@waron97/prbot 3.3.0 → 3.5.0

package/src/commands/changelog.js

@@ -4,6 +4,7 @@ import search from '@inquirer/search';
 import inquirer from 'inquirer';
 import { resolveAddonsPath } from '../lib/addons.js';
 import { fuzzyMatch } from '../lib/fuzzy.js';
+import { log } from '../lib/logger.js';
 
 function buildRefString(tridents, jiras, prNumber) {
     const refs = [];
@@ -116,7 +117,7 @@ async function changelog(prNumber, options) {
     const duplicate = findDuplicateLine(content, tridents, jiras);
     let appendMode = false;
     if (duplicate) {
-        console.log(`\nExisting entry (line ${duplicate.lineNumber + 1}):\n  ${duplicate.line}`);
+        log(`\nExisting entry (line ${duplicate.lineNumber + 1}):\n  ${duplicate.line}`);
         const { confirm } = await inquirer.prompt([
             {
                 type: 'confirm',
@@ -132,7 +133,7 @@ async function changelog(prNumber, options) {
         const lines = content.split('\n');
         lines[duplicate.lineNumber] = appendPrToLine(lines[duplicate.lineNumber], prNumber);
         await fs.writeFile(changelogPath, lines.join('\n'));
-        console.log('Updated existing line');
+        log('Updated existing line');
         return;
     }
 
@@ -176,7 +177,7 @@ async function changelog(prNumber, options) {
     lines.splice(endLine + 1, 0, newEntry);
 
     await fs.writeFile(changelogPath, lines.join('\n'));
-    console.log('Changelog entry added');
+    log('Changelog entry added');
 }
 
 function findLineByPrNumber(content, prNumber) {

package/src/commands/commit.js

@@ -3,6 +3,7 @@ import inquirer from 'inquirer';
 import searchList from 'inquirer-search-list';
 import { resolveAddonsPath } from '../lib/addons.js';
 import { execGit } from '../lib/git.js';
+import { log } from '../lib/logger.js';
 
 inquirer.registerPrompt('search-list', searchList);
 
@@ -50,7 +51,7 @@ function validateSameModule(files) {
     const allSameModule = modules.every((module) => `[${module}]` === currentModule);
 
     if (!allSameModule) {
-        console.log(chalk.red('Selected files are not of the same module'));
+        log(chalk.red('Selected files are not of the same module'));
         return null;
     }
 
@@ -59,8 +60,8 @@ function validateSameModule(files) {
 
 async function getFilesToCommit(stagedChanges, unstagedChanges) {
     if (stagedChanges.trim()) {
-        console.log(chalk.green('Staged changes:'));
-        console.log(stagedChanges);
+        log(chalk.green('Staged changes:'));
+        log(stagedChanges);
 
         return {
             filesToCheck: stagedChanges.trim().split('\n'),
@@ -71,9 +72,9 @@ async function getFilesToCommit(stagedChanges, unstagedChanges) {
     const unstagedFiles = unstagedChanges.trim().split('\n');
 
     while (true) {
-        console.log(chalk.yellow('No staged changes found.'));
-        console.log(chalk.yellow('Unstaged changes:'));
-        console.log(unstagedChanges);
+        log(chalk.yellow('No staged changes found.'));
+        log(chalk.yellow('Unstaged changes:'));
+        log(unstagedChanges);
 
         const answers = await inquirer.prompt([
             {
@@ -104,7 +105,7 @@ async function commit() {
         const stagedChanges = await execGit(['diff', '--cached', '--name-only'], ADDONS_PATH);
 
         if (!unstagedChanges.trim() && !stagedChanges.trim()) {
-            console.log(chalk.red('No changes found to commit.'));
+            log(chalk.red('No changes found to commit.'));
             return;
         }
 
@@ -115,7 +116,7 @@ async function commit() {
         } = await getFilesToCommit(stagedChanges, unstagedChanges);
 
         if (filesToCheck.length === 0) {
-            console.log(chalk.red('No files selected.'));
+            log(chalk.red('No files selected.'));
             return;
         }
 
@@ -167,13 +168,13 @@ async function commit() {
         }
 
         await execGit(['commit', '-m', commitMessage], ADDONS_PATH);
-        console.log(chalk.green('Commit created successfully!'));
+        log(chalk.green('Commit created successfully!'));
 
         const remainingUnstaged = await execGit(['diff', '--name-only'], ADDONS_PATH);
         const remainingStaged = await execGit(['diff', '--cached', '--name-only'], ADDONS_PATH);
 
         if (!remainingUnstaged.trim() && !remainingStaged.trim()) {
-            console.log(chalk.green('No more changes to commit.'));
+            log(chalk.green('No more changes to commit.'));
             break;
         }
 

package/src/commands/export.js

@@ -1,3 +1,4 @@
+import { log } from '../lib/logger.js';
 import { exportEmailTemplates } from './exportEmailTemplates.js';
 import { exportImperex } from './exportImperex.js';
 import { exportLrp } from './exportLrp.js';
@@ -5,7 +6,7 @@ import { exportPb } from './exportPb.js';
 import { exportWorkflow } from './exportWorkflow.js';
 
 function exportRip() {
-    console.log('Not implemented yet.');
+    log('Not implemented yet.');
 }
 
 export { exportPb, exportRip, exportImperex, exportEmailTemplates, exportWorkflow, exportLrp };

package/src/commands/exportPb.js

@@ -36,13 +36,30 @@ async function initiateExport(guid, token) {
     if (!response.ok) throw new Error(await response.text());
 }
 
+// No job/request id is returned by initiateExport, so the poll still
+// correlates by GUID + a corrected date window over the last few results —
+// a heuristic, not a stable identifier (see REL-ADP-PB-001; a real fix
+// depends on the ImportExport API exposing a request id, EXT-002). What we
+// can and do own locally is not hanging forever: an overall deadline.
+const PB_EXPORT_POLL_INTERVAL_MS = 3_000;
+const PB_EXPORT_POLL_TIMEOUT_MS = 120_000;
+
 async function pollExportResult(guid, requestTime, token) {
     const url = `${process.env.IMPORTEXPORT_URL}/export/info/processKey=ExportElement&subProcess=true&status=FAILED,COMPLETED&referenceId=process_builder`;
     // Server createDate is offset -1hr from system time; subtract 1hr+5s buffer
     const cutoff = requestTime - 3_605_000;
+    const deadline = requestTime + PB_EXPORT_POLL_TIMEOUT_MS;
 
     while (true) {
-        await new Promise((r) => setTimeout(r, 3000));
+        if (Date.now() > deadline) {
+            throw new Error(
+                `REMOTE_TIMEOUT: Process Builder export for guid ${guid} did not complete within ${
+                    PB_EXPORT_POLL_TIMEOUT_MS / 1000
+                }s`
+            );
+        }
+
+        await new Promise((r) => setTimeout(r, PB_EXPORT_POLL_INTERVAL_MS));
 
         const response = await fetch(url, {
             method: 'POST',
@@ -153,4 +170,4 @@ async function exportPb(opts) {
     }
 }
 
-export { exportPb };
+export { exportPb, pollExportResult };

package/src/commands/init.js

@@ -1,6 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
 import inquirer from 'inquirer';
 import { CONFIG_DIR, CONFIG_FILE } from '../config.js';
+import { log } from '../lib/logger.js';
 
 async function init() {
     if (!existsSync(CONFIG_DIR)) {
@@ -142,7 +143,7 @@ async function init() {
             .map(([k, v]) => `${k}=${v}`)
             .join('\n') + '\n'
     );
-    console.log(`Config written to ${CONFIG_FILE}`);
+    log(`Config written to ${CONFIG_FILE}`);
 }
 
 export { init };

package/src/commands/routine.js

@@ -3,7 +3,7 @@ import path from 'path';
 import { select } from '@inquirer/prompts';
 import { parse } from 'yaml';
 import { CONFIG_DIR } from '../config.js';
-import { setSilent } from '../lib/logger.js';
+import { log, setSilent } from '../lib/logger.js';
 import { exportEmailTemplates } from './exportEmailTemplates.js';
 import { exportImperex } from './exportImperex.js';
 import { exportLrp } from './exportLrp.js';
@@ -52,39 +52,50 @@ function isNothingToCommit(err) {
 }
 
 async function runRoutine(routine) {
-    console.log(`Running Routine: ${routine.name}`);
+    log(`Running Routine: ${routine.name}`);
+
+    const failures = [];
 
     for (const step of routine.steps) {
         const label = `[${step.name}]`;
         const fn = COMMAND_MAP[step.command];
         if (!fn) {
-            console.log(`${label} Unknown command: ${step.command}`);
+            log(`${label} Unknown command: ${step.command}`);
+            failures.push(`${step.name}: unknown command "${step.command}"`);
             continue;
         }
 
-        console.log(`${label} Job started`);
+        log(`${label} Job started`);
         setSilent(true);
 
         try {
             await fn(stepOpts(step));
-            console.log(`${label} Done (committed)`);
+            log(`${label} Done (committed)`);
         } catch (err) {
             if (isNothingToCommit(err)) {
-                console.log(`${label} Done (nothing to commit)`);
+                log(`${label} Done (nothing to commit)`);
             } else {
-                console.log(`${label} Failed: ${err.message}`);
+                log(`${label} Failed: ${err.message}`);
+                failures.push(`${step.name}: ${err.message}`);
             }
         } finally {
             setSilent(false);
         }
     }
+
+    if (failures.length) {
+        throw new Error(
+            `Routine "${routine.name}" completed with ${failures.length} failed step(s):\n` +
+                failures.map((f) => `  - ${f}`).join('\n')
+        );
+    }
 }
 
 async function routine() {
     const routines = loadRoutines();
 
     if (!routines.length) {
-        console.log(
+        log(
             'No routines defined. Create ~/.config/prbot/routines.yaml or add routines: to agrippa.yaml.'
         );
         return;

package/src/index.js

@@ -18,54 +18,102 @@ import { main as prMain } from './commands/pr.js';
 import { routine } from './commands/routine.js';
 import { verbot } from './commands/ver.js';
 import { CONFIG_FILE } from './config.js';
-import { setSilent } from './lib/logger.js';
+import { error, log, setSilent } from './lib/logger.js';
 import { checkForUpdate, currentVersion } from './lib/updateCheck.js';
 
+// Commands that never talk to RIP/DevOps/Trident/Keycloak. They still read
+// non-secret config (e.g. ADDONS_PATH) from the same file, but must not end
+// up holding credentials in their process env — a coding agent invoking one
+// of these should not even technically be able to leak or reuse a secret it
+// never needed.
+const LOCAL_COMMANDS = new Set(['init', 'ver', 'commit', 'changelog']);
+const SECRET_ENV_KEYS = [
+    'KC_USER',
+    'KC_PASSWORD',
+    'KC_ID',
+    'KC_SECRET',
+    'DEVOPS_TOKEN',
+    'TRIDENT_TOKEN',
+];
+const OFFLINE = process.env.PRBOT_OFFLINE === '1' || process.argv.includes('--offline');
+
 configDotenv({ path: CONFIG_FILE, quiet: true });
 
+const invokedCommand = process.argv[2];
+if (LOCAL_COMMANDS.has(invokedCommand)) {
+    for (const key of SECRET_ENV_KEYS) delete process.env[key];
+}
+
 let _updateAvailable = null;
-checkForUpdate().then((v) => {
-    _updateAvailable = v;
-});
+if (!OFFLINE) {
+    checkForUpdate().then((v) => {
+        _updateAvailable = v;
+    });
+}
 
 process.on('exit', () => {
     if (_updateAvailable) {
-        console.log(
-            `\nUpdate available: ${currentVersion} → ${_updateAvailable}\nRun: prbot update`
-        );
+        log(`\nUpdate available: ${currentVersion} → ${_updateAvailable}\nRun: prbot update`);
     }
 });
 
+// Single point of convergence for every command's failure. Exit code 0 must
+// mean the requested operation actually succeeded; nothing downstream of
+// this should ever swallow an error into a zero exit.
+function fail(err) {
+    error(`Error: ${err?.message ?? err}`);
+    process.exitCode = 1;
+}
+
+process.on('unhandledRejection', (err) => {
+    fail(err instanceof Error ? err : new Error(String(err)));
+});
+process.on('uncaughtException', (err) => {
+    fail(err);
+});
+
+/**
+ * Adds `--quiet`/`--silent` to a command and returns a helper that reads
+ * both, warning once if the deprecated `--silent` alias is used. `--silent`
+ * used to also swallow errors (so a failed export could report success);
+ * it no longer does — both flags only suppress informational output.
+ */
+function withQuiet(cmd) {
+    return cmd
+        .option('-q, --quiet', 'Suppress informational output (errors still fail the command)')
+        .option('-s, --silent', 'Deprecated alias of --quiet; no longer swallows errors');
+}
+
+function resolveQuiet(opts) {
+    if (opts.silent) {
+        error('Warning: --silent is deprecated and no longer swallows errors; use --quiet.');
+    }
+    return Boolean(opts.quiet || opts.silent);
+}
+
 program
     .command('pr <module>')
     .option('-b, --bump <level>')
-    .action((module, opts) => {
-        prMain(module)
-            .then(() => {
-                if (opts.bump) {
-                    return verbot(module, opts.bump);
-                }
-            })
-            .catch((err) => {
-                throw err;
-            });
+    .action(async (module, opts) => {
+        await prMain(module);
+        if (opts.bump) await verbot(module, opts.bump);
     });
 
 program
     .command('ver <module>')
     .option('-b, --bump <level>')
-    .action((module, opts) => {
+    .action(async (module, opts) => {
         if (!opts.bump) {
             throw new Error('No bump level specified');
         }
-        verbot(module, opts.bump);
+        await verbot(module, opts.bump);
     });
 
 program
     .command('init')
     .description('Create config file')
-    .action(() => {
-        init();
+    .action(async () => {
+        await init();
     });
 
 const collect = (val, prev) => [...(prev ?? []), val];
@@ -75,10 +123,8 @@ program
     .option('-t, --trident <code>', 'Trident issue codes (repeatable)', collect)
     .option('-j, --jira <code>', 'JIRA issue codes (repeatable)', collect)
     .option('-m, --message <text>', 'Changelog entry message')
-    .action((prNumber, opts) => {
-        changelog(prNumber, opts).catch((err) => {
-            throw err;
-        });
+    .action(async (prNumber, opts) => {
+        await changelog(prNumber, opts);
     });
 
 program
@@ -89,107 +135,86 @@ program
     .option('-b, --branch <name>', 'Branch name (default: autopr_<taskId>)')
     .option('-n, --name <text>', 'PR title (default: task name from Odoo)')
     .option('--amend', 'Amend existing PR on current branch with new trident/jira refs')
-    .action((opts) => {
-        autopr(opts).catch((err) => {
-            throw err;
-        });
+    .action(async (opts) => {
+        await autopr(opts);
     });
 
-program.command('commit').action((opts) => {
-    commit(opts).catch((err) => {
-        throw err;
-    });
+program.command('commit').action(async (opts) => {
+    await commit(opts);
 });
 
 const exportCmd = program.command('export');
 
-exportCmd
-    .command('workflow')
-    .option('--no-commit')
-    .option('-b, --bump <level>', 'Version bump level (patch, minor, major)')
-    .option('-m, --module <id>', 'Module/workflow ID to export (skips interactive selection)')
-    .option('-s, --silent', 'Suppress all output and swallow errors')
-    .option(
-        '--auto-premigrate',
-        'Auto-generate pre-migrate script when XML ID renames are detected (no prompt)'
-    )
-    .action((opts) => {
-        if (opts.silent) setSilent(true);
-        exportWorkflow(opts).catch((err) => {
-            if (!opts.silent) throw err;
-        });
-    });
+withQuiet(
+    exportCmd
+        .command('workflow')
+        .option('--no-commit')
+        .option('-b, --bump <level>', 'Version bump level (patch, minor, major)')
+        .option('-m, --module <id>', 'Module/workflow ID to export (skips interactive selection)')
+        .option(
+            '--auto-premigrate',
+            'Auto-generate pre-migrate script when XML ID renames are detected (no prompt)'
+        )
+).action(async (opts) => {
+    if (resolveQuiet(opts)) setSilent(true);
+    await exportWorkflow(opts);
+});
 
 exportCmd.command('rip').action(() => exportRip());
 
-exportCmd
-    .command('pb')
-    .option('--no-commit')
-    .option('-s, --silent', 'Suppress all output and swallow errors')
-    .action((opts) => {
-        if (opts.silent) setSilent(true);
-        exportPb(opts).catch((err) => {
-            if (!opts.silent) throw err;
-        });
-    });
+withQuiet(exportCmd.command('pb').option('--no-commit')).action(async (opts) => {
+    if (resolveQuiet(opts)) setSilent(true);
+    await exportPb(opts);
+});
 
-exportCmd
-    .command('imperex')
-    .option('--no-commit')
-    .option('-s, --silent', 'Suppress all output and swallow errors')
-    .action((opts) => {
-        if (opts.silent) setSilent(true);
-        exportImperex(opts).catch((err) => {
-            if (!opts.silent) throw err;
-        });
-    });
+withQuiet(exportCmd.command('imperex').option('--no-commit')).action(async (opts) => {
+    if (resolveQuiet(opts)) setSilent(true);
+    await exportImperex(opts);
+});
 
-exportCmd
-    .command('lrp')
-    .option('--no-commit')
-    .option('-s, --silent', 'Suppress all output and swallow errors')
-    .action((opts) => {
-        if (opts.silent) setSilent(true);
-        exportLrp(opts).catch((err) => {
-            if (!opts.silent) throw err;
-        });
-    });
+withQuiet(exportCmd.command('lrp').option('--no-commit')).action(async (opts) => {
+    if (resolveQuiet(opts)) setSilent(true);
+    await exportLrp(opts);
+});
 
-exportCmd
-    .command('email-templates')
-    .option('--no-commit')
-    .option('-b, --bump <level>', 'Version bump level (patch, minor, major)')
-    .option('-e, --exclude <value...>', 'exclude templates matching id, name, or template_code')
-    .option('-m, --module <name>', 'module directory name (skip prompt)')
-    .option('-w, --workflow <value>', 'workflow name or id (skip prompt)')
-    .option('-s, --silent', 'Suppress all output and swallow errors')
-    .option(
-        '--auto-premigrate',
-        'Auto-generate pre-migrate script when XML ID renames are detected (no prompt)'
-    )
-    .action((opts) => {
-        if (opts.silent) setSilent(true);
-        exportEmailTemplates(opts).catch((err) => {
-            if (!opts.silent) throw err;
-        });
-    });
+withQuiet(
+    exportCmd
+        .command('email-templates')
+        .option('--no-commit')
+        .option('-b, --bump <level>', 'Version bump level (patch, minor, major)')
+        .option('-e, --exclude <value...>', 'exclude templates matching id, name, or template_code')
+        .option('-m, --module <name>', 'module directory name (skip prompt)')
+        .option('-w, --workflow <value>', 'workflow name or id (skip prompt)')
+        .option(
+            '--auto-premigrate',
+            'Auto-generate pre-migrate script when XML ID renames are detected (no prompt)'
+        )
+).action(async (opts) => {
+    if (resolveQuiet(opts)) setSilent(true);
+    await exportEmailTemplates(opts);
+});
 
-program.command('routine').action(() => {
-    routine().catch((err) => {
-        throw err;
-    });
+program.command('routine').action(async () => {
+    await routine();
 });
 
-program.command('update').action(() => {
-    console.log('Updating prbot...');
-    execFile('npm', ['i', '-g', '@waron97/prbot'], (error, stdout, stderr) => {
-        if (error) {
-            console.error(stderr || error.message);
-            process.exit(1);
-        }
-        console.log(stdout);
-        console.log('Done.');
+program
+    .command('update [version]')
+    .description('Update the global prbot install (defaults to latest if no version given)')
+    .action(async (version) => {
+        const target = version ? `@waron97/prbot@${version}` : '@waron97/prbot';
+        log(version ? `Updating prbot to ${version}...` : 'Updating prbot to latest...');
+        await new Promise((resolve, reject) => {
+            execFile('npm', ['i', '-g', target], (err, stdout, stderr) => {
+                if (err) {
+                    reject(new Error(stderr || err.message));
+                    return;
+                }
+                log(stdout);
+                log('Done.');
+                resolve();
+            });
+        });
     });
-});
 
-program.parse();
+program.parseAsync().catch(fail);

package/src/lib/auth.js

@@ -18,7 +18,25 @@ async function getToken() {
         body: payload.toString(),
     });
 
-    const json = await response.json();
+    if (!response.ok) {
+        // Never log the response body: on a password-grant endpoint it can
+        // echo back the submitted credentials.
+        throw new Error(
+            `AUTH_FAILED: Keycloak token request failed with status ${response.status}`
+        );
+    }
+
+    let json;
+    try {
+        json = await response.json();
+    } catch {
+        throw new Error('AUTH_FAILED: Keycloak response was not valid JSON');
+    }
+
+    if (!json || typeof json.access_token !== 'string' || !json.access_token) {
+        throw new Error('AUTH_FAILED: Keycloak response did not contain an access_token');
+    }
+
     return json.access_token;
 }
 

package/src/lib/logger.js

@@ -8,8 +8,19 @@ function isSilent() {
     return silent;
 }
 
+// Informational output — suppressed by --quiet/--silent.
 function log(...args) {
     if (!silent) console.log(...args);
 }
 
-export { setSilent, isSilent, log };
+// Warnings and errors are never suppressed: --quiet reduces noise, it must
+// never hide something the user needs to see to trust the exit code.
+function warn(...args) {
+    console.warn(...args);
+}
+
+function error(...args) {
+    console.error(...args);
+}
+
+export { setSilent, isSilent, log, warn, error };