naro-cli 0.3.0 → 0.4.1

package/README.md

@@ -13,11 +13,19 @@ naro deploy --prod  # production deployment
 ```
 
 The first `naro deploy` creates the project (named after `package.json`),
-seeds it with your local `.env` values, links the directory via
-`.naro/project.json` (gitignored automatically) and prints the live URL.
-From then on the platform owns env vars (`naro env add/remove/pull`) —
-later deploys do not re-upload local dotenv files. No Cloudflare
-credentials are ever needed.
+links the directory via `.naro/project.json` (gitignored automatically) and
+prints the live URL. No Cloudflare credentials are ever needed.
+
+Local `.env` files are never uploaded on their own. Every deploy scans your
+source for the env vars it references (`process.env.X`, `import.meta.env.X`,
+plus anything listed in `.env.example`), compares that with the project, and
+asks before opening a dotenv file to fill what is missing. Decline and it
+prints the `naro env add` commands instead. With `--yes`, `--json` or outside
+a TTY it never asks — it just lists what is missing and deploys.
+
+Values you register are encrypted at rest, and `naro env pull` /
+`naro env list --reveal` can read them back — your account credentials are
+effectively your env credentials.
 
 ## Commands
 

package/dist/{chunk-B6F7QIW7.js → chunk-YLFLDW2H.js}

@@ -6,10 +6,10 @@ var __export = (target, all) => {
 };
 
 // src/deploy.ts
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync6 } from "fs";
 import { cp, mkdtemp as mkdtemp2, readFile as readFile7, rm as rm2 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { basename, dirname, join as join13 } from "path";
+import { basename, dirname, join as join15 } from "path";
 import { fileURLToPath } from "url";
 
 // ../../packages/build/src/artifact-upload.ts
@@ -186,6 +186,27 @@ var DeploymentError = class extends Error {
   }
 };
 
+// ../../packages/core/src/git-remote.ts
+var SCP_LIKE = /^[^@\s/]+@([^:\s/]+):(.+)$/;
+function parseGitHubRemote(url2) {
+  const trimmed = url2.trim();
+  if (trimmed === "") return null;
+  const scp = SCP_LIKE.exec(trimmed);
+  const path = scp ? scp[2] ?? null : pathnameOf(trimmed);
+  if (path === null) return null;
+  const segments = path.replace(/\.git$/, "").split("/").filter((segment) => segment !== "");
+  if (segments.length !== 2) return null;
+  const [owner, repo] = segments;
+  return { owner, repo, fullName: `${owner}/${repo}` };
+}
+function pathnameOf(url2) {
+  try {
+    return new URL(url2).pathname;
+  } catch {
+    return null;
+  }
+}
+
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -14950,7 +14971,10 @@ export default defineCloudflareConfig({});
     )}
 `
   );
-  const packageManagerConfigPath = await createPackageManagerConfig(appRoot, writer);
+  const packageManagerConfigPath = await createPackageManagerConfig(
+    appRoot,
+    writer
+  );
   return {
     openNextConfigPath,
     wranglerConfigPath,
@@ -15735,7 +15759,7 @@ var LocalBuildExecutor = class {
             args: ["run", resolved.buildScript],
             cwd: appRoot,
             env: {
-              ...input.env ?? {},
+              ...input.env,
               ...isNext ? { NEXT_PRIVATE_STANDALONE: "true" } : {},
               NPM_CONFIG_USERCONFIG: packageManagerConfigPath
             },
@@ -15865,6 +15889,8 @@ async function errorFromResponse(response, context) {
   const code = serverCode ?? (response.status === 401 ? "UNAUTHORIZED" : response.status === 404 ? "NOT_FOUND" : response.status === 429 ? "RATE_LIMITED" : "INTERNAL_ERROR");
   const details = {};
   if (body?.error?.fields !== void 0) details.fields = body.error.fields;
+  if (typeof body?.error?.installUrl === "string")
+    details.installUrl = body.error.installUrl;
   return new NaroError(
     code,
     serverMessage ?? `${context} failed: the control plane returned ${String(response.status)}.`,
@@ -16189,6 +16215,7 @@ var NaroClient = class {
   doFetch;
   teams;
   projects;
+  github;
   deployments;
   env;
   domains;
@@ -16199,6 +16226,7 @@ var NaroClient = class {
     this.doFetch = options.fetch ?? fetch;
     this.teams = new TeamsApi(this);
     this.projects = new ProjectsApi(this);
+    this.github = new GithubApi(this);
     this.deployments = new DeploymentsApi(this);
     this.env = new EnvApi(this);
     this.domains = new DomainsApi(this);
@@ -16257,6 +16285,51 @@ var ProjectsApi = class {
     );
     return projectInfo(body.project);
   }
+  /**
+   * Connects a project to a GitHub repository, turning `git push` into a
+   * deployment.
+   *
+   * "The App is not installed on that account" is a normal branch here, not a
+   * failure: the CLI opens a browser and polls, while MCP hands the URL back
+   * to the agent. So it is returned rather than thrown.
+   */
+  async connectGit(projectId, fullName) {
+    try {
+      const body = await this.client.request(
+        `/api/projects/${encodeURIComponent(projectId)}/git`,
+        { method: "POST", body: { fullName }, context: "Connect repository" }
+      );
+      return { ok: true, project: projectInfo(body.project) };
+    } catch (error51) {
+      if (isNaroError(error51) && error51.code === "REPOSITORY_NOT_ACCESSIBLE") {
+        const installUrl = error51.details?.installUrl;
+        return {
+          ok: false,
+          installUrl: typeof installUrl === "string" ? installUrl : null
+        };
+      }
+      throw error51;
+    }
+  }
+  async disconnectGit(projectId) {
+    const body = await this.client.request(
+      `/api/projects/${encodeURIComponent(projectId)}/git`,
+      { method: "DELETE", context: "Disconnect repository" }
+    );
+    return projectInfo(body.project);
+  }
+};
+var GithubApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  /** Repositories every installation attached to the team can reach. */
+  async listRepositories(teamSlug) {
+    const body = await this.client.request(`/api/github/repositories?team=${encodeURIComponent(teamSlug)}`, {
+      context: "List repositories"
+    });
+    return body.repositories;
+  }
 };
 var DeploymentsApi = class {
   constructor(client) {
@@ -16517,13 +16590,118 @@ function serializeDotenv(vars) {
 `;
 }
 
-// ../../packages/sdk/src/framework.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+// ../../packages/sdk/src/env-scan.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3, readdirSync, statSync } from "fs";
 import { join as join11 } from "path";
+var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".mts",
+  ".cts",
+  ".vue",
+  ".svelte",
+  ".astro"
+]);
+var SKIP_DIRECTORIES = /* @__PURE__ */ new Set([
+  "node_modules",
+  "dist",
+  "build",
+  "out",
+  "coverage",
+  "tmp"
+]);
+var EXAMPLE_FILES = [".env.example", ".env.sample", ".env.template"];
+var IGNORED_KEYS = /* @__PURE__ */ new Set([
+  "NODE_ENV",
+  "PORT",
+  "CI",
+  "HOME",
+  "PATH",
+  "PWD",
+  "TZ",
+  "NEXT_RUNTIME",
+  "MODE",
+  "BASE_URL",
+  "DEV",
+  "PROD",
+  "SSR"
+]);
+var MAX_FILES = 5e3;
+var MAX_FILE_BYTES2 = 1024 * 1024;
+var REFERENCE = /(?:process|import\.meta)\.env(?:\.([A-Za-z_][A-Za-z0-9_]*)|\[\s*["'`]([A-Za-z_][A-Za-z0-9_]*)["'`]\s*\])/g;
+function ignored(key) {
+  return IGNORED_KEYS.has(key) || key.startsWith("npm_");
+}
+function collect(dir, out) {
+  if (out.length >= MAX_FILES) return;
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (out.length >= MAX_FILES) return;
+    if (entry.isSymbolicLink()) continue;
+    const path = join11(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name.startsWith(".") || SKIP_DIRECTORIES.has(entry.name))
+        continue;
+      collect(path, out);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    const dot = entry.name.lastIndexOf(".");
+    if (dot < 0 || !SOURCE_EXTENSIONS.has(entry.name.slice(dot))) continue;
+    out.push(path);
+  }
+}
+function scanEnvReferences(dir) {
+  const found = /* @__PURE__ */ new Map();
+  const files = [];
+  collect(dir, files);
+  for (const file2 of files) {
+    let text;
+    try {
+      if (statSync(file2).size > MAX_FILE_BYTES2) continue;
+      text = readFileSync3(file2, "utf8");
+    } catch {
+      continue;
+    }
+    for (const match of text.matchAll(REFERENCE)) {
+      const key = match[1] ?? match[2];
+      if (!key || ignored(key)) continue;
+      found.set(key, "code");
+    }
+  }
+  for (const name of EXAMPLE_FILES) {
+    const path = join11(dir, name);
+    if (!existsSync2(path)) continue;
+    let parsed;
+    try {
+      parsed = parseDotenv(readFileSync3(path, "utf8"));
+    } catch {
+      continue;
+    }
+    for (const key of Object.keys(parsed)) {
+      if (ignored(key) || found.has(key)) continue;
+      found.set(key, "example");
+    }
+  }
+  return [...found].map(([key, source]) => ({ key, source })).sort((a, b) => a.key.localeCompare(b.key));
+}
+
+// ../../packages/sdk/src/framework.ts
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
+import { join as join12 } from "path";
 function readPackageJson2(dir) {
   try {
     return JSON.parse(
-      readFileSync3(join11(dir, "package.json"), "utf8")
+      readFileSync4(join12(dir, "package.json"), "utf8")
     );
   } catch {
     return null;
@@ -16534,7 +16712,7 @@ function hasDependency(pkg, name) {
 }
 function hasConfig(dir, base2, evidence) {
   for (const ext of ["js", "mjs", "cjs", "ts", "mts"]) {
-    if (existsSync2(join11(dir, `${base2}.${ext}`))) {
+    if (existsSync3(join12(dir, `${base2}.${ext}`))) {
       evidence.push(`${base2}.${ext}`);
       return true;
     }
@@ -16546,8 +16724,8 @@ function detectFramework2(dir) {
   const pkg = readPackageJson2(dir);
   if (hasDependency(pkg, "next") || hasConfig(dir, "next.config", evidence)) {
     if (hasDependency(pkg, "next")) evidence.push("package.json: next");
-    if (existsSync2(join11(dir, "app"))) evidence.push("app/");
-    if (existsSync2(join11(dir, "pages"))) evidence.push("pages/");
+    if (existsSync3(join12(dir, "app"))) evidence.push("app/");
+    if (existsSync3(join12(dir, "pages"))) evidence.push("pages/");
     return {
       framework: "nextjs",
       name: "Next.js",
@@ -16601,7 +16779,7 @@ function detectFramework2(dir) {
       deployable: true
     };
   }
-  if (!pkg && existsSync2(join11(dir, "index.html"))) {
+  if (!pkg && existsSync3(join12(dir, "index.html"))) {
     evidence.push("index.html (no package.json)");
     return {
       framework: "static",
@@ -16624,28 +16802,29 @@ function detectFramework2(dir) {
 
 // ../../packages/sdk/src/link.ts
 import {
-  existsSync as existsSync3,
+  existsSync as existsSync4,
   mkdirSync as mkdirSync2,
-  readFileSync as readFileSync4,
+  readFileSync as readFileSync5,
   rmSync as rmSync2,
   writeFileSync as writeFileSync2
 } from "fs";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 function linkDir(dir) {
-  return join12(dir, ".naro");
+  return join13(dir, ".naro");
 }
 function linkFile(dir) {
-  return join12(linkDir(dir), "project.json");
+  return join13(linkDir(dir), "project.json");
 }
 function readProjectLink(dir) {
   try {
-    const parsed = JSON.parse(readFileSync4(linkFile(dir), "utf8"));
+    const parsed = JSON.parse(readFileSync5(linkFile(dir), "utf8"));
     if (typeof parsed.projectId !== "string" || parsed.projectId.length === 0)
       return null;
     return {
       projectId: parsed.projectId,
       ...typeof parsed.teamSlug === "string" ? { teamSlug: parsed.teamSlug } : {},
-      ...typeof parsed.projectName === "string" ? { projectName: parsed.projectName } : {}
+      ...typeof parsed.projectName === "string" ? { projectName: parsed.projectName } : {},
+      ...parsed.autoDeployDeclined === true ? { autoDeployDeclined: true } : {}
     };
   } catch {
     return null;
@@ -16656,20 +16835,20 @@ function writeProjectLink(dir, link) {
   writeFileSync2(linkFile(dir), `${JSON.stringify(link, null, 2)}
 `);
   writeFileSync2(
-    join12(linkDir(dir), "README.txt"),
+    join13(linkDir(dir), "README.txt"),
     "This directory links the project to Naro and should not be committed.\n"
   );
 }
 function removeProjectLink(dir) {
-  if (!existsSync3(linkDir(dir))) return false;
+  if (!existsSync4(linkDir(dir))) return false;
   rmSync2(linkDir(dir), { recursive: true, force: true });
   return true;
 }
 function ensureGitignoreHasNaro(dir) {
-  const gitignorePath = join12(dir, ".gitignore");
-  const hasGitignore = existsSync3(gitignorePath);
-  if (!hasGitignore && !existsSync3(join12(dir, ".git"))) return false;
-  const current = hasGitignore ? readFileSync4(gitignorePath, "utf8") : "";
+  const gitignorePath = join13(dir, ".gitignore");
+  const hasGitignore = existsSync4(gitignorePath);
+  if (!hasGitignore && !existsSync4(join13(dir, ".git"))) return false;
+  const current = hasGitignore ? readFileSync5(gitignorePath, "utf8") : "";
   const covered = current.split(/\r?\n/).map((line) => line.trim()).some((line) => line === ".naro" || line === ".naro/" || line === "/.naro");
   if (covered) return false;
   const suffix = current.length === 0 || current.endsWith("\n") ? "" : "\n";
@@ -16678,6 +16857,67 @@ function ensureGitignoreHasNaro(dir) {
   return true;
 }
 
+// src/env-consent.ts
+import { existsSync as existsSync5 } from "fs";
+import { join as join14 } from "path";
+var DOTENV_FILES = [".env.local", ".env.production", ".env"];
+var PUBLIC_PREFIXES = ["NEXT_PUBLIC_", "VITE_", "REACT_APP_", "PUBLIC_"];
+function maskEnvValue(key, value) {
+  if (PUBLIC_PREFIXES.some((prefix) => key.startsWith(prefix)))
+    return value.length > 60 ? `${value.slice(0, 60)}\u2026` : value;
+  return value.length <= 8 ? "****" : `${value.slice(0, 4)}****`;
+}
+function findDotenvFile(dir) {
+  for (const name of DOTENV_FILES) if (existsSync5(join14(dir, name))) return name;
+  return null;
+}
+function envAddGuidance(keys) {
+  return [
+    "  Set them yourself:",
+    ...keys.map((key) => `    npx naro-cli env add ${key}`),
+    "  (values come from a hidden prompt or stdin, never from argv)"
+  ];
+}
+async function promptForMissingEnv(ctx, keys) {
+  const guide = (remaining2) => {
+    for (const line of envAddGuidance(remaining2)) ctx.output.log(line);
+  };
+  const file2 = findDotenvFile(ctx.cwd);
+  if (!file2) {
+    guide(keys);
+    return {};
+  }
+  const consented = await ctx.prompter.confirm(
+    `Found ${file2}. Read it to fill these ${String(keys.length)} value(s)?`
+  );
+  if (!consented) {
+    ctx.output.log(`\u25B8 skipped reading ${file2}`);
+    guide(keys);
+    return {};
+  }
+  const local = (ctx.readEnv ?? readProjectEnv)(ctx.cwd);
+  const collected = {};
+  for (const key of keys) {
+    const value = local[key];
+    if (value !== void 0 && value !== "") collected[key] = value;
+  }
+  const names = Object.keys(collected);
+  if (names.length === 0) {
+    ctx.output.log(`\u25B8 no matching values in ${file2}`);
+    guide(keys);
+    return {};
+  }
+  const width = Math.max(...names.map((name) => name.length));
+  for (const key of names)
+    ctx.output.log(
+      `  ${key.padEnd(width)}  ${maskEnvValue(key, collected[key] ?? "")}`
+    );
+  ctx.output.log(`\u25B8 adding ${String(names.length)} env var(s)`);
+  const remaining = keys.filter((key) => !(key in collected));
+  if (remaining.length > 0) guide(remaining);
+  return collected;
+}
+
 // src/git-info.ts
 import { execFile } from "child_process";
 var SUPPORTED_REMOTE = [
@@ -16857,7 +17097,7 @@ function slugify2(value) {
 async function projectName(sourceDir) {
   try {
     const pkg = JSON.parse(
-      await readFile7(join13(sourceDir, "package.json"), "utf8")
+      await readFile7(join15(sourceDir, "package.json"), "utf8")
     );
     if (pkg.name) return pkg.name;
   } catch {
@@ -16868,8 +17108,8 @@ var COPY_SKIP = /(^|[\\/])(node_modules|\.next|\.open-next|\.git|\.wrangler|\.tu
 function resolveBin(name) {
   let dir = dirname(fileURLToPath(import.meta.url));
   for (; ; ) {
-    const candidate = join13(dir, "node_modules", ".bin", name);
-    if (existsSync4(candidate)) return candidate;
+    const candidate = join15(dir, "node_modules", ".bin", name);
+    if (existsSync6(candidate)) return candidate;
     const parent = dirname(dir);
     if (parent === dir) return name;
     dir = parent;
@@ -16893,7 +17133,7 @@ async function detectPackageManagerLenient(root) {
 }
 function localDependencies(sourceDir) {
   return {
-    createWorkspace: () => mkdtemp2(join13(tmpdir2(), "naro-build-")),
+    createWorkspace: () => mkdtemp2(join15(tmpdir2(), "naro-build-")),
     removeWorkspace: (path) => rm2(path, { recursive: true, force: true }),
     async runCommand(spec, observer) {
       if (spec.command === "git" && spec.args[0] === "clone") {
@@ -16955,6 +17195,32 @@ async function deployDirectory(sourceDir, options, log2) {
   else if (git.repositoryUrl) log2(`\u25B8 linking ${git.repositoryUrl}`);
   if (options.env && Object.keys(options.env).length > 0)
     log2(`\u25B8 syncing ${String(Object.keys(options.env).length)} env var(s)`);
+  const scanned = scanEnvReferences(sourceDir).map(
+    (reference) => reference.key
+  );
+  let missing = [];
+  if (scanned.length > 0) {
+    let existing = /* @__PURE__ */ new Set();
+    if (options.projectId) {
+      try {
+        const rows = await client.env.list(options.projectId);
+        existing = new Set(rows.map((row) => row.key));
+      } catch {
+      }
+    }
+    const provided = options.env ?? {};
+    missing = scanned.filter((key) => !existing.has(key) && !(key in provided));
+  }
+  let collected = {};
+  if (missing.length > 0) {
+    log2(
+      `\u25B8 ${String(missing.length)} env var(s) needed, not set on this project: ${missing.join(", ")}`
+    );
+    if (options.onMissingEnv) collected = await options.onMissingEnv(missing);
+    else for (const line of envAddGuidance(missing)) log2(line);
+  }
+  const missingEnvKeys = missing.filter((key) => !(key in collected));
+  const envToSend = { ...options.env, ...collected };
   log2("\u25B8 starting deployment");
   const ctx = await client.deployments.createCli({
     ...options.projectId ? { projectId: options.projectId } : { name },
@@ -16964,7 +17230,7 @@ async function deployDirectory(sourceDir, options, log2) {
     ...options.rootDirectory != null && {
       rootDirectory: options.rootDirectory
     },
-    ...options.env !== void 0 && { env: options.env }
+    ...Object.keys(envToSend).length > 0 && { env: envToSend }
   });
   if (ctx.envSkipped?.length)
     log2(`\u26A0 skipped env: ${ctx.envSkipped.join(", ")}`);
@@ -16984,7 +17250,7 @@ async function deployDirectory(sourceDir, options, log2) {
         repositoryUrl: sourceDir,
         branch: ctx.branch,
         rootDirectory: options.rootDirectory ?? ctx.rootDirectory,
-        env: { ...ctx.env, ...options.env ?? {} }
+        env: { ...ctx.env, ...envToSend }
       },
       observer
     );
@@ -17017,7 +17283,8 @@ async function deployDirectory(sourceDir, options, log2) {
     projectId: ctx.projectId,
     status: detail.deployment.status,
     url: url2,
-    production
+    production,
+    missingEnvKeys
   };
 }
 async function waitForFinish(client, ctx, log2) {
@@ -17037,6 +17304,7 @@ function deploymentUrl(detail, ctx, production) {
 }
 
 export {
+  parseGitHubRemote,
   NaroError,
   isNaroError,
   toNaroError,
@@ -17052,14 +17320,15 @@ export {
   openBrowser,
   isTerminalStatus,
   NaroClient,
-  readProjectEnv,
   serializeDotenv,
   readProjectLink,
   writeProjectLink,
   removeProjectLink,
   ensureGitignoreHasNaro,
+  promptForMissingEnv,
+  detectGitInfo,
   parseDotenv2 as parseDotenv,
-  readProjectEnv2,
+  readProjectEnv2 as readProjectEnv,
   eventsObserver,
   slugify2 as slugify,
   deployDirectory

package/dist/deploy.d.ts

@@ -35,6 +35,11 @@ export interface DeployOptions {
     fetch?: typeof fetch;
     /** Test seam: replaces the local OpenNext build. */
     executor?: DeployBuildExecutor;
+    /**
+     * 소스가 참조하지만 프로젝트에 없는 env 키를 받아, 등록할 값을 돌려준다.
+     * 대화형 CLI만 전달한다 — MCP·CI는 생략하고 안내만 받는다.
+     */
+    onMissingEnv?: (keys: string[]) => Promise<Record<string, string>>;
 }
 export interface DeployResult {
     deploymentId: string;
@@ -42,6 +47,8 @@ export interface DeployResult {
     status: DeploymentStatus;
     url: string;
     production: boolean;
+    /** 끝까지 채워지지 않은 키. */
+    missingEnvKeys: string[];
 }
 /**
  * The full CLI deploy: authenticate, register the deployment with the

package/dist/deploy.js

@@ -3,9 +3,9 @@ import {
   deployDirectory,
   eventsObserver,
   parseDotenv,
-  readProjectEnv2 as readProjectEnv,
+  readProjectEnv,
   slugify
-} from "./chunk-B6F7QIW7.js";
+} from "./chunk-YLFLDW2H.js";
 export {
   deployDirectory,
   eventsObserver,

package/dist/env-consent.d.ts

@@ -0,0 +1,18 @@
+import type { Output } from "./output";
+import type { Prompter } from "./prompt";
+export interface EnvConsentContext {
+    cwd: string;
+    prompter: Prompter;
+    output: Output;
+    /** 테스트 주입용. 기본값은 SDK의 readProjectEnv. */
+    readEnv?: (dir: string) => Record<string, string>;
+}
+export declare function maskEnvValue(key: string, value: string): string;
+/** 동의를 구하기 전에는 존재만 확인한다. 내용은 열지 않는다. */
+export declare function findDotenvFile(dir: string): string | null;
+export declare function envAddGuidance(keys: string[]): string[];
+/**
+ * 누락된 env 키를 채운다. dotenv 파일은 사용자가 명시적으로 동의한 뒤에만
+ * 열리고, 그때도 요청된 키의 값만 꺼낸다 — 파일의 나머지 내용은 전송되지 않는다.
+ */
+export declare function promptForMissingEnv(ctx: EnvConsentContext, keys: string[]): Promise<Record<string, string>>;

package/dist/index.js

@@ -6,6 +6,7 @@ import {
   controlPlaneUrl,
   createAuthClient,
   deployDirectory,
+  detectGitInfo,
   ensureGitignoreHasNaro,
   isExpired,
   isNaroError,
@@ -13,7 +14,8 @@ import {
   loadStoredSession,
   login,
   openBrowser,
-  readProjectEnv,
+  parseGitHubRemote,
+  promptForMissingEnv,
   readProjectLink,
   refreshStoredSession,
   removeProjectLink,
@@ -23,7 +25,7 @@ import {
   slugify,
   toNaroError,
   writeProjectLink
-} from "./chunk-B6F7QIW7.js";
+} from "./chunk-YLFLDW2H.js";
 
 // src/args.ts
 var BOOLEAN_FLAGS = {
@@ -154,7 +156,7 @@ var Output = class {
             success: false,
             code: naroError.code,
             message: naroError.message,
-            ...naroError.details ?? {}
+            ...naroError.details
           },
           null,
           2
@@ -411,8 +413,162 @@ async function runToken(context) {
   );
 }
 
+// src/commands/git.ts
+var defaults = {
+  detectRemote: async (dir) => (await detectGitInfo(dir)).repositoryUrl,
+  openBrowser,
+  sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+};
+function connected(context, project) {
+  const branch = project.defaultBranch;
+  context.output.result(
+    {
+      projectId: project.id,
+      repositoryFullName: project.repositoryFullName,
+      autoDeploy: true
+    },
+    [
+      `\u2705 Connected to ${project.repositoryFullName ?? "the repository"}.`,
+      `   Pushes to ${branch} now deploy automatically.`,
+      "",
+      "   To turn this off: naro git disconnect"
+    ]
+  );
+}
+async function runGitConnect(context, overrides = {}) {
+  const deps = { ...defaults, ...overrides };
+  const { output } = context;
+  const explicit = context.positionals[0];
+  let fullName;
+  if (explicit) {
+    const parsed = parseGitHubRemote(explicit) ?? parseGitHubRemote(`https://github.com/${explicit}`);
+    if (!parsed)
+      throw new NaroError(
+        "VALIDATION_FAILED",
+        `"${explicit}" is not an owner/repo pair.`
+      );
+    fullName = parsed.fullName;
+  } else {
+    const remote = await deps.detectRemote(context.cwd);
+    const parsed = remote ? parseGitHubRemote(remote) : null;
+    if (!parsed) {
+      throw new NaroError(
+        "NO_GIT_REMOTE",
+        remote ? `Could not read a GitHub owner/repo from "${remote}". Pass it directly: naro git connect <owner/repo>` : "This directory has no GitHub origin remote. Pass one directly: naro git connect <owner/repo>"
+      );
+    }
+    fullName = parsed.fullName;
+  }
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const first = await client.projects.connectGit(projectId, fullName);
+  if (first.ok) {
+    connected(context, first.project);
+    return;
+  }
+  if (!first.installUrl) {
+    throw new NaroError(
+      "REPOSITORY_NOT_ACCESSIBLE",
+      `Naro cannot reach ${fullName}, and no install URL was offered. Connect it from the dashboard.`
+    );
+  }
+  output.log(`
+\u25B8 Naro needs access to ${fullName}.`);
+  output.log(`  Opening ${first.installUrl}`);
+  deps.openBrowser(first.installUrl);
+  output.log("  Waiting for the installation to finish...\n");
+  await waitForInstall(context, projectId, fullName, deps);
+}
+async function waitForInstall(context, projectId, fullName, deps) {
+  const client = await context.client();
+  const project = await client.projects.get(projectId);
+  const teams = await client.teams.list();
+  const teamSlug = teams.find((team) => team.id === project.teamId)?.slug;
+  if (teamSlug) {
+    const attempts = deps.pollAttempts ?? 60;
+    const interval = deps.pollIntervalMs ?? 3e3;
+    for (let attempt = 0; attempt < attempts; attempt += 1) {
+      await deps.sleep(interval);
+      let reachable = false;
+      try {
+        const repositories = await client.github.listRepositories(teamSlug);
+        reachable = repositories.some(
+          (repository) => repository.fullName.toLowerCase() === fullName.toLowerCase()
+        );
+      } catch {
+      }
+      if (!reachable) continue;
+      const retry = await client.projects.connectGit(projectId, fullName);
+      if (retry.ok) {
+        connected(context, retry.project);
+        return;
+      }
+    }
+  }
+  context.output.result(
+    { projectId, repositoryFullName: null, autoDeploy: false },
+    [
+      `\u25B8 Still waiting on access to ${fullName}.`,
+      "  Finish the installation, then run: naro git connect"
+    ]
+  );
+}
+async function runGitDisconnect(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const project = await client.projects.disconnectGit(projectId);
+  context.output.result({ projectId: project.id, autoDeploy: false }, [
+    `\u2705 ${project.name} no longer deploys on push.`,
+    "   Deploy from here with: naro deploy"
+  ]);
+}
+async function offerAutoDeploy(context, projectId, overrides = {}) {
+  const deps = { ...defaults, ...overrides };
+  if (overrides.canPrompt === false) return;
+  try {
+    if (readProjectLink(context.cwd)?.autoDeployDeclined === true) return;
+    const remote = await deps.detectRemote(context.cwd);
+    const parsed = remote ? parseGitHubRemote(remote) : null;
+    if (!parsed) return;
+    const client = await context.client();
+    const project = await client.projects.get(projectId);
+    if (project.repositoryFullName) return;
+    const wanted = await context.prompter.confirm(
+      "Should your changes deploy automatically from now on?"
+    );
+    if (!wanted) {
+      const link = readProjectLink(context.cwd);
+      writeProjectLink(context.cwd, {
+        ...link ?? { projectId },
+        autoDeployDeclined: true
+      });
+      context.output.log(
+        "\u25B8 Not now. Later, if you change your mind: naro git connect"
+      );
+      return;
+    }
+    const result = await client.projects.connectGit(projectId, parsed.fullName);
+    if (result.ok) {
+      connected(context, result.project);
+      return;
+    }
+    if (!result.installUrl) return;
+    context.output.log(`
+\u25B8 Naro needs access to ${parsed.fullName}.`);
+    context.output.log(`  Opening ${result.installUrl}`);
+    deps.openBrowser(result.installUrl);
+    context.output.log("  Waiting for the installation to finish...\n");
+    await waitForInstall(context, projectId, parsed.fullName, deps);
+  } catch (error) {
+    context.output.log(
+      `\u25B8 Could not set up automatic deploys (${error instanceof Error ? error.message : String(error)}).`
+    );
+    context.output.log("  Try later with: naro git connect");
+  }
+}
+
 // src/commands/deploy.ts
-async function runDeploy(context) {
+async function runDeploy(context, deps = { deploy: deployDirectory, offerAutoDeploy }) {
   const { flags, output } = context;
   const link = flags.project ? { projectId: flags.project } : readProjectLink(context.cwd);
   if (flags.prod && !flags.yes && !flags.json && isInteractive()) {
@@ -422,12 +578,8 @@ async function runDeploy(context) {
   output.log(`
 \u{1F680} Deploying ${context.cwd}
 `);
-  const localEnv = link ? {} : readProjectEnv(context.cwd);
-  if (link)
-    output.log(
-      "\u25B8 using project env vars (manage them with `naro env`, sync local files with `naro env pull`)"
-    );
-  const result = await deployDirectory(
+  const canPrompt = !flags.json && !flags.yes && isInteractive();
+  const result = await deps.deploy(
     context.cwd,
     {
       name: flags.name,
@@ -435,10 +587,12 @@ async function runDeploy(context) {
       rootDirectory: flags.root ?? null,
       branch: flags.branch,
       production: flags.prod,
-      // Local dotenv files seed the project ONCE (first, unlinked deploy).
-      // After that the platform owns env — a stray .env.local must not
-      // silently overwrite values set via the dashboard or `naro env add`.
-      env: localEnv,
+      ...canPrompt && {
+        onMissingEnv: (keys) => promptForMissingEnv(
+          { cwd: context.cwd, prompter: context.prompter, output },
+          keys
+        )
+      },
       token: flags.token,
       allowLogin: !flags.json && !flags.yes
     },
@@ -450,13 +604,15 @@ async function runDeploy(context) {
       output.log("\u25B8 added .naro to .gitignore");
     output.log("\u25B8 linked (.naro/project.json)");
   }
+  await deps.offerAutoDeploy?.(context, result.projectId, { canPrompt });
   context.output.result(
     {
       deploymentId: result.deploymentId,
       projectId: result.projectId,
       status: result.status,
       url: result.url,
-      target: result.production ? "production" : "preview"
+      target: result.production ? "production" : "preview",
+      missingEnvKeys: result.missingEnvKeys
     },
     [
       "",
@@ -1092,6 +1248,9 @@ Usage:
   naro deployments                   List deployments of the linked project
   naro inspect <deployment-id>       Show one deployment + build logs
 
+  naro git connect [owner/repo]      Deploy on every push (defaults to your origin remote)
+  naro git disconnect                Stop deploying on push
+
   naro logs [deployment-id]          Runtime logs (or build logs of a deployment)
        [--type build|runtime] [--env production|preview] [--level error] [--follow]
 
@@ -1190,6 +1349,15 @@ function route(parsed) {
       return { handler: runPromote, positionals };
     case "rollback":
       return { handler: runRollback, positionals };
+    case "git":
+      switch (positionals[0]) {
+        case "connect":
+          return { handler: runGitConnect, positionals: positionals.slice(1) };
+        case "disconnect":
+          return { handler: runGitDisconnect, positionals: [] };
+        default:
+          return null;
+      }
     default:
       return null;
   }

package/dist/output.d.ts

@@ -0,0 +1,29 @@
+export interface OutputStreams {
+    stdout(text: string): void;
+    stderr(text: string): void;
+}
+/**
+ * One Output per invocation. Human mode: progress + results on stdout.
+ * JSON mode (--json): stdout carries exactly one machine-readable JSON
+ * object; every human-facing line moves to stderr so agents never have to
+ * parse log noise.
+ */
+export declare class Output {
+    readonly json: boolean;
+    readonly debug: boolean;
+    private readonly streams;
+    private resultPrinted;
+    constructor(json: boolean, debug: boolean, streams?: OutputStreams);
+    /** Progress/log line for humans. */
+    log(message: string): void;
+    /** Extra diagnostics, only with --debug. */
+    debugLog(message: string): void;
+    /**
+     * Final command result. JSON mode prints {success:true, ...data}; human
+     * mode prints the lines instead.
+     */
+    result(data: Record<string, unknown>, humanLines?: string[]): void;
+    /** Command failure: stable {success:false, code, message} in JSON mode. */
+    fail(error: unknown): void;
+    get hasResult(): boolean;
+}

package/dist/prompt.d.ts

@@ -0,0 +1,17 @@
+export interface Prompter {
+    /** Free-text question. */
+    ask(question: string): Promise<string>;
+    /** Question with hidden echo (secrets). */
+    askHidden(question: string): Promise<string>;
+    /** y/N confirmation, defaults to No. */
+    confirm(question: string): Promise<boolean>;
+    /** Pick one option by number; returns its index. */
+    select(question: string, options: string[]): Promise<number>;
+}
+export declare function isInteractive(): boolean;
+/** Reads all of stdin — the CI path for piped secret values. */
+export declare function readStdin(): Promise<string>;
+export declare function createPrompter(options: {
+    json: boolean;
+    yes: boolean;
+}): Prompter;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "naro-cli",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "type": "module",
   "bin": {
     "naro": "./dist/index.js"
@@ -29,15 +29,14 @@
     "typescript": "7.0.2",
     "vitest": "3.2.7",
     "@next-deploy/build": "0.1.0",
-    "@next-deploy/config": "0.1.0",
     "@next-deploy/core": "0.1.0",
+    "@next-deploy/config": "0.1.0",
     "@next-deploy/sdk": "0.1.0"
   },
   "scripts": {
     "build": "tsup && pnpm build:types",
     "build:types": "tsc --project tsconfig.build.json",
     "test": "vitest run",
-    "typecheck": "tsc --noEmit",
-    "lint": "tsc --noEmit"
+    "typecheck": "tsc --noEmit"
   }
 }