Merge branch 'vnext' of https://github.com/pksorensen/pks-cli into vnext

pksorensen · pksorensen · commit 53791eae6cdb · 2026-03-04T17:44:01.000Z
diff --git a/.github/workflows/build-base-images.yml b/.github/workflows/build-base-images.yml
@@ -7,6 +7,7 @@ on:
       - vnext
     paths:
       - 'templates/base-images/**'
+      - 'src/**'
   workflow_dispatch:
     inputs:
       image:
@@ -94,8 +95,8 @@ jobs:
       - name: Build and push
         uses: docker/build-push-action@v5
         with:
-          context: templates/base-images
-          file: templates/base-images/${{ matrix.image.dockerfile }}
+          context: ${{ matrix.image.context || 'templates/base-images' }}
+          file: ${{ matrix.image.dockerfile }}
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
@@ -182,7 +182,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '24'
           registry-url: 'https://registry.npmjs.org'
 
       - name: Download npm packages
@@ -192,8 +192,6 @@ jobs:
           path: ./packages
 
       - name: Publish to npm
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           VERSION="${{ needs.release-please.outputs.cli_version }}"
 
@@ -207,7 +205,7 @@ jobs:
           fi
 
           echo "Publishing version $VERSION to '$TAG' channel..."
-          PUBLISH_FLAGS="--access public --tag $TAG"
+          PUBLISH_FLAGS="--access public --tag $TAG --provenance"
 
           # Publish platform packages first (they are optionalDependencies)
           for package in ./packages/pks-cli-cli-{linux,osx,win}-*.tgz; do
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
@@ -1,7 +1,7 @@
 {
-  "src": "5.0.0-rc.1",
-  "templates/devcontainer": "5.0.0-rc.1",
-  "templates/claude-dotnet-9": "5.0.0-rc.1",
-  "templates/claude-dotnet-10-full": "5.0.0-rc.1",
-  "templates/pks-fullstack": "5.0.0-rc.1"
+  "src": "5.1.3-rc.28",
+  "templates/devcontainer": "4.0.0-rc.11",
+  "templates/claude-dotnet-9": "3.0.0-rc.11",
+  "templates/claude-dotnet-10-full": "4.0.0-rc.11",
+  "templates/pks-fullstack": "3.0.0-rc.13"
 }
diff --git a/release-please-config.vnext.json b/release-please-config.vnext.json
@@ -2,7 +2,7 @@
   "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
   "prerelease": true,
   "prerelease-type": "rc",
-  "separate-pull-requests": false,
+  "separate-pull-requests": true,
   "bump-minor-pre-major": true,
   "bump-patch-for-minor-pre-major": true,
   "include-v-in-tag": true,
diff --git a/src/CHANGELOG.md b/src/CHANGELOG.md
diff --git a/src/Commands/Ado/AdoInitCommand.cs b/src/Commands/Ado/AdoInitCommand.cs
@@ -7,7 +7,9 @@
 namespace PKS.Commands.Ado;
 
 /// <summary>
-/// Interactive Azure DevOps authentication via OAuth2 authorization code + PKCE
+/// Interactive Azure DevOps authentication via OAuth2 authorization code + PKCE.
+/// Opens browser for user consent, exchanges code for tokens, and stores
+/// credentials for use with git credential helper.
 /// </summary>
 [Description("Authenticate with Azure DevOps")]
 public class AdoInitCommand : Command<AdoInitCommand.Settings>
diff --git a/src/Commands/Ado/AdoSettings.cs b/src/Commands/Ado/AdoSettings.cs
@@ -3,6 +3,9 @@
 
 namespace PKS.Commands.Ado;
 
+/// <summary>
+/// Shared settings for Azure DevOps commands.
+/// </summary>
 public class AdoSettings : CommandSettings
 {
     [CommandOption("-v|--verbose")]
diff --git a/src/Commands/Ado/AdoStatusCommand.cs b/src/Commands/Ado/AdoStatusCommand.cs
@@ -6,7 +6,8 @@
 namespace PKS.Commands.Ado;
 
 /// <summary>
-/// Display current Azure DevOps authentication status
+/// Displays current Azure DevOps authentication status including user profile,
+/// selected organization, and token refresh timestamps.
 /// </summary>
 [Description("Show Azure DevOps authentication status")]
 public class AdoStatusCommand : Command<AdoSettings>
@@ -49,6 +50,8 @@ private async Task<int> ExecuteAsync()
         table.AddRow("Org URL", Markup.Escape($"https://dev.azure.com/{credentials.SelectedOrg}"));
         table.AddRow("Authenticated", credentials.CreatedAt.ToString("yyyy-MM-dd HH:mm:ss UTC"));
         table.AddRow("Last Refreshed", credentials.LastRefreshedAt.ToString("yyyy-MM-dd HH:mm:ss UTC"));
+        var tokenStatus = string.IsNullOrEmpty(credentials.RefreshToken) ? "[red]Missing[/]" : "[green]Present[/]";
+        table.AddRow("Refresh Token", tokenStatus);
 
         _console.Write(table);
         return 0;
diff --git a/src/Commands/GitHub/Runner/RunnerStartCommand.cs b/src/Commands/GitHub/Runner/RunnerStartCommand.cs
@@ -135,7 +135,8 @@ public async Task<int> ExecuteAsync(CommandContext context, Settings settings)
             await using var credentialServer = new GitCredentialServer(
                 _authService,
                 firstRegistration.Id,
-                msg => {
+                msg =>
+                {
                     try { File.AppendAllText(logPath, $"[{DateTime.UtcNow:yyyy-MM-dd HH:mm:ss}] [cred-server] {msg}\n"); } catch { }
                 });
             await credentialServer.StartAsync();
diff --git a/src/Infrastructure/Services/Runner/GitCredentialServer.cs b/src/Infrastructure/Services/Runner/GitCredentialServer.cs
@@ -73,12 +73,15 @@ public async Task StartAsync(CancellationToken ct = default)
         await _app.StartAsync(ct);
 
         // Make socket world-accessible so container users (e.g. 'node') can connect
-        if (File.Exists(_socketPath))
+        if (OperatingSystem.IsLinux() || OperatingSystem.IsMacOS())
         {
-            File.SetUnixFileMode(_socketPath,
-                UnixFileMode.UserRead | UnixFileMode.UserWrite | UnixFileMode.UserExecute |
-                UnixFileMode.GroupRead | UnixFileMode.GroupWrite | UnixFileMode.GroupExecute |
-                UnixFileMode.OtherRead | UnixFileMode.OtherWrite | UnixFileMode.OtherExecute);
+            if (File.Exists(_socketPath))
+            {
+                File.SetUnixFileMode(_socketPath,
+                    UnixFileMode.UserRead | UnixFileMode.UserWrite | UnixFileMode.UserExecute |
+                    UnixFileMode.GroupRead | UnixFileMode.GroupWrite | UnixFileMode.GroupExecute |
+                    UnixFileMode.OtherRead | UnixFileMode.OtherWrite | UnixFileMode.OtherExecute);
+            }
         }
     }
 
diff --git a/src/Program.cs b/src/Program.cs
@@ -17,7 +17,6 @@
 using PKS.Commands.Agentics;
 using PKS.Commands.Agentics.Runner;
 using PKS.Commands.Ado;
-using PKS.Infrastructure.Services.Runner;
 using Spectre.Console;
 using Spectre.Console.Cli;
 using System.Text;
diff --git a/src/pks-cli.csproj b/src/pks-cli.csproj
@@ -12,7 +12,7 @@
     <PackAsTool>true</PackAsTool>
     <ToolCommandName>pks</ToolCommandName>
     <PackageId>pks-cli</PackageId>
-    <PackageVersion>5.0.0-rc.1</PackageVersion>
+    <PackageVersion>5.1.3-rc.28</PackageVersion>
     <Authors>PKS Team</Authors>
     <Description>The next agentic CLI for .NET developers - Poul's Killer Swarms</Description>
     <PackageTags>cli;dotnet;agentic;developer-tools</PackageTags>
diff --git a/src/version.txt b/src/version.txt
@@ -1 +1 @@
-5.0.0-rc.1
+5.1.3-rc.28
diff --git a/templates/base-images/base-images.json b/templates/base-images/base-images.json
@@ -6,7 +6,8 @@
       "name": "pks-fullstack-base",
       "displayName": "PKS Fullstack Development Base",
       "description": "Base image for fullstack development with Node.js 20, .NET 8+10, Playwright, DevTunnel CLI, Git Credential Manager, Aspire CLI, and Claude Code",
-      "dockerfile": "pks-fullstack-base/Dockerfile",
+      "dockerfile": "templates/base-images/pks-fullstack-base/Dockerfile",
+      "context": ".",
       "registry": "ghcr.io/pksorensen",
       "tags": ["latest", "1.0.0"],
       "platforms": ["linux/amd64"],
diff --git a/templates/base-images/pks-fullstack-base/Dockerfile b/templates/base-images/pks-fullstack-base/Dockerfile
@@ -1,5 +1,20 @@
 FROM mcr.microsoft.com/dotnet/sdk:10.0 AS dotnet
 
+# Build pks-cli as a self-contained binary
+FROM mcr.microsoft.com/dotnet/sdk:10.0 AS pks-build
+WORKDIR /src
+COPY src/pks-cli.csproj .
+RUN dotnet restore -r linux-x64
+COPY src/ .
+COPY templates/ ../templates/
+RUN dotnet publish -c Release -r linux-x64 \
+    -p:PublishSelfContained=true \
+    -p:PublishSingleFile=true \
+    -p:PublishTrimmed=false \
+    -p:PublishReadyToRun=true \
+    -p:EmbedTemplates=true \
+    -o /out
+
 FROM node:20
 
 ARG TZ
@@ -198,6 +213,66 @@ RUN set -e && \
     echo "✓ Git Credential Manager installed (not configured — enable manually if needed)"
 # ============================================================================
 
+# ============================================================================
+# PKS CLI Installation + Privilege Separation
+# ============================================================================
+# Dedicated pks user owns the token cache — node can execute pks via sudo
+# but cannot read the stored credentials directly.
+#
+# For Azure DevOps auth (interactive devcontainer):
+#   sudo -u pks pks ado init        # one-time browser auth
+#   sudo -u pks pks ado status      # check auth state
+#   git clone https://dev.azure.com/org/project/_git/repo  # just works
+#
+# The credential helper is scoped to dev.azure.com only — GitHub uses
+# VS Code's injected credentials or the runner's socket-based helper.
+
+USER root
+
+# Create pks system user with home directory for token storage
+RUN adduser --system --home /home/pks --shell /bin/false pks && \
+    mkdir -p /home/pks/.pks-cli && \
+    chown -R pks:nogroup /home/pks/.pks-cli && \
+    chmod 700 /home/pks/.pks-cli
+
+# Install pks-cli binary
+COPY --from=pks-build /out/pks-cli /usr/local/bin/pks
+RUN chmod 755 /usr/local/bin/pks
+
+# Credential helper wrapper script (implements git credential protocol)
+RUN cat > /usr/local/bin/pks-ado-credential <<'SCRIPT'
+#!/bin/sh
+# Git credential helper for Azure DevOps via pks-cli
+# Delegates to pks git askpass running as the pks user
+case "$1" in
+  get)
+    # Read and discard stdin (git sends protocol/host)
+    cat > /dev/null
+    TOKEN=$(sudo -n -u pks /usr/local/bin/pks git askpass "Password" 2>/dev/null)
+    if [ $? -eq 0 ] && [ -n "$TOKEN" ]; then
+      echo "username=pks"
+      echo "password=$TOKEN"
+    fi
+    ;;
+  store|erase)
+    # No-op — pks manages its own token lifecycle
+    ;;
+esac
+SCRIPT
+RUN chmod 755 /usr/local/bin/pks-ado-credential
+
+# Sudoers: node can run pks as pks user without password
+RUN echo "node ALL=(pks) NOPASSWD: /usr/local/bin/pks" > /etc/sudoers.d/pks-cli && \
+    chmod 440 /etc/sudoers.d/pks-cli
+
+# Configure git credential helper for dev.azure.com only (system-level)
+# No system-level default helper is set (incoming change removed GCM from system config)
+# so this URL-scoped helper is the only system credential config.
+RUN git config --system credential.https://dev.azure.com.helper "!/usr/local/bin/pks-ado-credential"
+
+USER node
+# ============================================================================
+
 # ============================================================================
 # .NET Aspire CLI Installation
 # ============================================================================

Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`{`
`2`		`- "src": "5.0.0-rc.1",`
`3`		`- "templates/devcontainer": "5.0.0-rc.1",`
`4`		`- "templates/claude-dotnet-9": "5.0.0-rc.1",`
`5`		`- "templates/claude-dotnet-10-full": "5.0.0-rc.1",`
`6`		`- "templates/pks-fullstack": "5.0.0-rc.1"`
	`2`	`+ "src": "5.1.3-rc.28",`
	`3`	`+ "templates/devcontainer": "4.0.0-rc.11",`
	`4`	`+ "templates/claude-dotnet-9": "3.0.0-rc.11",`
	`5`	`+ "templates/claude-dotnet-10-full": "4.0.0-rc.11",`
	`6`	`+ "templates/pks-fullstack": "3.0.0-rc.13"`
`7`	`7`	`}`
Original file line number	Diff line number	Diff line change
`@@ -3,6 +3,9 @@`
`3`	`3`
`4`	`4`	`namespace PKS.Commands.Ado;`
`5`	`5`
	`6`	`+/// <summary>`
	`7`	`+/// Shared settings for Azure DevOps commands.`
	`8`	`+/// </summary>`
`6`	`9`	`public class AdoSettings : CommandSettings`
`7`	`10`	`{`
`8`	`11`	`[CommandOption("-v\|--verbose")]`
Original file line number	Diff line number	Diff line change
`@@ -73,12 +73,15 @@ public async Task StartAsync(CancellationToken ct = default)`
`73`	`73`	`await _app.StartAsync(ct);`
`74`	`74`
`75`	`75`	`// Make socket world-accessible so container users (e.g. 'node') can connect`
`76`		`- if (File.Exists(_socketPath))`
	`76`	`+ if (OperatingSystem.IsLinux() \|\| OperatingSystem.IsMacOS())`
`77`	`77`	`{`
`78`		`- File.SetUnixFileMode(_socketPath,`
`79`		`- UnixFileMode.UserRead \| UnixFileMode.UserWrite \| UnixFileMode.UserExecute \|`
`80`		`- UnixFileMode.GroupRead \| UnixFileMode.GroupWrite \| UnixFileMode.GroupExecute \|`
`81`		`- UnixFileMode.OtherRead \| UnixFileMode.OtherWrite \| UnixFileMode.OtherExecute);`
	`78`	`+ if (File.Exists(_socketPath))`
	`79`	`+ {`
	`80`	`+ File.SetUnixFileMode(_socketPath,`
	`81`	`+ UnixFileMode.UserRead \| UnixFileMode.UserWrite \| UnixFileMode.UserExecute \|`
	`82`	`+ UnixFileMode.GroupRead \| UnixFileMode.GroupWrite \| UnixFileMode.GroupExecute \|`
	`83`	`+ UnixFileMode.OtherRead \| UnixFileMode.OtherWrite \| UnixFileMode.OtherExecute);`
	`84`	`+ }`
`82`	`85`	`}`
`83`	`86`	`}`
`84`	`87`