laneyard 0.2.0 → 0.4.0

package/README.md

@@ -25,6 +25,11 @@ the Fastfile you already have and asks *your* fastlane what it can do — plugin
 hard-codes no knowledge of fastlane at all, so upgrading fastlane or adding a plugin needs no
 change here.
 
+The adaptation goes one way. A repository that builds today keeps building unedited: signing
+credentials reach your lanes under the variable names your Fastfile already reads, and where
+Laneyard needs to know something no file can tell it, it asks on a form rather than asking you to
+change the file.
+
 ## Where it fits
 
 |                              | Laneyard    | Hosted CI    | Self-hosted runner |
@@ -58,14 +63,15 @@ Then, from a project you already build with fastlane:
 
 ```bash
 cd ~/code/your-app
-laneyard add     # adopt this project
+laneyard setup   # answer a few questions about this project
 laneyard         # start the server
 ```
 
-`laneyard add` inspects what is there — the `fastlane` directory even when nested in a monorepo, a
-`Gemfile`, an Xcode project or a Gradle build — writes the matching block into
-`~/.laneyard/config.yml`, and prints a generated server password once. Write it down; it is not
-shown again.
+`laneyard setup` inspects what is there — the `fastlane` directory even when nested in a monorepo, a
+`Gemfile`, an Xcode project or a Gradle build — and writes the matching block into
+`~/.laneyard/config.yml`. On a machine that has no account yet, it also creates the first admin:
+it asks what to call it and prints its generated password once. Write it down; it is not shown
+again, and nothing stores it.
 
 <details>
 <summary>Running from source instead</summary>
@@ -95,7 +101,9 @@ Laneyard means copying one file, and restoring it means copying it back.
 server:
   port: 7890
   bind: 0.0.0.0
-  password_hash: "scrypt$…"      # written by `laneyard add`
+  users:                         # written by `laneyard setup`, see Accounts
+    - { name: martin, role: admin, password_hash: "scrypt$…" }
+    - { name: lea, role: builder, password_hash: "scrypt$…" }
   max_concurrent_runs: 1         # only 1 is accepted, see below
   retention: { runs: 50, artifact_days: 30 }
 
@@ -112,9 +120,63 @@ a time across every project — parallel runs would need a working directory per
 not exist yet. A larger number is refused when the file loads rather than silently ignored, so a
 server is never configured for builds that never happen.
 
-### `laneyard.yml` — optional, committed in your repository
+### Accounts
+
+Everyone who signs in has a name, a password and one of two roles. Two, because a third role is
+easy to add and impossible to remove.
+
+| | **admin** | **builder** |
+|---|---|---|
+| start a build, watch it, cancel it | ✓ | ✓ |
+| download artifacts, read logs and the Fastfile | ✓ | ✓ |
+| see the readiness checklist | ✓ | ✓ |
+| read and write secrets | ✓ | |
+| save, commit and push the Fastfile | ✓ | |
+| remove a project | ✓ | |
+| manage accounts | ✓ | |
+
+A builder is what you give someone who ships without being trusted with the signing chain: they
+can press the button and watch what happens, and they never see a credential.
+
+The interface shows a builder only what a builder can use — the secrets, fastfile and settings
+tabs are not drawn, and neither is the accounts screen. That is courtesy, not security: the
+server refuses those routes on its own, whatever the browser was shown, and the test suite
+proves it for every verb and every spelling of the address.
+
+Add and remove accounts from the accounts screen, or from the command line:
+
+```bash
+echo "$PASSWORD" | laneyard user add lea --role builder
+```
 
-Build behaviour belongs next to the code, so it can be versioned with it:
+The password is read from standard input, never taken as an argument — an argument lands in your
+shell history. Without `--role`, the account is a builder.
+
+Two things are refused, in the API and on the command line alike: removing the last admin, and
+demoting the last admin. A server nobody can administer cannot be repaired from the interface.
+
+Anyone changes their own password from **your account**, reached by clicking your name in the
+header — a builder included, since that page is about one person rather than about the server's
+list of people. It asks for the current password even though you are already signed in: a session
+is a cookie in a browser that may have been left open on a desk. Doing it ends every other session
+that account has, and leaves the page you did it on signed in. That is how the random password
+`laneyard setup` printed once stops being a string on a sticky note.
+
+Removing an account ends its sessions immediately — "remove the account" and "revoke access" are
+the same act. So does editing `config.yml` by hand: every request looks the account up again, so
+a demotion takes effect at once rather than at the next restart.
+
+**Upgrading from 0.2.** An existing `server.password_hash` keeps working, unedited. It is read as
+a single admin account called `admin` — sign in with that name and the password you already have.
+The first time you add someone, the file is rewritten into the `users` form above, comments and
+all. Do not write both forms: a file holding a `password_hash` *and* a `users` list is refused at
+load, because there is no obvious winner.
+
+### `laneyard.yml` — in your repository, and committed
+
+Build behaviour belongs next to the code, so it can be versioned with it — `laneyard setup`
+writes this file for you, and you should commit it. A colleague who clones the repository then
+builds it the same way, without configuring anything.
 
 ```yaml
 fastlane_dir: fastlane
@@ -123,8 +185,20 @@ timeout_minutes: 60
 artifact_globs:
   - "build/**/*.ipa"
   - "build/**/*.app.dSYM.zip"
+platforms: [ios]                 # or `[android]`, or both
 ```
 
+`platforms` decides which half of the readiness checklist applies: an Android project is never
+asked for an App Store Connect key. Left out, Laneyard looks at the repository — an Xcode project
+means iOS, a Gradle build means Android — and reports what it found rather than assuming.
+
+It looks **beside the Fastfile**, not at the repository root, because that is where an app keeps
+its platform folders: `ios/` and `fastlane/` are siblings, and both move together when the app is
+one directory of a monorepo. So `app/fastlane/Fastfile` alongside `app/ios/Runner.xcodeproj` is
+found, and a project configured with `ios/fastlane` reports iOS alone rather than being shown the
+Android section on the strength of a sibling folder its lanes never touch. When that guess is
+wrong, `platforms` is read first and settles it.
+
 Field by field, the repository file wins over the server block, which wins over the defaults. Any
 field of `laneyard.yml` may also be written in the server block, so a repository you would rather
 not touch can be configured entirely from `config.yml`.
@@ -134,8 +208,9 @@ reported and the last valid configuration stays live — a typo never takes the
 
 ### Secrets
 
-Credentials do not live in a file. They go into an encrypted vault, from the Secrets tab of a
-project or from the command line:
+The variables your lanes read do not live in a file. They go into an encrypted vault, from the
+Secrets tab of a project or from the command line — the files a project signs with go in the same
+vault, as blocks, and have a section of their own below:
 
 ```bash
 laneyard secret set MATCH_PASSWORD --project cartes-ios   # reads the value from standard input
@@ -146,25 +221,182 @@ The value is never an argument: a command line ends up in `~/.zsh_history` and i
 `ps`. Typing the command alone leaves you at a blank line — type or paste the value, then
 `Ctrl-D`.
 
+**Reading one back.** The vault is write-only for anything you called a secret: the server never
+sends a masked value back, so the interface has nothing to uncover and no browser ever holds one.
+
+Not everything stored here is a secret, though — `APP_VERSION`, `SENTRY_ORG`, an issuer id are
+identifiers, and being unable to check what an import stored makes the import something you take on
+faith. So the line is the one you drew yourself: a value kept out of the logs is never returned; a
+value you stored without that is shown on request, one named key at a time. `mask` and `unmask`
+change which it is without touching the value — otherwise revealing something would mean first
+retyping the value you were trying to read.
+
+**Bring the ones you already have.** A project that builds today has its variables in
+`fastlane/.env` — gitignored, on one laptop, and therefore absent from the clone a build runs
+from. From that working copy:
+
+```bash
+laneyard secret import --project cartes-ios          # shows what it would store
+laneyard secret import --project cartes-ios --yes    # stores it
+```
+
+It runs from the CLI because that is where the `.env` is; the server only ever sees a clone. A
+variable naming a service account JSON has the **file's contents** stored, under `SUPPLY_JSON_KEY_DATA`
+— a name supply reads on its own — because a path does not travel to another machine. A variable
+naming a `.p8` is reported and left alone: no action in fastlane reads a `.p8` out of an environment
+variable, and that credential belongs in a signing block, described below. Everything stored is
+masked, and nothing is printed but names.
+
+Nothing in your lanes has to change afterwards. `key_filepath:` and `json_key:` keep working as
+written — a signing block puts a real file back on disk for the length of a run.
+
 A secret becomes an environment variable for every run of the project it belongs to. Without
 `--project` it applies to every project; a project secret of the same name wins over a global
 one. Secrets are kept out of the logs unless you pass `--no-mask`, and a masked value must be at
 least four characters long — see below.
 
+### Signing credentials
+
+A signing credential is not a string. An Android keystore is bytes that Gradle reads through a path,
+and a `.p8` is useless without the key id and the issuer id that go with it — so these are stored as
+blocks: one file, plus the handful of fields that make it usable, taken whole or refused. A keystore
+stored without its alias is not a partial success; it is a build that fails in a month.
+
+| block | the file | the fields beside it |
+| ------------------------------ | ---------------------- | ------------------------------------------- |
+| *app store connect key*        | `.p8`                  | key id, issuer id                           |
+| *android upload keystore*      | `.jks` or `.keystore`  | key alias, store password, key password     |
+| *play store service account*   | JSON                   | —                                           |
+
+They live in the **signing** part of a project's Secrets tab, beside the variables and the secrets.
+The file is encrypted at rest like everything else in the vault and never comes back out to a
+browser: a stored block shows its file name and nothing more, so replacing one means giving it again
+in full.
+
+A variable a block has made redundant is said to be so, beside the row and in one sentence:
+`SUPPLY_JSON_KEY_DATA` once a Play block applies — it still works, but the same credential is then
+stored twice — and `APP_STORE_CONNECT_API_KEY_P8`, which no action in fastlane has ever read.
+Neither is removed for you: the row is yours, and the button to drop it is on the same line.
+
+**A block becomes real files, for the length of a run.** Gradle's `storeFile` is a path, and
+`app_store_connect_api_key` wants a path, so a credential that exists only as ciphertext in a
+database cannot be used by anything. Each block that applies is written into
+`~/.laneyard/runs/<run id>/secrets/`, mode `600` in a `700` directory, and that directory is removed
+when the run ends — whether it passed, failed, was cancelled or timed out. Every applicable block is
+written, whether or not the lane looks like it needs one: a Fastfile can reach anything through `sh`
+or a plugin, and a guess of "not needed" that is wrong is a debug-signed artifact rather than a
+missing variable.
+
+**It reaches your lanes under the names your project already reads.** Each block's form arrives
+pre-filled with the names fastlane itself declares — `APP_STORE_CONNECT_API_KEY_KEY_FILEPATH`,
+`APP_STORE_CONNECT_API_KEY_KEY_ID`, `APP_STORE_CONNECT_API_KEY_ISSUER_ID` for the key, and
+`SUPPLY_JSON_KEY` for the service account — and every one of them is editable. A Fastfile written
+around `ENV.fetch("ASC_KEY_FILEPATH")` is not a Fastfile doing it wrong: you say so on that form,
+rather than being asked to rename anything in the repository. The name stored with the block is the
+only name exported, and no default is emitted alongside it as a courtesy — that courtesy is what
+would make a typo in the configured name look like it had worked.
+
+Nothing in fastlane reads a keystore by convention, so the keystore's names are Laneyard's own —
+`ANDROID_KEYSTORE_PATH`, `ANDROID_KEYSTORE_PASSWORD`, `ANDROID_KEY_ALIAS`, `ANDROID_KEY_PASSWORD` —
+and the same rule applies to them.
+
+**The keystore block can also supply `key.properties`.** The Flutter documentation's own build
+script signs with the release config when that file exists and with the debug config when it does
+not, and gitignores it — so on a build server it is always absent. Rather than telling you to
+rewrite your build script, Laneyard writes the file the script is already looking for, for the
+length of the run, out of the keystore block. Two things about that file cannot be read out of a
+build script and are asked for on the block instead: where it goes, when the script names it in a
+way that leaves the directory unresolved, and what the keys inside it are called, which start from
+the Flutter documentation's four. Asking at configuration time is allowed; requiring a change to
+your repository is not.
+
+**Only the projects that sign need any of this.** fastlane is not only for shipping to stores —
+lanes take screenshots, run tests, sync certificates — so the three blocks are an offer rather than
+a gate. A project that wants an artifact out of a Gradle build needs the keystore and nothing else,
+and three untouched circles are not three things it is failing.
+
+A block stored on a project belongs to that project. One stored globally applies to every project,
+and a project's own block wins over it. Both are admin-only, like the rest of the vault.
+
 ### Readiness
 
-Every project has a Readiness tab: five checks on what stands between it and a build that runs
-while nobody watches.
+Every project has a Readiness tab: what stands between it and a build that runs while nobody
+watches. Only the checks that apply to the project are shown — an Android project is never asked
+for an App Store Connect key, because one irrelevant warning teaches you to ignore the screen.
+
+**What a tick means.** The checks read your Fastfile, following a lane into the methods that
+Fastfile defines — factoring your lanes into `def deploy_ios` is good practice, not something that
+should make Laneyard blind. Two things stay out of reach and always will: `import`/`import_from_git`
+brings in lanes written elsewhere, and `fastlane/actions/` holds actions whose names mean nothing to
+a reader that has only seen the Fastfile. Where either applies, a check that found nothing says
+*could not tell* rather than ticking. A green tick here means "looked, and it is fine" — never
+"looked, and saw nothing".
+
+Always:
 
 - **the repository** answers `git ls-remote` without asking for credentials — a run that meets a
   password prompt does not fail, it waits;
 - **dependencies** are installable: `bundle check` against your Gemfile, or the `fastlane` a run
   would otherwise find on the PATH;
-- **App Store Connect** has an API key in the vault rather than a `FASTLANE_SESSION`, which
-  expires and takes the next night's build with it;
+- **no lane calls an action known to stop and ask** — `prompt`, `sigh`, `cert`, a writable
+  `match`, an upload waiting for its summary to be confirmed;
+- **the variables the lanes read** are in the vault. Every `ENV.fetch("…")` a lane reaches is
+  collected and looked up. This is the check for the commonest way a project that works on your
+  laptop fails on a build server: the variables live in `fastlane/.env`, that file is gitignored,
+  and it never reaches the clone a build runs from — so the run stops at the first one with
+  nothing on screen to say why.
+
+  Two things a Fastfile cannot tell you, and two places to say them. A variable read by a tool the
+  lane shells out to — `sentry-cli` and its `SENTRY_AUTH_TOKEN` — is named nowhere in the lanes. A
+  committed `fastlane/.env.example` is read for exactly this, since that is what the file is for,
+  and `required_secrets` in `laneyard.yml` covers whatever it does not. A variable found only in
+  the server's own environment is reported rather than ticked over: it works, but it works because
+  of how this server was started.
+
+  A name a signing block exports counts as being in the vault, since that is where the block is:
+  a lane reading `SUPPLY_JSON_KEY` with a Play block stored is not asked for it again, on this
+  checklist or on the Secrets tab. The two read the same answer.
+
+On iOS:
+
+- **App Store Connect** has an API key. The vault is checked first and is the only thing that
+  earns a tick — a signing block, or the variables a project stored before blocks existed, since
+  fastlane reads those exactly as it did. A project that configured fastlane long before it met
+  Laneyard keeps its key elsewhere, so the lanes are read for `app_store_connect_api_key` and for a `key_filepath` or
+  `api_key_path` argument, and the repository for a `.p8`. Any of those is reported as *could not
+  tell*, not as a warning: a path in a Fastfile says a key was arranged, not that the file is on
+  this machine. An Appfile holding only an `apple_id` is a warning — that is the account
+  two-factor authentication will stop the run to ask about. One name is called out rather than
+  accepted: a value stored under `APP_STORE_CONNECT_API_KEY_P8` used to earn a tick here, and no
+  action in fastlane has ever read a variable of that name — the check now says so, because being
+  told to redo the work beats a screen that has quietly gone silent about it;
 - **match** has its `MATCH_PASSWORD` stored and is called `readonly`, so it fetches certificates
-  instead of trying to create them;
-- **no lane calls an action known to stop and ask** — `prompt`, `sigh`, a writable `match`.
+  instead of trying to create them.
+
+On Android:
+
+- **the keystore** is reachable without a prompt: a lane handing `gradle` a `storeFile` needs a
+  passphrase, and one that is neither in the call nor in the vault makes gradle stop and ask. A
+  keystore block settles this before the lanes are read at all — the file and both passphrases
+  reach the run together, so nothing can stop and ask, whichever lane runs;
+- **the release is signed with the release key.** The one check here whose failure is silent:
+  the Flutter documentation's own snippet signs with the release config when `key.properties`
+  exists and with the *debug* config when it does not — and gitignores `key.properties`, so it is
+  absent from every clone. The build then succeeds, produces an artifact signed with the debug key,
+  and the rejection arrives from the store minutes later saying nothing about signing. This reads
+  the Gradle file as text and says so before the build, not after — and then, for a project whose
+  keystore is stored here, writes the `key.properties` that build is already asking for, for the
+  length of the run. Your build script is not asked to change: the file arrives where it looks for
+  it, marked `# written by laneyard, do not commit`, and is removed when fastlane stops. A file of
+  your own without that marker is never written over and never deleted;
+- **the Play Store service account** is there when a lane calls `upload_to_play_store`. The vault
+  first — a block, or a `SUPPLY_JSON_KEY` variable stored before blocks existed — then the
+  `json_key` argument in the call, then the **Appfile**: `json_key_file` and `json_key_data`, which
+  is where a long-standing project almost always keeps it. Only the vault is a tick; the other two
+  are *could not tell*, for the same reason as above.
+
+Like the iOS ones, the Android checks read **literal arguments only**. `gradle(storePassword:
+ENV["PW"])` is reported as undetermined, never guessed at: a checklist that guesses gets believed.
 
 They run when you open the tab or press refresh, never on their own: they shell out to git and to
 bundler. The time of the last run is on screen, because a stale green tick is worse than a red
@@ -179,7 +411,9 @@ growing a second copy of its form.
 green and `match(readonly: false)` is a warning, but `match(readonly: ENV["RO"])` has no value
 until the lane runs, so it is reported as undetermined — `○`, with the reason — rather than
 guessed either way. The same applies to anything a lane computes: a checklist that guesses gets
-believed, and then it is worse than no checklist. Android signing is not covered at all yet.
+believed, and then it is worse than no checklist. Android signing is read out of the Gradle build
+script rather than the Fastfile, since that is where it lives — and read as text, because running
+someone's build script to ask it a question is not something a checklist may do.
 
 ### The Fastfile
 
@@ -204,20 +438,51 @@ Below the editor is what git makes of the workspace: the diff, a message field,
 `push`. A commit stages exactly the files that changed and never `git add -A` — a build leaves
 artifacts and reports scattered around, and none of them belong in your history.
 
+### Removing a project
+
+Every project has a Settings tab, and the one thing on it is removal. It takes the project's block
+out of `config.yml` — through the YAML document, so your comments and your key order survive —
+and stops showing it. It is confirmed by typing the project's name: it is the one destructive
+action in Laneyard, and a dialogue you can click through is not a confirmation.
+
+What it does *not* do is most of the point, because "delete" elsewhere usually means the opposite:
+
+- **the runs stay.** Every build that project ever ran keeps its page, its log and its artifacts,
+  each still at its own address. Removing a project means stop showing it, not destroy its past;
+- **the clone and the artifacts stay on disk.** Their paths are printed when it is done, so you
+  can remove them yourself. Nothing is deleted from a web page on one click;
+- **the secrets stay in the vault**, encrypted and unreachable, and come back if you add the
+  project again under the same name;
+- **the repository is untouched.** Its `laneyard.yml`, its Fastfile and its history are the
+  repository's, not Laneyard's.
+
+Removal is refused while a run of that project is in flight — that run is using the workspace. A
+run still waiting in the queue will not start: it ends as failed, saying its project is gone.
+
 ## Security
 
 Read this before putting Laneyard on a network.
 
 - **It is built for a local network, not the internet.** It listens on `0.0.0.0` so you can reach
-  it from your laptop, behind one password. Do not expose it publicly. If you need remote access,
+  it from your laptop, behind a password. Do not expose it publicly. If you need remote access,
   put it behind a VPN or an SSH tunnel.
-- **The password** is stored as an scrypt hash and repeated failures are throttled. Sessions live
-  in memory and do not survive a restart.
+- **Passwords** are stored as scrypt hashes and repeated failures are throttled, per account, so
+  hammering one name cannot lock out the others. Sessions survive a restart, and what is stored is
+  a SHA-256 of the token rather than the token: a stolen `laneyard.db` is a list of digests, not a
+  ring of working keys.
+- **A role is enforced by the server, not by the interface.** One table names the routes that
+  require an admin, and one hook is the only thing that reads it — there is no permission check
+  hidden inside a handler. What a builder is not shown is also what a builder is refused.
 - **Secrets are encrypted at rest.** Values are stored with AES-256-GCM under a key kept in
   `~/.laneyard/key` — outside the database, mode `600`, and Laneyard refuses to start if anyone
   else can read it. Someone who walks off with `laneyard.db` gets ciphertext. Nothing else in the
   process holds plaintext: the store, the API and the interface deal in names only, and no route
   ever sends a value back — which is why the Secrets tab has no reveal button.
+- **A signing block is on disk only while a run needs it.** A keystore has no string form, so the
+  file is written into `~/.laneyard/runs/<run id>/secrets/`, mode `600` inside a `700` directory,
+  and that directory goes when the run ends. The block's secret fields — the two keystore
+  passphrases — are removed from a run's output the same way a masked secret is, because gradle is
+  perfectly willing to echo one back on failure.
 - **Masked values are removed from output before it is written, not when it is displayed.** The
   substitution happens once, at the point where a run's output fans out, so the log file on disk,
   the live stream to your browser and the stored error summary all contain `••••••` and never the
@@ -237,6 +502,12 @@ What this does *not* cover, stated plainly:
   pretending. Store it unmasked if it genuinely does not matter.
 - **Anything fastlane prints that is not a stored secret is stored in the clear**, under
   `~/.laneyard/logs/`.
+- **`key.properties` is written into the workspace, and it holds passwords.** It is the one
+  credential Laneyard puts in the clone rather than in the run's own directory, because Gradle
+  resolves that path relative to the build. It is mode `600`, carries a marker line as its first
+  line, is removed when the run ends, and is swept for again at the start of the next run in case a
+  server was killed mid-build. A file of yours without that marker is never written over and never
+  removed.
 
 ## Status
 
@@ -249,6 +520,10 @@ What this does *not* cover, stated plainly:
 - `✓` build queue, cancellation, timeouts surfaced in the UI
 - `✓` a checklist that gets a project running unattended
 - `✓` edit the Fastfile in the browser, verified on every save
+- `✓` signing credentials stored whole — the file and the fields beside it — written to disk for
+  the length of a run and exported under the names your project already reads
+- `✓` remove a project from the interface, without touching its history
+- `✓` named accounts, with a builder role that never sees a credential
 - `○` git-triggered and scheduled builds
 
 Two things worth knowing today: listing lanes does not fetch the repository, so a lane you have

package/dist/src/cli/detect.js

@@ -1,8 +1,9 @@
 import { execFile } from "node:child_process";
-import { access } from "node:fs/promises";
+import { access, realpath } from "node:fs/promises";
 import { basename, join, relative, sep } from "node:path";
 import { promisify } from "node:util";
 import { glob } from "tinyglobby";
+import { detectPlatforms, searchDir } from "../heuristics/platforms.js";
 const exec = promisify(execFile);
 const exists = async (p) => {
     try {
@@ -30,14 +31,44 @@ function slugify(name) {
         .replace(/^-+|-+$/g, "");
     return s === "" ? "project" : s;
 }
+/** `git@host:owner/name.git` or `https://host/owner/name.git` → `name`. */
+function repositoryName(url) {
+    if (!url)
+        return null;
+    const last = url.replace(/\/+$/, "").split(/[/:]/).pop();
+    if (!last)
+        return null;
+    const name = last.replace(/\.git$/, "");
+    return name === "" ? null : name;
+}
+/** The globbing `heuristics/platforms.ts` asks for, bound to one directory. */
+const findIn = (dir) => (globs, { onlyDirectories }) => glob(globs, onlyDirectories ? { cwd: dir, onlyDirectories: true } : { cwd: dir, onlyFiles: true });
+/** Turns an absolute path into a repository-relative one, with forward slashes. */
+const toRepoPath = (root, absolute) => relative(root, absolute).split(sep).join("/");
 /**
  * Inspects an existing project and proposes a configuration.
  *
- * Decides nothing irreversible: everything it returns is a proposal the
- * user sees and can correct before it's written.
+ * **Every path it reports is relative to the repository root, not to the
+ * directory the command was run in.** That distinction is the whole difficulty:
+ * Laneyard clones the repository, so a Fastfile at `app/fastlane` is at
+ * `app/fastlane` in the workspace no matter which folder someone happened to
+ * be standing in when they ran `laneyard setup`. Measuring from the current
+ * directory produced a configuration that looked right and pointed nowhere.
+ *
+ * Decides nothing irreversible: everything it returns is a proposal the user
+ * sees and can correct before it's written.
  */
 export async function detectProject(dir) {
-    // The Fastfile can be at the root or under a subfolder, for monorepos.
+    // Without a repository there is nothing to clone; `runSetupCommand` refuses
+    // shortly after, so falling back to `dir` here only keeps this function total.
+    // Both sides are resolved before being compared: on macOS the temporary
+    // directory is a symlink, and git always answers with the real path — so a
+    // raw comparison yields a nonsense `../../private/...` relative path.
+    const here = await realpath(dir).catch(() => dir);
+    const root = await realpath((await gitOr(["rev-parse", "--show-toplevel"], dir, null)) ?? dir).catch(() => dir);
+    const subPath = toRepoPath(root, here);
+    // Look from where the user is standing — that is what they meant by "this
+    // project" — but report what is found relative to the repository root.
     const fastfiles = await glob(["fastlane/Fastfile", "*/fastlane/Fastfile", "*/*/fastlane/Fastfile"], {
         cwd: dir,
         absolute: true,
@@ -45,26 +76,48 @@ export async function detectProject(dir) {
     });
     const fastfile = fastfiles.sort((a, b) => a.length - b.length)[0] ?? null;
     const fastlaneDir = fastfile
-        ? relative(dir, join(fastfile, "..")).split(sep).join("/")
+        ? toRepoPath(root, await realpath(join(fastfile, "..")).catch(() => join(fastfile, "..")))
         : null;
-    const isIos = (await glob(["*.xcodeproj", "*.xcworkspace", "*/*.xcodeproj"], { cwd: dir, onlyDirectories: true }))
-        .length > 0;
-    const isAndroid = (await glob(["build.gradle", "build.gradle.kts", "*/build.gradle", "*/build.gradle.kts"], {
-        cwd: dir,
-        onlyFiles: true,
-    })).length > 0;
+    // From beside the Fastfile rather than from where the user is standing: the
+    // markers are the app's siblings, and `*/*/fastlane/Fastfile` above already
+    // allows the app to be two directories down, out of reach of the two-level
+    // marker globs from here.
+    // `fastlaneDir` is relative to the repository root, while the listing happens
+    // where the user is standing — the same directory only when they are at the
+    // root. The absolute Fastfile path needs no such reconciling, so the app root
+    // is taken from it: the Fastfile's grandparent is the app.
+    const appRoot = fastfile ? toRepoPath(dir, join(fastfile, "..", "..")) : null;
+    const platforms = await detectPlatforms(findIn(searchDir(dir, appRoot)));
+    const isIos = platforms.includes("ios");
+    const isAndroid = platforms.includes("android");
+    // Artifact patterns are anchored to the sub-project too. In a monorepo an
+    // unanchored `**/*.ipa` would collect a sibling app's build as if it were
+    // this one's — and nothing downstream would notice.
+    const prefix = subPath === "" ? "" : `${subPath}/`;
     const artifactGlobs = [];
     if (isIos)
-        artifactGlobs.push("**/*.ipa", "**/*.app.dSYM.zip");
+        artifactGlobs.push(`${prefix}**/*.ipa`, `${prefix}**/*.app.dSYM.zip`);
     if (isAndroid)
-        artifactGlobs.push("**/*.apk", "**/*.aab");
+        artifactGlobs.push(`${prefix}**/*.apk`, `${prefix}**/*.aab`);
+    const gitUrl = await gitOr(["remote", "get-url", "origin"], dir, null);
+    // The slug names the repository, and the sub-project when there is one: two
+    // apps in the same monorepo must not both want to be called `app`.
+    //
+    // The name comes from the remote rather than the local folder, because the
+    // folder is an accident of where someone cloned. `…/popotheque.git` checked
+    // out into `~/work/current` should still be called `popotheque`.
+    const repoName = repositoryName(gitUrl) ?? basename(root);
+    const slug = slugify(subPath === "" ? repoName : `${repoName}-${subPath}`);
     return {
-        slug: slugify(basename(dir)),
-        gitUrl: await gitOr(["remote", "get-url", "origin"], dir, null),
+        slug,
+        gitUrl,
         defaultBranch: (await gitOr(["rev-parse", "--abbrev-ref", "HEAD"], dir, "main")) ?? "main",
         fastlaneDir,
+        // A Gemfile beside the Fastfile is the one fastlane will use, not one at the
+        // repository root — `bundle exec` runs from the sub-project.
         runtime: (await exists(join(dir, "Gemfile"))) ? "bundle" : "system",
         artifactGlobs,
-        platform: isIos ? "ios" : isAndroid ? "android" : "unknown",
+        platforms,
+        subPath,
     };
 }

package/dist/src/cli/prompt.js

@@ -0,0 +1,61 @@
+import { createInterface } from "node:readline/promises";
+/**
+ * Thrown when the user walks away from a question — Ctrl-C or Ctrl-D. Not a
+ * failure: the caller turns it into one sentence and a 130 exit code.
+ */
+export class PromptAborted extends Error {
+    constructor() {
+        super("interrupted");
+        this.name = "PromptAborted";
+    }
+}
+/** Reads from the real terminal. */
+export function terminalAsker() {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    // Left alone, Ctrl-C closes the interface while `rl.question` stays pending
+    // forever, and node reports that as "Detected unsettled top-level await" —
+    // an internal complaint about our code, printed at someone who just pressed
+    // Ctrl-C. Aborting the question makes it a rejection we can answer for.
+    const interrupted = new AbortController();
+    rl.on("SIGINT", () => rl.close());
+    rl.on("close", () => interrupted.abort());
+    async function question(prompt) {
+        try {
+            return await rl.question(prompt, { signal: interrupted.signal });
+        }
+        catch {
+            throw new PromptAborted();
+        }
+    }
+    return {
+        async ask(label, proposed, hint) {
+            if (hint)
+                process.stdout.write(`\n  ${hint}\n`);
+            // The proposal is shown in the prompt rather than typed for the user:
+            // pressing Return accepts it, which is what someone does nine times out
+            // of ten, and correcting it costs one line.
+            const answer = (await question(`  ${label} [${proposed}]: `)).trim();
+            return answer === "" ? proposed : answer;
+        },
+        async confirm(question_, defaultYes) {
+            const suffix = defaultYes ? "[Y/n]" : "[y/N]";
+            const answer = (await question(`${question_} ${suffix} `)).trim().toLowerCase();
+            if (answer === "")
+                return defaultYes;
+            return answer.startsWith("y");
+        },
+        close() {
+            rl.close();
+        },
+    };
+}
+/** Accepts every proposal without asking. Used by `--yes` and by the tests. */
+export const acceptingAsker = {
+    async ask(_label, proposed) {
+        return proposed;
+    },
+    async confirm(_question, defaultYes) {
+        return defaultYes;
+    },
+    close() { },
+};