backstep 0.1.13 → 0.1.14

package/dist/cli.js

@@ -464,8 +464,9 @@ async function main() {
     }
     // Takes away something Claude made on GitHub (the thing, as undo reported it, on stdin). The mod runs this after asking.
     // Gets the person's OK on GitHub for another gh permission: code on the clipboard, approval page opened.
+    // The code is printed on a line of its own straight away, so the mod can show it; the answer is the last line.
     if (cmd === "gh-auth") {
-        const out = await grantScope(rest[0] ?? "");
+        const out = await grantScope(rest[0] ?? "", (code) => console.log(JSON.stringify({ code, url: "https://github.com/login/device" })));
         console.log(JSON.stringify(out));
         if (!out.ok)
             process.exitCode = 1;

package/dist/github.js

@@ -80,8 +80,9 @@ function openPage(url) {
 // Gives gh's sign-in another permission (like delete_repo) with GitHub's own
 // approval page: the one-time code is put on the clipboard and the page opened,
 // so the person only pastes it and approves. Resolves once GitHub says yes,
-// or no, or nine minutes pass (Claude Code gives a command ten).
-export function grantScope(scope) {
+// or no, or nine minutes pass (Claude Code gives a command ten). `onCode` hears
+// the code as soon as gh prints it, so it can be shown while GitHub waits.
+export function grantScope(scope, onCode) {
     return new Promise((resolve) => {
         // gh would open the page too; Backstep already does, so gh's browser is told to do nothing.
         const env = { ...process.env, NO_COLOR: "1", GH_BROWSER: process.platform === "win32" ? "cmd /c exit" : "true" };
@@ -96,6 +97,7 @@ export function grantScope(scope) {
                 shown = true;
                 copy(code);
                 openPage(DEVICE);
+                onCode?.(code);
                 // gh waits for Enter before it would open the page itself; it's already open.
                 child.stdin.write("\n");
             }

package/mod/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "backstep",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "Press ctrl+z to rewind everything Claude did in its last turn: file edits, shell commands, and database and tool changes.",
   "types": "./types/index.d.ts",
   "userConfig": {

package/mod/hooks/register.test.tsx

@@ -723,13 +723,25 @@ test('a GitHub repository Claude created is offered for deletion after undo, and
             runs.filter((r) => r.argv.includes('gh-undo')).length === 1
             ? { ok: false, needs: 'delete_repo', detail: 'GitHub needs your OK before bzells11/taskflow can be deleted' }
             : { ok: true, detail: 'deleted the repository bzells11/taskflow' }
-          : e.argv.includes('gh-auth')
-            ? { ok: true, detail: 'GitHub approved it' }
           : e.argv.includes('db-check')
             ? { ask: null }
             : null
     return { value: { exitCode: 0, stdout: out ? JSON.stringify(out) : '', stderr: '', isStdoutTruncated: false, isStderrTruncated: false } }
   })
+  // GitHub's approval: the code comes first, then the answer once the person approves (when `approve` is called).
+  let approve = () => {}
+  const approved = new Promise<void>((resolve) => (approve = resolve))
+  let codeShown: Promise<void> = Promise.resolve()
+  let gotCode = () => {}
+  codeShown = new Promise<void>((resolve) => (gotCode = resolve))
+  on('process.spawn', async function* (_, e) {
+    runs.push({ argv: [...e.argv] })
+    yield { stream: 'stdout' as const, text: '{"code":"ABCD-1234","url":"https://github.com/login/device"}\n' }
+    gotCode()
+    await approved
+    yield { stream: 'stdout' as const, text: '{"ok":true,"detail":"GitHub approved it"}\n' }
+    return { value: { code: 0, signal: null } }
+  })
   on('tool.call', { tool: 'AskUserQuestion' }, (_, e) => {
     const questions = (e as unknown as { questions: { question: string }[] }).questions
     asked.push(questions[0].question)
@@ -753,7 +765,17 @@ test('a GitHub repository Claude created is offered for deletion after undo, and
   const pressed = ui.press({ key: 'undo' })
   await clock.advance(1000)
   await pressed
+  await codeShown
+  await clock.settle()
+  // While GitHub waits, the band says it's a step to take and shows the code, not a failure.
+  expect(await ui.find({ type: 'Text', text: /One more step to delete the GitHub repository bzells11\/taskflow/ })).toBeTruthy()
+  expect(await ui.find({ type: 'Text', text: 'ABCD-1234' })).toBeTruthy()
+  // The push went to the repository being deleted, so it isn't listed as not undone.
+  expect(await ui.find({ type: 'Text', text: /Not undone/ })).toBeFalsy()
+  approve()
   await clock.settle()
+  expect(await ui.find({ type: 'Text', text: 'ABCD-1234' })).toBeFalsy()
+  expect(await ui.find({ type: 'Text', text: /on GitHub: deleted the repository bzells11\/taskflow/ })).toBeTruthy()
   expect(asked).toEqual(['Claude created the GitHub repository bzells11/taskflow. Delete it on GitHub too?'])
   expect(JSON.parse(runs.find((r) => r.argv.includes('gh-undo'))?.stdin ?? '{}')).toEqual(repo)
   // Missing permission: GitHub's OK is fetched by Backstep itself, then the delete is tried again.
@@ -762,7 +784,7 @@ test('a GitHub repository Claude created is offered for deletion after undo, and
     'gh-auth delete_repo',
     'gh-undo',
   ])
-  expect(logs.find((l) => l.includes('opened the approval page and copied the code'))).toBeTruthy()
+  expect(logs.find((l) => l.includes('paste the code ABCD-1234 on the GitHub page'))).toBeTruthy()
   expect(logs.find((l) => l.includes('On GitHub: deleted the repository'))).toBeTruthy()
   // The repository is gone, so its push isn't asked about.
   expect(runs.some((r) => r.argv.includes('revert-push'))).toBe(false)

package/mod/hooks/register.tsx

@@ -7,7 +7,7 @@
 import { atom, read, update } from 'claude-code'
 import type { EngineInterface, Register } from 'claude-code'
 
-import type { Rewind, RewindItem, Turn } from '../types'
+import type { GithubCode, Rewind, RewindItem, Turn } from '../types'
 
 const turns = atom({ plugin: 'backstep', key: 'turns' } as const, [] as Turn[])
 const rewind = atom({ plugin: 'backstep', key: 'rewind' } as const, null as Rewind | null)
@@ -16,6 +16,8 @@ const armed = atom({ plugin: 'backstep', key: 'armed' } as const, null as number
 // The keys bound to undo, read as a session starts and when the person changes
 // them. Kept in state, not a variable, so the band redraws with the new key.
 const keys = atom({ plugin: 'backstep', key: 'keys' } as const, ['ctrl+u'] as string[])
+// The one-time code GitHub's approval page wants, on the band while GitHub waits.
+const githubCode = atom({ plugin: 'backstep', key: 'githubCode' } as const, null as GithubCode | null)
 // Backstep's mark, as on the logo: the front rewind triangle in the terminal's
 // own black or white, the one behind it in the logo's pink.
 const PINK = '#ee7bb6'
@@ -80,6 +82,39 @@ async function jsonRun($: EngineInterface, args: string[], timeoutMs: number, st
 
 const ghUndo = ($: EngineInterface, g: GhMade) => jsonRun($, ['gh-undo'], 120_000, JSON.stringify(g))
 
+// Gets GitHub's OK for one more gh permission. The CLI prints the one-time code
+// on a line of its own as soon as GitHub gives it, so the band shows it while
+// GitHub waits; the answer is its last line.
+async function ghAuth($: EngineInterface, scope: string, what: string): Promise<{ ok: boolean; detail: string }> {
+  let out = ''
+  try {
+    const child = $.process.spawn({ argv: backstep(['gh-auth', scope]) })
+    for await (const { stream, text } of child) {
+      if (stream !== 'stdout') continue
+      out += text
+      const code = out.match(/"code":"([A-Z0-9]{4}-[A-Z0-9]{4})"/)?.[1]
+      if (code && !(await read($, githubCode))) {
+        await update($, githubCode, () => ({ code, what }))
+        $.ui.log(`${MARK_TEXT} One more step to ${what}: paste the code ${code} on the GitHub page that just opened, then press Authorize. (It's already copied, so ⌘V / Ctrl+V works.)`)
+      }
+    }
+  } catch (err) {
+    out += `\n${JSON.stringify({ ok: false, detail: err instanceof Error ? err.message : String(err) })}`
+  } finally {
+    await update($, githubCode, () => null)
+  }
+  try {
+    return JSON.parse(out.trim().split('\n').at(-1) ?? '') as { ok: boolean; detail: string }
+  } catch {
+    return { ok: false, detail: "GitHub didn't answer" }
+  }
+}
+
+// Adds a line to the band's list once something offered after the rewind is settled.
+async function addItem($: EngineInterface, item: RewindItem) {
+  await update($, rewind, (r) => (r ? { ...r, items: [...r.items, item], shown: r.shown + 1 } : r))
+}
+
 // Asks, for each thing Claude made on GitHub in the undone turns, whether to take it away there too.
 // Returns the repositories deleted, whose pushes then need no undo of their own.
 async function offerGithubUndo($: EngineInterface, outcomes: Outcome[]): Promise<Set<string>> {
@@ -96,12 +131,12 @@ async function offerGithubUndo($: EngineInterface, outcomes: Outcome[]): Promise
     let r = await ghUndo($, g)
     // gh's sign-in needs one more permission: get it on GitHub's own page, then try again.
     if (!r.ok && r.needs) {
-      $.ui.toast("GitHub needs your OK first. Backstep opened GitHub in your browser and copied the code: paste it there and press Authorize.", { timeoutMs: 15_000 })
-      $.ui.log(`${MARK_TEXT} GitHub needs your OK first: Backstep opened the approval page and copied the code to your clipboard. Paste it and press Authorize.`)
-      const granted = await jsonRun($, ['gh-auth', r.needs], 600_000)
+      $.ui.toast('One more step: paste the code shown above the prompt on the GitHub page that just opened, then press Authorize.', { timeoutMs: 15_000 })
+      const granted = await ghAuth($, r.needs, `${yes === 'Close it' ? 'close' : 'delete'} ${describeGh(g)}`)
       r = granted.ok ? await ghUndo($, g) : { ok: false, detail: `GitHub didn't give the OK (${granted.detail}), so ${describeGh(g)} is still there` }
     }
     if (r.ok && g.kind === 'repo') gone.add(g.repo)
+    await addItem($, r.ok ? { label: `on GitHub: ${r.detail}`, ok: true } : { label: `on GitHub: ${r.detail}`, ok: false })
     $.ui.log(r.ok ? `${MARK_TEXT} On GitHub: ${r.detail}.` : `${MARK_TEXT} Not undone on GitHub: ${r.detail}`)
     $.ui.toast(r.ok ? `Backstep ${r.detail}.` : `Backstep ${r.detail}`)
   }
@@ -237,9 +272,11 @@ async function undoLastTurn($: EngineInterface, count = 1) {
   // A push, or something made on GitHub, is offered back below, so it isn't listed as lost.
   const offered = outcomes.some((o) => o.ok && o.pushed)
   const offeredGh = outcomes.some((o) => o.ok && o.github?.length)
+  // Deleting the repository takes whatever was pushed to it along.
+  const offeredRepo = outcomes.some((o) => o.ok && o.github?.some((g) => g.kind === 'repo'))
   const kept = taken
     .flatMap((t) => t.lostItems ?? [])
-    .filter((l) => !(offered && /pushes to a remote/.test(l)) && !(offeredGh && /changes GitHub/.test(l)))
+    .filter((l) => !((offered || offeredRepo) && /pushes to a remote/.test(l)) && !(offeredGh && /changes GitHub/.test(l)))
     .map((label) => ({ label, ok: false }))
   const items: RewindItem[] = [...undone, ...stopped, ...kept]
   const done = undone.length
@@ -755,6 +792,24 @@ export const register: Register = (on, options) => {
       )
     }
 
+    const waiting = await read($, githubCode)
+    // GitHub is waiting on the person: the code, big and plain, says this is a step to take, not a failure.
+    const step = waiting ? (
+      <Box flexDirection="column" marginTop={r ? 1 : 0}>
+        <Box>
+          <Text bold>◀</Text>
+          <Text color={PINK} bold>◀</Text>
+          <Text color="warning" bold>{` One more step to ${waiting.what}:`}</Text>
+        </Box>
+        <Text>{'   Paste this code on the GitHub page that just opened, then press Authorize:'}</Text>
+        <Box>
+          <Text>{'   '}</Text>
+          <Text color={PINK} bold>{waiting.code}</Text>
+          <Text dimColor>{'  (already copied: ⌘V / Ctrl+V)'}</Text>
+        </Box>
+      </Box>
+    ) : null
+
     if (r) {
       const tone = r.phase === 'failed' ? 'error' : r.phase === 'empty' ? 'warning' : undefined
       const glyph = r.phase === 'failed' ? '✗' : r.phase === 'empty' ? '!' : '✓'
@@ -782,10 +837,13 @@ export const register: Register = (on, options) => {
               {i.label}
             </Text>
           ))}
+          {step}
         </Box>
       )
     }
 
+    if (step) return step
+
     const { target, before } = await undoTargets($)
     const label = (await read($, keys)).map(keyLabel).join(' / ')
     if (target && (await read($, armed)) !== null) {

package/mod/types/index.d.ts

@@ -29,10 +29,14 @@ export type Rewind = {
   message: string
 }
 
+// GitHub waiting on the person's OK for one more permission: the one-time code to paste, and what it's for.
+export type GithubCode = { code: string; what: string }
+
 declare module 'claude-code' {
   interface PluginState {
     // armed: when the undo key was first pressed; a second press within a few seconds undoes.
     // keys: the keys bound to undo, kept here so the band redraws when they change.
-    backstep: { turns: Turn[]; rewind: Rewind | null; note: string | null; armed: number | null; keys: string[] }
+    // githubCode: the code GitHub's approval page wants, shown on the band until GitHub answers.
+    backstep: { turns: Turn[]; rewind: Rewind | null; note: string | null; armed: number | null; keys: string[]; githubCode: GithubCode | null }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backstep",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "Undo for everything your agents touch: an MCP proxy that makes agent actions reversible.",
   "scripts": {
     "dev": "node src/cli.ts",