Merge branch 'main' into becca/e2e-fixed-domains

Author: ottovlotto

.changeset/fix-mod-origin-and-private-repo-probe.md

@@ -0,0 +1,5 @@
+---
+"playground-cli": patch
+---
+
+`dot mod` no longer prints a misleading `[contracts] No origin configured — using dev fallback (Alice) for query dry-run` warning when the user is signed in via `dot init`. The CDM meta-registry lookup that resolves the live playground registry address now receives the signer's address as `defaultOrigin`. `dot mod` also lazy-probes the picked app's repository between picker dismount and the setup steps, surfacing a clear "private or does not exist" error before any files are written when a publisher has flipped repo visibility after deploying.

CHANGELOG.md

@@ -1,5 +1,11 @@
 # playground-cli
 
+## 0.16.17
+
+### Patch Changes
+
+- 88d78d3: `dot deploy --modable` now rejects private GitHub repositories at preflight with a clear error message instead of silently failing later. `dot mod` also surfaces a more actionable error when it encounters a private or non-existent repository instead of the misleading "pin one in metadata.branch" hint.
+
 ## 0.16.16
 
 ### Patch Changes

CLAUDE.md

@@ -23,7 +23,7 @@ These are things that aren't self-evident from reading the code and have bitten
 - **Throttle TUI info updates** — bulletin-deploy logs per-chunk and builds (vite/next) stream thousands of lines/sec. Calling `setState` on every log event floods React's reconciler with so much backpressure the process can balloon past 20 GB and freeze the OS. `RunningStage` coalesces "latest info" updates to ≤10/sec via a ref + timer and caps line length at 160 chars. Any new hot-path event sink should do the same; don't hook raw per-line streams directly into Ink state.
 - **Process-guard safety net** (`src/utils/process-guard.ts`) — deploy pipelines open several long-lived WebSockets + child processes and any one of them can keep the event loop alive after the TUI visibly finishes, turning `dot` into a zombie that accumulates retry buffers indefinitely (seen climbing past 25 GB). We defend in depth: (1) `installSignalHandlers()` catches SIGINT/TERM/HUP + `unhandledRejection` and forces cleanup + exit within 3 s; (2) `scheduleHardExit()` installs an `unref`'d timer that kills the process if the event loop doesn't drain within a grace period; (3) `startMemoryWatchdog()` aborts if RSS exceeds 4 GB — a generous cap because legit deploys on Bun SEA binaries routinely touch 1–1.5 GB from runtime-metadata decoding + Bun's JSC heap + Ink yoga. Do NOT re-add a per-window growth detector: we tried 300 MB / 3 s and it false-positived on the single-burst metadata-loading spike, aborting deploys that would have succeeded. Set `DOT_MEMORY_TRACE=1` to stream per-sample RSS/heap/external stats — useful when diagnosing a real leak report. **Telemetry bootstrap** (`src/bootstrap.ts`) is the FIRST import in `src/index.ts`. It sets `BULLETIN_DEPLOY_USE_AMBIENT_SENTRY=1` and `BULLETIN_DEPLOY_HOST_APP=playground-cli` before `bulletin-deploy` can evaluate, then maps `DOT_TELEMETRY`/internal-context detection to `BULLETIN_DEPLOY_TELEMETRY`. Do not leave `BULLETIN_DEPLOY_TELEMETRY` unset while setting the host app: `bulletin-deploy@0.7.6` treats `playground-cli` as an internal host, which would enable deploy telemetry for external users. `BULLETIN_DEPLOY_MEM_REPORT` is not forced off by default anymore because upstream guards the Bun-incompatible memory-report path. Any new long-running command should register a cleanup hook via `onProcessShutdown()`.
 - **Parser MUST NOT emit an event per log line.** `DeployLogParser.feed()` is called for every console line bulletin-deploy prints — hundreds per deploy on the happy path, thousands if retries fire. We intentionally emit events ONLY for phase-banner matches and `[N/M]` chunk progress. Everything else returns `null`. Adding a catch-all `info` emit turns the parser into a firehose that allocates ~200 bytes × thousands of lines, and was a measurable contributor to chunk-upload memory pressure.
-- **`dot mod` is GitHub-tarball-only and must stay that way.** `src/utils/mod/source.ts` downloads from `codeload.github.com` (no auth, no `git`/`gh` required for the public-repo case) and extracts via `node:zlib` + the pure-JS `tar` package. Do NOT re-introduce `git clone` or `gh repo fork` paths — both would re-add a hard tooling requirement and the fork path was specifically removed because GitHub caps you to one fork per source-repo per account, which broke "mod the same starter twice." A non-modable app (no `metadata.repository`) returns a hard error from `dot mod`; the interactive picker filters those out so the user never sees an unmoddable option.
+- **`dot mod` is GitHub-tarball-only and must stay that way.** `src/utils/mod/source.ts` downloads from `codeload.github.com` (no auth, no `git`/`gh` required for the public-repo case) and extracts via `node:zlib` + the pure-JS `tar` package. Do NOT re-introduce `git clone` or `gh repo fork` paths — both would re-add a hard tooling requirement and the fork path was specifically removed because GitHub caps you to one fork per source-repo per account, which broke "mod the same starter twice." A non-modable app (no `metadata.repository`) returns a hard error from `dot mod`; the interactive picker filters those out so the user never sees an unmoddable option. The picker does NOT pre-probe each app's repo visibility, because that would burn the 60 req/hr anonymous GitHub API quota on every `dot mod`. Instead, `runModCommand` lazy-probes the picked app once via `assertPublicGitHubRepo()` between picker dismount and `SetupScreen` mount; `dot deploy --modable` already rejects private repos at deploy time, so this fires only when a publisher has flipped visibility post-publish.
 - **`ensureGhAuthed()` does NOT shell out to `gh auth login`.** Even from the interactive deploy, Ink owns stdout + raw-mode stdin and a `stdio: "inherit"` child would race Ink's `useInput` for keystrokes — producing garbled output and dropped key events. Both interactive and non-interactive paths that need GitHub repo creation fail with the same actionable message: run `gh auth login` once outside `dot`, then retry. Existing `origin` URLs do not require `gh` auth. Properly suspending Ink to hand off stdio is possible but requires unmounting + re-rendering with state preservation, and we deemed that complexity not worth it for a one-time-per-machine speedbump. If you ever do implement it, the wiring point is `ModablePreflightStage` in `src/commands/deploy/DeployScreen.tsx`.
 - **`metadata.repository` is set ONLY when `--modable` is opted in.** Older code in `publishToPlayground` would silently probe `git remote get-url origin` and stuff whatever it found into the metadata, which surprised users who didn't realise their fork was being advertised. The new contract: `runDeploy` takes an explicit `repositoryUrl: string | null`, and `publishToPlayground` writes the field iff that param is non-null. The CLI command is responsible for resolving the URL upstream via `src/utils/deploy/modable.ts::resolveRepositoryUrl()`, which uses an existing `origin` URL without pushing, or runs `gh repo create --public --push` to set up a fresh public repo when no origin exists. Re-deploys never delete user repos.
 - **`startMemoryWatchdog()` runs for both `dot deploy` and `dot mod`.** Mod's tarball download is a streaming pipe through `node:zlib` + `tar.extract()`, and a stuck IPFS gateway or a malformed tarball can leak buffers. Same 4 GB cap, same worker-thread sampler. Any new top-level command that does meaningful I/O should also call `startMemoryWatchdog()` and register `stopWatchdog` via `onProcessShutdown()`.

package.json

@@ -1,7 +1,7 @@
 {
     "name": "playground-cli",
     "description": "CLI for Polkadot Playground",
-    "version": "0.16.16",
+    "version": "0.16.17",
     "private": true,
     "type": "module",
     "packageManager": "pnpm@10.32.1",

src/commands/mod/index.ts

@@ -10,6 +10,7 @@ import { AppBrowser, type AppEntry } from "./AppBrowser.js";
 import { SetupScreen } from "./SetupScreen.js";
 import { defaultRepoName } from "../../utils/git/repoName.js";
 import { runCliCommand } from "../../cli-runtime.js";
+import { assertPublicGitHubRepo, ModablePreflightError } from "../../utils/deploy/modable.js";
 
 export const modCommand = new Command("mod")
     .description("Mod a playground app — clone the source as a fresh project to customise")
@@ -56,6 +57,41 @@ async function runModCommand(
             metadata = picked;
         }
 
+        // Lazy verify that the picked app's source repository is publicly
+        // reachable. The picker filters apps that have NO repository URL, but
+        // a publisher can flip a repo to private after deploying, which would
+        // break the anonymous codeload download a few steps down. Bail here
+        // with a clean message so the user can pick a different app before we
+        // mount SetupScreen and start writing files.
+        //
+        // The direct-domain path (`dot mod some-domain.dot`) has no metadata
+        // at this point and falls through to SetupScreen, where the same
+        // 404/401 surfaces from `resolveDefaultBranch` as a step failure.
+        // Slightly less polished UX, but lifting the metadata fetch up here
+        // just for symmetry would be a larger refactor.
+        if (metadata?.repository) {
+            const repoUrl = metadata.repository;
+            try {
+                await withSpan(
+                    "cli.mod.repo-check",
+                    "verify repository is public",
+                    { "cli.mod.repo": repoUrl },
+                    () => assertPublicGitHubRepo(repoUrl),
+                );
+            } catch (err) {
+                if (err instanceof ModablePreflightError) {
+                    console.error();
+                    console.error(`  ${err.message}.`);
+                    console.error(
+                        `  Pick a different app or ask the publisher to make the repo public.`,
+                    );
+                    process.exitCode = 1;
+                    return;
+                }
+                throw err;
+            }
+        }
+
         const targetDir = await withSpan("cli.mod.resolve-target", "resolve target directory", () =>
             resolveTargetDir({ domain }),
         );

src/utils/contractManifest.test.ts

@@ -80,10 +80,31 @@ describe("resolveLiveContractAddresses", () => {
             expect.arrayContaining([
                 expect.objectContaining({ name: "getAddress", type: "function" }),
             ]),
+            expect.any(Object),
         );
         expect(getAddressQueryMock).toHaveBeenCalledWith(PLAYGROUND_REGISTRY_CONTRACT);
     });
 
+    it("forwards defaultOrigin to createContractFromClient when provided", async () => {
+        getAddressQueryMock.mockResolvedValue({
+            success: true,
+            value: { isSome: true, value: liveAddress },
+        });
+
+        const assetHub = {} as any;
+        const origin = "5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY";
+        await resolveLiveContractAddresses(assetHub, [PLAYGROUND_REGISTRY_CONTRACT], {
+            defaultOrigin: origin,
+        });
+
+        expect(createContractFromClientMock).toHaveBeenCalledWith(
+            assetHub,
+            CDM_REGISTRY_ADDRESS,
+            expect.any(Array),
+            expect.objectContaining({ defaultOrigin: origin }),
+        );
+    });
+
     it("omits libraries when the live registry has no address", async () => {
         getAddressQueryMock.mockResolvedValue({
             success: true,
@@ -136,4 +157,47 @@ describe("withLiveContractAddresses", () => {
             ]),
         ).rejects.toThrow(/CDM meta-registry did not return live address/);
     });
+
+    it("forwards defaultOrigin through withLiveContractAddresses", async () => {
+        getAddressQueryMock.mockResolvedValue({
+            success: true,
+            value: { isSome: true, value: liveAddress },
+        });
+
+        const assetHub = {} as any;
+        const origin = "5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY";
+        await withLiveContractAddresses(manifest(), assetHub, [PLAYGROUND_REGISTRY_CONTRACT], {
+            defaultOrigin: origin,
+        });
+
+        expect(createContractFromClientMock).toHaveBeenCalledWith(
+            assetHub,
+            CDM_REGISTRY_ADDRESS,
+            expect.any(Array),
+            expect.objectContaining({ defaultOrigin: origin }),
+        );
+    });
+
+    it("forwards defaultOrigin through withRequiredLiveContractAddresses", async () => {
+        getAddressQueryMock.mockResolvedValue({
+            success: true,
+            value: { isSome: true, value: liveAddress },
+        });
+
+        const assetHub = {} as any;
+        const origin = "5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY";
+        await withRequiredLiveContractAddresses(
+            manifest(),
+            assetHub,
+            [PLAYGROUND_REGISTRY_CONTRACT],
+            { defaultOrigin: origin },
+        );
+
+        expect(createContractFromClientMock).toHaveBeenCalledWith(
+            assetHub,
+            CDM_REGISTRY_ADDRESS,
+            expect.any(Array),
+            expect.objectContaining({ defaultOrigin: origin }),
+        );
+    });
 });

src/utils/contractManifest.ts

@@ -102,14 +102,27 @@ function patchContractAddresses(
     return patched;
 }
 
+/**
+ * Options for the meta-registry lookup. `defaultOrigin` is forwarded to the
+ * underlying contract handle so the read-only `getAddress` dry-run uses the
+ * caller's logged-in account instead of the dev fallback (Alice). Without it,
+ * `@polkadot-apps/contracts` emits a misleading `[contracts] No origin
+ * configured` warning even when the user has signed in via `dot init`.
+ */
+export interface LiveContractLookupOptions {
+    defaultOrigin?: string;
+}
+
 export async function resolveLiveContractAddresses(
     assetHub: PolkadotClient,
     libraries: readonly string[] = LIVE_CONTRACTS,
+    options: LiveContractLookupOptions = {},
 ): Promise<Record<string, HexString>> {
     const registry = await createContractFromClient(
         assetHub,
         CDM_REGISTRY_ADDRESS,
         CDM_REGISTRY_ABI,
+        { defaultOrigin: options.defaultOrigin },
     );
     const entries = await withoutReviveTraceNoise(() =>
         Promise.all(
@@ -133,17 +146,19 @@ export async function withLiveContractAddresses(
     manifest: CdmJson,
     assetHub: PolkadotClient,
     libraries: readonly string[] = LIVE_CONTRACTS,
+    options: LiveContractLookupOptions = {},
 ): Promise<CdmJson> {
-    const liveAddresses = await resolveLiveContractAddresses(assetHub, libraries);
+    const liveAddresses = await resolveLiveContractAddresses(assetHub, libraries, options);
     return patchContractAddresses(manifest, liveAddresses);
 }
 
 export async function withRequiredLiveContractAddresses(
     manifest: CdmJson,
     assetHub: PolkadotClient,
     libraries: readonly string[] = LIVE_CONTRACTS,
+    options: LiveContractLookupOptions = {},
 ): Promise<CdmJson> {
-    const liveAddresses = await resolveLiveContractAddresses(assetHub, libraries);
+    const liveAddresses = await resolveLiveContractAddresses(assetHub, libraries, options);
     const missing = libraries.filter((library) => !liveAddresses[library]);
     if (missing.length > 0) {
         throw new Error(`CDM meta-registry did not return live address for ${missing.join(", ")}`);

src/utils/deploy/modable.test.ts

@@ -3,7 +3,12 @@ import { execFileSync } from "node:child_process";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { decideRepositoryAction, resolveRepositoryUrl } from "./modable.js";
+import {
+    decideRepositoryAction,
+    resolveRepositoryUrl,
+    assertPublicGitHubRepo,
+    ModablePreflightError,
+} from "./modable.js";
 
 describe("decideRepositoryAction", () => {
     it("uses the existing origin when present", () => {
@@ -35,6 +40,63 @@ describe("decideRepositoryAction", () => {
     });
 });
 
+describe("assertPublicGitHubRepo", () => {
+    it("does nothing for a public repo", async () => {
+        const mockFetch: typeof fetch = async () =>
+            new Response(JSON.stringify({ private: false }), { status: 200 });
+        await expect(
+            assertPublicGitHubRepo("https://github.com/foo/bar", mockFetch),
+        ).resolves.toBeUndefined();
+    });
+
+    it("throws for a private repo (API reports private: true)", async () => {
+        const mockFetch: typeof fetch = async () =>
+            new Response(JSON.stringify({ private: true }), { status: 200 });
+        await expect(
+            assertPublicGitHubRepo("https://github.com/org/secret", mockFetch),
+        ).rejects.toThrow(ModablePreflightError);
+    });
+
+    it("throws for a 404 response (private or missing)", async () => {
+        const mockFetch: typeof fetch = async () => new Response("Not Found", { status: 404 });
+        await expect(
+            assertPublicGitHubRepo("https://github.com/org/ghost", mockFetch),
+        ).rejects.toThrow(/private or does not exist/i);
+    });
+
+    it("throws for a 401 response", async () => {
+        const mockFetch: typeof fetch = async () => new Response("Unauthorized", { status: 401 });
+        await expect(
+            assertPublicGitHubRepo("https://github.com/org/ghost", mockFetch),
+        ).rejects.toThrow(ModablePreflightError);
+    });
+
+    it("does nothing for a non-GitHub URL", async () => {
+        const mockFetch: typeof fetch = async () => {
+            throw new Error("should not be called");
+        };
+        await expect(
+            assertPublicGitHubRepo("https://gitlab.com/foo/bar", mockFetch),
+        ).resolves.toBeUndefined();
+    });
+
+    it("does nothing on network error (fail open)", async () => {
+        const mockFetch: typeof fetch = async () => {
+            throw new Error("ECONNREFUSED");
+        };
+        await expect(
+            assertPublicGitHubRepo("https://github.com/foo/bar", mockFetch),
+        ).resolves.toBeUndefined();
+    });
+
+    it("skips check for rate-limit (403) responses", async () => {
+        const mockFetch: typeof fetch = async () => new Response("rate limited", { status: 403 });
+        await expect(
+            assertPublicGitHubRepo("https://github.com/foo/bar", mockFetch),
+        ).resolves.toBeUndefined();
+    });
+});
+
 describe("resolveRepositoryUrl", () => {
     let tmp: string | null = null;
 
@@ -43,6 +105,11 @@ describe("resolveRepositoryUrl", () => {
         tmp = null;
     });
 
+    const publicFetch: typeof fetch = async () =>
+        new Response(JSON.stringify({ private: false }), { status: 200 });
+    const privateFetch: typeof fetch = async () =>
+        new Response(JSON.stringify({ private: true }), { status: 200 });
+
     it("uses an existing origin without pushing", async () => {
         tmp = mkdtempSync(join(tmpdir(), "pg-modable-origin-"));
         execFileSync("git", ["init"], { cwd: tmp, stdio: "ignore" });
@@ -51,8 +118,21 @@ describe("resolveRepositoryUrl", () => {
             stdio: "ignore",
         });
 
-        await expect(resolveRepositoryUrl({ cwd: tmp, repoName: null })).resolves.toBe(
-            "git@github.com:foo/bar",
-        );
+        await expect(
+            resolveRepositoryUrl({ cwd: tmp, repoName: null, fetch: publicFetch }),
+        ).resolves.toBe("git@github.com:foo/bar");
+    });
+
+    it("throws when the existing origin is a private GitHub repo", async () => {
+        tmp = mkdtempSync(join(tmpdir(), "pg-modable-private-"));
+        execFileSync("git", ["init"], { cwd: tmp, stdio: "ignore" });
+        execFileSync("git", ["remote", "add", "origin", "https://github.com/org/secret.git"], {
+            cwd: tmp,
+            stdio: "ignore",
+        });
+
+        await expect(
+            resolveRepositoryUrl({ cwd: tmp, repoName: null, fetch: privateFetch }),
+        ).rejects.toThrow(ModablePreflightError);
     });
 });