@united-robotics/cli 0.4.6 → 0.4.8

package/dist/index.js

@@ -11,6 +11,8 @@ var configDirName = ".united-robotics";
 var globalConfigDir = join(homedir(), configDirName);
 var globalConfigPath = join(globalConfigDir, configFileName);
 var defaultApiUrl = process.env.UR_API_URL ?? "https://united-robotics.rollersoft.com.au";
+var defaultGitName = "exis[ai]";
+var defaultGitEmail = "gotexis@gmail.com";
 function load() {
   const localPath = findLocalConfigPath(process.cwd());
   for (const path of [process.env.UR_CONFIG, localPath, globalConfigPath].filter(Boolean)) {
@@ -26,6 +28,17 @@ function save(config, opts = {}) {
   mkdirSync(dirname(path), { recursive: true });
   writeFileSync(path, JSON.stringify(config, null, 2));
 }
+function rememberDefaultProject(projectId, cwd) {
+  const currentCwd = process.cwd();
+  try {
+    process.chdir(cwd);
+    const cfg = load();
+    save({ ...cfg, defaultProjectId: projectId });
+    ignoreWorkspaceConfigInGit(cwd);
+  } finally {
+    process.chdir(currentCwd);
+  }
+}
 async function api(path, init = {}) {
   const cfg = load();
   const res = await fetch(`${cfg.apiUrl}${path}`, { ...init, headers: { authorization: `Bearer ${cfg.token ?? ""}`, "content-type": "application/json", ...init.headers ?? {} } });
@@ -47,7 +60,7 @@ program.command("team").argument("<cmd>").action(async (cmd) => {
 var project = program.command("project");
 project.command("ls").option("--team <teamId>").action(async (opts) => console.log(JSON.stringify(await api(`/api/projects${opts.team ? `?team=${encodeURIComponent(opts.team)}` : ""}`), null, 2)));
 project.command("show").argument("<projectId>").action(async (projectId) => console.log(JSON.stringify({ projectId, repos: await projectRepos(projectId) }, null, 2)));
-project.command("clone").argument("<projectId>").option("--dest <path>").option("--in-place", "clone into the current directory so AGENTS.md and workspace files land at the project root").option("--no-submodules", "clone primary repo only").option("--name <name>", "Git user.name for Vercel-compatible commits", "exis[ai]").option("--email <email>", "Git user.email for Vercel-compatible commits", "gotexis@gmail.com").action(async (projectId, opts) => {
+project.command("clone").argument("<projectId>").option("--dest <path>").option("--in-place", "clone into the current directory so AGENTS.md and workspace files land at the project root").option("--no-submodules", "clone primary repo only").option("--name <name>", "Git user.name for Vercel-compatible commits", defaultGitName).option("--email <email>", "Git user.email for Vercel-compatible commits", defaultGitEmail).action(async (projectId, opts) => {
   const repos = await projectRepos(projectId);
   const primary = repos.find((r) => r.kind === "primary") ?? repos[0];
   if (!primary) throw new Error("No repo found");
@@ -70,18 +83,21 @@ project.command("clone").argument("<projectId>").option("--dest <path>").option(
       preservedConfig?.restore();
     }
     const worktree = dest ?? repoDirName(primary.url);
+    rememberDefaultProject(projectId, worktree);
     configureGitIdentity(worktree, opts.name, opts.email, credentials.env);
-    if (opts.submodules) initProjectWorktree(worktree, opts.name, opts.email, credentials.env);
+    if (opts.submodules) initProjectWorktree(worktree, projectId, opts.name, opts.email, credentials.env);
+    else configureGitCredentialHelper(worktree, projectId, credentials.env);
     printCloneSuccess(projectId, worktree, token);
   } finally {
     credentials.cleanup();
   }
 });
-project.command("init").argument("<projectId>").option("--cwd <path>", "workspace path", process.cwd()).option("--name <name>", "Git user.name for Vercel-compatible commits", "exis[ai]").option("--email <email>", "Git user.email for Vercel-compatible commits", "gotexis@gmail.com").action(async (projectId, opts) => {
+project.command("init").argument("<projectId>").option("--cwd <path>", "workspace path", process.cwd()).option("--name <name>", "Git user.name for Vercel-compatible commits", defaultGitName).option("--email <email>", "Git user.email for Vercel-compatible commits", defaultGitEmail).action(async (projectId, opts) => {
   const token = await projectGithubToken(projectId);
   const credentials = createGitAskpass(token.token);
   try {
-    initProjectWorktree(opts.cwd, opts.name, opts.email, credentials.env);
+    rememberDefaultProject(projectId, opts.cwd);
+    initProjectWorktree(opts.cwd, projectId, opts.name, opts.email, credentials.env);
     console.log(`Initialized ${projectId} workspace at ${opts.cwd}`);
     printDetachedHeadNotice();
   } finally {
@@ -93,7 +109,7 @@ program.command("repo").argument("<cmd>").argument("<projectId>").action(async (
   console.log(JSON.stringify(await projectRepos(projectId), null, 2));
 });
 var git = program.command("git").description("Git helpers for tenant workspaces");
-git.command("identity").option("--name <name>", "Git user.name", "exis[ai]").option("--email <email>", "Git user.email", "gotexis@gmail.com").option("--global", "write global git config instead of current repo").option("--recursive", "also apply to initialized submodules").action((opts) => {
+git.command("identity").option("--name <name>", "Git user.name", defaultGitName).option("--email <email>", "Git user.email", defaultGitEmail).option("--global", "write global git config instead of current repo").option("--recursive", "also apply to initialized submodules").action((opts) => {
   if (opts.global) {
     runGit(["config", "--global", "user.name", opts.name], { cwd: process.cwd() });
     runGit(["config", "--global", "user.email", opts.email], { cwd: process.cwd() });
@@ -103,6 +119,16 @@ git.command("identity").option("--name <name>", "Git user.name", "exis[ai]").opt
   }
   console.log(`Configured git committer identity: ${opts.name} <${opts.email}>`);
 });
+git.command("credential-helper").description("Git credential helper used by United Robotics workspaces").argument("[operation]", "git credential helper operation").option("--project <projectId>", "project id; defaults to local config defaultProjectId").action(async (operation, opts) => {
+  if (operation && operation !== "get") return;
+  const projectId = opts.project ?? load().defaultProjectId;
+  if (!projectId) throw new Error("Missing project id for UR git credential helper. Run `ur project init <projectId>` from the workspace root.");
+  const result = await projectGithubToken(projectId);
+  process.stdout.write(`username=x-access-token
+password=${result.token}
+
+`);
+});
 var github = program.command("github");
 github.command("token").option("--project <projectId>", "project id", "skinspirit-main").option("--repo <repo>", "repo id, name, full name, or URL within the project").option("--json", "emit full JSON").option("--redact", "redact token in JSON output").action(async (opts) => {
   const result = await api(`/api/projects/${opts.project}/github-token`, {
@@ -158,20 +184,97 @@ esac
     cleanup: () => rmSync(dir, { recursive: true, force: true })
   };
 }
-function initProjectWorktree(worktree, name, email, env = process.env) {
+function initProjectWorktree(worktree, projectId, name, email, env = process.env) {
   configureGitIdentity(worktree, name, email, env);
   runGit(["submodule", "sync", "--recursive"], { cwd: worktree, env, authHint: true, allowFailure: true });
   runGit(["submodule", "update", "--init", "--recursive"], { cwd: worktree, env, authHint: true });
+  configureGitCredentialHelper(worktree, projectId, env);
   configureSubmoduleIdentities(worktree, name, email, env);
+  configureSubmoduleCredentialHelpers(worktree, projectId, env);
   printDetachedHeadNotice();
 }
 function configureGitIdentity(cwd, name, email, env = process.env) {
   runGit(["config", "--local", "user.name", name], { cwd, env });
   runGit(["config", "--local", "user.email", email], { cwd, env });
+  installIdentityHooks(cwd, name, email);
+}
+function installIdentityHooks(cwd, name, email) {
+  const gitDir = resolveGitDir(cwd);
+  if (!gitDir) return;
+  const hooksDir = join(gitDir, "hooks");
+  mkdirSync(hooksDir, { recursive: true });
+  const expected = `${name} <${email}>`;
+  const preCommit = `#!/bin/sh
+set -eu
+expected_name='${shellSingleQuoteSafe(name)}'
+expected_email='${shellSingleQuoteSafe(email)}'
+actual_name="\${GIT_AUTHOR_NAME:-$(git config --get user.name || true)}"
+actual_email="\${GIT_AUTHOR_EMAIL:-$(git config --get user.email || true)}"
+committer_name="\${GIT_COMMITTER_NAME:-$(git config --get user.name || true)}"
+committer_email="\${GIT_COMMITTER_EMAIL:-$(git config --get user.email || true)}"
+if [ "$actual_name" != "$expected_name" ] || [ "$actual_email" != "$expected_email" ] || [ "$committer_name" != "$expected_name" ] || [ "$committer_email" != "$expected_email" ]; then
+  echo "United Robotics identity guard: commits must use ${expected}." >&2
+  echo "Run: ur git identity --recursive" >&2
+  exit 1
+fi
+`;
+  const prePush = `#!/bin/sh
+set -eu
+expected='${shellSingleQuoteSafe(expected)}'
+while read local_ref local_sha remote_ref remote_sha; do
+  case "$local_sha" in
+    0000000000000000000000000000000000000000) continue ;;
+  esac
+  if [ "$remote_sha" = "0000000000000000000000000000000000000000" ]; then
+    range="$local_sha"
+  else
+    range="$remote_sha..$local_sha"
+  fi
+  bad=$(git log --format='%H%x09%an <%ae>%x09%cn <%ce>' "$range" -- 2>/dev/null | awk -F '	' -v e="$expected" '$2 != e || $3 != e { print; exit }')
+  if [ -n "$bad" ]; then
+    echo "United Robotics identity guard: refusing push with non-standard author/committer." >&2
+    echo "$bad" >&2
+    echo "Expected author and committer: $expected" >&2
+    echo "Fix by recommitting/amending after: ur git identity --recursive" >&2
+    exit 1
+  fi
+done
+`;
+  writeExecutableHook(join(hooksDir, "pre-commit"), preCommit);
+  writeExecutableHook(join(hooksDir, "pre-push"), prePush);
+}
+function resolveGitDir(cwd) {
+  const result = runGit(["rev-parse", "--git-dir"], { cwd, allowFailure: true });
+  if (result.status !== 0) return null;
+  const value = result.stdout.trim();
+  if (!value) return null;
+  return value.startsWith("/") ? value : join(cwd, value);
+}
+function writeExecutableHook(path, content) {
+  writeFileSync(path, content, { mode: 493 });
+  chmodSync(path, 493);
+}
+function listInitializedSubmodules(worktree, env = process.env) {
+  const result = runGit(["submodule", "status", "--recursive"], { cwd: worktree, env, allowFailure: true });
+  return result.stdout.split(/\r?\n/).map((line) => line.trim().split(/\s+/)[1]).filter((value) => Boolean(value));
+}
+function configureGitCredentialHelper(cwd, projectId, env = process.env) {
+  const helper = `!ur git credential-helper --project ${shellSingleQuoteSafe(projectId)}`;
+  runGit(["config", "--local", "--unset-all", "credential.helper"], { cwd, env, allowFailure: true });
+  runGit(["config", "--local", "--add", "credential.helper", ""], { cwd, env });
+  runGit(["config", "--local", "--add", "credential.helper", helper], { cwd, env });
+  runGit(["config", "--local", "credential.useHttpPath", "true"], { cwd, env });
+  runGit(["config", "--local", "credential.interactive", "false"], { cwd, env, allowFailure: true });
 }
 function configureSubmoduleIdentities(worktree, name, email, env = process.env) {
   const result = runGit(["submodule", "foreach", "--recursive", `git config --local user.name '${shellSingleQuoteSafe(name)}' && git config --local user.email '${shellSingleQuoteSafe(email)}'`], { cwd: worktree, env, allowFailure: true });
   if (result.status !== 0) console.warn("Warning: could not apply git identity to all submodules. Run `ur git identity --recursive` after submodules are initialized.");
+  for (const submodule of listInitializedSubmodules(worktree, env)) installIdentityHooks(join(worktree, submodule), name, email);
+}
+function configureSubmoduleCredentialHelpers(worktree, projectId, env = process.env) {
+  const helper = `!ur git credential-helper --project ${shellSingleQuoteSafe(projectId)}`;
+  const result = runGit(["submodule", "foreach", "--recursive", `git config --local --unset-all credential.helper || true; git config --local --add credential.helper ''; git config --local --add credential.helper '${shellSingleQuoteSafe(helper)}'; git config --local credential.useHttpPath true; git config --local credential.interactive false || true`], { cwd: worktree, env, allowFailure: true });
+  if (result.status !== 0) console.warn("Warning: could not apply UR git credential helper to all submodules. Run `ur project init <projectId>` after submodules are initialized.");
 }
 function runGit(args, options = { cwd: process.cwd() }) {
   const gitArgs = options.authHint ? ["-c", "credential.helper=", "-c", "credential.useHttpPath=true", ...args] : args;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@united-robotics/cli",
-  "version": "0.4.6",
+  "version": "0.4.8",
   "type": "module",
   "bin": {
     "ur": "dist/index.js"