Implement the local-first woj CLI - #53
Merged
Merged
Conversation
Add @wasm-oj/cli, the single `woj` executable for Students and Organizers. Local commands (init/build/run/test/bench/watch/judge/toolchain/config/ cache/doctor) never touch the network; remote commands authorize through a browser-approved PKCE device flow and keep the bearer only in the OS credential store. Retire the `wasm-oj-collection` bin in favour of `woj organizer collection`. Server side adds the CLI login flow tables and endpoints, a bearer transport that is fenced out of every browser-only privileged mutation, and a same-origin Turnstile approval page the CLI can retry against. Carry the Java WASI toolchain into the CLI catalog so `woj toolchain` mirrors the six toolchain packages the platform now ships. Claude-Session: https://claude.ai/code/session_01PHk8gF2Y12sSzyTGaFUi68
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #42.
What
Adds
@wasm-oj/cli— onewojexecutable covering the Student and Organizer journeys with the same product boundaries as the web application.init,build,run,test,bench,watch,judge,toolchain,config,cache,doctor): uses only bytes already on the machine.--offlinerejects every network-capable command before dispatch.auth,problem,submit,submission,contest,performance,organizer …): browser-approved PKCE device login; the bearer lives only in the OS credential store (@napi-rs/keyring), with no plaintext file fallback.--jsonfor machine-readable output.wasm-oj-collectionbin;woj organizer collection …replaces it, and.github/actions/wojnow invokes it via@wasm-oj/cli.Server side
migrations/core/0018_cli_auth.sql— device-authorization flows and access tokens. D1 stores only the S256 challenge and the token hash; a flow can mint at most one token.worker/browser-mutation-boundary.test.tslocks that boundary in.woj submitcan retry the identical request after the short-lived allowance is granted.Java toolchain parity
Rebased onto main after #51 landed the Java WASI toolchain. Carried it through the CLI surface:
CLI_TOOLCHAIN_DESCRIPTORSnow mirrors all six public toolchain packages (woj toolchain list/info/fetch/verify java-teavmwork).WORKSPACE_PACKAGE_PATTERNexternalizes@wasm-oj/toolchain-javaduring library builds.docs/releasing.mdanddocs/versioning.md.Java stays toolchain-only here:
BuiltinLanguage, problem starter templates, andallowedProfilesdo not carryjava, so it is deliberately not awoj init/woj problem pullworkspace language yet.Verification
pnpm run ci:verify— 178 test files, 883 tests passingpnpm run library:verify— 13 packed packages, including@wasm-oj/cli, in a clean NodeNext consumerdocs:verify,licenses:verify,contract:verify,package-manager:verify,github:verify— all passwoj --version,woj --help,woj toolchain list(java present),woj init, offline fence, unknown-command and missing-runtime exit codesNote
parseCliconsumes--while extracting global options, so the leaf-level--handling never sees it. No current command needs--(program args use repeatable--arg), so this is latent rather than a live defect.https://claude.ai/code/session_01PHk8gF2Y12sSzyTGaFUi68