breakaway 1.4.0-main.50 → 1.4.0-main.52

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "breakaway",
-  "version": "1.4.0-main.50",
+  "version": "1.4.0-main.52",
   "description": "The task board for you and your coding agents: a Cloudflare Worker, its web app, Taskwarrior sync, and the CLI (npx breakaway).",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/scripts/tasks/github-connect.js

@@ -0,0 +1,50 @@
+/**
+ * Before github-connect trades its code: whether the board already has a GitHub App (CLI-2). Each code comes
+ * from a new App on GitHub, so a second run on a board that has one would overwrite the keys of the App that works
+ * with a second App's. Read from the board's Connections report (`GET /api/connections`, its `github.app`
+ * row). Pure, so it's tested without a board.
+ */
+
+/**
+ * `ok` false stops the command before the code is traded (it still works, within its hour); `note` is what
+ * a run that goes ahead says first.
+ *
+ * @param {{ connections?: { id: string, state: string, detail?: string, at?: string | null, link?: string | null }[] } | null | undefined} report
+ * @param {{ replace: boolean }} options
+ * @returns {{ ok: boolean, message?: string, note?: string }}
+ */
+export function appInPlace(report, { replace }) {
+  const row = Array.isArray(report?.connections) ? report.connections.find((c) => c.id === 'github.app') : undefined;
+  if (!row)
+    return replace
+      ? {
+          ok: true,
+          note: "Couldn't ask the board whether it already has a GitHub App; connecting a new one (--replace).",
+        }
+      : {
+          ok: false,
+          message:
+            "couldn't ask the board whether it already has a GitHub App, so nothing was changed; the code still works within its hour. Check the board answers (npx breakaway connections), then run this again; or add --replace to connect a new App whatever is there.",
+        };
+  if (row.state === 'off') return { ok: true };
+  const what = `${row.detail}${row.link ? `, ${row.link}` : ''}`;
+  const deleteOld = `Once the new one works, delete the old one on GitHub (Settings → Developer settings → GitHub Apps)${row.link ? `: ${row.link}` : ''}.`;
+  if (replace) return { ok: true, note: `Replacing the board's GitHub App (${what}). ${deleteOld}` };
+  // Checked, and GitHub refused it: it doesn't work, so a new one takes its place.
+  if (row.state === 'attention' && row.at)
+    return {
+      ok: true,
+      note: `The board's GitHub App doesn't work (${row.detail}); connecting the new one in its place. ${deleteOld}`,
+    };
+  const kept =
+    "Nothing was changed: this code's App would replace that one. If you made the new App by mistake, delete it on GitHub (Settings → Developer settings → GitHub Apps). To switch the board to it, run npx breakaway github-connect <code> --replace within the code's hour, then delete the old one.";
+  if (row.state === 'working')
+    return {
+      ok: false,
+      message: `the board already has a working GitHub App: ${what}. ${kept}`,
+    };
+  return {
+    ok: false,
+    message: `the board already has a GitHub App's keys (${what}); press Check now on its Connections view to see whether it works. ${kept}`,
+  };
+}

package/scripts/tasks.mjs

@@ -42,6 +42,7 @@ import { looksLikeSecret } from '../src/ping.js';
 import { promptPathOf } from '../src/repos.js';
 import { hookFailure, sessionProxy, routeThroughSessionProxy } from './tasks/proxy.js';
 import { githubFromRemote, inRepo, pickRepo } from './tasks/repo.js';
+import { appInPlace } from './tasks/github-connect.js';
 import { checkInstall } from './tasks/install-check.js';
 import { NO_TERMINAL, ask as askIn } from './tasks/ask.js';
 import {
@@ -296,10 +297,11 @@ Setup (owner)
   setup                  connect this machine's Taskwarrior (writes taskrc in this machine's folder for the board, with every repository's report and context)
   rotate-sync            new client ID and sync secret; the server re-encrypts its history
   rotate-token           new API token; every browser is signed out
-  github-connect <code>  store the GitHub App's keys (the board's GitHub view gives the code)
+  github-connect <code>  store the GitHub App's keys (the board's GitHub view gives the code); refuses when the board
+                         already has an App, unless --replace
   agents-connect         store the agent routine's URL and token (docs/tasks.md#cloud-agents-from-the-board)
                          --repo <slug> connects another repository's routine; --replace drops ones this machine doesn't hold
-  init-secrets           once, for a brand-new board
+  init-secrets           once, for a brand-new board; --force starts again, keeping the old file as a .bak
 
 Install repository     (no board needed: the files and steps that deploy a board from its own repository)
   install init [dir]     write an install repository into <dir> (default: here): its config, breakaway.json, the Deploy and
@@ -1727,6 +1729,12 @@ const commands = {
     const code = need(args[0], 'code');
     // Before the code is traded: it works once, and the keys it gives have to go into the board's own secrets.
     await ensureBoardInstall('github-connect');
+    // Each code comes from a new App: on a board that has one, it would replace the working App's keys (CLI-2).
+    const inPlace = appInPlace(await call('GET', 'connections', undefined, { soft: true }), {
+      replace: Boolean(opts.replace),
+    });
+    if (!inPlace.ok) fail(inPlace.message);
+    if (inPlace.note) console.log(inPlace.note);
     const res = await fetch(`https://api.github.com/app-manifests/${enc(code)}/conversions`, {
       method: 'POST',
       headers: {
@@ -1775,6 +1783,9 @@ const commands = {
     const install = installConfig();
     // A new install has no address until it's deployed (CLD-139).
     const known = BOARD.from !== 'default' || install.url !== null;
+    // --force never loses the only copy of the sync secret: the old file is kept the way rotations keep it (CLI-2).
+    const kept = backupEnvFile();
+    if (kept) console.log(`Kept the old one as ${kept} (0600).`);
     writePrivate(
       ENV_FILE,
       envFile({
@@ -2226,9 +2237,18 @@ function writePrivate(path, content) {
   chmodSync(path, 0o600);
 }
 
+/** Moves tasks.env aside as tasks.env.<date>.bak (0600), and says where; null when there's none. */
+function backupEnvFile() {
+  if (!existsSync(ENV_FILE)) return null;
+  const backup = `${ENV_FILE}.${new Date().toISOString().replace(/[:.]/gu, '-')}.bak`;
+  renameSync(ENV_FILE, backup);
+  chmodSync(backup, 0o600);
+  return backup;
+}
+
 /** tasks.env.next becomes tasks.env; the old one is kept as tasks.env.<date>.bak. */
 function promoteEnvFile() {
-  if (existsSync(ENV_FILE)) renameSync(ENV_FILE, `${ENV_FILE}.${new Date().toISOString().replace(/[:.]/gu, '-')}.bak`);
+  backupEnvFile();
   renameSync(`${ENV_FILE}.next`, ENV_FILE);
 }