laneyard 0.4.0 → 0.5.0

package/dist/src/cli/setup.js

@@ -1,5 +1,7 @@
+import { execFile } from "node:child_process";
 import { readFile, writeFile } from "node:fs/promises";
 import { join } from "node:path";
+import { promisify } from "node:util";
 import { Document, parseDocument, YAMLSeq } from "yaml";
 import { VALID_NAME, ensureFirstAdmin, hasAccount } from "../config/accounts.js";
 import { loadServerConfig } from "../config/load.js";
@@ -7,6 +9,8 @@ import { serializeYaml as serialize } from "../config/yaml.js";
 import { bad, bold, dim, field, heading, ok, warn } from "./style.js";
 import { acceptingAsker, terminalAsker } from "./prompt.js";
 import { detectProject } from "./detect.js";
+import { appRootOf } from "../heuristics/platforms.js";
+const exec = promisify(execFile);
 /**
  * Adds a project block to config.yml while preserving the rest of the file.
  *
@@ -76,6 +80,28 @@ export async function removeProjectFromConfig(path, slug) {
     await writeFile(path, serialize(doc), "utf8");
     return true;
 }
+/**
+ * Empties the project list, leaving the `server:` block and the file's shape.
+ *
+ * What `laneyard reset` does to config.yml: every project goes, the accounts and
+ * the port stay. The same YAML-document edit as removing one project, and for
+ * the same reason — the file is hand-written, so its comments and its key order
+ * must survive being touched. The items are spliced out of the existing sequence
+ * rather than the key replaced, so `projects:` keeps its place and any comment
+ * sitting on it.
+ *
+ * Returns how many blocks were removed, so the caller can report the count.
+ */
+export async function clearProjectsInConfig(path) {
+    const doc = parseDocument(await readFile(path, "utf8"));
+    const projects = doc.getIn(["projects"]);
+    if (!(projects instanceof YAMLSeq) || projects.items.length === 0)
+        return 0;
+    const removed = projects.items.length;
+    projects.items.splice(0, removed);
+    await writeFile(path, serialize(doc), "utf8");
+    return removed;
+}
 /**
  * Entry point for `laneyard setup`.
  *
@@ -120,7 +146,12 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
                 dim("  Continuing updates its entry, keeping anything you added by hand.\n") +
                 dim("  Give it another name to keep both.\n"));
         }
-        const repoConfigPath = join(repoRoot(cwd, d.subPath), LANEYARD_YML);
+        // The repository file lives in the app's own directory, so a monorepo of N
+        // apps carries N of them — one beside each app's fastlane folder. `appRoot`
+        // is the fastlane dir's parent; for a plain app whose fastlane sits at the
+        // root it is `.`, and the file lands at the repository root as it always did.
+        const appRoot = appRootOf(d.fastlaneDir);
+        const repoConfigPath = join(repoRoot(cwd, d.subPath), appRoot, LANEYARD_YML);
         if (await fileExists(repoConfigPath)) {
             process.stdout.write("\n" + warn(`${LANEYARD_YML} already exists in the repository.\n`) +
                 dim("  Its values win over anything written here; it will be left alone.\n"));
@@ -152,6 +183,18 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
         const gitUrl = await asker.ask("repository", d.gitUrl);
         const branch = await asker.ask("default branch", d.defaultBranch, dim("A run uses this branch unless you pick another one when you start it."));
         const fastlaneDir = await asker.ask("fastlane directory", d.fastlaneDir, dim("Relative to the repository root, because that is what Laneyard clones."));
+        // A fastlane folder that is on disk but not in git will not survive the
+        // clone Laneyard builds from — the case that started this: a stray
+        // `app copie/` macOS made, detected here and absent from the remote.
+        // Warned, not refused: setup proposes and the user decides, exactly as with
+        // every value above. Silent when git cannot answer — a courtesy, not a gate.
+        if (!(await fastlaneDirIsTracked(repoRoot(cwd, d.subPath), fastlaneDir))) {
+            process.stdout.write("\n" +
+                warn(`${bold(fastlaneDir)} exists here but is not tracked by git.\n`) +
+                dim("  Laneyard builds from a clone of the remote, so a path that is not in\n") +
+                dim("  git will not be in the clone — the build will fail looking for it.\n") +
+                dim("  Commit and push it, or give a path that is in git.\n"));
+        }
         const useBundler = await asker.confirm("\n" +
             dim("  With bundler, runs use the fastlane version pinned in the Gemfile.\n") +
             dim("  Without it, whichever fastlane is installed on the build machine.\n") +
@@ -204,10 +247,18 @@ export async function runSetupCommand(cwd, configPath, options = {}) {
         // The repository half: how it builds. This is the part that was going into
         // the machine's file and therefore never being committed — which is exactly
         // backwards, since it is the part a colleague needs.
+        //
+        // Its paths are written relative to the app's own directory, because the file
+        // lives there: `fastlane_dir` is omitted when it is the plain `fastlane` the
+        // default already assumes, and each glob is stripped of the app prefix. An
+        // app moved or duplicated keeps this file unchanged; `store.ts` puts the
+        // prefix back when it reads it.
         const wroteRepoConfig = await writeRepoConfigIfAbsent(repoConfigPath, {
-            fastlane_dir: fastlaneDir,
+            ...(appRelative(appRoot, fastlaneDir) === "fastlane"
+                ? {}
+                : { fastlane_dir: appRelative(appRoot, fastlaneDir) }),
             runtime,
-            artifact_globs: globs,
+            artifact_globs: globs.map((g) => appRelative(appRoot, g)),
             // Written down rather than re-inferred on every readiness check: a value
             // in a file can be corrected when the guess was wrong, and setup and the
             // checklist cannot end up disagreeing about the same repository.
@@ -264,22 +315,38 @@ async function configuredPort(configPath) {
 }
 /** The repository file, named once so the message and the write cannot disagree. */
 const LANEYARD_YML = "laneyard.yml";
-/**
- * What the first account is called when nobody says otherwise.
- *
- * The same name a lone `password_hash` is read under, so a machine set up today
- * and a machine upgraded from 0.2 sign in the same way.
- */
+/** What the first account is called when nobody says otherwise. */
 const DEFAULT_ADMIN_NAME = "admin";
 /**
  * The repository root, from where the command ran and how deep it sits.
  *
- * `laneyard.yml` belongs at the root because that is where the server reads it:
- * the clone is the repository, not the sub-directory someone was standing in.
+ * The anchor everything else is measured against: the clone is the whole
+ * repository, not the sub-directory someone was standing in, so `config.yml`'s
+ * `fastlane_dir` and the app directory `laneyard.yml` lands in are both relative
+ * to here, whichever folder setup was run from.
  */
 function repoRoot(cwd, subPath) {
     return subPath === "" ? cwd : join(cwd, ...subPath.split("/").map(() => ".."));
 }
+/**
+ * Whether git tracks anything under a path in the working copy setup ran in.
+ *
+ * A folder can be on disk and absent from git — untracked, gitignored, or a
+ * stray local copy — and such a folder does not survive the clone Laneyard
+ * builds from. `git ls-files` lists nothing under an untracked path, so an
+ * empty listing is the signal. Returns true — warning nothing — when git
+ * cannot answer at all (not a repository, git missing): the check is a
+ * courtesy, and setup must not crash on its account.
+ */
+export async function fastlaneDirIsTracked(root, dir) {
+    try {
+        const { stdout } = await exec("git", ["ls-files", "--", dir], { cwd: root });
+        return stdout.trim() !== "";
+    }
+    catch {
+        return true;
+    }
+}
 const fileExists = async (path) => {
     try {
         await readFile(path);
@@ -313,6 +380,21 @@ async function writeRepoConfigIfAbsent(path, settings) {
     await writeFile(path, doc.toString(), "utf8");
     return true;
 }
+/**
+ * A repo-root-relative path read as relative to the app directory.
+ *
+ * The inverse of what `store.ts` does when it reads an app-level file: the file
+ * lives in `<appRoot>/`, so its paths drop that prefix. `.` is the repository
+ * root — a path there is already app-relative and unchanged. A path that does
+ * not sit under the app (an unanchored glob like `**​/*.ipa`) is left as it is;
+ * it still means the same thing once the read-time prefix is applied.
+ */
+function appRelative(appRoot, p) {
+    if (appRoot === "" || appRoot === ".")
+        return p;
+    const prefix = `${appRoot}/`;
+    return p.startsWith(prefix) ? p.slice(prefix.length) : p;
+}
 /** `git@github.com:you/thing.git` reads better as `you/thing` in a sentence. */
 function repositoryLabel(url) {
     return url.replace(/^.*[:/]([^/:]+\/[^/]+?)(\.git)?$/, "$1");

package/dist/src/cli/uninstall.js

@@ -0,0 +1,368 @@
+import Database from "better-sqlite3";
+import { readdir, readFile, rm, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { parse } from "yaml";
+import { OWN_FILES, OWN_FOLDERS, readLine, removePaths } from "./home.js";
+import { bad, bold, dim, field, heading, ok, warn } from "./style.js";
+export const UNINSTALL_USAGE = `laneyard uninstall [--dry-run]
+
+Removes Laneyard's data folder: the configuration, the vault key, the database,
+the workspaces, the artifacts and the logs. It does not remove the npm package —
+a command cannot sensibly delete the binary it is running from — and it prints
+the command that does.
+
+  laneyard uninstall --dry-run   list what is there and stop
+
+There is no npm lifecycle hook doing any of this on \`npm uninstall\`, on
+purpose: a package manager must not delete someone's signing keys on its own,
+and a lifecycle script cannot ask.
+`;
+export async function readInventory(home) {
+    const empty = {
+        home,
+        exists: false,
+        config: null,
+        key: null,
+        db: null,
+        folders: [],
+        strangers: [],
+        bytes: 0,
+    };
+    const here = await stat(home).catch(() => null);
+    if (here === null || !here.isDirectory())
+        return empty;
+    const present = new Set((await readdir(home).catch(() => [])));
+    const configPath = join(home, "config.yml");
+    const configBytes = await sizeOf(configPath);
+    const config = configBytes === null
+        ? null
+        : { path: configPath, bytes: configBytes, projects: await projectsIn(configPath) };
+    const keyPath = join(home, "key");
+    const keyBytes = await sizeOf(keyPath);
+    const key = keyBytes === null ? null : { path: keyPath, bytes: keyBytes };
+    const dbPath = join(home, "laneyard.db");
+    const dbBytes = await sizeOf(dbPath);
+    const db = dbBytes === null
+        ? null
+        : {
+            path: dbPath,
+            // The write-ahead log is part of the database, not a stray file: a row
+            // written a second ago may live only there. Counted with it so the
+            // size on screen is the size on disk.
+            bytes: dbBytes + ((await sizeOf(`${dbPath}-wal`)) ?? 0) + ((await sizeOf(`${dbPath}-shm`)) ?? 0),
+            ...(await readVault(dbPath)),
+        };
+    const folders = [];
+    for (const name of OWN_FOLDERS) {
+        const path = join(home, name);
+        const tally = await tallyFolder(path);
+        if (tally !== null)
+            folders.push({ name, path, ...tally });
+    }
+    const strangers = [...present]
+        .filter((name) => !OWN_FILES.includes(name) && !OWN_FOLDERS.includes(name))
+        .sort();
+    return {
+        home,
+        exists: true,
+        config,
+        key,
+        db,
+        folders,
+        strangers,
+        bytes: (config?.bytes ?? 0) +
+            (key?.bytes ?? 0) +
+            (db?.bytes ?? 0) +
+            folders.reduce((sum, f) => sum + f.bytes, 0),
+    };
+}
+/**
+ * Counts what the vault holds, without writing a byte.
+ *
+ * Opened read-only rather than through `openDatabase`: that one applies the
+ * schema and switches on the write-ahead log, both of which are writes, and
+ * `--dry-run` promises not to make one.
+ *
+ * Read-only is not quite enough on its own. SQLite needs a `-shm` beside a WAL
+ * database, and it creates one to open it even for reading — so the two are
+ * noted before and removed again after if they were not there. They are scratch
+ * files with nothing of anyone's in them, and removing what we made is what
+ * lets the promise be a real one. A server that is running has them open
+ * already, so they exist beforehand and are never touched.
+ *
+ * The counts are read rather than skipped over: the number of stored
+ * credentials is exactly the wrong thing to guess at. When the database cannot
+ * be opened at all, that is reported instead, in its own words.
+ */
+async function readVault(dbPath) {
+    const sidecars = [`${dbPath}-wal`, `${dbPath}-shm`];
+    const ours = await Promise.all(sidecars.map(async (path) => ((await stat(path).catch(() => null)) === null ? path : null)));
+    let db = null;
+    try {
+        db = new Database(dbPath, { readonly: true, fileMustExist: true });
+        const count = (sql) => db.prepare(sql).get().n;
+        return {
+            vault: {
+                // The empty slug is how a global row is stored — the same convention
+                // `SecretStore` and `CredentialStore` use, and the reason the two are
+                // counted apart: a global secret belongs to every project.
+                projectSecrets: count("SELECT COUNT(*) AS n FROM secret WHERE project_slug != ''"),
+                globalSecrets: count("SELECT COUNT(*) AS n FROM secret WHERE project_slug = ''"),
+                projectBlocks: count("SELECT COUNT(*) AS n FROM credential WHERE project_slug != ''"),
+                globalBlocks: count("SELECT COUNT(*) AS n FROM credential WHERE project_slug = ''"),
+                runs: count("SELECT COUNT(*) AS n FROM run"),
+            },
+            unreadable: null,
+        };
+    }
+    catch (cause) {
+        return { vault: null, unreadable: cause.message };
+    }
+    finally {
+        db?.close();
+        for (const path of ours) {
+            if (path !== null)
+                await rm(path, { force: true }).catch(() => undefined);
+        }
+    }
+}
+/** The slugs config.yml declares, or none if it cannot be read. */
+async function projectsIn(path) {
+    try {
+        const doc = parse(await readFile(path, "utf8"));
+        return (doc?.projects ?? []).map((p) => p?.slug ?? "?").filter((s) => s !== "");
+    }
+    catch {
+        return [];
+    }
+}
+async function sizeOf(path) {
+    const info = await stat(path).catch(() => null);
+    return info === null || !info.isFile() ? null : info.size;
+}
+/**
+ * A folder's direct children, and the total size of everything under it.
+ *
+ * Only regular files count. A symlink is followed by nothing here — a clone is
+ * perfectly capable of holding a link to somewhere enormous that this command
+ * is not going to remove, and counting the target would report a size that is
+ * not the size of what goes.
+ */
+async function tallyFolder(path) {
+    const info = await stat(path).catch(() => null);
+    if (info === null || !info.isDirectory())
+        return null;
+    const children = await readdir(path).catch(() => []);
+    return { entries: children.length, bytes: await sizeUnder(path) };
+}
+/**
+ * Every regular file under a folder, added up.
+ *
+ * `readdir` with file types answers from the directory entry itself, so a
+ * symlink is neither a file nor a directory here and is skipped — which is the
+ * behaviour wanted: `rm` will remove the link, not what it points at, and the
+ * size on screen has to be the size of what actually goes.
+ */
+async function sizeUnder(path) {
+    const entries = await readdir(path, { withFileTypes: true }).catch(() => []);
+    let bytes = 0;
+    for (const entry of entries) {
+        if (entry.isDirectory())
+            bytes += await sizeUnder(join(path, entry.name));
+        else if (entry.isFile()) {
+            const info = await stat(join(path, entry.name)).catch(() => null);
+            bytes += info?.size ?? 0;
+        }
+    }
+    return bytes;
+}
+/** Sizes in the units a person reads, not in bytes. */
+export function humanSize(bytes) {
+    if (bytes < 1024)
+        return `${bytes} B`;
+    const units = ["KB", "MB", "GB", "TB"];
+    let value = bytes / 1024;
+    let unit = 0;
+    while (value >= 1024 && unit < units.length - 1) {
+        value /= 1024;
+        unit += 1;
+    }
+    return `${value < 10 ? value.toFixed(1) : Math.round(value)} ${units[unit]}`;
+}
+const plural = (n, noun) => `${n} ${n === 1 ? noun : `${noun}s`}`;
+/** English, not a rule: "entry" does not take an `s`. */
+const entries = (n) => `${n} ${n === 1 ? "entry" : "entries"}`;
+/** The inventory, as it appears on screen. Shared by the dry run and the real one. */
+export function renderInventory(inv) {
+    let out = heading("laneyard uninstall");
+    out += field("home", inv.home) + "\n";
+    out += field("total", humanSize(inv.bytes)) + "\n";
+    out += heading("configuration");
+    if (inv.config === null) {
+        out += field("config.yml", dim("not there")) + "\n";
+    }
+    else {
+        out += field("config.yml", `${inv.config.path}  ${dim(humanSize(inv.config.bytes))}`) + "\n";
+        out +=
+            field("projects", inv.config.projects.length === 0 ? dim("none declared") : inv.config.projects.join(", ")) + "\n";
+    }
+    out += heading("the vault");
+    out += field("key", inv.key === null ? dim("not there") : inv.key.path) + "\n";
+    if (inv.db === null) {
+        out += field("database", dim("not there")) + "\n";
+    }
+    else {
+        out += field("database", `${inv.db.path}  ${dim(humanSize(inv.db.bytes))}`) + "\n";
+        if (inv.db.vault === null) {
+            out +=
+                field("contents", dim("could not be read")) + "\n" +
+                    dim(`               ${inv.db.unreadable ?? "unknown reason"}\n`) +
+                    dim("               Stop the server and run this again to see what is in it.\n");
+        }
+        else {
+            const v = inv.db.vault;
+            out += field("secrets", `${plural(v.projectSecrets, "project secret")}`) + "\n";
+            // Said on its own line and in words rather than folded into the number
+            // above: a global secret is read by every project on this machine, and
+            // "in scope" is the fact someone needs before they answer the question.
+            out +=
+                field("", v.globalSecrets === 0
+                    ? dim("no global secret")
+                    : `${plural(v.globalSecrets, "global secret")} — shared by every project, ${bold("removed too")}`) + "\n";
+            out += field("signing", `${plural(v.projectBlocks, "project signing block")}`) + "\n";
+            out +=
+                field("", v.globalBlocks === 0
+                    ? dim("no global signing block")
+                    : `${plural(v.globalBlocks, "global signing block")} — shared by every project, ${bold("removed too")}`) + "\n";
+            out += field("history", plural(v.runs, "run")) + "\n";
+        }
+    }
+    out += heading("on disk");
+    if (inv.folders.length === 0) {
+        out += dim("  nothing: no workspace was ever cloned and no run ever produced anything.\n");
+    }
+    for (const folder of inv.folders) {
+        out +=
+            field(folder.name, folder.entries === 0
+                ? dim("empty")
+                : `${entries(folder.entries)}  ${dim(humanSize(folder.bytes))}`) + "\n";
+        out += dim(`               ${folder.path}\n`);
+    }
+    if (inv.strangers.length > 0) {
+        out += heading("not Laneyard's");
+        out += dim("  These are in the folder and were not put there by Laneyard. They are left\n");
+        out += dim("  where they are, and the folder is left with them.\n\n");
+        for (const name of inv.strangers)
+            out += `  ${join(inv.home, name)}\n`;
+    }
+    return out;
+}
+/**
+ * The one paragraph this command exists to make sure someone reads.
+ *
+ * Everything else here is recoverable: a config.yml can be written again by
+ * `laneyard setup`, a workspace re-cloned, an artifact rebuilt. The key cannot.
+ * It is a random 32 bytes that exists in one place, and every stored value is
+ * ciphertext without it — so a backup of `laneyard.db` alone restores nothing.
+ */
+export function renderIrreversible(inv) {
+    const v = inv.db?.vault;
+    const stored = v === undefined || v === null ? null : v.projectSecrets + v.globalSecrets + v.projectBlocks + v.globalBlocks;
+    return (heading("what cannot be undone") +
+        warn(`The vault key is the one thing here that has no other copy.\n`) +
+        dim("  Every secret and every signing block is encrypted under " + (inv.key?.path ?? join(inv.home, "key")) + ".\n") +
+        dim("  Once it is gone, laneyard.db is ciphertext nobody can read — restoring a backup\n") +
+        dim("  of the database alone will not bring anything back.\n") +
+        (stored === null || stored === 0
+            ? ""
+            : dim(`  ${plural(stored, "stored value")} ${stored === 1 ? "goes" : "go"} with it.\n`)) +
+        "\n" +
+        dim("  The originals are yours and are untouched: the .p8 in your downloads, the\n") +
+        dim("  keystore in your safe, the passwords in your password manager. It is Laneyard's\n") +
+        dim("  copy that is unrecoverable — you will upload them again from wherever you keep\n") +
+        dim("  them. If you do not know where that is, stop here and go and find out.\n") +
+        "\n" +
+        dim("  Your repositories are untouched. Nothing outside " + inv.home + " is read or written.\n"));
+}
+/**
+ * Entry point for `laneyard uninstall`.
+ *
+ * Inventory, then the one irreversible thing, then a typed confirmation, then
+ * the removal. In that order and never any other: a question asked before the
+ * numbers are on screen is a question nobody can answer.
+ */
+export async function runUninstallCommand(home, args, io) {
+    let dryRun = false;
+    for (const arg of args) {
+        if (arg === "--dry-run" || arg === "-n")
+            dryRun = true;
+        else {
+            // Deliberately no `--keep-runs`, no `--yes`, no `--force`. Every one of
+            // them is a way to run this without reading it, which is the only thing
+            // standing between someone and an unrecoverable signing key. Keeping the
+            // run history without its database is not a thing that exists anyway.
+            io.err(`Unknown option: ${arg}\n\n${UNINSTALL_USAGE}`);
+            return 1;
+        }
+    }
+    const inv = await readInventory(home);
+    if (!inv.exists) {
+        io.out(`${dim(`No data folder at ${home}. There is nothing for Laneyard to remove.`)}\n\n` +
+            removalHint());
+        return 0;
+    }
+    io.out(renderInventory(inv));
+    io.out(renderIrreversible(inv));
+    if (dryRun) {
+        io.out("\n" +
+            dim("Nothing was removed. Run `laneyard uninstall` without --dry-run to remove it.") +
+            "\n\n" +
+            removalHint());
+        return 0;
+    }
+    // Typed in full, not `y`. A `y/n` is answered by a reflex; this is the one
+    // command in the product that destroys credentials, and the path is what
+    // proves the person read which folder is about to go — it is not always
+    // ~/.laneyard, and $LANEYARD_HOME is exactly the case where a reflex is wrong.
+    io.out("\n" +
+        bold("Type the path of the folder to remove, exactly, to confirm:") + "\n" +
+        `  ${inv.home}\n` +
+        "\n> ");
+    const answer = await readLine(io.stdin);
+    if (answer !== inv.home) {
+        io.err("\n" +
+            bad(answer === ""
+                ? "Nothing was typed, so nothing was removed."
+                : "That is not the path, so nothing was removed.") +
+            "\n");
+        return 1;
+    }
+    const removed = await removePaths(home, [...OWN_FILES, ...OWN_FOLDERS]);
+    // The folder itself only when there is nothing left in it. Anything Laneyard
+    // did not write is somebody's, and this command has no business deciding
+    // otherwise — `$LANEYARD_HOME` can point anywhere.
+    const left = (await readdir(home).catch(() => []));
+    if (left.length === 0)
+        await rm(home, { recursive: true, force: true }).catch(() => undefined);
+    io.out(heading("removed") +
+        ok(`${entries(removed.length)}, ${humanSize(inv.bytes)} freed.\n`) +
+        (left.length === 0
+            ? dim(`  ${home} is gone.\n`)
+            : dim(`  ${home} is kept: ${plural(left.length, "file")} in it ${left.length === 1 ? "is" : "are"} not Laneyard's.\n`)) +
+        "\n" +
+        removalHint());
+    return 0;
+}
+/**
+ * The package is still installed, and this cannot be the thing that removes it.
+ *
+ * A process cannot sensibly delete the binary it is running from, and a command
+ * that tried would leave someone with a half-removed install and no way to ask
+ * about it. So it says what to type instead — the whole command, so it can be
+ * copied rather than remembered.
+ */
+function removalHint() {
+    return (dim("The npm package is still installed. Laneyard does not remove its own binary:\n") +
+        `  ${bold("npm uninstall -g laneyard")}\n` +
+        dim("(installed from source with `npm link`? `npm unlink -g laneyard`.)\n"));
+}