@theholocron/cli 5.0.0-alpha.183 → 5.0.0-alpha.185

package/dist/cli.mjs

@@ -2396,6 +2396,43 @@ async function runDeployFromFiles(input) {
 	}
 }
 //#endregion
+//#region src/ui/provider-error/provider-error.ts
+/** Vendor response bodies land in the terminal — cap their length so one
+*  oversized error can't flood the report, and strip control characters
+*  (newlines and the C1 range, whose 0x9b is an 8-bit CSI) so a crafted body
+*  can't forge extra report lines or inject terminal escape sequences. */
+const MAX_DETAIL_LENGTH = 200;
+function sanitizeDetail(text) {
+	const stripped = text.replace(/[\x00-\x1f\x7f-\x9f]/g, " ").replace(/\s+/g, " ").trim();
+	return stripped.length > MAX_DETAIL_LENGTH ? `${stripped.slice(0, MAX_DETAIL_LENGTH)}…` : stripped;
+}
+/**
+* `errorMessage(err)` alone is just `"<Vendor> <METHOD> <path> → <status>"` —
+* the actual reason (what the vendor's response body said) lives in
+* `ProviderApiError.details`, a raw response-body string (not parsed JSON —
+* see AGENTS.md), and was being silently dropped. Appending it (sanitized
+* and length-capped — see `sanitizeDetail`) turns e.g. a bare "→ 403" into
+* something that actually explains itself, without the vendor text being
+* able to overwhelm or manipulate the terminal.
+*/
+function describeProviderError(err) {
+	if (err instanceof ProviderApiError$1 && err.details) {
+		const detail = sanitizeDetail(String(err.details));
+		if (detail) return `${errorMessage(err)}: ${detail}`;
+	}
+	return errorMessage(err);
+}
+/**
+* What to put in structured logs: the plain message of the underlying error,
+* with no response body. The detail {@link describeProviderError} adds is for the
+* person at the terminal; a provider's raw body has no business in telemetry.
+* Wrapper errors carry the original as `cause`, so look through one level.
+*/
+function logReason(err) {
+	const root = err instanceof Error && err.cause !== void 0 ? err.cause : err;
+	return errorMessage(root);
+}
+//#endregion
 //#region src/commands/doctor/doctor.ts
 /**
 * `holocron doctor` — load the config, instantiate every capability,
@@ -2493,54 +2530,26 @@ async function smokeCheck(key, provider, impl) {
 	try {
 		return await withTimeout(runSmokeCheck(key, provider, impl), SMOKE_CHECK_TIMEOUT_MS);
 	} catch (err) {
-		return mk(key, provider, "fail", smokeCheckErrorMessage(err), errorMessage(err));
-	}
-}
-/** Vendor response bodies land in the terminal — cap their length so one
-*  oversized error can't flood the report, and strip control characters
-*  (newlines and the C1 range, whose 0x9b is an 8-bit CSI) so a crafted body
-*  can't forge extra report lines or inject terminal escape sequences. */
-const MAX_DETAIL_LENGTH = 200;
-function sanitizeDetail(text) {
-	const stripped = text.replace(/[\x00-\x1f\x7f-\x9f]/g, " ").replace(/\s+/g, " ").trim();
-	return stripped.length > MAX_DETAIL_LENGTH ? `${stripped.slice(0, MAX_DETAIL_LENGTH)}…` : stripped;
-}
-/**
-* `errorMessage(err)` alone is just `"<Vendor> <METHOD> <path> → <status>"` —
-* the actual reason (what the vendor's response body said) lives in
-* `ProviderApiError.details`, a raw response-body string (not parsed JSON —
-* see AGENTS.md), and was being silently dropped. Appending it (sanitized
-* and length-capped — see `sanitizeDetail`) turns e.g. a bare "→ 400" into
-* something that actually explains itself, without the vendor text being
-* able to overwhelm or manipulate the terminal report.
-*/
-function smokeCheckErrorMessage(err) {
-	if (err instanceof ProviderApiError$1 && err.details) {
-		const detail = sanitizeDetail(String(err.details));
-		if (detail) return `${errorMessage(err)}: ${detail}`;
+		return mk(key, provider, "fail", describeProviderError(err), errorMessage(err));
 	}
-	return errorMessage(err);
 }
 async function runSmokeCheck(key, provider, impl) {
 	switch (key) {
 		case "source": return mk(key, provider, "ok", `whoami: ${(await impl.whoami()).login}`);
-		case "issues": {
-			const report = await impl.doctor();
-			return mk(key, provider, "ok", `${report.authedAs} / ${report.projectLabel} (${countResolvedLifecycle(report)})`);
-		}
-		case "secrets": return mk(key, provider, "ok", `repo secrets: ${(await impl.listSecrets({ kind: "repo" })).length} configured`);
+		case "issues": return mk(key, provider, "ok", describeLifecycle(await impl.doctor()));
+		case "secrets": return mk(key, provider, "ok", `secrets: ${(await impl.listSecrets({ kind: "repo" })).length} configured`);
 		case "ci": {
 			const runs = await impl.listRuns({ limit: 1 });
-			return mk(key, provider, "ok", runs.length === 0 ? "no recent runs" : `most recent: ${runs[0].workflowName} (${runs[0].status})`);
+			return mk(key, provider, "ok", runs.length === 0 ? "runs: none recent" : `most recent: ${runs[0].workflowName} (${runs[0].status})`);
 		}
-		case "vault": return mk(key, provider, "ok", `${(await impl.list()).length} keys available`);
-		case "deployment": return mk(key, provider, "ok", `${(await impl.listProjects()).length} project(s) visible`);
-		case "environments": return mk(key, provider, "ok", `${(await impl.listEnvironments()).length} environment(s) configured`);
+		case "vault": return mk(key, provider, "ok", `keys: ${(await impl.list()).length} visible`);
+		case "deployment": return mk(key, provider, "ok", `projects: ${(await impl.listProjects()).length} visible`);
+		case "environments": return mk(key, provider, "ok", `environments: ${(await impl.listEnvironments()).length} configured`);
 		case "dns": {
 			const dns = impl;
 			if (dns.whoami) {
 				const who = await dns.whoami();
-				return mk(key, provider, who.ok ? "ok" : "fail", `${who.zones} zone(s) visible`);
+				return mk(key, provider, who.ok ? "ok" : "fail", `zones: ${who.zones} visible`);
 			}
 			return mk(key, provider, "skip", "loaded (no smoke check defined for this capability)");
 		}
@@ -2548,7 +2557,7 @@ async function runSmokeCheck(key, provider, impl) {
 			const workers = impl;
 			if (workers.whoami) {
 				const who = await workers.whoami();
-				return mk(key, provider, who.ok ? "ok" : "fail", `${who.scripts} script(s) visible`);
+				return mk(key, provider, who.ok ? "ok" : "fail", `scripts: ${who.scripts} visible`);
 			}
 			return mk(key, provider, "skip", "loaded (no smoke check defined for this capability)");
 		}
@@ -2577,7 +2586,7 @@ async function runSmokeCheck(key, provider, impl) {
 			const monitoring = impl;
 			if (monitoring.whoami) {
 				const who = await monitoring.whoami();
-				return mk(key, provider, who.ok ? "ok" : "fail", who.ok ? "token verified" : "token check failed");
+				return mk(key, provider, who.ok ? "ok" : "fail", who.ok ? "token: verified" : "token: check failed");
 			}
 			return mk(key, provider, "skip", "loaded (no smoke check defined for this capability)");
 		}
@@ -2591,15 +2600,23 @@ async function runSmokeCheck(key, provider, impl) {
 			const wiki = impl;
 			if (wiki.whoami) {
 				const who = await wiki.whoami();
-				return mk(key, provider, who.ok ? "ok" : "fail", who.ok ? "token configured" : "token not configured");
+				return mk(key, provider, who.ok ? "ok" : "fail", who.ok ? "token: configured" : "token: not configured");
 			}
 			return mk(key, provider, "skip", "loaded (no smoke check defined for this capability)");
 		}
 		default: return mk(key, provider, "skip", "loaded (no smoke check defined for this capability)");
 	}
 }
-function countResolvedLifecycle(report) {
-	return `${report.lifecycle.filter((l) => l.resolved).length}/${report.lifecycle.length} lifecycle slots ready`;
+/**
+* What the issues row says: how many lifecycle slots (inProgress, inReview, done)
+* map to something the tracker recognises, and which do not. The token's user and
+* the repo are not repeated -- `source` already names the account, and a slot
+* that is not configured is the part someone has to act on.
+*/
+function describeLifecycle(report) {
+	const unresolved = report.lifecycle.filter((l) => !l.resolved).map((l) => l.slot);
+	const base = `lifecycle: ${report.lifecycle.length - unresolved.length}/${report.lifecycle.length} slots ready`;
+	return unresolved.length > 0 ? `${base} (unresolved: ${unresolved.join(", ")})` : base;
 }
 function mk(capability, provider, status, message, logMessage) {
 	return {
@@ -3232,6 +3249,24 @@ async function runNew(input) {
 function defaultSecretName(channel) {
 	return `HOLOCRON_NOTIFY_WEBHOOK_${channel.toUpperCase().replace(/[^A-Z0-9]+/g, "_")}`;
 }
+/** A throwaway secret, written and removed to prove write access. */
+const PREFLIGHT_SECRET = "HOLOCRON_NOTIFY_PREFLIGHT";
+/**
+* Prove the secrets store can be WRITTEN before creating anything that needs it.
+* A webhook's URL is shown once; creating the webhook and then failing to store
+* it leaves an orphan the user has to delete by hand. Listing is not enough --
+* a token can read secrets it cannot write -- so write a throwaway secret and
+* remove it.
+*/
+async function assertSecretsReachable(secrets, scope) {
+	try {
+		await secrets.setSecret(scope, PREFLIGHT_SECRET, "ok");
+		await secrets.deleteSecret(scope, PREFLIGHT_SECRET);
+	} catch (err) {
+		const where = scope.kind === "organization" ? `organization ${scope.name}` : scope.kind;
+		throw new Error(`cannot write to the secrets store for ${where} (${describeProviderError(err)}) — fix that token before creating webhooks`, { cause: err });
+	}
+}
 /** Why a capability is not loaded: the plugin's own load error when there is one (e.g. a missing token). */
 function whyMissing(loader, key, fallback) {
 	const failure = loader.loadFailures().find((f) => f.key === key);
@@ -3290,7 +3325,7 @@ async function provisionChannel(deps, spec) {
 		try {
 			await secrets.setSecret(scope, secretName, hook.url);
 		} catch (err) {
-			throw new Error(`webhook ${webhookName} was ${hook.created ? "created" : "found"} but storing its URL in ${secretName} failed (${errorMessage(err)}) — delete the webhook in the provider and re-run to get a fresh URL`, { cause: err });
+			throw new Error(`webhook ${webhookName} was ${hook.created ? "created" : "found"} but storing its URL in ${secretName} failed (${describeProviderError(err)}) — delete the webhook in the provider and re-run to get a fresh URL`, { cause: err });
 		}
 		print(`  ✓ ${hook.created ? "created" : "found  "} webhook ${webhookName}; URL stored in ${secretName}`);
 		outcome.webhook = {
@@ -3334,6 +3369,7 @@ async function runNotificationsChannelAdd(input) {
 			name: org
 		} : void 0);
 		if (input.withWebhook && !scope && !dryRun) throw new Error("no org to store the webhook secret under — pass --scope or set `org` in holocron.config.ts");
+		if (secrets && scope && !dryRun) await assertSecretsReachable(secrets, scope);
 		const channel = await provisionChannel({
 			notifications,
 			...secrets ? { secrets } : {},
@@ -3369,11 +3405,11 @@ async function runNotificationsChannelAdd(input) {
 			channel
 		};
 	} catch (err) {
-		const message = errorMessage(err);
+		const message = describeProviderError(err);
 		print(`  ✗ ${message}`);
 		logger.warn({
 			channel: input.name,
-			reason: message
+			reason: logReason(err)
 		}, `notifications channel add: ${input.name}`);
 		return {
 			status: "fail",
@@ -3410,9 +3446,9 @@ async function runNotificationsSetup(input) {
 		roles: [],
 		failures: []
 	};
-	const refuse = (message) => {
+	const refuse = (message, reason = message) => {
 		print(`  ✗ ${message}`);
-		logger.warn({ reason: message }, "notifications setup");
+		logger.warn({ reason }, "notifications setup");
 		return {
 			...report,
 			status: "fail",
@@ -3439,6 +3475,11 @@ async function runNotificationsSetup(input) {
 		name: org
 	} : void 0);
 	if (wantsWebhook && !scope && !dryRun) return refuse("no org to store webhook secrets under — pass --scope or set `org` in holocron.config.ts");
+	if (secrets && scope && !dryRun) try {
+		await assertSecretsReachable(secrets, scope);
+	} catch (err) {
+		return refuse(errorMessage(err), logReason(err));
+	}
 	const taken = /* @__PURE__ */ new Map();
 	for (const category of layout.categories ?? []) for (const channel of category.channels ?? []) {
 		if (!channel.webhook) continue;
@@ -3452,7 +3493,7 @@ async function runNotificationsSetup(input) {
 		try {
 			await fn();
 		} catch (err) {
-			const message = errorMessage(err);
+			const message = describeProviderError(err);
 			print(`  ✗ ${step}: ${message}`);
 			report.failures.push({
 				step,