syndai 0.4.1 → 0.6.0

package/src/secrets.js

@@ -0,0 +1,317 @@
+// `syndai env`, `syndai secrets` and `syndai run`: a workspace's environments and secrets from
+// a terminal, Doppler-style (docs: syndai.ai/docs/cli, "Secrets and environments").
+//
+// The environment: --env, else SYNDAI_ENV, else the directory's link (`syndai env use`,
+// `syndai link --env`), else the workspace default (where runs go). The project: the usual
+// resolver (--app, SYNDAI_APP, the link, the git remote, the only project), never a picker;
+// its values layer over the shared ones, as in a run. `set`, `rm` and `import` write shared
+// values unless --project.
+//
+// A value never travels through argv, JSON output, an error or a log line: `set` reads it from
+// a hidden prompt or stdin, `get` prints it only to a terminal (or with --plain), `download`
+// writes a 0600 file (or a pipe), and `run` hands values to the child's environment only.
+
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import { constants } from "node:os";
+import path from "node:path";
+import { productionStepUp } from "./auth.js";
+import { NAME, parseDotenv, serializeDotenv } from "./dotenv.js";
+import { ApiError, CliError, EXIT } from "./errors.js";
+import { environmentBySlug, listEnvironments, projectLabel, resolveProject } from "./projects.js";
+import { findLink, saveLink, writeFileAtomic } from "./store.js";
+import { ask, askSecret, readAll } from "./ui.js";
+
+/** The slug the flags, SYNDAI_ENV or the link name; null means the workspace default. */
+function chosenSlug(ctx) {
+  return ctx.flags.env || ctx.io.env.SYNDAI_ENV || findLink(ctx.paths, ctx.io.cwd)?.environment || null;
+}
+
+/** The chosen environment, or the default one (both validated against the workspace). */
+async function chosenEnvironment(ctx, environments) {
+  const envs = environments ?? (await listEnvironments(ctx));
+  const slug = chosenSlug(ctx);
+  if (slug) return environmentBySlug(ctx, slug, envs);
+  const fallback = envs.find((env) => env.default) ?? envs[0];
+  if (!fallback) throw new CliError(EXIT.FAILED, "This workspace has no environments.", { next: "https://app.syndai.ai" });
+  return fallback;
+}
+
+/** The project whose values layer over the shared ones, or null (shared only). */
+function layeredProject(ctx) {
+  return resolveProject(ctx, { app: ctx.flags.app, required: false, picker: false });
+}
+
+/** The project a write targets: shared (null) unless --project. */
+async function writeTarget(ctx) {
+  if (!ctx.flags.project) return null;
+  return resolveProject(ctx, { app: ctx.flags.app, picker: false });
+}
+
+const scopeOf = (project) => (project ? `project ${projectLabel(project)}` : "shared");
+
+// --- syndai env --------------------------------------------------------------------------
+
+export async function env(ctx, [action = "ls", slug, ...extra]) {
+  if (action === "ls" && !slug) return envList(ctx);
+  if (action === "use" && slug && !extra.length) return envUse(ctx, slug);
+  throw new CliError(EXIT.USAGE, "Usage: syndai env ls | syndai env use <env>");
+}
+
+async function envList(ctx) {
+  const envs = await listEnvironments(ctx);
+  const current = (await chosenEnvironment(ctx, envs)).slug;
+  const rows = envs.map((e) => ({ ...e, current: e.slug === current }));
+  const width = Math.max(...rows.map((e) => e.slug.length), 4);
+  ctx.ui.result(
+    { environments: rows, current },
+    rows
+      .map((e) => `${e.current ? "*" : " "} ${e.slug.padEnd(width)}  ${e.name}  (${e.role}${e.default ? ", default" : ""})`)
+      .join("\n"),
+  );
+  return EXIT.OK;
+}
+
+async function envUse(ctx, slug) {
+  const environment = await environmentBySlug(ctx, slug);
+  const { paths, io } = ctx;
+  const here = findLink(paths, io.cwd);
+  // The nearest link keeps its project; with none, this directory gets an environment-only one.
+  const dir = here?.dir ?? path.resolve(io.cwd);
+  const { dir: _dir, ...kept } = here ?? { customer_id: await ctx.customerId() };
+  saveLink(paths, dir, { ...kept, environment: environment.slug });
+  ctx.ui.result({ dir, environment: environment.slug }, `${dir} now uses ${environment.slug}.`);
+  return EXIT.OK;
+}
+
+// --- syndai secrets ----------------------------------------------------------------------
+
+export async function secrets(ctx, [action = "ls", ...args]) {
+  const handler = SECRET_ACTIONS[action];
+  if (!handler) {
+    throw new CliError(EXIT.USAGE, "Usage: syndai secrets [ls | set KEY | rm KEY | import FILE|- | get KEY | download]");
+  }
+  return handler(ctx, args);
+}
+
+/** One positional secret name; never echoes what was typed (it may be a pasted value). */
+function secretName(args, verb) {
+  if (args.length !== 1 || args[0].includes("=")) {
+    throw new CliError(EXIT.USAGE, `syndai secrets ${verb} takes one name; a value never goes on the command line.`, {
+      next: verb === "set" ? "syndai secrets set KEY   (then type the value, or pipe it on stdin)" : null,
+    });
+  }
+  if (!NAME.test(args[0])) {
+    throw new CliError(EXIT.USAGE, "A secret name is uppercase letters, digits and _ (like API_TOKEN).");
+  }
+  return args[0];
+}
+
+const SECRET_ACTIONS = {
+  async ls(ctx, args) {
+    if (args.length) throw new CliError(EXIT.USAGE, "Usage: syndai secrets [ls]");
+    const environment = await chosenEnvironment(ctx);
+    const project = await layeredProject(ctx);
+    const { secrets: rows } = await ctx.client.call("listSecrets");
+    const shown = rows
+      .filter((s) => s.environment === environment.slug && (!s.repository_id || s.repository_id === project?.id))
+      .map((s) => ({
+        key_name: s.key_name,
+        environment: s.environment,
+        scope: s.repository_id ? "project" : "shared",
+        repository_id: s.repository_id,
+        updated_at: s.updated_at,
+      }));
+    const width = Math.max(...shown.map((s) => s.key_name.length), 4);
+    const human = shown.length
+      ? [
+          `${"NAME".padEnd(width)}  SCOPE    UPDATED`,
+          ...shown.map((s) => `${s.key_name.padEnd(width)}  ${s.scope.padEnd(7)}  ${s.updated_at.slice(0, 10)}`),
+        ].join("\n")
+      : `No secrets in ${environment.slug} yet. Add one: syndai secrets set KEY`;
+    ctx.ui.result({ environment: environment.slug, project_id: project?.id ?? null, secrets: shown }, human);
+    return EXIT.OK;
+  },
+
+  async set(ctx, args) {
+    const { io, ui } = ctx;
+    const name = secretName(args, "set");
+    let value;
+    if (io.stdin.isTTY) {
+      if (!ui.interactive) {
+        throw new CliError(EXIT.USAGE, "Nobody can type the value here; pipe it on stdin.", {
+          next: `printf %s "$VALUE" | syndai secrets set ${name}`,
+        });
+      }
+      value = await askSecret(io, `Value for ${name} (hidden): `);
+    } else {
+      value = (await readAll(io.stdin)).replace(/\r?\n$/, "");
+    }
+    if (!value) throw new CliError(EXIT.USAGE, `No value for ${name}: type it at the prompt or pipe it on stdin.`);
+    const environment = await chosenEnvironment(ctx);
+    const project = await writeTarget(ctx);
+    const { secret } = await ctx.client.call("putSecret", {
+      params: { key_name: name },
+      body: { value, environment: environment.slug, ...(project ? { repository_id: project.id } : {}) },
+    });
+    ui.result(
+      { key_name: name, environment: environment.slug, scope: project ? "project" : "shared", repository_id: project?.id ?? null, updated_at: secret.updated_at },
+      `Set ${name} in ${environment.slug} (${scopeOf(project)}).`,
+    );
+    return EXIT.OK;
+  },
+
+  async rm(ctx, args) {
+    const { flags, io, ui } = ctx;
+    const name = secretName(args, "rm");
+    const environment = await chosenEnvironment(ctx);
+    const project = await writeTarget(ctx);
+    const where = `${environment.slug} (${scopeOf(project)})`;
+    if (!flags.yes) {
+      if (!ui.interactive) {
+        throw new CliError(EXIT.USAGE, "Removing a secret needs --yes when nobody can confirm it.", {
+          next: `syndai secrets rm ${name} --yes`,
+        });
+      }
+      const answer = await ask(io, `Remove ${name} from ${where}? [y/N] `);
+      if (!/^y/i.test(answer)) {
+        ui.result({ key_name: name, removed: false }, "Kept.");
+        return EXIT.OK;
+      }
+    }
+    await ctx.client.call("deleteSecret", {
+      params: { key_name: name },
+      query: { environment: environment.slug, repository_id: project?.id },
+    });
+    ui.result({ key_name: name, environment: environment.slug, removed: true }, `Removed ${name} from ${where}.`);
+    return EXIT.OK;
+  },
+
+  async import(ctx, args) {
+    const { io, ui } = ctx;
+    if (args.length !== 1) throw new CliError(EXIT.USAGE, "Usage: syndai secrets import FILE|-");
+    const [source] = args;
+    let text;
+    try {
+      text = source === "-" ? await readAll(io.stdin) : fs.readFileSync(path.resolve(io.cwd, source), "utf8");
+    } catch (err) {
+      throw new CliError(EXIT.USAGE, `Cannot read ${source} (${err.code ?? "unreadable"}).`);
+    }
+    const items = parseDotenv(text);
+    if (!items.length) throw new CliError(EXIT.USAGE, `${source} has no KEY=VALUE lines.`);
+    const environment = await chosenEnvironment(ctx);
+    const project = await writeTarget(ctx);
+    await ctx.client.call("importSecrets", {
+      body: { items, environment: environment.slug, ...(project ? { repository_id: project.id } : {}) },
+    });
+    const names = items.map((item) => item.key_name);
+    ui.result(
+      { environment: environment.slug, scope: project ? "project" : "shared", imported: names.length, names },
+      `Imported ${names.length} value${names.length === 1 ? "" : "s"} into ${environment.slug} (${scopeOf(project)}): ${names.join(", ")}.`,
+    );
+    return EXIT.OK;
+  },
+
+  async get(ctx, args) {
+    const { io, flags } = ctx;
+    const name = secretName(args, "get");
+    if (flags.json) throw new CliError(EXIT.USAGE, "JSON never carries a secret value; use --plain.");
+    if (!io.stdout.isTTY && !flags.plain) {
+      throw new CliError(EXIT.USAGE, "Not printing a secret value into a pipe or a file without --plain.", {
+        next: `syndai secrets get ${name} --plain`,
+      });
+    }
+    const { environment, values } = await resolveValues(ctx, [name]);
+    if (!(name in values)) throw new CliError(EXIT.FAILED, `${name} is not set in ${environment}.`, { next: "syndai secrets" });
+    // --plain: the exact bytes, for $(...) and pipes; a terminal gets a newline.
+    io.stdout.write(flags.plain ? values[name] : `${values[name]}\n`);
+    return EXIT.OK;
+  },
+
+  async download(ctx, args) {
+    const { io, flags, ui } = ctx;
+    if (args.length) throw new CliError(EXIT.USAGE, "Usage: syndai secrets download [-o FILE]");
+    if (!flags.output && (io.stdout.isTTY || flags.json)) {
+      throw new CliError(EXIT.USAGE, "Pass -o FILE: a terminal (or --json) never gets the values.", {
+        next: "syndai secrets download -o .env",
+      });
+    }
+    const { environment, values } = await resolveValues(ctx);
+    const text = serializeDotenv(values);
+    const names = Object.keys(values).sort();
+    if (!flags.output) {
+      io.stdout.write(text);
+      return EXIT.OK;
+    }
+    const file = path.resolve(io.cwd, flags.output);
+    writeFileAtomic(file, text, 0o600);
+    if (notIgnored(file)) {
+      ui.progress(ui.yellow(`Warning: ${flags.output} is not ignored by git; add it to .gitignore so it is never committed.`));
+    }
+    ui.result(
+      { file, environment, count: names.length, names },
+      `Wrote ${names.length} value${names.length === 1 ? "" : "s"} from ${environment} to ${file} (mode 600).`,
+    );
+    return EXIT.OK;
+  },
+};
+
+/** True only inside a git checkout that does not ignore `file` (outside one: false). */
+function notIgnored(file) {
+  try {
+    execFileSync("git", ["check-ignore", "-q", path.basename(file)], {
+      cwd: path.dirname(file),
+      stdio: "ignore",
+      timeout: 3000,
+    });
+    return false; // exit 0: ignored
+  } catch (err) {
+    return err.status === 1; // 1: not ignored; 128 (no repo) or no git: nothing to warn about
+  }
+}
+
+/**
+ * The chosen environment's merged values (`names` narrows them). A production environment
+ * the server refuses (no approved step-up) gets one browser step-up on a terminal, whose grant
+ * rides only this command's retry.
+ */
+async function resolveValues(ctx, names) {
+  const slug = chosenSlug(ctx);
+  const project = await layeredProject(ctx);
+  const body = {
+    ...(slug ? { environment: slug } : {}),
+    ...(project ? { repository_id: project.id } : {}),
+    ...(names ? { names } : {}),
+  };
+  try {
+    return await ctx.client.call("resolveSecrets", { body });
+  } catch (err) {
+    if (!(err instanceof ApiError && err.code === "PRODUCTION_STEP_UP_REQUIRED")) throw err;
+    const grant = await productionStepUp(ctx);
+    if (!grant) throw err;
+    return ctx.client.call("resolveSecrets", { body: { ...body, production_grant: grant } });
+  }
+}
+
+// --- syndai run --------------------------------------------------------------------------
+
+/** `syndai run [--env E] [--] <command>...`: the child alone gets the values; its exit code is ours. */
+export async function run(ctx, command) {
+  const { io, ui } = ctx;
+  if (!command.length) throw new CliError(EXIT.USAGE, "Usage: syndai run [--env E] [--] <command> [args...]");
+  const { environment, values } = await resolveValues(ctx);
+  const count = Object.keys(values).length;
+  ui.progress(ui.dim(`Injected ${count} value${count === 1 ? "" : "s"} from ${environment}`));
+  let exit;
+  try {
+    exit = await io.exec(command[0], command.slice(1), { ...io.env, ...values });
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      ui.progress(`${ui.red("error:")} command not found: ${command[0]}`);
+      return 127;
+    }
+    throw err;
+  }
+  if (exit.signal) return 128 + (constants.signals[exit.signal] ?? 0);
+  return exit.code ?? EXIT.FAILED;
+}

package/src/ui.js

@@ -59,6 +59,56 @@ export async function ask(io, question) {
   }
 }
 
+/**
+ * Ask for a secret without echoing it, in raw mode: Enter ends it, Ctrl-C interrupts, Backspace
+ * edits, an escape sequence (an arrow key) is dropped. A terminal that cannot hide typing is
+ * refused rather than echoing, and so is a pasted multi-line value (it would be cut at its
+ * first line): both go through stdin instead.
+ */
+export async function askSecret(io, question) {
+  const { stdin } = io;
+  if (typeof stdin.setRawMode !== "function") {
+    throw new CliError(EXIT.USAGE, "This terminal can't hide what you type; pipe the value on stdin instead.");
+  }
+  if (io.signal.aborted) throw interrupted();
+  io.stderr.write(question);
+  stdin.setRawMode(true);
+  stdin.setEncoding("utf8");
+  stdin.resume();
+  return new Promise((resolve, reject) => {
+    let value = "";
+    const finish = (err) => {
+      stdin.removeListener("data", onData);
+      io.signal.removeEventListener("abort", onAbort);
+      stdin.setRawMode(false);
+      stdin.pause();
+      io.stderr.write("\n");
+      if (err) reject(err);
+      else resolve(value);
+    };
+    const onAbort = () => finish(interrupted());
+    const onData = (chunk) => {
+      // An escape sequence (ESC [ ... final byte) is a key like an arrow, never part of a value.
+      const keys = chunk.replace(/\u001b\[[0-9;?]*[@-~]|\u001b./g, "");
+      for (let i = 0; i < keys.length; i++) {
+        const ch = keys[i];
+        if (ch === "\r" || ch === "\n") {
+          if (keys.slice(i + 1).replace(/^[\r\n]+/, "")) {
+            return finish(new CliError(EXIT.USAGE, "That value has more than one line; pipe it on stdin instead."));
+          }
+          return finish();
+        }
+        if (ch === "\u0003") return finish(interrupted());
+        if (ch === "\u0004") return finish(value ? null : new CliError(EXIT.NEEDS_YOU, "No answer: input closed."));
+        if (ch === "\u007f" || ch === "\b") value = Array.from(value).slice(0, -1).join("");
+        else value += ch;
+      }
+    };
+    stdin.on("data", onData);
+    io.signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
 /** Release stdin so the process can exit (called once a command is done). */
 export function closeInput(io) {
   readers.get(io.stdin)?.rl.close();
@@ -83,6 +133,11 @@ export function openBrowser(url) {
   }
 }
 
+/** `review`'s rule for a hand-off page: open it on a terminal; the caller always prints it. */
+export function openPage({ ui, io }, url) {
+  if (ui.interactive && !ui.json) io.openUrl(url);
+}
+
 /** Show long text through $PAGER on a terminal; print it plainly otherwise. */
 export function page(proc, text) {
   if (!proc.stdout.isTTY) {

package/src/watch.js

@@ -5,14 +5,18 @@
 // cursor. Ctrl-C only detaches: it never sends a cancel. `--logs` also tails the run's SSE
 // events (resuming with Last-Event-ID) next to the loop.
 
-import { ApiError, CliError, EXIT, explain } from "./errors.js";
+import { ApiError, CliError, EXIT, UnavailableError, explain } from "./errors.js";
 import { backoffMs } from "./http.js";
-import { ask, ulid } from "./ui.js";
+import { ask, openPage, ulid } from "./ui.js";
 
 const POLL_WAIT_S = 45;
 const MIN_POLL_GAP_MS = 1000;
 const DEADLINE_GRACE_MS = 2000;
 const TIMED_OUT = Symbol("timed out");
+// A deploy answers 502/503 for a minute or two, longer than one request's retries: the
+// watch keeps polling through it and gives up only after this long without an answer.
+const OUTAGE_MAX_MS = 10 * 60_000;
+const OUTAGE_MAX_WAIT_MS = 30_000;
 
 // Exit code per ChangeState state (docs: syndai.ai/docs/cli, "Exit codes").
 const STATE_EXIT = {
@@ -21,6 +25,7 @@ const STATE_EXIT = {
   ready: EXIT.OK,
   live: EXIT.OK,
   live_unverified: EXIT.UNVERIFIED,
+  unverified: EXIT.UNVERIFIED,
   failed: EXIT.FAILED,
   reverted: EXIT.FAILED,
   cancelled: EXIT.FAILED,
@@ -35,6 +40,7 @@ export function nextFor(state) {
   const id = state.run_id;
   if (state.state === "needs_input") return `syndai answer ${id}`;
   if (state.state === "held") return `syndai review ${id}`;
+  if (state.state === "unverified") return state.pr_url ?? state.run_url ?? null;
   if (state.state === "ready") return `syndai go-live ${id}`;
   if (state.state === "live_unverified") return `syndai watch ${id}`;
   return state.done ? null : `syndai watch ${id}`;
@@ -55,6 +61,8 @@ export function describe(state) {
       return `Held: ${state.held?.message ?? state.held?.reason ?? "needs your review"}`;
     case "ready":
       return `Ready for review${headline}`;
+    case "unverified":
+      return `Delivered, but checks could not be verified${headline}`;
     case "live":
       return `Live: ${state.live_url ?? state.project?.live_url ?? ""}`.trim();
     case "live_unverified":
@@ -68,12 +76,19 @@ export function describe(state) {
 export function finish(ctx, state, { exitCode = exitFor(state), next = nextFor(state) } = {}) {
   const { ui } = ctx;
   const lines = [describe(state)];
+  for (const link of questionLinks(state)) lines.push(`Connect it here: ${link}`);
+  if (state.pr_url) lines.push(ui.dim(state.pr_url));
   if (state.run_url) lines.push(ui.dim(state.run_url));
   ui.result({ ...state, ...(next ? { next } : {}) }, lines.join("\n"));
   if (next && !ui.json) ui.progress(`Next: ${next}`);
   return exitCode;
 }
 
+/** The pages an open question needs (a connection to make), each an absolute portal URL. */
+function questionLinks(state) {
+  return state.state === "needs_input" ? (state.needs_input ?? []).map((q) => q.link).filter(Boolean) : [];
+}
+
 export async function getChange(ctx, runId) {
   return ctx.client.call("changeState", { params: { run_id: runId }, query: { wait: 0 } });
 }
@@ -95,6 +110,8 @@ export async function watchChange(ctx, runId, { timeoutMs = null, untilNot = nul
   let last = null;
   let lastLine = null;
   const answered = new Set(); // a state read before our answer landed must not ask again
+  let outageSince = null;
+  let outageTries = 0;
   try {
     for (;;) {
       const remaining = deadline === null ? Number.POSITIVE_INFINITY : deadline - io.now();
@@ -111,14 +128,24 @@ export async function watchChange(ctx, runId, { timeoutMs = null, untilNot = nul
         });
       } catch (err) {
         if (err === TIMED_OUT) return timedOut(ctx, runId, last);
-        throw err;
+        if (!(err instanceof UnavailableError)) throw err;
+        outageSince ??= io.now();
+        if (io.now() - outageSince >= OUTAGE_MAX_MS) throw err;
+        if (outageTries++ === 0) ui.progress(ui.dim(`· Syndai is unreachable (${err.message}); still watching`));
+        await io.sleep(Math.min(OUTAGE_MAX_WAIT_MS, backoffMs(outageTries + 4)), io.signal);
+        continue;
       }
+      outageSince = null;
+      outageTries = 0;
       const line = describe(state);
       const changed = line !== lastLine || state.cursor !== cursor;
       const final =
         (state.done && state.state !== untilNot) || (state.state === "needs_input" && !ui.interactive);
       if (final) return finish(ctx, state);
-      if (line !== lastLine) ui.progress(`${ui.dim("·")} ${line}`);
+      if (line !== lastLine) {
+        ui.progress(`${ui.dim("·")} ${line}`);
+        if (state.pr_url) ui.progress(ui.dim(state.pr_url));
+      }
       lastLine = line;
       cursor = state.cursor ?? cursor;
       last = state;
@@ -162,6 +189,10 @@ function timedOut(ctx, runId, last) {
 export async function answerInteractively(ctx, runId, questions) {
   for (const question of questions) {
     ctx.ui.progress(ctx.ui.bold(question.summary ?? "A question about your change"));
+    if (question.link) {
+      ctx.ui.progress(`Connect it here: ${question.link}`);
+      openPage(ctx, question.link);
+    }
     const entries = [];
     for (const input of question.inputs ?? []) {
       const entry = await askInput(ctx, input);