@viberaven/cli 1.6.9 → 1.6.11

package/README.md

@@ -10,10 +10,10 @@ Requires Node.js 20 or newer. Run from the app's project root:
 
 ```bash
 # Open the local Studio
-npx -y viberaven@1.6.9
+npx -y viberaven@1.6.11
 
 # Fresh terminal check
-npx -y viberaven@1.6.9 check
+npx -y viberaven@1.6.11 check
 ```
 
 The `viberaven` package launches this CLI. Studio combines findings, provider context and git comparisons. For chat, select an installed/authenticated Codex CLI, Claude Code or Gemini CLI and use **Test connection**. Access modes: `ask`, `approve`, `full`. Stop Studio with Ctrl+C.
@@ -27,10 +27,10 @@ Checks include migration tables without RLS, unrestricted policy conditions such
 `check --json` prints a findings summary and artifact paths. `--json` without `check` runs a fresh scan and prints the full gate object.
 
 ```bash
-npx -y viberaven@1.6.9 check --json
-npx -y viberaven@1.6.9 audit --vercel-supabase --json
-npx -y viberaven@1.6.9 fix --gap <gapId> --dry-run
-npx -y viberaven@1.6.9 init --agents all --dry-run
+npx -y viberaven@1.6.11 check --json
+npx -y viberaven@1.6.11 audit --vercel-supabase --json
+npx -y viberaven@1.6.11 fix --gap <gapId> --dry-run
+npx -y viberaven@1.6.11 init --agents all --dry-run
 ```
 
 Read tasks and source before targeted edits. Preview fixes first. The `rls_disabled` recipe adds an RLS migration without policies: agree before applying, because browser roles lose row access until policies exist. Apply/test through your database workflow; recheck after a batch. Provider actions require provider evidence.
@@ -41,9 +41,9 @@ Read tasks and source before targeted edits. Preview fixes first. The `rls_disab
 
 ```bash
 # Fail on blockers
-npx -y viberaven@1.6.9 --strict --json
+npx -y viberaven@1.6.11 --strict --json
 # Also fail on warnings
-npx -y viberaven@1.6.9 --strict=warning --json
+npx -y viberaven@1.6.11 --strict=warning --json
 ```
 
 Default `--strict` returns 0 for `clear`/`warning`, 1 for `not_clear`, 2 for `error`, 3 for `unknown` or unavailable results. `--strict=warning` also returns 1 for warnings.

package/dist/cli.js

@@ -15051,7 +15051,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "1.6.9";
+    VERSION = "1.6.11";
   }
 });
 
@@ -21533,6 +21533,9 @@ async function readMaybe(path) {
     return null;
   }
 }
+function blobId(content, like) {
+  return (0, import_node_crypto5.createHash)(like.length === 64 ? "sha256" : "sha1").update(`blob ${content.length}\0`).update(content).digest("hex");
+}
 function parsePorcelain(raw) {
   const parts = raw.split("\0");
   const entries = [];
@@ -21578,17 +21581,61 @@ async function takeBaseline(cwd) {
       secret: secret || void 0
     };
   }
-  return { git: true, root, head: head.code === 0 ? head.stdout.toString("utf8").trim() : null, takenAt, dirty };
+  const headId = head.code === 0 ? head.stdout.toString("utf8").trim() : null;
+  const checkout = headId ? await checkoutForms(cwd, root, headId, dirty, MAX_SNAPSHOT_TOTAL - total) : {};
+  return { git: true, root, head: headId, takenAt, dirty, checkout };
+}
+async function checkoutForms(cwd, root, head, dirty, budget) {
+  const tree = await safeGit(cwd, ["ls-tree", "-r", "-z", "--full-name", head], 15e3);
+  if (tree.code !== 0) return {};
+  const files = [];
+  for (const record of tree.stdout.toString("utf8").split("\0")) {
+    const tab = record.indexOf("	");
+    if (tab < 0) continue;
+    const [mode, type, id] = record.slice(0, tab).split(" ");
+    const path = record.slice(tab + 1);
+    if (type !== "blob" || mode !== "100644" && mode !== "100755") continue;
+    if (path in dirty || isSecretPath(path) || /(?:^|\/)\.viberaven\//.test(path)) continue;
+    files.push({ path, id });
+  }
+  const forms = {};
+  let scanned = 0;
+  const look = async ({ path, id }) => {
+    const target = (0, import_node_path42.join)(root, path);
+    const size = await (0, import_promises33.stat)(target).then((info) => info.size, () => null);
+    if (size === null || scanned + size > MAX_CHECKOUT_SCAN) return;
+    scanned += size;
+    const content = await readMaybe(target);
+    if (!content || blobId(content, id) === id) return;
+    const asLf = withoutCrlf(content);
+    if (asLf.length < content.length && blobId(asLf, id) === id && withCrlf(asLf).equals(content)) {
+      forms[path] = { eol: "crlf" };
+    } else if (content.length <= MAX_SNAPSHOT_BYTES && content.length <= budget) {
+      budget -= content.length;
+      forms[path] = { content: content.toString("base64") };
+    } else {
+      forms[path] = { tooLarge: true };
+    }
+  };
+  let next = 0;
+  await Promise.all(Array.from({ length: CHECKOUT_READS_AT_ONCE }, async () => {
+    while (next < files.length) await look(files[next++]);
+  }));
+  return forms;
 }
 async function baseContent(baseline, path) {
   const entry = baseline.dirty[path];
   if (entry) {
     if (entry.hash === null) return null;
-    return entry.content ? Buffer.from(entry.content, "base64") : void 0;
+    return entry.content !== void 0 ? Buffer.from(entry.content, "base64") : void 0;
   }
   if (!baseline.root || !baseline.head) return null;
+  const checkout = baseline.checkout?.[path];
+  if (checkout?.content !== void 0) return Buffer.from(checkout.content, "base64");
+  if (checkout?.tooLarge) return void 0;
   const shown = await safeGit(baseline.root, ["show", `${baseline.head}:${path}`]);
-  return shown.code === 0 ? shown.stdout : null;
+  if (shown.code !== 0) return null;
+  return checkout?.eol === "crlf" ? withCrlf(shown.stdout) : shown.stdout;
 }
 function lineStats(before, after) {
   const count = (text2) => {
@@ -21794,7 +21841,7 @@ async function loadBaseline(runsDir, runId) {
     return null;
   }
 }
-var import_node_child_process9, import_node_crypto5, import_promises33, import_node_os3, import_node_path42, STATUS_PATHSPEC, MAX_SNAPSHOT_FILES, MAX_SNAPSHOT_BYTES, MAX_SNAPSHOT_TOTAL, SECRET_FILE, lf, NOT_PROVEN;
+var import_node_child_process9, import_node_crypto5, import_promises33, import_node_os3, import_node_path42, STATUS_PATHSPEC, MAX_SNAPSHOT_FILES, MAX_SNAPSHOT_BYTES, MAX_SNAPSHOT_TOTAL, MAX_CHECKOUT_SCAN, CHECKOUT_READS_AT_ONCE, SECRET_FILE, withCrlf, withoutCrlf, lf, NOT_PROVEN;
 var init_workspace = __esm({
   "src/local-ui/actions/workspace.ts"() {
     "use strict";
@@ -21808,7 +21855,11 @@ var init_workspace = __esm({
     MAX_SNAPSHOT_FILES = 300;
     MAX_SNAPSHOT_BYTES = 1e6;
     MAX_SNAPSHOT_TOTAL = 2e7;
+    MAX_CHECKOUT_SCAN = 2e8;
+    CHECKOUT_READS_AT_ONCE = 16;
     SECRET_FILE = /(?:^|\/)\.env(?:\.[^/]*)?$|\.(?:pem|key|p12|pfx|keystore)$|(?:^|\/)id_(?:rsa|ed25519|ecdsa)$/i;
+    withCrlf = (content) => Buffer.from(content.toString("latin1").replace(/\n/g, "\r\n"), "latin1");
+    withoutCrlf = (content) => Buffer.from(content.toString("latin1").replace(/\r\n/g, "\n"), "latin1");
     lf = (text2) => text2.replace(/\r\n/g, "\n");
     NOT_PROVEN = "Changed during the run, but not proven to be only the agent\u2019s edit (you or another tool may have changed it), so Undo left it alone. Review it and put it back yourself if you want.";
   }
@@ -21829,7 +21880,7 @@ async function detectPreviewCommand(cwd) {
   const packageManager = await exists2("pnpm-lock.yaml") ? "pnpm" : await exists2("yarn.lock") ? "yarn" : await exists2("bun.lockb") || await exists2("bun.lock") ? "bun" : "npm";
   const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
   const framework = FRAMEWORKS.find(([dep]) => dep in deps)?.[1] ?? null;
-  return { packageManager, script, framework, display: `${packageManager} run ${script}` };
+  return { packageManager, script, framework, display: `${packageManager} run ${script}`, reloadsItself: RELOADS_ITSELF.test(scripts[script]) };
 }
 function answers(host, port) {
   return new Promise((resolveAnswer) => {
@@ -21873,7 +21924,7 @@ function previewFailureReason(log) {
   if (/Missing script/i.test(log)) return "The script VibeRaven picked is not in package.json.";
   return void 0;
 }
-var import_node_child_process10, import_promises34, import_node_net, import_node_path43, URL_PATTERN, READY_TIMEOUT_MS, LOG_LIMIT, FRAMEWORKS, PreviewManager;
+var import_node_child_process10, import_promises34, import_node_net, import_node_path43, URL_PATTERN, READY_TIMEOUT_MS, LOG_LIMIT, FRAMEWORKS, RELOADS_ITSELF, PreviewManager;
 var init_preview2 = __esm({
   "src/local-ui/preview.ts"() {
     "use strict";
@@ -21886,6 +21937,7 @@ var init_preview2 = __esm({
     READY_TIMEOUT_MS = 12e4;
     LOG_LIMIT = 6e3;
     FRAMEWORKS = [["next", "Next.js"], ["vite", "Vite"], ["@remix-run/dev", "Remix"], ["astro", "Astro"], ["@sveltejs/kit", "SvelteKit"], ["nuxt", "Nuxt"], ["react-scripts", "Create React App"]];
+    RELOADS_ITSELF = /\b(?:next\s+dev|vite\b(?!\s+(?:build|preview))|astro\s+dev|nuxi?\s+dev|remix\s+(?:vite:)?dev|react-scripts\s+start|webpack(?:-dev-server|\s+serve)|nodemon|tsx\s+watch|ts-node-dev|svelte-kit\s+dev|ng\s+serve|parcel\b(?!\s+build))|--watch\b/i;
     PreviewManager = class {
       constructor(cwd, home, preferredPort = 3e3) {
         this.cwd = cwd;
@@ -21939,7 +21991,7 @@ var init_preview2 = __esm({
           return this.snapshot();
         }
         this.assignedPort = port;
-        this.status = { state: "starting", command: command.display, framework: command.framework, startedAt: (/* @__PURE__ */ new Date()).toISOString(), log: "", revision: this.status.revision };
+        this.status = { state: "starting", command: command.display, framework: command.framework, reloadsItself: command.reloadsItself, startedAt: (/* @__PURE__ */ new Date()).toISOString(), log: "", revision: this.status.revision };
         const child = (0, import_node_child_process10.spawn)(`${command.packageManager} run ${command.script}`, {
           cwd: this.cwd,
           shell: true,
@@ -22027,6 +22079,25 @@ var init_preview2 = __esm({
         if (this.status.state !== "starting") return Promise.resolve(this.snapshot());
         return new Promise((resolveWait) => this.readyWaiters.push(() => resolveWait(this.snapshot())));
       }
+      /**
+       * The app's code changed. A dev server that reloads by itself only needs the frame reloaded; any other one is
+       * restarted, so the preview never keeps serving the code from before the change.
+       */
+      async reload() {
+        if (!this.isRunning()) return this.snapshot();
+        if (this.status.reloadsItself) {
+          this.bumpRevision();
+          return this.snapshot();
+        }
+        const port = this.assignedPort;
+        this.stop();
+        for (let tries = 0; tries < 50 && port && await portTaken(port); tries += 1) {
+          await new Promise((resolveDelay) => setTimeout(resolveDelay, 200));
+        }
+        await this.start();
+        this.bumpRevision();
+        return this.waitForReady();
+      }
       /** Marks that the app's code changed, so the Studio reloads the frame exactly once. */
       bumpRevision() {
         this.status = { ...this.status, revision: this.status.revision + 1 };
@@ -22382,7 +22453,7 @@ var init_engine = __esm({
         const outcome = await revertChanges(baseline, paths.map((path) => ({ path, kind: "modified", additions: 0, deletions: 0 })), keep);
         this.deps.store.update(runId, { reverted: { at: (/* @__PURE__ */ new Date()).toISOString(), ...outcome } });
         this.deps.store.emit(runId, "run.reverted", { restored: outcome.restored.length, skipped: outcome.skipped.length });
-        if (outcome.restored.length && this.deps.preview.isRunning()) this.deps.preview.bumpRevision();
+        if (outcome.restored.length && this.deps.preview.isRunning()) await this.deps.preview.reload();
         return outcome;
       }
       /**
@@ -22401,7 +22472,7 @@ var init_engine = __esm({
         if ("error" in outcome) return outcome;
         this.deps.store.update(runId, { restoredFiles: [.../* @__PURE__ */ new Set([...run.restoredFiles ?? [], path])] });
         this.deps.store.emit(runId, "file.restored", { path });
-        if (this.deps.preview.isRunning()) this.deps.preview.bumpRevision();
+        if (this.deps.preview.isRunning()) await this.deps.preview.reload();
         return outcome;
       }
       stopped(runId) {
@@ -22556,7 +22627,8 @@ var init_engine = __esm({
         const cancelledNow = () => this.stopped(runId);
         if (!checkSpecs.length) unknowns.push("No typecheck or test script, so the code was not checked.");
         if (this.deps.preview.isRunning()) {
-          this.deps.preview.bumpRevision();
+          if (changes.length) await this.deps.preview.reload();
+          else this.deps.preview.bumpRevision();
           const ready = await this.deps.preview.waitForReady();
           if (cancelledNow()) return this.finishCancelled(runId, changes, notProven);
           const answerHttp = ready.url ? await this.deps.preview.fetchStatus(ready.url, 6e4) : null;
@@ -24253,9 +24325,13 @@ async function sendStackAppJs(response) {
 }
 async function sendStackAppCss(response) {
   try {
-    const body = await (0, import_promises36.readFile)((0, import_node_path45.join)(__dirname, "stack", "stack.css"));
+    const [shell, scene] = await Promise.all([
+      (0, import_promises36.readFile)((0, import_node_path45.join)(__dirname, "stack", "stack.css"), "utf8"),
+      (0, import_promises36.readFile)((0, import_node_path45.join)(__dirname, "stack", "scene.css"), "utf8").catch(() => "")
+    ]);
     response.writeHead(200, { "content-type": "text/css; charset=utf-8", "cache-control": "no-store" });
-    response.end(body);
+    response.end(`${shell}
+${scene}`);
   } catch {
     sendText(response, 404, "Stack stylesheet not found: src/local-ui/stack/stack.css is missing.");
   }
@@ -25649,7 +25725,8 @@ async function runConnect(options, deps) {
         const reply = await call(deps, "POST", `/v1/runner/jobs/${encodeURIComponent(job.id)}/result`, result, runnerAccessToken);
         if (unauthorized(reply.status)) break;
         if (reply.status >= 200 && reply.status < 300) {
-          log(result.status === "succeeded" ? `  \u2713 ${result.outputSummary[0]} (sent to the site)` : `  \u2717 ${result.outputSummary[0] ?? "Could not finish."} (sent to the site)`);
+          const sign = { succeeded: "\u2713", needs_user: "\u2022", cancelled: "\u25A0", failed: "\u2717" }[result.status] ?? "\u2717";
+          log(`  ${sign} ${result.outputSummary[0] ?? "Could not finish."} (sent to the site)`);
           return;
         }
       } catch {