heyspex 0.1.0 → 0.2.1

package/scripts/lib/hs-source-log.mjs

@@ -26,41 +26,32 @@
  * {@link formatSettlementResult}.
  */
 import { spawnSync } from 'node:child_process';
-import { readFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
+import { readBearerToken } from '../../vendor/heyspex-mcp/credentials.mjs';
+import { hookVaultHeaders } from './hook-vault-header.mjs';
 import { resolveConsoleUrl } from './console-url-resolver.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 export const REPO_ROOT = path.resolve(__dirname, '..', '..');
 
 // ---- Bearer-header idiom -------------------------------------------------
-// Mirrors `readPairedToken`/`bearerHeaderFor` in
-// `spex-console/src/lib/cli/control-shared.ts` byte-for-byte in behavior:
-// same paired `hsmcp_`/`hscmp_` token read from `~/.heyspex/credentials.yaml`,
-// same loopback-skip rule (a local dev console never needed auth; a genuinely
-// remote/paired console does — [[HS-PH7O-ILNC-DIAG-hs-check-report-cannot-authenticate]]).
-// Duplicated here in plain Node ESM rather than imported from that TS module
-// because `scripts/lib/*.mjs` runs standalone (bare `node`, no Next.js build
-// step) — the same reasoning `console-url-resolver.mjs`'s own module doc
-// gives for staying dependency-free.
+// Same contract as `readPairedToken`/`bearerHeaderFor` in
+// `spex-console/src/lib/cli/control-shared.ts`: the bearer comes from the ONE
+// shared reader (`vendor/heyspex-mcp/credentials.mjs`,
+// [[HS-HL0D-WW9R-TASK-share-one-bearer-reader-and-one-console]] — env
+// `HEYSPEX_MCP_TOKEN`, then `mcp_token:` in `~/.heyspex/credentials.yaml`),
+// and the loopback-skip rule stays (a local dev console never needed auth; a
+// genuinely remote/paired console does —
+// [[HS-PH7O-ILNC-DIAG-hs-check-report-cannot-authenticate]]).
 
 /**
- * Raw paired Bearer token from `~/.heyspex/credentials.yaml`, or `undefined`
- * if absent/unreadable.
+ * Paired Bearer token for this machine, or `undefined` if none resolves.
  * @returns {string | undefined}
  */
 export function readPairedToken() {
-  try {
-    const raw = readFileSync(join(homedir(), '.heyspex', 'credentials.yaml'), 'utf-8');
-    const match = raw.match(/\b(hsmcp_[A-Za-z0-9_-]+|hscmp_[A-Za-z0-9_-]+)\b/);
-    return match?.[1];
-  } catch {
-    return undefined;
-  }
+  return readBearerToken() ?? undefined;
 }
 
 /**
@@ -141,7 +132,7 @@ export async function lookupConsoleSettlement({
 
   let res;
   try {
-    res = await fetchImpl(url, { headers: { ...bearerHeaderFor(resolvedUrl) } });
+    res = await fetchImpl(url, { headers: { ...bearerHeaderFor(resolvedUrl), ...hookVaultHeaders() } });
   } catch (err) {
     return {
       found: false,

package/scripts/lib/hs-source-preflight.mjs

@@ -361,12 +361,26 @@ export function formatPreflightReport(plan) {
 
 /**
  * CLI entry for `hs source status`. Returns a process exit code; always 0
- * (read-only report, never fails the invocation itself).
- * @param {{ cwd?: string }} [opts]
+ * (read-only report, never fails the invocation itself). Appends the "Cloud
+ * spec commits (this session)" section from the console
+ * ([[HS-OAD2-CWPX-TASK-hs-source-status-names-the-spec-commits]]); the
+ * console lookup is lazy-imported and injectable, and an unreachable console
+ * prints "unknown", never "none".
+ * @param {{ cwd?: string, fetchDrainCommitsFn?: () => Promise<any> }} [opts]
+ * @returns {Promise<number>}
  */
-export function runStatusCommand({ cwd = process.cwd() } = {}) {
+export async function runStatusCommand({ cwd = process.cwd(), fetchDrainCommitsFn } = {}) {
   const status = getTreeStatus({ cwd });
   console.log(formatStatusReport(status));
+  try {
+    const mod = await import('./hs-source-branch.mjs');
+    const result = await (fetchDrainCommitsFn ?? mod.fetchDrainCommits)();
+    console.log('');
+    console.log(mod.formatDrainCommits(result).join('\n'));
+  } catch {
+    console.log('');
+    console.log('Cloud spec commits (this session):\n  unknown (console lookup unavailable)');
+  }
   return 0;
 }
 
@@ -398,5 +412,5 @@ function invokedDirectly() {
 if (invokedDirectly()) {
   const verb = process.argv[2];
   if (verb === 'preflight') process.exit(runPreflightCommand());
-  else process.exit(runStatusCommand());
+  else runStatusCommand().then((code) => process.exit(code));
 }