pruff-skills 1.5.3 → 1.5.4

package/dist/cli.mjs

@@ -7587,6 +7587,10 @@ main()
   .finally(() => process.exit(0));
 `;
 const TENANT_CONFIG_PATH = join("scripts", "tenant", "tenant.config.ts");
+const TENANT_TYPES_PATH = join("scripts", "tenant", "types.ts");
+function tenantAdminSupportsSuperAdmin(typesSource) {
+	return /\bsuperAdmin\??\s*:/.test(typesSource);
+}
 function renderTenantConfig(v) {
 	return `import { CompanyType } from './consts';
 import { TenantScriptConfig } from './types';
@@ -7598,8 +7602,7 @@ const config: TenantScriptConfig = {
   companyTypes: [CompanyType.Intelligence],
   admin: {
     email: ${JSON.stringify(v.adminEmail)},
-    password: ${JSON.stringify(v.adminPassword)},
-    superAdmin: true,
+    password: ${JSON.stringify(v.adminPassword)},${v.superAdmin ? "\n    superAdmin: true," : ""}
   },
   additionalUsers: [],
   configurationFlags: [],
@@ -7876,7 +7879,9 @@ async function preflight() {
 	M.success("git · node · npm present");
 	if (!ensureGh()) return false;
 	if (!await ensureGitHubAuth()) return false;
-	return ensureGitCredentialHelper();
+	if (!ensureGitCredentialHelper()) return false;
+	ensurePackagesScope();
+	return true;
 }
 function ensureGh() {
 	if (has("gh")) return true;
@@ -7954,6 +7959,62 @@ function ensureGitCredentialHelper() {
 	M.error(`git has no credential helper for github.com, so cloning the private Pruff repos will fail.\n  Run ${import_picocolors.default.cyan("gh auth setup-git")} (or ${import_picocolors.default.cyan("gh auth login -h github.com -p https -w")} and answer yes to "Authenticate Git with your GitHub credentials?"), then re-run.`);
 	return false;
 }
+function ghTokenScopes(statusOutput) {
+	const line = statusOutput.split("\n").find((l) => l.includes("Token scopes:"));
+	if (!line) return null;
+	return (line.split("Token scopes:")[1] ?? "").split(",").map((scope) => scope.trim().replace(/^'|'$/g, "")).filter((scope) => scope !== "");
+}
+function hasPackagesScope(scopes) {
+	if (scopes === null) return true;
+	return scopes.includes("read:packages") || scopes.includes("write:packages");
+}
+function ghAuthStatusOutput() {
+	const r = spawnSync("gh", [
+		"auth",
+		"status",
+		"-h",
+		"github.com"
+	], { encoding: "utf-8" });
+	return `${r.stdout ?? ""}\n${r.stderr ?? ""}`;
+}
+function ensurePackagesScope() {
+	if (hasPackagesScope(ghTokenScopes(ghAuthStatusOutput()))) {
+		M.success("GitHub Packages access (read:packages)");
+		return;
+	}
+	const refresh = "gh auth refresh -h github.com -s read:packages";
+	if (process.stdout.isTTY) {
+		M.info("Granting read:packages to the gh token (private @pruff-tech packages)…");
+		run("gh", [
+			"auth",
+			"refresh",
+			"-h",
+			"github.com",
+			"-s",
+			"read:packages"
+		]);
+		if (hasPackagesScope(ghTokenScopes(ghAuthStatusOutput()))) {
+			M.success("GitHub Packages access (read:packages)");
+			return;
+		}
+	}
+	note("gh token lacks read:packages — dependency installs will 401.");
+	M.warn(`The gh token is missing ${import_picocolors.default.cyan("read:packages")}, so installing the private @pruff-tech packages will fail with 401.\n  Run ${import_picocolors.default.cyan(refresh)}, then re-run.`);
+}
+function packagesAuthEnv() {
+	if (process.env.NODE_AUTH_TOKEN) return void 0;
+	const { ok, out } = capture("gh", [
+		"auth",
+		"token",
+		"-h",
+		"github.com"
+	]);
+	return ok && out !== "" ? { NODE_AUTH_TOKEN: out } : void 0;
+}
+function serverSupportsSuperAdmin(serverPath) {
+	const typesPath = join(serverPath, TENANT_TYPES_PATH);
+	return existsSync(typesPath) && tenantAdminSupportsSuperAdmin(readFileSync(typesPath, "utf-8"));
+}
 function has(cmd) {
 	return spawnSync("command", ["-v", cmd], {
 		shell: true,
@@ -8114,13 +8175,13 @@ function installDeps(repo, workspace) {
 	}
 	const s = Y();
 	s.start(`Installing ${name} dependencies (${installCmd})…`);
-	const ok = run(installCmd, installArgs, target);
+	const ok = run(installCmd, installArgs, target, packagesAuthEnv());
 	if (ok && existsSync(join(target, "node_modules"))) s.stop(`${name} dependencies installed`);
 	else {
 		s.stop(import_picocolors.default.yellow(`${name} dependency install failed`));
 		note(`${name} dependencies failed to install.`);
 		if (ok) M.warn(`${installCmd} exited 0 but ${name}/node_modules is missing — install likely no-opped.`);
-		M.warn(`Run manually: ${import_picocolors.default.dim(`cd ${name} && ${installCmd} ${installArgs.join(" ")}`)}`);
+		M.warn(`Run manually: ${import_picocolors.default.dim(`cd ${name} && NODE_AUTH_TOKEN=$(gh auth token) ${installCmd} ${installArgs.join(" ")}`)}\n  A 401 from npm.pkg.github.com means the gh token lacks read:packages: ${import_picocolors.default.dim("gh auth refresh -h github.com -s read:packages")}`);
 	}
 }
 function writeWorkspaceClaudeMd(workspace) {
@@ -8571,7 +8632,8 @@ function setupLocalDatabase(serverPath, env) {
 		taxIdentifier: env.CLIENT_RUT ?? "",
 		companyName: env.CLIENT_NAME ?? clientId,
 		adminEmail,
-		adminPassword
+		adminPassword,
+		superAdmin: serverSupportsSuperAdmin(serverPath)
 	}), () => server.exec(SERVER_SCRIPT.createTenant));
 	s.stop(tenantCreated ? `Tenant "${clientId}" provisioned` : import_picocolors.default.yellow("Tenant provisioning failed"));
 	if (!tenantCreated) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pruff-skills",
-  "version": "1.5.3",
+  "version": "1.5.4",
   "description": "The official Pruff agent skills CLI",
   "type": "module",
   "bin": {