jan-cli 0.21.0

YAML-defined CLI trees with progressive help, optional exec aliases, merged extra specs, and SQLite audit logging keyed by git branch
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74

# Include and remote content

`include` splits a large tree across files. Local paths are **always** resolved from the directory selected by `jan use`. Absolute paths, `..` components, and symlink escapes out of that root are rejected both at load time and by `jan bundle`.

## Root-level include

A list merges top-level command maps from other files:

```yaml
include:
  - fragments/extra.yaml
  - path: fragments/pinned.yaml
    sha256: <64-hex>                 # optional local pin
  - url: https://example.com/shared.yaml
    sha256: <64-hex>                 # required for remote
    ttl: 86400                       # optional
commands:
  local:
    about: Defined in this file
```

## Per-command include

Grafts a file as that command's subtree (YAML) or as an exec leaf (any other extension).

```yaml
commands:
  git:
    include: default/git.yaml          # YAML subtree (unhashed)
  pinned:
    include:
      path: default/git.yaml
      sha256: <64-hex>                 # optional local pin
  shared:
    include:
      url: https://example.com/git.yaml
      sha256: <64-hex>
  basename:
    about: Print last path component
    commands:
      run:
        include:
          path: scripts/files/basename.sh   # script → exec leaf
          argv: [bash]                      # optional interpreter prefix
          passthrough: true
```

After load, jan retains the include as a link on the node (`jan show` prints `source:`). `jan validate` re-checks any declared local hashes. `jan bundle` packs linked script files along with YAML.

Local includes do **not** require a hash (convenient while editing). Remote includes still require HTTPS + `sha256`.

## Remote object cache

| Setting | Default |
|---------|---------|
| Cache root | `$JAN_CACHE_DIR` or `~/.cache/jan` |
| Objects | `…/objects/` (scripts and YAML includes) |
| Trees | `…/trees/<sha256>/` (remote `jan use` bundles) |
| TTL | 86400 seconds (24h); per-include / `exec.url` `ttl` overrides |
| Max download | 20 MiB |
| Timeout | 20 seconds |
| HTTP | Denied unless `JAN_ALLOW_HTTP` or `--allow-http` |

Hashes are 64-character hex. A mismatch fails closed.

## Remote `jan use`

```bash
jan use https://example.com/scripts-jan.zip --sha256 <64-hex>
```

The URL must be a jan **bundle zip** (same layout as `jan bundle`). After verification, the tree is cached under `~/.cache/jan/trees/<sha256>/` and that path is preferred. Config records `source-url` and `source-sha256` (`jan use --show`).

`jan bundle` **fails** if the tree contains remote includes — vendor YAML locally first so bundles stay self-contained.