reposets 3.0.0 → 3.1.0

package/bin/reposets.js

@@ -15,10 +15,9 @@ import { listCommand } from "../cli/commands/list.js";
 import { nukeCommand } from "../cli/commands/nuke.js";
 import { validateCommand } from "../cli/commands/validate.js";
 import { Effect, Layer } from "effect";
-import { AppCache, AppStore } from "@effected/app";
+import { App, AppCache, AppStore } from "@effected/app";
 import { NodeRuntime, NodeServices } from "@effect/platform-node";
 import { CliAudience, CliRuntime, ConfigIssueRenderer, Fmt } from "@effected/cli";
-import { AppDirs, Xdg } from "@effected/xdg";
 import { Command } from "effect/cli";
 
 //#region src/cli/index.ts
@@ -33,18 +32,18 @@ import { Command } from "effect/cli";
 * `0.0.0 (dev build)` from every build until the version was threaded down
 * from here through {@link Invocation}.
 */
-const VERSION = "3.0.0";
+const VERSION = "3.1.0";
 /**
 * The application's directories: XDG resolution and the `reposets` namespace
 * under it.
 *
 * @remarks
-* Built the way `App.layer` builds its own (`AppDirs.layer` `provideMerge`
-* `Xdg.layer`), but without the two databases `App.layer` always opens. Every
-* command can resolve a path through this; resolving one creates nothing —
-* only an `ensure*` member does, and only the command that writes calls it.
+* `App.layerDirs` is the directories half of `App.layer`, without the two
+* databases `App.layer` always opens. Every command can resolve a path through
+* this; resolving one creates nothing — only an `ensure*` member does, and only
+* the command that writes calls it.
 */
-const DirsLive = Layer.provideMerge(AppDirs.layer({ namespace: "reposets" }), Xdg.layer);
+const DirsLive = App.layerDirs({ namespace: "reposets" });
 /**
 * The state database, `store.db` under the XDG state directory.
 *
@@ -182,6 +181,7 @@ NodeRuntime.runMain(CliRuntime.main(CliAudience.run(cli, { version: VERSION }),
 	env: {
 		audienceEnvVar: "REPOSETS_AUDIENCE",
 		log: { envVar: "REPOSETS_LOG_LEVEL" },
+		spansEnvVar: "REPOSETS_SPANS",
 		stderrIsTerminal: Effect.sync(() => process.stderr.isTTY === true)
 	},
 	render,

package/cli/commands/credentials.js

@@ -2,9 +2,9 @@ import { profileOwner } from "../../schemas/credentials.js";
 import { ReposetsCredentialsFile } from "../../services/ConfigFiles.js";
 import { Effect, Option } from "effect";
 import { CliInteractive, CliMessage, Doc } from "@effected/cli";
-import { AppDirs } from "@effected/xdg";
 import { CliError, Command, Flag } from "effect/cli";
 import { CliUi, Select, TextInput } from "@effected/cli/ui";
+import { AppDirs } from "@effected/xdg";
 
 //#region src/cli/commands/credentials.ts
 const EMPTY = { profiles: {} };
@@ -39,17 +39,42 @@ const SECRET_PREFIXES = [
 	"xoxb-"
 ];
 /**
+* A token embedded anywhere in a value — `op://v/ghp_…` — rather than leading it.
+*
+* @remarks
+* A prefix only counts at a word boundary and followed by a token-like body:
+* a run of at least 20 letters and digits for the GitHub and 1Password
+* prefixes (a `ghp_` token's body is 36), digits for a Slack bot token. Both
+* conditions keep names out: `devops_team` has no boundary before `ops_`, and
+* `op://Vault/ops_deploy_credentials/field` has no unbroken 20-character run
+* after it. `sk-` is deliberately absent — too common inside ordinary words to
+* mean anything away from the start of a value.
+*/
+const EMBEDDED_SECRET = /(?:^|[^A-Za-z0-9])(?:(?:gh[pousr]_|github_pat_|ops_)[A-Za-z0-9]{20}|xoxb-[0-9]{6})/;
+/**
+* A GitHub classic token from before prefixes: exactly 40 hex digits.
+*
+* @remarks
+* It carries no prefix and is under the length rule, and one that begins with
+* a letter is also a valid environment-variable name, so without this it is
+* accepted by `--env` and printed back in the confirmation line.
+*/
+const LEGACY_GITHUB_TOKEN = /^[0-9a-f]{40}$/i;
+/**
 * Whether a value looks like a pasted token rather than a reference or a name.
 *
 * @remarks
-* A known token prefix, or anything longer than 60 characters. The length rule
-* catches the tokens that carry no recognisable prefix, but it never applies to
-* an `op://` value: that is a 1Password reference by construction, none of the
-* token prefixes begins that way, and a real reference crosses 60 characters
-* easily once a vault or item name has spaces in it
-* (`op://Engineering Shared Vault/GitHub Production Deploy Token/credential`).
+* A known token prefix at the start, a token embedded anywhere
+* ({@link EMBEDDED_SECRET}), a pre-prefix GitHub token
+* ({@link LEGACY_GITHUB_TOKEN}), or anything longer than 60 characters. The
+* length rule catches the tokens that carry no recognisable prefix, but it
+* never applies to an `op://` value: that is a 1Password reference by
+* construction, none of the token prefixes begins that way, and a real
+* reference crosses 60 characters easily once a vault or item name has spaces
+* in it (`op://Engineering Shared Vault/GitHub Production Deploy Token/credential`).
+* A token pasted *into* a reference is still caught, by the embedded rule.
 */
-const looksLikeSecret = (value) => SECRET_PREFIXES.some((prefix) => value.startsWith(prefix)) || !value.startsWith("op://") && value.length > 60;
+const looksLikeSecret = (value) => SECRET_PREFIXES.some((prefix) => value.startsWith(prefix)) || EMBEDDED_SECRET.test(value) || LEGACY_GITHUB_TOKEN.test(value) || !value.startsWith("op://") && value.length > 60;
 /**
 * The explanation for a flag value {@link looksLikeSecret} catches — in any
 * flag, since a token pasted into `--profile` or `--username` would otherwise
@@ -167,8 +192,18 @@ const validName = (what) => (value) => value.trim() === "" ? `${what} is require
 * profile key, an owner or a reference, or reaches the confirmation line. The
 * text prompts' frames are cleared when they close, so a token typed and then
 * abandoned is not left in the terminal's scrollback; the accepted answers are
-* recorded in the confirmation line instead. While a value is being typed it
-* is visible — the kit's `TextInput` has no masked mode.
+* recorded in the confirmation line instead. The reference prompt — the one
+* field a token is most likely to be pasted into — is masked by the same rule
+* `validate` refuses on (`mask: looksLikeSecret`), so what is hidden is exactly
+* what is refused. The kit latches the mask once the rule answers true, until
+* the field is emptied, so editing a pasted token's prefix away never unmasks
+* the rest; a paste is masked from its first frame, and a token typed by hand
+* shows at most its public prefix (`ghp`) before the mask trips. A real
+* `op://` reference or variable name stays readable while it is typed.
+* `validate` sees the real text and refuses a token with a message that never
+* quotes it. The reference itself is echoed in the confirmation line, which is
+* where a typo in it shows. The name prompts are not masked: a name is read back as
+* it is typed.
 *
 * `op_service_account_token` is likewise not accepted: it comes from the
 * environment, so there is nothing to write here.
@@ -240,7 +275,8 @@ const createHandler = (input) => Effect.gen(function* () {
 		const reference = yield* ask(TextInput.screen({
 			message: kind === "op" ? "1Password reference" : "Environment variable name",
 			placeholder: kind === "op" ? "op://Vault/item/field" : "REPOSETS_GITHUB_TOKEN",
-			validate: validateReference(kind)
+			validate: validateReference(kind),
+			mask: looksLikeSecret
 		}), MISSING_REFERENCE, { clear: true });
 		return kind === "op" ? { op: reference } : { env: reference };
 	});

package/cli/commands/doctor.js

@@ -8,8 +8,8 @@ import { CredentialResolver, CredentialResolverLive } from "../../services/Crede
 import { ConfigFlag } from "../flags.js";
 import { Config, Console, Effect, FileSystem, Layer, Option, Path, Result } from "effect";
 import { CliMessage, Doc, SchemaIssueRenderer, Status } from "@effected/cli";
-import { AppDirs } from "@effected/xdg";
 import { Command } from "effect/cli";
+import { AppDirs } from "@effected/xdg";
 import { GitHubClient } from "@effected/github";
 import { Toml } from "@effected/toml";
 

package/cli/commands/init.js

@@ -3,9 +3,9 @@ import { Invocation } from "../../services/Invocation.js";
 import { configSchemaHost, credentialsSchemaHost, schemaDirective } from "../../schemas/hosted.js";
 import { Effect, FileSystem, Option, Path } from "effect";
 import { CliExit, CliMessage } from "@effected/cli";
-import { AppDirs } from "@effected/xdg";
 import { Command, Flag } from "effect/cli";
 import { CliUi, Select } from "@effected/cli/ui";
+import { AppDirs } from "@effected/xdg";
 
 //#region src/cli/commands/init.ts
 /**

package/cli/commands/nuke.js

@@ -3,9 +3,9 @@ import { Invocation } from "../../services/Invocation.js";
 import { CACHE_DB_FILENAME, STATE_DB_FILENAME } from "../../store/files.js";
 import { Effect, FileSystem, Path } from "effect";
 import { CliExit, CliInteractive, CliMessage, Doc } from "@effected/cli";
-import { AppDirs, Xdg } from "@effected/xdg";
 import { CliError, Command, Flag } from "effect/cli";
 import { CliUi, Confirm, MultiSelect } from "@effected/cli/ui";
+import { AppDirs, Xdg } from "@effected/xdg";
 
 //#region src/cli/commands/nuke.ts
 const forceFlag = Flag.Boolean("force").pipe(Flag.withDefault(false), Flag.withDescription("Delete without asking. Intended for scripts; there is no undo"));

package/cli/commands/sync.js

@@ -10,6 +10,7 @@ import { PHASE_NAMES } from "../../sync/phase.js";
 import { allPhases } from "../../sync/phases/index.js";
 import { SyncEngine, SyncEngineLive } from "../../sync/SyncEngine.js";
 import { syncSummaryBlock } from "../views/sync-progress-model.js";
+import { syncProgressView } from "../views/sync-progress-view.js";
 import { Console, Effect, Exit, Layer, Option, PubSub } from "effect";
 import { CliExit, CliInteractive, CliMessage, Doc } from "@effected/cli";
 import { CliError, Command, Flag } from "effect/cli";
@@ -136,7 +137,7 @@ const runUnderSyncView = (view, work) => Effect.scoped(Effect.gen(function* () {
 * nothing tears the frame. The view's committed final frame is the summary.
 *
 * Anyone else — a pipe, an agent, CI — gets no view and no React load: the
-* view module is imported dynamically on the drawing path only. The same
+* view's `render` is a `CliUi.lazyView`, and this path never mounts it. The same
 * summary block is printed statically with `Doc.print` instead.
 *
 * **Findings are failures, not diagnostics.** "No config found", a dangling
@@ -257,9 +258,8 @@ const syncHandler = (input) => Effect.gen(function* () {
 			return summary;
 		}).pipe(Effect.provide(sharedLayer));
 	};
-	const runWithView = Effect.promise(() => import("../views/sync-progress.js")).pipe(Effect.flatMap(({ syncProgressView }) => runUnderSyncView(syncProgressView, runSync)));
 	const interactive = yield* CliInteractive;
-	const report = interactive ? yield* runWithView : yield* runSync(void 0);
+	const report = interactive ? yield* runUnderSyncView(syncProgressView, runSync) : yield* runSync(void 0);
 	if (!interactive) yield* Doc.print([syncSummaryBlock({
 		dryRun: input.dryRun,
 		total,

package/cli/views/sync-progress-model.js

@@ -81,7 +81,6 @@ const isSyncRunStart = (event) => event._tag === "RunStarted";
 * @public
 */
 const isSyncRunEnd = (event) => event._tag === "RunEnded";
-const noun = (n, one, many) => n === 1 ? one : many;
 /**
 * The run's counts as one document block: `Dry run: 2/3 repos, 4 changes, 1
 * drifted, 0 errors`.
@@ -93,6 +92,10 @@ const noun = (n, one, many) => n === 1 ? one : many;
 * reader looks for, and a counter that vanishes at zero makes the line change
 * shape between runs.
 *
+* Plurals are the kit's `{ one, other }` labels. A counter shown as a share
+* of the headline's total — `repos` — agrees with that total (`0/1 repo`,
+* `1/3 repos`); every other counter agrees with its own count.
+*
 * @public
 */
 const syncSummaryBlock = (state) => Doc.counts({
@@ -102,13 +105,19 @@ const syncSummaryBlock = (state) => Doc.counts({
 	counters: [
 		Doc.counter(Status.core, "success", {
 			key: "repos",
-			label: noun(state.total, "repo", "repos"),
+			label: {
+				one: "repo",
+				other: "repos"
+			},
 			n: state.repos,
 			showZero: true
 		}),
 		Doc.counter(Status.core, "info", {
 			key: "changes",
-			label: noun(state.changes, "change", "changes"),
+			label: {
+				one: "change",
+				other: "changes"
+			},
 			n: state.changes,
 			showZero: true
 		}),
@@ -120,7 +129,10 @@ const syncSummaryBlock = (state) => Doc.counts({
 		}),
 		Doc.counter(Status.core, "failure", {
 			key: "errors",
-			label: noun(state.errors, "error", "errors"),
+			label: {
+				one: "error",
+				other: "errors"
+			},
 			n: state.errors,
 			showZero: true
 		})

package/cli/views/sync-progress-view.js

@@ -0,0 +1,32 @@
+import { initialSyncProgress, isSyncRunEnd, isSyncRunStart, reduceSyncProgress } from "./sync-progress-model.js";
+import { CliUi } from "@effected/cli/ui";
+
+//#region src/cli/views/sync-progress-view.ts
+/**
+* The sync progress view: every `CliUi.live` option but `events`.
+*
+* @remarks
+* Defined once and exported so the handler and its tests drive the same value —
+* a test that rebuilt the options would exercise a copy. `hosted` because a
+* run that cannot draw (a pipe, an agent, CI) has its own closing output — the
+* static summary `sync` prints — so the view must print nothing there; the
+* handler does not mount it on such a run in the first place.
+*
+* `render` is `CliUi.lazyView`: the JSX module is imported only when a run
+* first draws, so importing this module — and `sync` — loads neither React
+* nor Ink. It lives apart from the model because the JSX module imports the
+* model, and a lazy import back into it is still an import cycle.
+*
+* @public
+*/
+const syncProgressView = {
+	initial: initialSyncProgress,
+	reduce: reduceSyncProgress,
+	render: CliUi.lazyView(() => import("./sync-progress.js").then((module) => module.syncProgressRender)),
+	isStart: isSyncRunStart,
+	isTerminal: isSyncRunEnd,
+	mode: "hosted"
+};
+
+//#endregion
+export { syncProgressView };

package/cli/views/sync-progress.js

@@ -1,4 +1,4 @@
-import { initialSyncProgress, isSyncRunEnd, isSyncRunStart, reduceSyncProgress, syncSummaryBlock } from "./sync-progress-model.js";
+import { syncSummaryBlock } from "./sync-progress-model.js";
 import { Fmt } from "@effected/cli";
 import { DocView, Styled, useGlyphs } from "@effected/cli/ui";
 import { Box, Text } from "ink";
@@ -37,32 +37,19 @@ const SyncProgress = (props) => {
 	});
 };
 /**
-* The sync progress view: every `CliUi.live` option but `events`.
+* The sync progress view's `render`.
 *
 * @remarks
-* Defined once and exported so the handler and its test drive the same value —
-* a test that rebuilt the options would exercise a copy. `hosted` because a
-* run that cannot draw (a pipe, an agent, CI) has its own closing output — the
-* static summary `sync` prints — so the view must print nothing there; the
-* handler does not mount it on such a run in the first place.
-*
-* This module is the only one that holds JSX, and `sync` imports it
-* dynamically on the drawing path alone, so a non-interactive run never loads
-* React or Ink.
+* This module is the only one that holds JSX. It is loaded through
+* `CliUi.lazyView` by `syncProgressView` in `sync-progress-view.ts`, so only
+* a run that draws it ever loads React or Ink.
 *
 * @public
 */
-const syncProgressView = {
-	initial: initialSyncProgress,
-	reduce: reduceSyncProgress,
-	render: (state, frame) => /* @__PURE__ */ jsx(SyncProgress, {
-		state,
-		frame
-	}),
-	isStart: isSyncRunStart,
-	isTerminal: isSyncRunEnd,
-	mode: "hosted"
-};
+const syncProgressRender = (state, frame) => /* @__PURE__ */ jsx(SyncProgress, {
+	state,
+	frame
+});
 
 //#endregion
-export { syncProgressView };
+export { syncProgressRender };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "reposets",
-	"version": "3.0.0",
+	"version": "3.1.0",
 	"private": false,
 	"description": "CLI tool to sync GitHub repo settings, secrets and rulesets across personal repositories",
 	"keywords": [
@@ -49,14 +49,14 @@
 	"dependencies": {
 		"@1password/sdk": "^0.5.0",
 		"@effect/platform-node": "^4.0.0",
-		"@effected/app": "^0.20.0",
-		"@effected/cli": "^0.11.0",
-		"@effected/config-file": "^0.14.0",
+		"@effected/app": "^0.21.1",
+		"@effected/cli": "^0.12.0",
+		"@effected/config-file": "^0.14.2",
 		"@effected/env": "^0.1.0",
-		"@effected/github": "^0.15.0",
+		"@effected/github": "^0.15.1",
 		"@effected/glob": "^0.10.0",
-		"@effected/schemastore": "^0.20.0",
-		"@effected/store": "^0.12.0",
+		"@effected/schemastore": "^0.21.0",
+		"@effected/store": "^0.13.0",
 		"@effected/toml": "^0.11.0",
 		"@effected/walker": "^0.15.0",
 		"@effected/xdg": "^0.9.0",

package/services/SyncLogger.js

@@ -1,5 +1,5 @@
 import { Console, Context, Effect, Layer, PubSub, Ref } from "effect";
-import { CliTheme, Fmt, Status } from "@effected/cli";
+import { CliLog, CliTheme, Fmt, Status } from "@effected/cli";
 import { Audience } from "@effected/env";
 
 //#region src/services/SyncLogger.ts
@@ -47,8 +47,11 @@ function pluralize(resource, count) {
 * vocabulary: a change made is `success`, a dry run's `would …` is `info`, a
 * deletion and a drift are `warning`, a failure is `failure`, a skip is `skip`.
 * The glyph is painted for a person; an agent gets it unpainted and the text
-* plain, exactly as `CliMessage` does it. A failure's glyph is never painted:
-* it goes through the logger, which strips every escape a program logs. Headers
+* plain, through `CliTheme.forAudience` — the rule `CliMessage` paints by. The
+* failure lines with a glyph — the per-repository `error` line, at the action
+* lines' indent, and the closing `Sync complete with N errors:` header — go
+* through `CliLog.status`, which paints its glyph the same way on the log
+* channel (the logger strips every escape a program logs itself). Headers
 * (`group:`, `repo:`) take none — they are structure, not outcomes. The glyph
 * sits after the indent and before the padded verb, so the verbs still line
 * up with each other.
@@ -91,23 +94,21 @@ function SyncLoggerLive(config) {
 		const errors = yield* Ref.make([]);
 		const currentRepo = yield* Ref.make("");
 		const publish = (event) => events === void 0 ? Effect.void : PubSub.publish(events, event);
+		/** stdout's theme as this run's audience sees it: unpainted for an agent. */
+		const stdoutTheme = CliTheme.forAudience(theme.forStream("stdout"), audience.kind);
+		/** A status glyph for a report line on stdout. */
+		const mark = (status) => stdoutTheme.status(Status.core, status);
 		/**
-		* A status glyph for a report line on stdout: painted for a person,
-		* plain for an agent — who never gets an escape, whatever the terminal
-		* could do.
-		*/
-		const mark = (status) => audience.kind === "agent" ? Status.core.glyph(status, theme.glyphs) : theme.status(Status.core, status);
-		/**
-		* A status glyph for a failure line, never painted.
+		* A failure status line, glyph painted for a person, `indent` spaces in.
 		*
 		* @remarks
-		* Failures go through `Effect.logError`, and the kit's logger sanitises
-		* every line a program logs — escapes included — so a painted glyph
-		* would arrive as the bare glyph anyway. Painting it here would only be
-		* a promise the logger does not keep. The glyph itself survives, and in
-		* the ASCII set it is the word `[FAIL]`.
+		* `CliLog.status` logs at `Error` (the status's rank), so the line goes
+		* where `Effect.logError` goes — stderr — and its text is sanitised. The
+		* theme and audience this layer was built with are provided, so the
+		* glyph follows the same audience the stdout lines do. In the ASCII set
+		* the glyph is the word `[FAIL]`.
 		*/
-		const failureMark = Status.core.glyph("failure", theme.forStream("stderr").glyphs);
+		const emitFailure = (text, indent = 0) => CliLog.status(Status.core, "failure", text, { indent }).pipe(Effect.provideService(CliTheme, theme), Effect.provideService(Audience, audience));
 		const emit = (line) => Console.log(Fmt.sanitize(line));
 		/** An action line: indent, glyph, then the padded verb and its content. */
 		const action = (status, body) => Console.log(`    ${mark(status)} ${Fmt.sanitize(body)}`);
@@ -200,7 +201,7 @@ function SyncLoggerLive(config) {
 					context,
 					message
 				}]);
-				yield* emitError(`    ${failureMark} ${Fmt.sanitize(`error   ${context}: ${message}`)}`);
+				yield* emitFailure(`error   ${context}: ${message}`, 4);
 				yield* publish({
 					_tag: "Error",
 					repo,
@@ -212,7 +213,7 @@ function SyncLoggerLive(config) {
 				const errs = yield* Ref.get(errors);
 				if (errs.length === 0) yield* Console.log(`${mark("success")} Sync complete!`);
 				else {
-					yield* emitError(`${failureMark} Sync complete with ${errs.length} ${errs.length === 1 ? "error" : "errors"}:`);
+					yield* emitFailure(`Sync complete with ${errs.length} ${errs.length === 1 ? "error" : "errors"}:`);
 					for (const err of errs) yield* emitError(Fmt.sanitize(err.repo === "" ? `  ${err.context} — ${err.message}` : `  ${err.repo}: ${err.context} — ${err.message}`));
 				}
 				yield* publish({