gitspace 0.2.0-rc.16 → 0.2.0-rc.18

package/.gitspace/{select → scripts/select}/01-status.sh

@@ -3,8 +3,8 @@
 #
 # This runs every time you switch to an existing workspace.
 #
-# Bundle values are available as environment variables using bundle key names.
-# Example: DEVELOPERNAME, EXAMPLEAPITOKEN
+# Bundle values are available using exact keys and uppercase snake-case aliases.
+# Example aliases: DEVELOPER_NAME, EXAMPLE_API_TOKEN
 
 WORKSPACE_NAME=$1
 REPOSITORY=$2
@@ -14,14 +14,14 @@ echo "=== Workspace: $WORKSPACE_NAME ==="
 echo ""
 
 # Show bundle values (proof of concept)
-if [ -n "$DEVELOPERNAME" ]; then
-  echo "Welcome back, $DEVELOPERNAME!"
+if [ -n "$DEVELOPER_NAME" ]; then
+  echo "Welcome back, $DEVELOPER_NAME!"
 fi
 
 # Show that we have access to the secret (masked)
-if [ -n "$EXAMPLEAPITOKEN" ]; then
+if [ -n "$EXAMPLE_API_TOKEN" ]; then
   # Only show first 4 characters to prove we have access
-  TOKEN_PREVIEW="${EXAMPLEAPITOKEN:0:4}..."
+  TOKEN_PREVIEW="${EXAMPLE_API_TOKEN:0:4}..."
   echo "API Token available: $TOKEN_PREVIEW (stored in OS keychain)"
 fi
 

package/README.md

@@ -183,7 +183,7 @@ A bundle is a directory (typically `.gitspace/`) containing:
 Bundle values are passed to scripts as environment variables using the configured bundle keys:
 
 - `<KEY>` - Regular or secret value using the exact `configKey` from `bundle.json`
-- Legacy aliases `SPACE_VALUE_<KEY>` / `SPACE_SECRET_<KEY>` are also provided for compatibility
+- `<NORMALIZED_KEY>` - Uppercase snake-case alias (for example, `teamName` -> `TEAM_NAME`)
 
 **Example script:**
 
@@ -195,12 +195,12 @@ WORKSPACE_NAME=$1
 REPOSITORY=$2
 
 # Access bundle values
-if [ -n "$TEAMNAME" ]; then
-  echo "Welcome, $TEAMNAME team!"
+if [ -n "$TEAM_NAME" ]; then
+  echo "Welcome, $TEAM_NAME team!"
 fi
 
 # Access secrets (stored securely in OS keychain)
-if [ -n "$APIKEY" ]; then
+if [ -n "$API_KEY" ]; then
   echo "API Key configured"
 fi
 ```
@@ -393,9 +393,8 @@ inside each workspace so they can vary by branch:
 export SPACES_CURRENT_PROJECT="my-app"
 
 # Available in scripts (from bundle onboarding):
-# <KEY>                - Value by bundle config key name
-# SPACE_VALUE_<KEY>    - Legacy alias for regular values
-# SPACE_SECRET_<KEY>   - Legacy alias for secret values
+# <KEY>                - Value by exact bundle config key name
+# <NORMALIZED_KEY>     - Uppercase snake-case alias (e.g. teamName -> TEAM_NAME)
 ```
 
 ## Directory Structure

package/bun.lock

@@ -39,10 +39,10 @@
         "typescript": "^5.9.3",
       },
       "optionalDependencies": {
-        "@gitspace/darwin-arm64": "0.2.0-rc.15",
-        "@gitspace/darwin-x64": "0.2.0-rc.15",
-        "@gitspace/linux-arm64": "0.2.0-rc.15",
-        "@gitspace/linux-x64": "0.2.0-rc.15",
+        "@gitspace/darwin-arm64": "0.2.0-rc.17",
+        "@gitspace/darwin-x64": "0.2.0-rc.17",
+        "@gitspace/linux-arm64": "0.2.0-rc.17",
+        "@gitspace/linux-x64": "0.2.0-rc.17",
       },
     },
   },
@@ -63,7 +63,7 @@
 
     "@eslint/js": ["@eslint/js@8.57.1", "", {}, "sha512-d9zaMRSTIKDLhctzH12MtXvJKSSUhaHcjV+2Z+GK+EEY7XKpP5yR4x+N3TAcHTcu963nIr+TMcCb4DBCYX1z6Q=="],
 
-    "@gitspace/darwin-arm64": ["@gitspace/darwin-arm64@0.2.0-rc.15", "", { "os": "darwin", "cpu": "arm64", "bin": { "gssh-darwin-arm64": "bin/gssh" } }, "sha512-gjqsRdz2f7cOOTbj97wmQ4Z0nh7jWUVN4Dxj1N/Ex4fp6dJ8qu2d5izbsCHWVIPX4uN+gK/qqzxuwLwCdaEqlQ=="],
+    "@gitspace/darwin-arm64": ["@gitspace/darwin-arm64@0.2.0-rc.17", "", { "os": "darwin", "cpu": "arm64", "bin": { "gssh-darwin-arm64": "bin/gssh" } }, "sha512-aPei17D31di296UBdqOt59HrdvcIRL2oVGVRWT4etCIESgjTyhZQcCLsIezsWI4E4/9DQAqaLAfTif7TsuCRHQ=="],
 
     "@graphql-typed-document-node/core": ["@graphql-typed-document-node/core@3.2.0", "", { "peerDependencies": { "graphql": "^0.8.0 || ^0.9.0 || ^0.10.0 || ^0.11.0 || ^0.12.0 || ^0.13.0 || ^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, "sha512-mB9oAsNCm9aM3/SOv4YtBMqZbYj10R7dkq8byBqxGY/ncFwhf2oQzMV+LCRlWoDSEBJ3COiR1yeDvMtsoOsuFQ=="],
 

package/docs/SITE_DOCS_FIGMA_MAKE.md

@@ -377,15 +377,14 @@ Using bundle values in scripts:
 ```bash
 #!/bin/bash
 # Values available as environment variables:
-# <KEY>               - Value by bundle config key name
-# SPACE_VALUE_<KEY>   - Legacy alias for regular values
-# SPACE_SECRET_<KEY>  - Legacy alias for secret values
+# <KEY>               - Value by exact bundle config key name
+# <NORMALIZED_KEY>    - Uppercase snake-case alias (e.g. teamName -> TEAM_NAME)
 
-if [ -n "$TEAMNAME" ]; then
-  echo "Welcome, $TEAMNAME team!"
+if [ -n "$TEAM_NAME" ]; then
+  echo "Welcome, $TEAM_NAME team!"
 fi
 
-if [ -n "$APIKEY" ]; then
+if [ -n "$API_KEY" ]; then
   echo "API Key configured"
 fi
 ```
@@ -960,8 +959,8 @@ Bundles allow teams to share onboarding configurations. Place in `.gitspace/`:
 
 **Using values in scripts:**
 ```bash
-echo "Team: $TEAMNAME"
-echo "Has API key: $APIKEY"
+echo "Team: $TEAM_NAME"
+echo "Has API key: $API_KEY"
 ```
 
 ---

package/landing-page/src/components/docs/DocsContent.tsx

@@ -378,8 +378,8 @@ git status`} />
           </div>
 
           <h3 className="text-xl font-semibold text-white mb-4">Using Values in Scripts</h3>
-          <JsonBlock code={`echo "Team: $TEAMNAME"
-echo "Has API key: $APIKEY"`} />
+          <JsonBlock code={`echo "Team: $TEAM_NAME"
+echo "Has API key: $API_KEY"`} />
         </div>
       );
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitspace",
-  "version": "0.2.0-rc.16",
+  "version": "0.2.0-rc.18",
   "description": "CLI for managing GitHub workspaces with git worktrees and secure remote terminal access",
   "bin": {
     "gssh": "./bin/gssh"
@@ -17,10 +17,10 @@
     "relay": "bun src/relay/index.ts"
   },
   "optionalDependencies": {
-    "@gitspace/darwin-arm64": "0.2.0-rc.16",
-    "@gitspace/darwin-x64": "0.2.0-rc.16",
-    "@gitspace/linux-x64": "0.2.0-rc.16",
-    "@gitspace/linux-arm64": "0.2.0-rc.16"
+    "@gitspace/darwin-arm64": "0.2.0-rc.18",
+    "@gitspace/darwin-x64": "0.2.0-rc.18",
+    "@gitspace/linux-x64": "0.2.0-rc.18",
+    "@gitspace/linux-arm64": "0.2.0-rc.18"
   },
   "keywords": [
     "cli",

package/src/app/session/useWorkspaceDeleteFlow.ts

@@ -30,6 +30,7 @@ export interface UseWorkspaceDeleteFlowOptions {
   onDeleteSuccess?: (context: WorkspaceDeleteContext) => void | Promise<void>;
   onDeleteCancelled?: (context: WorkspaceDeleteContext) => void | Promise<void>;
   onDeleteError?: (context: WorkspaceDeleteErrorContext) => void | Promise<void>;
+  showLoadingDuringDelete?: boolean;
 }
 
 export interface UseWorkspaceDeleteFlowResult {
@@ -86,6 +87,7 @@ export function useWorkspaceDeleteFlow(
     onDeleteSuccess,
     onDeleteCancelled,
     onDeleteError,
+    showLoadingDuringDelete = false,
   } = options;
 
   const executeDelete = useCallback(async (
@@ -100,13 +102,17 @@ export function useWorkspaceDeleteFlow(
     };
 
     await onBeforeDelete?.(context);
-    flow.showLoading({
-      title: 'Deleting Workspace',
-      message:
-        params.scriptPolicy === 'skip'
-          ? 'Removing workspace without cleanup scripts...'
-          : `Running cleanup scripts for "${target.workspaceName}"...`,
-    });
+    if (showLoadingDuringDelete) {
+      flow.showLoading({
+        title: 'Deleting Workspace',
+        message:
+          params.scriptPolicy === 'skip'
+            ? 'Removing workspace without cleanup scripts...'
+            : `Running cleanup scripts for "${target.workspaceName}"...`,
+      });
+    } else {
+      flow.close();
+    }
 
     try {
       await deleteWorkspace(target.projectName, target.workspaceId, params);
@@ -144,7 +150,15 @@ export function useWorkspaceDeleteFlow(
 
       return false;
     }
-  }, [deleteWorkspace, flow, onBeforeDelete, onDeleteCancelled, onDeleteError, onDeleteSuccess]);
+  }, [
+    deleteWorkspace,
+    flow,
+    onBeforeDelete,
+    onDeleteCancelled,
+    onDeleteError,
+    onDeleteSuccess,
+    showLoadingDuringDelete,
+  ]);
 
   const deleteWorkspaceWithPrompt = useCallback(async (target: WorkspaceDeleteTarget): Promise<boolean> => {
     return executeDelete(target, { scriptPolicy: 'auto' }, false);

package/src/app.tui.tsx

@@ -87,7 +87,10 @@ import { useUserActivity } from './hooks/index.js';
 import { useBundleRefreshAttachFlow } from './session/index.js';
 import { useAttachController } from './app/session/useAttachController.js';
 import { useWorkspaceDeleteFlow } from './app/session/useWorkspaceDeleteFlow.js';
-import { initializeSecretRuntime } from './core/secret-runtime.js';
+import {
+  consumeLegacyCleanupReminderForTui,
+  initializeSecretRuntime,
+} from './core/secret-runtime.js';
 import {
   resolveInboxCommand,
   resolveMachineListCommand,
@@ -1322,9 +1325,13 @@ function App({ relayConfig, onQuit }: AppProps) {
   // ========== Keyboard Handlers ==========
 
   useKeyboard(async (key) => {
+    const localScriptTerminalRunning =
+      state.view === 'scripts' &&
+      (localScriptState?.isRunning ?? true);
+
     // Handle flow modals FIRST - even in terminal view
     // This ensures y/n work in confirmation modals when terminal is underneath
-    if (flow.isOpen) {
+    if (flow.isOpen && !localScriptTerminalRunning) {
       // Handle confirm modal with y/n shortcuts
       if (flow.flow.type === 'confirm') {
         if (key.raw === 'y' || key.name === 'return') {
@@ -2059,7 +2066,7 @@ function App({ relayConfig, onQuit }: AppProps) {
           error={localScriptState?.error}
           exitCode={localScriptState?.exitCode}
         />
-        <FlowTUI flow={flow} />
+        {!isRunning && <FlowTUI flow={flow} />}
         <StatusBar hint={isRunning ? '[Running scripts...]' : '[Esc/n] Back to workspaces'} />
       </Fragment>
     );
@@ -2590,6 +2597,12 @@ export async function launchTUI(
   // Clean exit handler
   const handleQuit = () => {
     renderer.destroy();
+
+    const legacyReminder = consumeLegacyCleanupReminderForTui();
+    if (legacyReminder) {
+      logger.warning(legacyReminder);
+    }
+
     process.exit(0);
   };
 

package/src/app.web.tsx

@@ -747,18 +747,19 @@ export default function App() {
     terminal.mode === 'browsing' &&
     showScriptTerminal
   ) {
+    const isRunning = terminal.scriptState?.isRunning ?? true;
     return (
       <>
         <ScriptTerminal
           phase={terminal.scriptState?.phase ?? 'pre'}
           workspaceName={scriptWorkspaceName}
-          isRunning={terminal.scriptState?.isRunning ?? true}
+          isRunning={isRunning}
           error={terminal.scriptState?.error}
           exitCode={terminal.scriptState?.exitCode}
           setWriteCallback={terminal.setWriteCallback}
           onBack={() => setShowScriptTerminal(false)}
         />
-        <FlowWeb flow={flow} />
+        {!isRunning && <FlowWeb flow={flow} />}
         <Toaster theme="dark" position="top-right" richColors />
       </>
     );

package/src/commands/migrate.ts

@@ -0,0 +1,52 @@
+import { getSecretMigrationInputs } from '../core/secret-runtime.js';
+import { logger } from '../utils/logger.js';
+import { promptConfirm } from '../utils/prompts.js';
+import { cleanupLegacySecretEntries, preloadAllSecrets } from '../utils/secrets.js';
+
+export interface CleanupLegacyOptions {
+  yes?: boolean;
+}
+
+export async function migrateCleanupLegacy(
+  options: CleanupLegacyOptions = {}
+): Promise<void> {
+  const migrationInputs = getSecretMigrationInputs();
+
+  if (!options.yes) {
+    const confirmed = await promptConfirm(
+      'Delete legacy keychain entries (project:*, global, and old per-key entries)? Unified secrets are kept.',
+      false
+    );
+
+    if (!confirmed) {
+      logger.info('Cancelled');
+      return;
+    }
+  }
+
+  // Ensure legacy entries are copied into unified storage before cleanup.
+  await preloadAllSecrets(migrationInputs.projectNames, {
+    projectLegacyKeys: migrationInputs.projectSecretKeys,
+    globalLegacyKeys: migrationInputs.globalSecretKeys,
+  });
+
+  const result = await cleanupLegacySecretEntries(migrationInputs.projectNames, {
+    projectLegacyKeys: migrationInputs.projectSecretKeys,
+    globalLegacyKeys: migrationInputs.globalSecretKeys,
+  });
+
+  if (result.errors.length > 0) {
+    logger.warning(`Legacy cleanup completed with ${result.errors.length} error(s).`);
+    for (const error of result.errors) {
+      logger.error(`  ${error}`);
+    }
+    logger.info(
+      `Legacy cleanup finished with issues. Deleted ${result.deleted} entries (${result.missing} already absent).`
+    );
+    return;
+  }
+
+  logger.success(
+    `Legacy cleanup complete. Deleted ${result.deleted} entries (${result.missing} already absent).`
+  );
+}

package/src/components/RemoteMachineScreen.tui.tsx

@@ -89,6 +89,32 @@ export function RemoteMachineScreen({ machine, relayUrl, identity, onBack }: Rem
       }
       return remote.selectedProjectName;
     },
+    onBeforeAttach: ({ target, params }) => {
+      if (target === 'workspace' && params.workspaceId) {
+        setShowInbox(false);
+        setScriptWorkspaceName(params.workspaceId.split(':').slice(-1)[0] ?? params.workspaceId);
+        setShowScriptTerminal(true);
+      }
+    },
+    onAttachCancelled: ({ target }) => {
+      if (target === 'workspace') {
+        setShowScriptTerminal(false);
+      }
+    },
+    onAttachError: ({ target, message }) => {
+      const isWorkspaceScriptFailure = message.startsWith('Workspace scripts failed during');
+      const hasScriptRuntimeState = Boolean(remote.scriptState);
+
+      if (target === 'workspace' && (!isWorkspaceScriptFailure || !hasScriptRuntimeState)) {
+        setShowScriptTerminal(false);
+      }
+
+      flow.showMessage({
+        title: isWorkspaceScriptFailure ? 'Workspace Script Failed' : 'Session Failed',
+        message,
+        variant: 'error',
+      });
+    },
   });
 
   const { deleteWorkspaceWithPrompt } = useWorkspaceDeleteFlow({
@@ -221,7 +247,11 @@ export function RemoteMachineScreen({ machine, relayUrl, identity, onBack }: Rem
   }, [flow, renderer]);
 
   useKeyboard(async (key) => {
-    if (flow.isOpen) {
+    const scriptTerminalRunning =
+      showScriptTerminal &&
+      (remote.scriptState?.isRunning ?? true);
+
+    if (flow.isOpen && !scriptTerminalRunning) {
       if (flow.flow.type === 'confirm') {
         if (key.raw === 'y' || key.name === 'return') {
           await flow.handleConfirm();
@@ -429,7 +459,7 @@ export function RemoteMachineScreen({ machine, relayUrl, identity, onBack }: Rem
           error={remote.scriptState?.error}
           exitCode={remote.scriptState?.exitCode}
         />
-        <FlowTUI flow={flow} />
+        {!isRunning && <FlowTUI flow={flow} />}
         <StatusBar hint={isRunning ? '[Running scripts...]' : '[Esc/n] Back to workspaces'} />
       </Fragment>
     );

package/src/core/__tests__/bundle.test.ts

@@ -0,0 +1,209 @@
+import { describe, expect, it } from 'bun:test';
+import { validateBundle } from '../bundle';
+
+describe('validateBundle', () => {
+  it('allows unique config keys with distinct normalized aliases', () => {
+    expect(() =>
+      validateBundle({
+        version: '1.0',
+        name: 'Valid Bundle',
+        onboarding: [
+          {
+            id: 'env-name',
+            type: 'input',
+            title: 'Environment Name',
+            description: 'Name of environment',
+            configKey: 'vercelEnv',
+          },
+          {
+            id: 'api-token',
+            type: 'secret',
+            title: 'API Token',
+            description: 'Service token',
+            configKey: 'apiToken',
+          },
+        ],
+      })
+    ).not.toThrow();
+  });
+
+  it('throws helpful error when configKey is duplicated across steps', () => {
+    expect(() =>
+      validateBundle({
+        version: '1.0',
+        name: 'Duplicate Key Bundle',
+        onboarding: [
+          {
+            id: 'api-token-input',
+            type: 'input',
+            title: 'API token input',
+            description: 'input',
+            configKey: 'apiToken',
+          },
+          {
+            id: 'api-token-secret',
+            type: 'secret',
+            title: 'API token secret',
+            description: 'secret',
+            configKey: 'apiToken',
+          },
+        ],
+      })
+    ).toThrow(/Bundle configKey collision/);
+  });
+
+  it('throws helpful error when normalized aliases collide', () => {
+    expect(() =>
+      validateBundle({
+        version: '1.0',
+        name: 'Alias Collision Bundle',
+        onboarding: [
+          {
+            id: 'api-token-dash',
+            type: 'input',
+            title: 'API token dash',
+            description: 'dash',
+            configKey: 'api-token',
+          },
+          {
+            id: 'api-token-camel',
+            type: 'secret',
+            title: 'API token camel',
+            description: 'camel',
+            configKey: 'apiToken',
+          },
+        ],
+      })
+    ).toThrow(/Bundle configKey alias collision/);
+
+    expect(() =>
+      validateBundle({
+        version: '1.0',
+        name: 'Alias Collision Bundle',
+        onboarding: [
+          {
+            id: 'api-token-dash',
+            type: 'input',
+            title: 'API token dash',
+            description: 'dash',
+            configKey: 'api-token',
+          },
+          {
+            id: 'api-token-camel',
+            type: 'secret',
+            title: 'API token camel',
+            description: 'camel',
+            configKey: 'apiToken',
+          },
+        ],
+      })
+    ).toThrow(/API_TOKEN/);
+  });
+
+  it('treats acronym boundaries as part of normalized alias collisions', () => {
+    expect(() =>
+      validateBundle({
+        version: '1.0',
+        name: 'Acronym Collision Bundle',
+        onboarding: [
+          {
+            id: 'http-client-acronym',
+            type: 'input',
+            title: 'HTTP client acronym',
+            description: 'acronym',
+            configKey: 'myHTTPClient',
+          },
+          {
+            id: 'http-client-camel',
+            type: 'secret',
+            title: 'HTTP client camel',
+            description: 'camel',
+            configKey: 'myHttpClient',
+          },
+        ],
+      })
+    ).toThrow(/Bundle configKey alias collision/);
+
+    expect(() =>
+      validateBundle({
+        version: '1.0',
+        name: 'Acronym Collision Bundle',
+        onboarding: [
+          {
+            id: 'http-client-acronym',
+            type: 'input',
+            title: 'HTTP client acronym',
+            description: 'acronym',
+            configKey: 'myHTTPClient',
+          },
+          {
+            id: 'http-client-camel',
+            type: 'secret',
+            title: 'HTTP client camel',
+            description: 'camel',
+            configKey: 'myHttpClient',
+          },
+        ],
+      })
+    ).toThrow(/MY_HTTP_CLIENT/);
+  });
+
+  it('throws helpful error when normalized alias is not shell-safe', () => {
+    expect(() =>
+      validateBundle({
+        version: '1.0',
+        name: 'Digit Prefix Bundle',
+        onboarding: [
+          {
+            id: 'two-fa-token',
+            type: 'secret',
+            title: '2FA token',
+            description: '2FA token',
+            configKey: '2faToken',
+          },
+        ],
+      })
+    ).toThrow(/non-shell env alias/);
+
+    expect(() =>
+      validateBundle({
+        version: '1.0',
+        name: 'Digit Prefix Bundle',
+        onboarding: [
+          {
+            id: 'two-fa-token',
+            type: 'secret',
+            title: '2FA token',
+            description: '2FA token',
+            configKey: '2faToken',
+          },
+        ],
+      })
+    ).toThrow(/2FA_TOKEN/);
+  });
+
+  it('detects exact key and normalized alias collisions', () => {
+    expect(() =>
+      validateBundle({
+        version: '1.0',
+        name: 'Exact Alias Collision Bundle',
+        onboarding: [
+          {
+            id: 'exact-upper',
+            type: 'input',
+            title: 'Exact upper',
+            description: 'exact',
+            configKey: 'API_TOKEN',
+          },
+          {
+            id: 'camel-key',
+            type: 'secret',
+            title: 'Camel key',
+            description: 'camel',
+            configKey: 'apiToken',
+          },
+        ],
+      })
+    ).toThrow(/Bundle configKey alias collision/);
+  });
+});