 @@ function nonEmptyModel(value) {
 function resolveAgentModel(explicitModel, configuredModel = process.env.THALLY_AGENT_MODEL, legacyModel = process.env.DOX_AGENT_MODEL) {
   return nonEmptyModel(explicitModel) ?? nonEmptyModel(configuredModel) ?? nonEmptyModel(legacyModel) ?? DEFAULT_AGENT_MODEL;
 }
-var DOCS_AGENT_WORKFLOW_CONTRACT = "thally-track/v3";
+var DOCS_AGENT_WORKFLOW_CONTRACT = "thally-track/v4";
 var DOCS_AGENT_WORKFLOW_TEMPLATE = `# Contract: ${DOCS_AGENT_WORKFLOW_CONTRACT}
 name: Thally docs agent
 
 on:
   # A product repo dispatches a docs task here (see the sender workflow).
   repository_dispatch:
-    types: [thally-document]
+    types: [thally-document, thally-readiness]
   # Run it by hand from the Actions tab.
   workflow_dispatch:
     inputs:
@@ -314,12 +314,15 @@ on:
     - cron: '0 6 * * 1'
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   document:
     if: github.event_name != 'schedule'
+    permissions:
+      contents: write
+      pull-requests: write
+      id-token: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -349,7 +352,13 @@ jobs:
           FROM_PR: \${{ github.event.client_payload.from_pr || inputs.from_pr }}
           TRACK_CONTEXT: \${{ github.event.client_payload.context || inputs.context }}
           REQUESTER: \${{ github.event.client_payload.requester }}
+          THALLY_PR_GRANT: \${{ github.event.client_payload.thally_pr_grant }}
+          THALLY_PR_BRANCH: \${{ github.event.client_payload.thally_pr_branch }}
+          THALLY_PR_BROKER_URL: \${{ github.event.client_payload.thally_pr_broker_url || 'https://app.thally.io/api/github/readiness-pr' }}
         run: |
+          if [ -n "\${THALLY_PR_GRANT:-}" ]; then
+            echo "::add-mask::$THALLY_PR_GRANT"
+          fi
           run_thally() {
             if [ -x node_modules/.bin/thally ]; then
               # Existing sites may pin an older CLI that cannot consume the
@@ -366,14 +375,49 @@ jobs:
           if [ -n "$REQUESTER" ]; then
             REQUESTER_ARGS=(--requester "$REQUESTER")
           fi
+          OUTPUT_ARGS=(--pr)
+          if [ -n "\${THALLY_PR_GRANT:-}" ]; then
+            # A readiness repair leaves its validated changes staged. The
+            # workflow pushes the pre-granted branch, then asks Cloud to open
+            # the PR as the Thally App after GitHub OIDC authentication.
+            OUTPUT_ARGS=()
+          fi
           if [ -n "$TRACK_CONTEXT" ]; then
             CONTEXT_FILE="$RUNNER_TEMP/thally-track-context.md"
             printf '%s' "$TRACK_CONTEXT" > "$CONTEXT_FILE"
-            run_thally agent "$INSTRUCTION" --from-pr "$FROM_PR" --context-file "$CONTEXT_FILE" "\${REQUESTER_ARGS[@]}" --pr
+            run_thally agent "$INSTRUCTION" --from-pr "$FROM_PR" --context-file "$CONTEXT_FILE" "\${REQUESTER_ARGS[@]}" "\${OUTPUT_ARGS[@]}"
           elif [ -n "$FROM_PR" ]; then
-            run_thally agent "$INSTRUCTION" --from-pr "$FROM_PR" "\${REQUESTER_ARGS[@]}" --pr
+            run_thally agent "$INSTRUCTION" --from-pr "$FROM_PR" "\${REQUESTER_ARGS[@]}" "\${OUTPUT_ARGS[@]}"
           else
-            run_thally agent "$INSTRUCTION" "\${REQUESTER_ARGS[@]}" --pr
+            run_thally agent "$INSTRUCTION" "\${REQUESTER_ARGS[@]}" "\${OUTPUT_ARGS[@]}"
+          fi
+          if [ -n "\${THALLY_PR_GRANT:-}" ]; then
+            GENERATED_BRANCH="$(git branch --show-current)"
+            if [[ "$GENERATED_BRANCH" != thally/agent-* ]]; then
+              echo "No documentation changes were needed."
+              exit 0
+            fi
+            if [[ ! "$THALLY_PR_BRANCH" =~ ^thally/agent-readiness-[a-f0-9]{16}$ ]]; then
+              echo "The readiness PR branch grant is invalid." >&2
+              exit 1
+            fi
+            git branch -m "$THALLY_PR_BRANCH"
+            git commit -m "docs: improve Thally Agent Readiness"
+            git push -u origin "$THALLY_PR_BRANCH"
+
+            node -e 'const url = new URL(process.env.THALLY_PR_BROKER_URL); const isProduction = url.origin === "https://app.thally.io"; const isPreview = /^deploy-preview-[0-9]+--thally-cloud\\.netlify\\.app$/.test(url.hostname); if (url.pathname !== "/api/github/readiness-pr" || (!isProduction && !isPreview)) process.exit(1)'
+
+            OIDC_RESPONSE="$(curl --silent --show-error --fail-with-body               -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN"               "\${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=thally-readiness-pr")"
+            export OIDC_RESPONSE
+            OIDC_TOKEN="$(node -e 'const body = JSON.parse(process.env.OIDC_RESPONSE); if (typeof body.value !== "string") process.exit(1); process.stdout.write(body.value)')"
+            unset OIDC_RESPONSE
+            echo "::add-mask::$OIDC_TOKEN"
+            REQUEST_FILE="$RUNNER_TEMP/thally-readiness-pr-request.json"
+            RESPONSE_FILE="$RUNNER_TEMP/thally-readiness-pr-response.json"
+            node -e 'require("node:fs").writeFileSync(process.argv[1], JSON.stringify({ grant: process.env.THALLY_PR_GRANT }))' "$REQUEST_FILE"
+            curl --silent --show-error --fail-with-body               --output "$RESPONSE_FILE"               -H "Authorization: Bearer $OIDC_TOKEN"               -H "Content-Type: application/json"               --data-binary "@$REQUEST_FILE"               "$THALLY_PR_BROKER_URL"
+            unset OIDC_TOKEN
+            node -e 'const body = JSON.parse(require("node:fs").readFileSync(process.argv[1], "utf8")); if (typeof body.pull_request_url !== "string") process.exit(1); process.stdout.write("Pull request: " + body.pull_request_url + "\\n")' "$RESPONSE_FILE"
           fi
 
   drift-sweep:
@@ -5906,6 +5950,13 @@ function buildRepairPrompt(errors) {
 function buildPullRequestCreateArgs(title, body, branch, baseBranch) {
   return ["pr", "create", "--title", title, "--body", body, "--head", branch, "--base", baseBranch];
 }
+function buildPullRequestTitle(instruction) {
+  const normalizedInstruction = instruction.replace(/\s+/g, " ").trim();
+  if (!normalizedInstruction) return "docs: update documentation";
+  const maxSummaryLength = 65;
+  const summary = normalizedInstruction.length > maxSummaryLength ? `${normalizedInstruction.slice(0, maxSummaryLength).trimEnd()}\u2026` : normalizedInstruction;
+  return `docs: ${summary}`;
+}
 async function runAgent(client, task, options) {
   const { projectDir, mode } = options;
   const model = resolveAgentModel(options.model);
@@ -5973,7 +6024,7 @@ async function runAgent(client, task, options) {
       return { branch, summary, steps, diff, validation, noChanges: false };
     }
     if (mode === "pr") {
-      const title = `docs: ${task.instruction.slice(0, 60)}`;
+      const title = buildPullRequestTitle(task.instruction);
       const body = `${summary}
 
 ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thallylabs/cli",
-  "version": "0.5.5",
+  "version": "0.5.7",
   "description": "The unified thally CLI — author content + config; the framework stays a hidden runtime",
   "type": "module",
   "engines": {
@@ -24,8 +24,8 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.78.0",
-    "@thallylabs/mcp": "0.7.3",
-    "create-thally-docs": "0.7.7"
+    "@thallylabs/mcp": "0.7.5",
+    "create-thally-docs": "0.7.9"
   },
   "devDependencies": {
     "@thallylabs/agent": "*",