create-egregore 0.21.0-runtime-mvp.5 → 0.21.0-runtime-mvp.7

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.21.0-runtime-mvp.5
+// egregore-launcher-version: 0.21.0-runtime-mvp.7
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -35,7 +35,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.21.0-runtime-mvp.5";
+const VERSION = "0.21.0-runtime-mvp.7";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");
@@ -2564,6 +2564,54 @@ async function fetchRuntimeMvpCandidate() {
   }
 }
 
+// Fetch the published candidate tarball from the npm registry and verify its
+// integrity before staging. The first-timer path: `p prepare` with nothing
+// staged must not dead-end into a CLI instruction referencing a tarball the
+// user does not have — the registry has it, digest-verified.
+function fetchCandidateTarball(version, cb) {
+  const metaUrl = new URL(`https://registry.npmjs.org/${PUBLIC_NPX_PACKAGE}/${version}`);
+  requestJson({
+    hostname: metaUrl.hostname,
+    path: metaUrl.pathname,
+    method: "GET",
+    protocol: metaUrl.protocol,
+    timeoutMs: 10000,
+    headers: { Accept: "application/json" },
+  }).then((meta) => {
+    const dist = meta && meta.status === 200 && meta.data && meta.data.dist;
+    if (!dist || !dist.tarball) return cb(new Error(`candidate ${version} not found on the registry`));
+    const dest = path.join(os.tmpdir(), `egregore-candidate-${version}.tgz`);
+    const fetchTarball = (url, redirects) => {
+      https.get(url, { headers: { "User-Agent": "egregore-launcher" } }, (res) => {
+        if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location && redirects > 0) {
+          res.resume();
+          return fetchTarball(res.headers.location, redirects - 1);
+        }
+        if (res.statusCode !== 200) {
+          res.resume();
+          return cb(new Error(`tarball download failed (HTTP ${res.statusCode})`));
+        }
+        const hash = crypto.createHash("sha512");
+        const out = fs.createWriteStream(dest);
+        res.on("data", (d) => hash.update(d));
+        res.pipe(out);
+        out.on("finish", () => {
+          out.close(() => {
+            const digest = `sha512-${hash.digest("base64")}`;
+            if (dist.integrity && digest !== dist.integrity) {
+              fs.rmSync(dest, { force: true });
+              return cb(new Error("candidate integrity mismatch — refusing to stage"));
+            }
+            cb(null, dest);
+          });
+        });
+        out.on("error", (err) => cb(err));
+      }).on("error", (err) => cb(err));
+    };
+    fetchTarball(dist.tarball, 3);
+  }).catch((err) => cb(err));
+}
+
 const UPGRADE_STATUS_LABEL = {
   none: "no update staged",
   pending: "staged, not started",
@@ -3121,6 +3169,40 @@ function renderSettingsPanel({ inst, data, cursor, view, domain, items, listCurs
     emptyBoxLine(innerWidth, margin),
   ];
 
+  if (view === "workflow") {
+    const current = (d.workflow === "simple" || d.workflow === "staged") ? d.workflow : "custom";
+    lines.push(boxLine(`${BOLD}Git workflow${RESET}`, innerWidth, margin));
+    lines.push(emptyBoxLine(innerWidth, margin));
+    const options = [
+      { key: "simple", name: "Simple", detail: "pull requests target main — one branch, no release staging" },
+      { key: "staged", name: "Staged", detail: "pull requests target develop; releases promote to main" },
+    ];
+    options.forEach((option, i) => {
+      const sel = i === listCursor;
+      const marker = sel ? `${CYAN}❯${RESET}` : " ";
+      const active = option.key === current ? ` ${GREEN}● current${RESET}` : "";
+      lines.push(boxLine(`${marker} ${sel ? BOLD : ""}${option.name}${RESET}${active}`, innerWidth, margin));
+      lines.push(boxLine(`   ${DIM}${option.detail}${RESET}`, innerWidth, margin));
+    });
+    if (current === "custom") {
+      lines.push(emptyBoxLine(innerWidth, margin));
+      lines.push(boxLine(`${YELLOW}● current: CUSTOM${RESET} ${DIM}— pull requests target ${d.base_branch || "?"}${RESET}`, innerWidth, margin));
+      lines.push(boxLine(`   ${DIM}selecting an option above replaces this for the whole org${RESET}`, innerWidth, margin));
+    }
+    lines.push(emptyBoxLine(innerWidth, margin));
+    if (mode === "confirm") {
+      const target = listCursor === 0 ? "SIMPLE — pull requests target main" : "STAGED — pull requests target develop";
+      lines.push(boxLine(`${YELLOW}Switch ${BOLD}${title}${RESET}${YELLOW} to ${target}?${RESET}`, innerWidth, margin));
+      lines.push(boxLine(`${DIM}This edits the org's committed egregore.json for everyone.${RESET} ${DIM}y / N${RESET}`, innerWidth, margin));
+    } else {
+      if (notice) lines.push(boxLine(notice, innerWidth, margin));
+      lines.push(boxLine(`${DIM}↑↓ nav · ${RESET}${BOLD}enter${RESET}${DIM} select · ← back · q quit${RESET}`, innerWidth, margin));
+    }
+    lines.push(emptyBoxLine(innerWidth, margin));
+    lines.push(`${margin}${DIM}└${"─".repeat(innerWidth)}┘${RESET}`);
+    return lines;
+  }
+
   if (view === "privacy" || view === "telemetry") {
     lines.push(boxLine(`${BOLD}${view === "privacy" ? "Privacy & access" : "Telemetry"}${RESET}`, innerWidth, margin));
     lines.push(emptyBoxLine(innerWidth, margin));
@@ -3282,7 +3364,7 @@ function renderSettingsPanel({ inst, data, cursor, view, domain, items, listCurs
     });
     lines.push(emptyBoxLine(innerWidth, margin));
     if (notice) lines.push(boxLine(notice, innerWidth, margin));
-    lines.push(boxLine(`${DIM}↑↓ nav · ${RESET}${BOLD}enter${RESET}${DIM} ${cursor === 3 || cursor === 4 ? "toggle" : "open"} · ← back · q quit${RESET}`, innerWidth, margin));
+    lines.push(boxLine(`${DIM}↑↓ nav · ${RESET}${BOLD}enter${RESET}${DIM} ${cursor === 3 ? "toggle" : "open"} · ← back · q quit${RESET}`, innerWidth, margin));
   }
 
   lines.push(emptyBoxLine(innerWidth, margin));
@@ -3784,8 +3866,36 @@ async function browser(args = {}) {
             && !["none", "cancelled", "rolled-back"].includes(status)
             && state.upgradeData.candidate_version;
           if (!staged) {
-            state.upgradeNotice = `${DIM}Stage a candidate package first: egregore settings ${state.upgradeInst.slug} runtime init <version> <candidate.tgz>${RESET}`;
-            render(); return;
+            const candidate = state.upgradeCandidate;
+            if (!candidate) {
+              state.upgradeNotice = `${DIM}No published candidate found. Stage one manually: egregore settings ${state.upgradeInst.slug} runtime init --candidate <version> --tarball <candidate.tgz>${RESET}`;
+              render(); return;
+            }
+            if (state.upgradeFetching) { render(); return; }
+            state.upgradeFetching = true;
+            const inst = state.upgradeInst;
+            state.upgradeNotice = `${DIM}Downloading ${candidate} from npm…${RESET}`;
+            render();
+            fetchCandidateTarball(candidate, (err, tgz) => {
+              state.upgradeFetching = false;
+              if (!state.upgradeInst || state.upgradeInst !== inst) return;
+              if (err) {
+                state.upgradeNotice = `${YELLOW}${err.message}${RESET}`;
+                render(); return;
+              }
+              const r = runUpgrade(inst, ["init", "--candidate", candidate, "--tarball", tgz]);
+              if (r === null || r.status !== 0) {
+                const detail = ((r && (r.stderr || r.stdout)) || "staging failed").trim().split("\n")[0];
+                state.upgradeNotice = `${YELLOW}${detail}${RESET}`;
+                render(); return;
+              }
+              refreshUpgrade();
+              state.upgradeData = upgradeStatus(inst) || state.upgradeData;
+              state.upgradeNotice = "";
+              state.upgradeMode = "confirm-prepare";
+              render();
+            });
+            return;
           }
           state.upgradeMode = "confirm-prepare"; render(); return;
         }
@@ -3800,6 +3910,36 @@ async function browser(args = {}) {
         if (key.ctrl && key.name === "c") { cleanup(); process.exit(130); }
         if (key.name === "q") { cleanup(); resolve(); return; }
 
+        if (S.settingsView === "workflow") {
+          if (S.settingsMode === "confirm") {
+            if (chunk === "y" || chunk === "Y") {
+              settingsRunVerb(["workflow", S.settingsListCursor === 0 ? "simple" : "staged"]);
+              S.settingsMode = "browse";
+              S.settingsView = "menu";
+              render(); return;
+            }
+            if (key.name === "escape" || chunk === "n" || chunk === "N" || key.name === "return") {
+              S.settingsMode = "browse"; render(); return;
+            }
+            return;
+          }
+          if (key.name === "escape" || key.name === "left") {
+            S.settingsView = "menu"; S.settingsNotice = ""; render(); return;
+          }
+          if (key.name === "up" || key.name === "k") { S.settingsListCursor = (S.settingsListCursor + 1) % 2; render(); return; }
+          if (key.name === "down" || key.name === "j") { S.settingsListCursor = (S.settingsListCursor + 1) % 2; render(); return; }
+          if (key.name === "return") {
+            const chosen = S.settingsListCursor === 0 ? "simple" : "staged";
+            const current = (S.settingsData && S.settingsData.workflow) || "custom";
+            if (chosen === current) {
+              S.settingsNotice = `${DIM}already on ${chosen.toUpperCase()}${RESET}`;
+              render(); return;
+            }
+            S.settingsMode = "confirm"; render(); return;
+          }
+          return;
+        }
+
         if (S.settingsView === "privacy" || S.settingsView === "telemetry") {
           const backToMenu = () => {
             S.settingsView = "menu"; S.settingsMode = "browse"; S.settingsInput = ""; S.settingsNotice = ""; render();
@@ -3996,8 +4136,9 @@ async function browser(args = {}) {
             settingsRunVerb(["hosting", on ? "off" : "on"]);
             render();
           } else if (S.settingsCursor === 4) {
-            const simple = (S.settingsData && S.settingsData.workflow) === "simple";
-            settingsRunVerb(["workflow", simple ? "staged" : "simple"]);
+            S.settingsView = "workflow"; S.settingsMode = "browse";
+            S.settingsListCursor = (S.settingsData && S.settingsData.workflow) === "simple" ? 0 : 1;
+            S.settingsNotice = "";
             render();
           } else {
             const domain = S.settingsCursor === 5 ? "repo" : S.settingsCursor === 6 ? "admin" : "people";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.21.0-runtime-mvp.5",
+  "version": "0.21.0-runtime-mvp.7",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {