propr-cli 0.8.3

package/dist/api/todos.js

@@ -0,0 +1,77 @@
+/**
+ * Repository To-Dos API
+ *
+ * Functions for interacting with the ProPR backend to-do endpoints.
+ */
+import { createApiClient } from "./client.js";
+export async function listTodos(repository, client) {
+    const apiClient = client ?? (await createApiClient());
+    const response = await apiClient.get("/api/repos/todos", {
+        params: { repository },
+    });
+    return response.data;
+}
+export async function getTodo(todoId, client) {
+    const apiClient = client ?? (await createApiClient());
+    const response = await apiClient.get(`/api/repos/todos/${todoId}`);
+    return response.data;
+}
+export async function createTodo(params, client) {
+    const apiClient = client ?? (await createApiClient());
+    const response = await apiClient.post("/api/repos/todos", {
+        body: params,
+    });
+    return response.data;
+}
+export async function updateTodo(todoId, updates, client) {
+    const apiClient = client ?? (await createApiClient());
+    const response = await apiClient.put(`/api/repos/todos/${todoId}`, {
+        body: updates,
+    });
+    return response.data;
+}
+export async function deleteTodo(todoId, client) {
+    const apiClient = client ?? (await createApiClient());
+    const response = await apiClient.delete(`/api/repos/todos/${todoId}`);
+    return response.data;
+}
+export async function listCategories(repository, client) {
+    const apiClient = client ?? (await createApiClient());
+    const response = await apiClient.get("/api/repos/todos/categories", {
+        params: { repository },
+    });
+    return response.data;
+}
+export async function createCategory(params, client) {
+    const apiClient = client ?? (await createApiClient());
+    const response = await apiClient.post("/api/repos/todos/categories", {
+        body: params,
+    });
+    return response.data;
+}
+export async function updateCategory(categoryId, updates, client) {
+    const apiClient = client ?? (await createApiClient());
+    const response = await apiClient.put(`/api/repos/todos/categories/${categoryId}`, {
+        body: updates,
+    });
+    return response.data;
+}
+export async function deleteCategory(categoryId, client) {
+    const apiClient = client ?? (await createApiClient());
+    const response = await apiClient.delete(`/api/repos/todos/categories/${categoryId}`);
+    return response.data;
+}
+export async function reorderTodos(repository, items, client) {
+    const apiClient = client ?? (await createApiClient());
+    const response = await apiClient.post("/api/repos/todos/reorder", {
+        body: { repository, items },
+    });
+    return response.data;
+}
+export async function reorderCategories(repository, items, client) {
+    const apiClient = client ?? (await createApiClient());
+    const response = await apiClient.post("/api/repos/todos/categories/reorder", {
+        body: { repository, items },
+    });
+    return response.data;
+}

package/dist/api/types.js

@@ -0,0 +1,6 @@
+/**
+ * API Client Types
+ *
+ * Type definitions for the CLI API client.
+ */
+export {};

package/dist/assets/.env.example

@@ -0,0 +1,183 @@
+# GitHub App Configuration
+GH_APP_ID=your_app_id
+GH_PRIVATE_KEY_PATH=./path/to/your-app-private-key.pem
+GH_INSTALLATION_ID=your_installation_id
+
+# Host path to the GitHub App private key (.pem). Recommended when running via
+# the `propr` CLI or launcher: the key is bind-mounted (read-only) into the app
+# containers and GH_PRIVATE_KEY_PATH above is overridden to point at it, so you
+# can keep the key anywhere on the host instead of staging it under data/.
+# Must be an absolute host path (no '~').
+# HOST_GH_PRIVATE_KEY=/home/your-user/propr/app-private-key.pem
+
+# GitHub auth: token relay (shared-app path) — ALTERNATIVE to the App private key
+# above. When PROPR_GH_RELAY_URL is set, the backend fetches short-lived
+# installation tokens from a vendor-run relay instead of minting them from a
+# private key, so you don't need to hold the shared App's key. You still set
+# GH_INSTALLATION_ID (which installation), but GH_PRIVATE_KEY_PATH /
+# HOST_GH_PRIVATE_KEY are not required in relay mode.
+#   PROPR_GH_RELAY_URL   — https URL of the relay (http only allowed for localhost)
+#   PROPR_GH_RELAY_TOKEN — the durable relay credential issued for your install
+# PROPR_GH_RELAY_URL=https://relay.propr.dev
+# PROPR_GH_RELAY_TOKEN=your_relay_token
+# Optional: force a mode explicitly instead of inferring (app | relay | demo).
+# GH_AUTH_MODE=relay
+
+# Logging Configuration
+LOG_LEVEL=info
+NODE_ENV=development
+
+# Daemon Configuration
+GITHUB_REPOS_TO_MONITOR=owner/repo1,owner/repo2
+POLLING_INTERVAL_MS=60000
+
+# Config Repository (for dynamic repository management)
+CONFIG_REPO=https://github.com/integry/gitfix-config.git
+
+# Issue Detection Configuration
+PRIMARY_PROCESSING_LABELS=AI,propr
+PR_LABEL=propr
+
+# Redis Configuration
+REDIS_HOST=127.0.0.1
+REDIS_PORT=6379
+
+# Queue Configuration
+GITHUB_ISSUE_QUEUE_NAME=github-issue-processor
+WORKER_CONCURRENCY=2
+COMMENT_BATCH_DELAY_MS=3000
+
+# Webhook Configuration
+# Webhooks are received by the dashboard API service (port 4000)
+ENABLE_GITHUB_WEBHOOKS=false
+GH_WEBHOOK_SECRET=your-webhook-secret
+
+# System Task Authorization
+# Secret used to sign system task requests (e.g., revert operations)
+# Generate with: openssl rand -hex 32
+SYSTEM_TASK_SECRET=
+# Maximum age (ms) for signed system task tokens. Increase if jobs frequently expire
+# due to queue backlog or worker downtime. Defaults to 7200000 (2 hours).
+# SYSTEM_TASK_TOKEN_MAX_AGE_MS=7200000
+
+# Worker Configuration
+
+# PR Comment Monitoring Configuration
+GITHUB_BOT_USERNAME=your_bot_username
+GITHUB_USER_WHITELIST=
+GITHUB_USER_BLACKLIST=
+PR_FOLLOWUP_TRIGGER_KEYWORDS=!propr
+
+# Git Configuration
+GIT_CLONES_BASE_PATH=/tmp/git-processor/clones
+GIT_WORKTREES_BASE_PATH=/tmp/git-processor/worktrees
+GIT_DEFAULT_BRANCH=main
+GIT_SHALLOW_CLONE_DEPTH=
+
+# Claude Code Configuration
+CLAUDE_DOCKER_IMAGE=propr/agent-claude:latest
+# Must be an absolute path — do NOT use ~ or ${HOME} (neither is expanded in
+# .env files parsed by Node or in Docker bind mounts).
+# CLAUDE_CONFIG_PATH=/home/your-user/.claude
+CLAUDE_CONFIG_PATH=
+CLAUDE_MAX_TURNS=10
+CLAUDE_TIMEOUT_MS=300000
+CODEX_TIMEOUT_MS=3600000
+
+# Antigravity Configuration
+ANTIGRAVITY_TIMEOUT_MS=300000
+
+# OpenCode Configuration
+OPENCODE_TIMEOUT_MS=3600000
+# Launcher credential mount paths (required when using docker/launcher).
+# HOST_OPENCODE_XDG_DIR points to the XDG config directory
+# (/home/your-user/.config/opencode)
+# and takes precedence over HOST_OPENCODE_DIR.
+# HOST_OPENCODE_DIR is accepted as a fallback alias for HOST_OPENCODE_XDG_DIR.
+# HOST_OPENCODE_LEGACY_DIR points to the legacy /home/your-user/.opencode directory.
+# The saved agent configPath still controls the runtime mount; the launcher
+# sets OPENCODE_CONFIG_PATH only as the default path for worker/API processes.
+# HOST_OPENCODE_DATA_DIR points to normal opencode auth data
+# (/home/your-user/.local/share/opencode). Set it for launcher deployments
+# so normal `opencode auth login` credentials are visible to spawned OpenCode
+# agent containers and can refresh auth metadata when required.
+# HOST_OPENCODE_XDG_DIR=/home/your-user/.config/opencode
+# HOST_OPENCODE_DIR=/home/your-user/.config/opencode
+# HOST_OPENCODE_LEGACY_DIR=/home/your-user/.opencode
+# HOST_OPENCODE_DATA_DIR=/home/your-user/.local/share/opencode
+
+# --- Mistral Vibe Configuration (only required when using a Vibe agent) ---
+# Must be an absolute path — do NOT use ~ or ${HOME} (see CLAUDE_CONFIG_PATH note).
+# VIBE_CONFIG_PATH=/home/your-user/.vibe
+# Used when VIBE_CONFIG_PATH does not provide credentials.
+# MISTRAL_API_KEY=
+VIBE_MAX_TURNS=1000
+VIBE_TIMEOUT_MS=3600000
+# Production launcher only — host paths for mounting agent credential directories
+# into containers. Omit any HOST_*_DIR to skip mounts for that agent.
+# All HOST_*_DIR values MUST be absolute paths (no ~ or relative paths).
+# HOST_CLAUDE_DIR=/home/your-user/.claude
+# HOST_CODEX_DIR=/home/your-user/.codex
+# HOST_ANTIGRAVITY_DIR=/home/your-user/.antigravity
+# HOST_VIBE_DIR=/home/your-user/.vibe
+# Required for Vibe Docker-outside-Docker: prompt files must be written to a
+# host-visible directory so spawned agent containers can bind-mount them.
+# Both should reference the same host path.
+# NOTE: These are required whenever Vibe agents are used with the launcher
+# (i.e. when MISTRAL_API_KEY is set), not only when HOST_VIBE_DIR is set.
+# Create the directory before starting: mkdir -p /tmp/propr-vibe-prompts
+# VIBE_PROMPT_CACHE_DIR=/tmp/propr-vibe-prompts
+# HOST_VIBE_PROMPT_CACHE_DIR=/tmp/propr-vibe-prompts
+
+# Dashboard API Configuration
+DASHBOARD_API_PORT=4000
+# Required in normal and demo mode for auth redirects.
+FRONTEND_URL=http://localhost:5173
+# Optional comma-separated redirect hosts for auth preview flows.
+# Entries are exact host matches by default. Prefix with "." or "*." only for
+# parent domains where every subdomain is trusted, for example .preview.example.com.
+# FRONTEND_URL is exact-only; COOKIE_DOMAIN allows subdomains when it starts with ".".
+# AUTH_REDIRECT_ALLOWED_HOSTS=preview.example.com
+
+# GitHub OAuth Configuration
+GH_OAUTH_CLIENT_ID=your_github_oauth_client_id
+GH_OAUTH_CLIENT_SECRET=your_github_oauth_client_secret
+GH_OAUTH_CALLBACK_URL=http://localhost:4000/api/auth/github/callback
+SESSION_SECRET=your-session-secret-here
+
+# Bearer Token Authentication (CLI)
+# Set to 'false' to disable Bearer token auth and only allow session-based login
+ENABLE_BEARER_AUTH=true
+
+# Demo Mode
+# Set to 'true' or '1' to allow read-only access without GitHub OAuth and block all mutating API requests.
+# Public demo deployments should use a curated config/database.
+PROPR_DEMO_MODE=false
+
+# --- SQLite Database ---
+# Path to SQLite database file (will be created if it doesn't exist)
+DB_FILENAME=./data/propr.sqlite
+
+# --- PR Preview Environment ---
+# Path to staging .env file (provides base configuration for PR previews)
+# PR-specific values (ports, API URLs) are passed as inline overrides
+STAGING_ENV_FILE=/path/to/staging/.env
+
+# Path to staging database file for seeding PR preview environments
+STAGING_DB_PATH=/path/to/staging/data/propr.sqlite
+
+# Enable preview environment routing (routes webhooks to PR preview instances)
+ENABLE_PREVIEW_ROUTING=false
+
+# The ProPR repository in 'owner/repo' format. Label events from this repo
+# trigger processor assignment changes. Defaults to 'integry/propr'.
+PROPR_REPO=integry/propr
+
+# The label that designates a ProPR PR as the active processor for webhook routing.
+# When this label is added to a ProPR repo PR, that PR's preview instance becomes
+# the active processor. Defaults to 'preview-env'.
+PROCESSOR_LABEL=preview-env
+
+# Host address for forwarding webhooks to PR preview instances.
+# Defaults to 'http://host.docker.internal' for Docker environments.
+# HOST_GATEWAY_ADDRESS=http://host.docker.internal

package/dist/assets/env.example.txt

@@ -0,0 +1,198 @@
+# GitHub App Configuration
+GH_APP_ID=your_app_id
+GH_PRIVATE_KEY_PATH=./path/to/your-app-private-key.pem
+GH_INSTALLATION_ID=your_installation_id
+
+# Host path to the GitHub App private key (.pem). Recommended when running via
+# the `propr` CLI or launcher: the key is bind-mounted (read-only) into the app
+# containers and GH_PRIVATE_KEY_PATH above is overridden to point at it, so you
+# can keep the key anywhere on the host instead of staging it under data/.
+# Must be an absolute host path (no '~').
+# HOST_GH_PRIVATE_KEY=/home/your-user/propr/app-private-key.pem
+
+# GitHub auth: token relay (shared-app path) — ALTERNATIVE to the App private key
+# above. When PROPR_GH_RELAY_URL is set, the backend fetches short-lived
+# installation tokens from a vendor-run relay instead of minting them from a
+# private key, so you don't need to hold the shared App's key. You still set
+# GH_INSTALLATION_ID (which installation), but GH_PRIVATE_KEY_PATH /
+# HOST_GH_PRIVATE_KEY are not required in relay mode.
+#   PROPR_GH_RELAY_URL   — https URL of the relay (http only allowed for localhost)
+#   PROPR_GH_RELAY_TOKEN — the durable relay credential issued for your install
+# PROPR_GH_RELAY_URL=https://relay.propr.dev/v1
+# PROPR_GH_RELAY_TOKEN=your_relay_token
+# Optional: force a mode explicitly instead of inferring (app | relay | demo).
+# GH_AUTH_MODE=relay
+
+# Logging Configuration
+LOG_LEVEL=info
+NODE_ENV=development
+
+# Daemon Configuration
+GITHUB_REPOS_TO_MONITOR=owner/repo1,owner/repo2
+POLLING_INTERVAL_MS=60000
+
+# Config Repository (for dynamic repository management)
+CONFIG_REPO=https://github.com/integry/gitfix-config.git
+
+# Issue Detection Configuration
+PRIMARY_PROCESSING_LABELS=AI,propr
+PR_LABEL=propr
+
+# Redis Configuration
+REDIS_HOST=127.0.0.1
+REDIS_PORT=6379
+
+# Queue Configuration
+GITHUB_ISSUE_QUEUE_NAME=github-issue-processor
+WORKER_CONCURRENCY=2
+COMMENT_BATCH_DELAY_MS=3000
+
+# Summarization fallback/cooldown controls
+# Promote the configured summarization fallback to primary after this many
+# primary quota failures for the same agent/model. Defaults to 3.
+# SUMMARIZATION_FALLBACK_PROMOTE_THRESHOLD=3
+# Pause normal summarization jobs for a repository/branch after both primary
+# and fallback paths fail. Defaults to 3600000 (1 hour).
+# SUMMARIZATION_QUOTA_COOLDOWN_MS=3600000
+
+# Webhook Configuration
+# Webhooks are received by the dashboard API service (port 4000)
+ENABLE_GITHUB_WEBHOOKS=false
+GH_WEBHOOK_SECRET=your-webhook-secret
+
+# System Task Authorization
+# Secret used to sign system task requests (e.g., revert operations)
+# Generate with: openssl rand -hex 32
+SYSTEM_TASK_SECRET=
+# Maximum age (ms) for signed system task tokens. Increase if jobs frequently expire
+# due to queue backlog or worker downtime. Defaults to 7200000 (2 hours).
+# SYSTEM_TASK_TOKEN_MAX_AGE_MS=7200000
+
+# Worker Configuration
+
+# PR Comment Monitoring Configuration
+GITHUB_BOT_USERNAME=your_bot_username
+GITHUB_USER_WHITELIST=
+GITHUB_USER_BLACKLIST=
+PR_FOLLOWUP_TRIGGER_KEYWORDS=!propr
+# With a whitelist set, polling resolves who applied the trigger label from the
+# issue timeline (page 1 + the most recent N pages). Raise this if long-lived
+# issues with very long timelines are skipped with "Could not determine label
+# applier". Default: 5.
+# LABEL_APPLIER_TIMELINE_MAX_PAGES=5
+
+# Git Configuration
+GIT_CLONES_BASE_PATH=/tmp/git-processor/clones
+GIT_WORKTREES_BASE_PATH=/tmp/git-processor/worktrees
+GIT_DEFAULT_BRANCH=main
+GIT_SHALLOW_CLONE_DEPTH=
+
+# Claude Code Configuration
+CLAUDE_DOCKER_IMAGE=propr/agent-claude:latest
+# Must be an absolute path — do NOT use ~ or ${HOME} (neither is expanded in
+# .env files parsed by Node or in Docker bind mounts).
+# CLAUDE_CONFIG_PATH=/home/your-user/.claude
+CLAUDE_CONFIG_PATH=
+CLAUDE_MAX_TURNS=10
+CLAUDE_TIMEOUT_MS=300000
+CODEX_TIMEOUT_MS=3600000
+
+# Antigravity Configuration
+ANTIGRAVITY_TIMEOUT_MS=300000
+
+# OpenCode Configuration
+OPENCODE_TIMEOUT_MS=3600000
+# Launcher credential mount paths (required when using docker/launcher).
+# HOST_OPENCODE_XDG_DIR points to the XDG config directory
+# (/home/your-user/.config/opencode)
+# and takes precedence over HOST_OPENCODE_DIR.
+# HOST_OPENCODE_DIR is accepted as a fallback alias for HOST_OPENCODE_XDG_DIR.
+# HOST_OPENCODE_LEGACY_DIR points to the legacy /home/your-user/.opencode directory.
+# The saved agent configPath still controls the runtime mount; the launcher
+# sets OPENCODE_CONFIG_PATH only as the default path for worker/API processes.
+# HOST_OPENCODE_DATA_DIR points to normal opencode auth data
+# (/home/your-user/.local/share/opencode). Set it for launcher deployments
+# so normal `opencode auth login` credentials are visible to spawned OpenCode
+# agent containers and can refresh auth metadata when required.
+# HOST_OPENCODE_XDG_DIR=/home/your-user/.config/opencode
+# HOST_OPENCODE_DIR=/home/your-user/.config/opencode
+# HOST_OPENCODE_LEGACY_DIR=/home/your-user/.opencode
+# HOST_OPENCODE_DATA_DIR=/home/your-user/.local/share/opencode
+
+# --- Mistral Vibe Configuration (only required when using a Vibe agent) ---
+# Must be an absolute path — do NOT use ~ or ${HOME} (see CLAUDE_CONFIG_PATH note).
+# VIBE_CONFIG_PATH=/home/your-user/.vibe
+# Used when VIBE_CONFIG_PATH does not provide credentials.
+# MISTRAL_API_KEY=
+VIBE_MAX_TURNS=1000
+VIBE_TIMEOUT_MS=3600000
+# Production launcher only — host paths for mounting agent credential directories
+# into containers. Omit any HOST_*_DIR to skip mounts for that agent.
+# All HOST_*_DIR values MUST be absolute paths (no ~ or relative paths).
+# HOST_CLAUDE_DIR=/home/your-user/.claude
+# HOST_CODEX_DIR=/home/your-user/.codex
+# Antigravity is Gemini-based and keeps its credentials under ~/.gemini, so the
+# directory name intentionally differs from the variable name.
+# HOST_ANTIGRAVITY_DIR=/home/your-user/.gemini
+# HOST_VIBE_DIR=/home/your-user/.vibe
+# Required for Vibe Docker-outside-Docker: prompt files must be written to a
+# host-visible directory so spawned agent containers can bind-mount them.
+# Both should reference the same host path.
+# NOTE: These are required whenever Vibe agents are used with the launcher
+# (i.e. when MISTRAL_API_KEY is set), not only when HOST_VIBE_DIR is set.
+# Create the directory before starting: mkdir -p /tmp/propr-vibe-prompts
+# VIBE_PROMPT_CACHE_DIR=/tmp/propr-vibe-prompts
+# HOST_VIBE_PROMPT_CACHE_DIR=/tmp/propr-vibe-prompts
+
+# Dashboard API Configuration
+DASHBOARD_API_PORT=4000
+# Required in normal and demo mode for auth redirects.
+FRONTEND_URL=http://localhost:5173
+# Optional comma-separated redirect hosts for auth preview flows.
+# Entries are exact host matches by default. Prefix with "." or "*." only for
+# parent domains where every subdomain is trusted, for example .preview.example.com.
+# FRONTEND_URL is exact-only; COOKIE_DOMAIN allows subdomains when it starts with ".".
+# AUTH_REDIRECT_ALLOWED_HOSTS=preview.example.com
+
+# GitHub OAuth Configuration
+GH_OAUTH_CLIENT_ID=your_github_oauth_client_id
+GH_OAUTH_CLIENT_SECRET=your_github_oauth_client_secret
+GH_OAUTH_CALLBACK_URL=http://localhost:4000/api/auth/github/callback
+SESSION_SECRET=your-session-secret-here
+
+# Bearer Token Authentication (CLI)
+# Set to 'false' to disable Bearer token auth and only allow session-based login
+ENABLE_BEARER_AUTH=true
+
+# Demo Mode
+# Set to 'true' or '1' to allow read-only access without GitHub OAuth and block all mutating API requests.
+# Public demo deployments should use a curated config/database.
+PROPR_DEMO_MODE=false
+
+# --- SQLite Database ---
+# Path to SQLite database file (will be created if it doesn't exist)
+DB_FILENAME=./data/propr.sqlite
+
+# --- PR Preview Environment ---
+# Path to staging .env file (provides base configuration for PR previews)
+# PR-specific values (ports, API URLs) are passed as inline overrides
+STAGING_ENV_FILE=/path/to/staging/.env
+
+# Path to staging database file for seeding PR preview environments
+STAGING_DB_PATH=/path/to/staging/data/propr.sqlite
+
+# Enable preview environment routing (routes webhooks to PR preview instances)
+ENABLE_PREVIEW_ROUTING=false
+
+# The ProPR repository in 'owner/repo' format. Label events from this repo
+# trigger processor assignment changes. Defaults to 'integry/propr'.
+PROPR_REPO=integry/propr
+
+# The label that designates a ProPR PR as the active processor for webhook routing.
+# When this label is added to a ProPR repo PR, that PR's preview instance becomes
+# the active processor. Defaults to 'preview-env'.
+PROCESSOR_LABEL=preview-env
+
+# Host address for forwarding webhooks to PR preview instances.
+# Defaults to 'http://host.docker.internal' for Docker environments.
+# HOST_GATEWAY_ADDRESS=http://host.docker.internal