codiedev 0.10.0-beta.1 → 0.10.0-beta.11

package/dist/commands/promote.js

@@ -1,53 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runPromote = runPromote;
-const shared_1 = require("./shared");
-function parseArgs(args) {
-    let artifactId;
-    let keyOverride;
-    for (let i = 0; i < args.length; i++) {
-        const a = args[i];
-        if ((a === "--key" || a === "-k") && i + 1 < args.length) {
-            keyOverride = args[++i];
-        }
-        else if (a.startsWith("--key=")) {
-            keyOverride = a.slice("--key=".length);
-        }
-        else if (!a.startsWith("--") && !artifactId) {
-            artifactId = a;
-        }
-    }
-    if (!artifactId) {
-        console.error("Usage: codiedev promote <extracted-artifact-id> [--key spec-foo.md]");
-        process.exit(1);
-    }
-    return { artifactId, keyOverride };
-}
-async function runPromote(args) {
-    const { artifactId, keyOverride } = parseArgs(args);
-    const config = (0, shared_1.requireConfig)();
-    const start = Date.now();
-    try {
-        const res = await (0, shared_1.apiRequest)("POST", "/api/cli/promote", {
-            config,
-            body: { artifactId, keyOverride },
-        });
-        (0, shared_1.recordAgentEvent)(config, {
-            tool: "codiedev_promote",
-            ok: true,
-            latencyMs: Date.now() - start,
-        });
-        console.log(`✓ Promoted to authored artifact ${res.key}`);
-        console.log(`  id: ${res.artifactId}`);
-    }
-    catch (err) {
-        (0, shared_1.recordAgentEvent)(config, {
-            tool: "codiedev_promote",
-            ok: false,
-            latencyMs: Date.now() - start,
-            error: err.message,
-        });
-        console.error(`Promote failed: ${err.message}`);
-        process.exit(1);
-    }
-}

package/dist/commands/pull.d.ts

@@ -1,2 +0,0 @@
-export declare function candidateKeys(key: string): string[];
-export declare function runPull(args: string[]): Promise<void>;

package/dist/commands/push.d.ts

@@ -1,33 +0,0 @@
-import { requireConfig } from "./shared";
-interface PushResponse {
-    ok: boolean;
-    artifactId: string;
-    key: string;
-    version: number;
-    type: string;
-    kind: "doc" | "skill";
-    tags: string[];
-    destination: string;
-}
-export interface ParsedArgs {
-    file: string;
-    type?: string;
-    kind?: string;
-    tags: string[];
-    force: boolean;
-    as?: string;
-    private?: boolean;
-}
-export declare function parseArgs(args: string[]): ParsedArgs;
-export declare function pushFile(config: ReturnType<typeof requireConfig>, opts: {
-    absPath: string;
-    key: string;
-    visibility?: "private" | "team";
-    contentHash?: string;
-    type?: string;
-    kind?: string;
-    tags?: string[];
-    force?: boolean;
-}): Promise<PushResponse>;
-export declare function runPush(args: string[]): Promise<void>;
-export {};

package/dist/commands/react.d.ts

@@ -1,2 +0,0 @@
-import type { CodiedevConfig } from "../utils";
-export declare function runReact(args: string[], configOverride?: CodiedevConfig): Promise<void>;

package/dist/commands/react.js

@@ -1,40 +0,0 @@
-"use strict";
-// `codiedev react <postId> <emoji>` — toggle a reaction on a feed post.
-// Calling twice with the same emoji removes it.
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runReact = runReact;
-const shared_1 = require("./shared");
-async function runReact(args, configOverride) {
-    const positionals = args.filter((a) => !a.startsWith("--"));
-    const [postId, emoji] = positionals;
-    if (!postId || !emoji) {
-        console.error("Usage: codiedev react <postId> <emoji>");
-        process.exit(1);
-    }
-    const config = configOverride ?? (0, shared_1.requireConfig)();
-    const start = Date.now();
-    try {
-        const res = await (0, shared_1.apiRequest)("POST", "/api/cli/react", {
-            config,
-            body: { postId, emoji },
-        });
-        (0, shared_1.recordAgentEvent)(config, {
-            tool: "codiedev_react",
-            ok: true,
-            latencyMs: Date.now() - start,
-        });
-        console.log(res.action === "removed"
-            ? `Removed ${res.emoji ?? emoji} from post ${postId}.`
-            : `Reacted to post ${postId} with ${res.emoji ?? emoji}.`);
-    }
-    catch (err) {
-        (0, shared_1.recordAgentEvent)(config, {
-            tool: "codiedev_react",
-            ok: false,
-            latencyMs: Date.now() - start,
-            error: err.message,
-        });
-        console.error(`React failed: ${err.message}`);
-        process.exit(1);
-    }
-}

package/dist/commands/reverseTicket.d.ts

@@ -1,2 +0,0 @@
-export declare function isSafeRef(ref: string): boolean;
-export declare function runReverseTicket(args: string[]): Promise<void>;

package/dist/commands/reverseTicket.js

@@ -1,477 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isSafeRef = isSafeRef;
-exports.runReverseTicket = runReverseTicket;
-const child_process_1 = require("child_process");
-const shared_1 = require("./shared");
-const prUrl_1 = require("../prUrl");
-/**
- * Run a binary with an explicit argv, never a shell.
- *
- * The `gh`/`glab` API paths are built from an owner/repo parsed out of a URL the
- * caller pastes in. `parsePrOrMrUrl` only bounds those segments to "no slash",
- * so they can still carry `$(…)`, backticks or `;` — which a `shell: true`
- * invocation would execute. Passing argv directly means the shell never sees
- * them at all.
- */
-function runArgv(bin, argv, opts = {}) {
-    const res = (0, child_process_1.spawnSync)(bin, argv, {
-        stdio: ["pipe", "pipe", "pipe"],
-        encoding: "utf8",
-        maxBuffer: opts.maxBuffer ?? 50 * 1024 * 1024,
-        shell: false,
-    });
-    if (res.error)
-        throw res.error;
-    if (res.status !== 0) {
-        throw new Error(`${bin} ${argv.join(" ")} failed (exit ${res.status}): ${(res.stderr || "").trim().slice(0, 500)}`);
-    }
-    return res.stdout ?? "";
-}
-// Git ref names legally contain `$()`, `;`, `|` and backticks, all of which
-// break out of the `shell: true` git calls in branch mode below. A ref supplied
-// via `--base` is caller-controlled, so bound it to the safe subset before it
-// reaches a command line. Mirrors `validate_ref` in modal/runner.py.
-const SAFE_REF_RE = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$/;
-function isSafeRef(ref) {
-    if (!ref || ref.startsWith("-"))
-        return false;
-    if (ref.includes("..") || ref.includes("@{"))
-        return false;
-    if (ref.endsWith("/") || ref.endsWith("."))
-        return false;
-    return SAFE_REF_RE.test(ref);
-}
-async function fetchPrOrMrBundle(parsed, rawUrl, noTruncate) {
-    console.log(`Fetching ${parsed.provider === "gitlab" ? "MR" : "PR"} ${parsed.owner}/${parsed.repo}#${parsed.number}…`);
-    if (parsed.provider === "github") {
-        let prJson;
-        let filesJson;
-        let diff;
-        try {
-            prJson = ghApi(`/repos/${parsed.owner}/${parsed.repo}/pulls/${parsed.number}`);
-            filesJson = ghApi(`/repos/${parsed.owner}/${parsed.repo}/pulls/${parsed.number}/files`);
-            try {
-                const rawDiff = ghRaw(`/repos/${parsed.owner}/${parsed.repo}/pulls/${parsed.number}`);
-                diff = noTruncate ? rawDiff : rawDiff.slice(0, 12_000);
-            }
-            catch {
-                // diff is nice-to-have
-            }
-        }
-        catch (err) {
-            console.error(`Failed to fetch PR via gh api: ${err.message}`);
-            process.exit(1);
-        }
-        return {
-            repo: `${parsed.owner}/${parsed.repo}`,
-            number: parsed.number,
-            title: prJson.title ?? "",
-            body: prJson.body ?? "",
-            author: prJson.user?.login ?? "unknown",
-            authorEmail: prJson.user?.email ?? undefined,
-            mergedAt: prJson.merged_at
-                ? Date.parse(prJson.merged_at)
-                : prJson.closed_at
-                    ? Date.parse(prJson.closed_at)
-                    : Date.now(),
-            filesChanged: (filesJson ?? []).map((f) => f.filename),
-            diff,
-            htmlUrl: prJson.html_url ?? rawUrl,
-        };
-    }
-    // GitLab path. `glab api projects/<encoded-path>/...` returns the same
-    // MR shape as the REST API. We pull the diff from `merge_requests/<n>/changes`
-    // and reassemble a unified diff out of each file's `diff` blob.
-    const projectPath = `${parsed.owner}/${parsed.repo}`;
-    let mrJson;
-    let changesJson;
-    try {
-        mrJson = glabApi(projectPath, `merge_requests/${parsed.number}`);
-        changesJson = glabApi(projectPath, `merge_requests/${parsed.number}/changes`);
-    }
-    catch (err) {
-        console.error(`Failed to fetch MR via glab api: ${err.message}`);
-        process.exit(1);
-    }
-    const changes = (changesJson?.changes ?? []);
-    const filesChanged = changes
-        .map((c) => c.new_path ?? c.old_path)
-        .filter((p) => Boolean(p));
-    const rawDiff = changes
-        .map((c) => {
-        const header = `diff --git a/${c.old_path ?? c.new_path} b/${c.new_path ?? c.old_path}`;
-        return [header, c.diff ?? ""].join("\n");
-    })
-        .join("\n");
-    const diff = noTruncate ? rawDiff : rawDiff.slice(0, 12_000);
-    return {
-        repo: projectPath,
-        number: parsed.number,
-        title: mrJson.title ?? "",
-        body: mrJson.description ?? "",
-        author: mrJson.author?.username ?? "unknown",
-        authorEmail: undefined,
-        mergedAt: mrJson.merged_at
-            ? Date.parse(mrJson.merged_at)
-            : mrJson.closed_at
-                ? Date.parse(mrJson.closed_at)
-                : Date.now(),
-        filesChanged,
-        diff,
-        htmlUrl: mrJson.web_url ?? rawUrl,
-    };
-}
-function checkCli(bin) {
-    try {
-        runArgv(bin, ["--version"], { maxBuffer: 1024 * 1024 });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function ghApi(path) {
-    return JSON.parse(runArgv("gh", ["api", path]));
-}
-function ghRaw(path) {
-    return runArgv("gh", [
-        "api",
-        "-H",
-        "Accept: application/vnd.github.v3.diff",
-        path,
-    ]);
-}
-// glab api takes a project path (URL-encoded) or numeric id and a sub-path.
-// For self-hosted GitLab, glab respects `GITLAB_HOST` env if the user has
-// configured glab against their internal instance.
-function glabApi(projectPath, subpath) {
-    const encoded = encodeURIComponent(projectPath);
-    return JSON.parse(runArgv("glab", ["api", `projects/${encoded}/${subpath}`]));
-}
-function parseArgs(args) {
-    let prUrl;
-    let base;
-    let forcedKey;
-    let noTruncate = false;
-    for (let i = 0; i < args.length; i++) {
-        const a = args[i];
-        if ((a === "--with" || a === "-w") && i + 1 < args.length) {
-            forcedKey = args[++i];
-        }
-        else if (a.startsWith("--with=")) {
-            forcedKey = a.slice("--with=".length);
-        }
-        else if ((a === "--base" || a === "-b") && i + 1 < args.length) {
-            base = args[++i];
-        }
-        else if (a.startsWith("--base=")) {
-            base = a.slice("--base=".length);
-        }
-        else if (a === "--full") {
-            noTruncate = true;
-        }
-        else if (!a.startsWith("--") && !prUrl) {
-            prUrl = a;
-        }
-    }
-    return { prUrl, base, forcedKey, noTruncate };
-}
-async function runReverseTicket(args) {
-    const { prUrl, base, forcedKey, noTruncate } = parseArgs(args);
-    // No PR URL → branch mode (mid-session, no PR exists yet).
-    if (!prUrl) {
-        return runBranchMode({ explicitBase: base, forcedKey });
-    }
-    const parsed = (0, prUrl_1.parsePrOrMrUrl)(prUrl);
-    if (!parsed) {
-        console.error("Couldn't parse PR/MR URL. Expected formats:");
-        console.error("  https://github.com/<owner>/<repo>/pull/<number>");
-        console.error("  https://gitlab.com/<group>/<repo>/-/merge_requests/<number>");
-        console.error("  (self-hosted GitLab works too — same shape, your host)");
-        console.error("");
-        console.error("Run with no arguments for branch mode (uses your current local branch).");
-        process.exit(1);
-    }
-    const requiredCli = parsed.provider === "gitlab" ? "glab" : "gh";
-    if (!checkCli(requiredCli)) {
-        console.error(`This command needs the \`${requiredCli}\` CLI installed and authenticated.`);
-        if (requiredCli === "gh") {
-            console.error("  brew install gh  (macOS)");
-            console.error("  gh auth login");
-        }
-        else {
-            console.error("  brew install glab  (macOS)");
-            console.error("  glab auth login");
-        }
-        process.exit(1);
-    }
-    const config = (0, shared_1.requireConfig)();
-    const bundle = await fetchPrOrMrBundle(parsed, prUrl, noTruncate);
-    console.log(`  title: ${bundle.title}`);
-    console.log(`  author: ${bundle.author}`);
-    console.log(`  files: ${bundle.filesChanged.length}`);
-    console.log(`  merged: ${new Date(bundle.mergedAt).toISOString()}`);
-    console.log("");
-    console.log("Generating ticket…");
-    console.log("");
-    const start = Date.now();
-    try {
-        const res = await (0, shared_1.apiRequest)("POST", "/api/cli/reverseTicket", {
-            config,
-            body: {
-                pr: bundle,
-                forcedArtifactKey: forcedKey,
-            },
-        });
-        (0, shared_1.recordAgentEvent)(config, {
-            tool: "codiedev_reverse_ticket",
-            ok: true,
-            latencyMs: Date.now() - start,
-        });
-        if (res.match) {
-            console.log(`✓ Matched artifact: ${res.match.key} (score=${res.match.score.toFixed(2)})`);
-            console.log(`  signals · body=${res.match.signals.bodyMention} · files=${res.match.signals.fileOverlap.toFixed(2)} · transcript=${res.match.signals.transcriptEdit}`);
-        }
-        else if (res.candidates.length > 0) {
-            console.log(`? Ambiguous / low confidence. Candidates:`);
-            for (const c of res.candidates.slice(0, 3)) {
-                console.log(`  - ${c.key} (score=${c.score.toFixed(2)})`);
-            }
-            console.log(`  Re-run with --with <key> to force a specific artifact.`);
-        }
-        else {
-            console.log("· No matched artifact. Ticket generated from PR diff alone.");
-        }
-        console.log(`  prompt tokens (est): ${res.tokensInEstimate}`);
-        console.log("");
-        console.log("─────────── Generated ticket ───────────");
-        console.log("");
-        console.log(res.ticket);
-    }
-    catch (err) {
-        (0, shared_1.recordAgentEvent)(config, {
-            tool: "codiedev_reverse_ticket",
-            ok: false,
-            latencyMs: Date.now() - start,
-            error: err.message,
-        });
-        console.error(`Reverse-ticket failed: ${err.message}`);
-        process.exit(1);
-    }
-}
-function git(cmd) {
-    try {
-        return (0, child_process_1.execSync)(`git ${cmd}`, {
-            stdio: ["pipe", "pipe", "pipe"],
-            maxBuffer: 32 * 1024 * 1024,
-        })
-            .toString("utf8")
-            .trim();
-    }
-    catch (err) {
-        throw new Error(`git ${cmd} failed: ${err.message}`);
-    }
-}
-function safeGit(fn) {
-    try {
-        return fn() || undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-async function runBranchMode(opts) {
-    // Confirm we're in a git repo.
-    try {
-        git("rev-parse --is-inside-work-tree");
-    }
-    catch {
-        console.error("Not inside a git repository. Run this from a checked-out repo.");
-        process.exit(1);
-    }
-    // `--base` lands unquoted on a `git` command line below, so reject anything
-    // outside the safe-ref subset instead of letting the shell interpret it.
-    if (opts.explicitBase !== undefined && !isSafeRef(opts.explicitBase)) {
-        console.error(`Invalid --base ref: ${JSON.stringify(opts.explicitBase)}. Expected a plain branch or tag name.`);
-        process.exit(1);
-    }
-    // Resolve base ref — explicit, then origin/main, then origin/master.
-    const candidates = opts.explicitBase
-        ? [opts.explicitBase]
-        : ["origin/main", "origin/master"];
-    let baseRef = null;
-    for (const c of candidates) {
-        try {
-            git(`rev-parse --verify ${c}`);
-            baseRef = c;
-            break;
-        }
-        catch {
-            // try next
-        }
-    }
-    if (!baseRef) {
-        console.error(`Couldn't find a base ref (tried ${candidates.join(", ")}). Pass --base <ref>.`);
-        process.exit(1);
-    }
-    const branch = git("rev-parse --abbrev-ref HEAD");
-    if (branch === "HEAD") {
-        console.error("Detached HEAD — checkout a branch first.");
-        process.exit(1);
-    }
-    const baseSha = git(`merge-base HEAD ${baseRef}`);
-    const headSha = git("rev-parse HEAD");
-    // Filter generated/lockfile noise from the diff body. The --stat (collected
-    // separately) still includes every file untouched, so excluded files still
-    // surface in the ticket's "Other files touched" section.
-    const isNoise = (p) => /(^|\/)(node_modules|dist|build|\.next|\.turbo|coverage|out)\//.test(p) ||
-        /(^|\/)package-lock\.json$/.test(p) ||
-        /(^|\/)yarn\.lock$/.test(p) ||
-        /(^|\/)pnpm-lock\.yaml$/.test(p) ||
-        /(^|\/)bun\.lock(b)?$/.test(p) ||
-        /(^|\/)Cargo\.lock$/.test(p) ||
-        /(^|\/)Gemfile\.lock$/.test(p) ||
-        /(^|\/)poetry\.lock$/.test(p) ||
-        /(^|\/)go\.sum$/.test(p);
-    const shellTolerant = (cmd) => {
-        try {
-            return (0, child_process_1.execSync)(`${cmd} || true`, {
-                stdio: ["pipe", "pipe", "pipe"],
-                maxBuffer: 32 * 1024 * 1024,
-            })
-                .toString("utf8")
-                .trim();
-        }
-        catch {
-            return "";
-        }
-    };
-    const shQuote = (s) => `'${s.replace(/'/g, "'\\''")}'`;
-    // Capture all work relative to the base ref: committed + uncommitted-tracked
-    // + new untracked. Matches "ticket my current changes" intent.
-    const trackedRaw = git(`diff --name-only ${baseSha}`);
-    const trackedFiles = trackedRaw ? trackedRaw.split("\n").filter(Boolean) : [];
-    const untrackedRaw = safeGit(() => git("ls-files --others --exclude-standard"));
-    const untrackedFiles = untrackedRaw
-        ? untrackedRaw.split("\n").filter(Boolean)
-        : [];
-    const filesChanged = Array.from(new Set([...trackedFiles, ...untrackedFiles]));
-    if (filesChanged.length === 0) {
-        console.error(`No changes detected between ${baseRef} and your working tree on ${branch}.`);
-        process.exit(1);
-    }
-    let stat = "";
-    try {
-        const trackedStat = git(`diff --stat=200 ${baseSha}`);
-        const untrackedStatLines = untrackedFiles.map((f) => {
-            const wc = shellTolerant(`wc -l < ${shQuote(f)}`);
-            const n = parseInt(wc.split(/\s+/)[0] || "0", 10) || 0;
-            return ` ${f} | ${n} ++++++++++ (new file)`;
-        });
-        stat = [trackedStat, ...untrackedStatLines]
-            .filter(Boolean)
-            .join("\n")
-            .slice(0, 8_000);
-    }
-    catch {
-        // best effort
-    }
-    let diff = "";
-    try {
-        const sourceTracked = trackedFiles.filter((f) => !isNoise(f));
-        const trackedDiff = sourceTracked.length > 0
-            ? git(`diff ${baseSha} -- ${sourceTracked.map(shQuote).join(" ")}`)
-            : git(`diff ${baseSha}`);
-        const sourceUntracked = untrackedFiles.filter((f) => !isNoise(f));
-        const untrackedDiffs = sourceUntracked.map((f) => shellTolerant(`git diff --no-index --no-color -- /dev/null ${shQuote(f)}`));
-        diff = [trackedDiff, ...untrackedDiffs]
-            .filter(Boolean)
-            .join("\n")
-            .slice(0, 40_000);
-    }
-    catch {
-        // best effort
-    }
-    let repo;
-    try {
-        const remoteUrl = git("config --get remote.origin.url");
-        const m = remoteUrl.match(/[:/]([^/:]+)\/([^/:]+?)(?:\.git)?$/);
-        if (!m) {
-            throw new Error(`Couldn't parse owner/repo from remote: ${remoteUrl}`);
-        }
-        repo = `${m[1]}/${m[2]}`;
-    }
-    catch (err) {
-        console.error(`Couldn't read git remote.origin.url: ${err.message}`);
-        process.exit(1);
-    }
-    const title = safeGit(() => git("log -1 --format=%s")) ?? `WIP: ${branch}`;
-    const author = safeGit(() => git("config --get user.name"));
-    const authorEmail = safeGit(() => git("config --get user.email"));
-    console.log(`Branch:  ${branch}  (${repo})`);
-    console.log(`Base:    ${baseRef} @ ${baseSha.slice(0, 12)}`);
-    console.log(`Head:    ${headSha.slice(0, 12)}`);
-    console.log(`Files:   ${filesChanged.length}`);
-    console.log("");
-    console.log("Generating ticket draft…");
-    console.log("");
-    const config = (0, shared_1.requireConfig)();
-    const start = Date.now();
-    try {
-        const res = await (0, shared_1.apiRequest)("POST", "/api/cli/reverseTicketFromBranch", {
-            config,
-            body: {
-                branch: {
-                    repo,
-                    branch,
-                    baseSha,
-                    headSha,
-                    title,
-                    author,
-                    authorEmail,
-                    filesChanged,
-                    diff: diff || undefined,
-                    stat: stat || undefined,
-                },
-                forcedArtifactKey: opts.forcedKey,
-            },
-        });
-        if (!res.ok || !res.artifactId) {
-            (0, shared_1.recordAgentEvent)(config, {
-                tool: "codiedev_reverse_ticket",
-                ok: false,
-                latencyMs: Date.now() - start,
-                error: "no result",
-            });
-            console.error("Reverse-ticket generation returned no result. The writer may have skipped due to missing context.");
-            process.exit(1);
-        }
-        (0, shared_1.recordAgentEvent)(config, {
-            tool: "codiedev_reverse_ticket",
-            ok: true,
-            latencyMs: Date.now() - start,
-        });
-        const portalHost = (process.env.CODIEDEV_PORTAL_URL || "https://codiedev.com").replace(/\/$/, "");
-        const portalLink = res.portalUrl.startsWith("http")
-            ? res.portalUrl
-            : `${portalHost}${res.portalUrl.startsWith("/") ? "" : "/"}${res.portalUrl}`;
-        const verb = res.action === "overwritten" ? "Updated" : "Created";
-        console.log(`✓ ${verb} reverse-ticket draft.`);
-        console.log(`  artifact: ${res.artifactKey ?? res.artifactId}`);
-        console.log(`  portal:   ${portalLink}`);
-        console.log("");
-        console.log("Open in your portal to review, edit, and push to Jira.");
-        console.log("Each call creates a fresh draft — clean up duplicates from the portal if needed.");
-    }
-    catch (err) {
-        (0, shared_1.recordAgentEvent)(config, {
-            tool: "codiedev_reverse_ticket",
-            ok: false,
-            latencyMs: Date.now() - start,
-            error: err.message,
-        });
-        console.error(`Reverse-ticket failed: ${err.message}`);
-        process.exit(1);
-    }
-}

package/dist/commands/search.d.ts

@@ -1,2 +0,0 @@
-import type { CodiedevConfig } from "../utils";
-export declare function runSearch(args: string[], configOverride?: CodiedevConfig): Promise<void>;

package/dist/commands/security.d.ts

@@ -1 +0,0 @@
-export declare function runSecurityCommand(args: string[]): Promise<void>;