@boxes-dev/dvb 0.2.4

package/dist/devbox/commands/init/index.js

@@ -0,0 +1,1117 @@
+import { randomUUID } from "node:crypto";
+import path from "node:path";
+import fs from "node:fs/promises";
+import os from "node:os";
+import readline from "node:readline/promises";
+import { resolveSocketInfo } from "@boxes-dev/core";
+import { createSecretStore, loadConfig, createSpritesClient, fingerprintFromOrigin, fingerprintFromRootCommit, normalizeGitRemoteUrl, resolveSpritesApiUrl, SpritesApiError, slugify, } from "@boxes-dev/core";
+import { DAEMON_TIMEOUT_MS, ensureDaemonRunning, requestJson, requireDaemonFeatures, } from "../../daemonClient.js";
+import { ensureSpritesToken } from "../../auth.js";
+import { fetchSpriteDaemonRelease, getConvexUrl, issueSpriteDaemonToken, } from "../../controlPlane.js";
+import { logger } from "../../logger.js";
+import { createStatusLine } from "../../ui/statusLine.js";
+import { parseInitArgs } from "./args.js";
+import { confirmCopyWorktree, findRepoRoot, mapGlobalGitConfigDestinations, readGlobalGitConfigFiles, readHeadState, readNullSeparatedPaths, readRepoOrigin, readRootCommit, readWorktreeState, resolveGitCommonDir, runCommand, } from "./repo.js";
+import { createFileListArchive, createGitMetaArchive, writePatch } from "./packaging.js";
+import { bootstrapDevbox, ensureSpriteDaemonService, expandHome, ensureWeztermMuxService, installSpriteDaemon, installWeztermMux, shellQuote, writeRemoteCodexConfig, } from "./remote.js";
+import { ensureDevboxToml, readRepoMarker, writeRepoMarker } from "./registry.js";
+import { readInitState, writeInitState } from "./state.js";
+import { ensureSshConfig, ensureSshKey, copyToClipboard, openBrowser, parseGitRemote, readRemoteOrigin, setRemoteOrigin, verifySshAuth, } from "./ssh.js";
+import { ensureKnownHostsFile, ensureLocalMountKey, ensureRemoteMountAccess, ensureSshdService, readLocalMountPublicKey, } from "../mountSsh.js";
+import { createSetupArtifacts, promptForPlanApproval, promptForServicesApproval, readSetupPlan, readServicesPlan, runLocalServicesScan, runLocalSetupScan, runRemoteCodexSetup, uploadSetupPlan, writeSetupPlan, writeSetupSchema, writeServicesPlan, writeServicesSchema, } from "./codex/index.js";
+import { mergeServicesToml, splitShellCommand, } from "../servicesToml.js";
+const resolveInitStatus = (steps, complete) => {
+    if (complete || steps?.codexApplied)
+        return "complete";
+    if (steps?.setupUploaded && steps?.workdirProvisioned) {
+        return "remote_ready";
+    }
+    return "local_required";
+};
+const mergeLocalPaths = (existing, repoRoot) => {
+    const merged = new Set(existing ?? []);
+    merged.add(repoRoot);
+    return [...merged];
+};
+const buildServicesTomlUpdates = (services) => {
+    const updates = {};
+    for (const service of services) {
+        const name = service.name.trim();
+        if (!name) {
+            throw new Error("Service name is required in services.json.");
+        }
+        const parts = splitShellCommand(service.command ?? "");
+        const [cmd, ...args] = parts;
+        if (!cmd) {
+            throw new Error(`Service "${name}" is missing a command.`);
+        }
+        updates[name] = {
+            name,
+            cmd,
+            ...(args.length > 0 ? { args } : {}),
+            ...(service.httpPort !== null ? { httpPort: service.httpPort } : {}),
+        };
+    }
+    return updates;
+};
+const writeRemoteServicesToml = async ({ client, canonical, workdir, services, }) => {
+    if (services.length === 0)
+        return;
+    let baseContent = "";
+    try {
+        const bytes = await client.readFile(canonical, {
+            path: "devbox.toml",
+            workingDir: workdir,
+        });
+        baseContent = Buffer.from(bytes).toString("utf8");
+    }
+    catch (error) {
+        if (!(error instanceof SpritesApiError && error.status === 404)) {
+            throw error;
+        }
+    }
+    const updates = buildServicesTomlUpdates(services);
+    if (Object.keys(updates).length === 0)
+        return;
+    const merged = mergeServicesToml(baseContent, updates);
+    await client.writeFile(canonical, path.posix.join(workdir.replace(/\/$/, ""), "devbox.toml"), Buffer.from(merged));
+};
+const promptYesNo = async (question, defaultYes = false) => {
+    if (!process.stdin.isTTY) {
+        return defaultYes;
+    }
+    const suffix = defaultYes ? " (Y/n): " : " (y/N): ";
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    const answer = await rl.question(`${question}${suffix}`);
+    rl.close();
+    const normalized = answer.trim().toLowerCase();
+    if (!normalized)
+        return defaultYes;
+    return normalized === "y" || normalized === "yes";
+};
+const promptToContinue = async (message) => {
+    if (!process.stdin.isTTY) {
+        return false;
+    }
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    await rl.question(message);
+    rl.close();
+    return true;
+};
+const ensureWorkdirOwnership = async ({ client, canonical, workdir, status, json, }) => {
+    const checkResult = await client.exec(canonical, [
+        "/bin/bash",
+        "-lc",
+        `if [ -d ${shellQuote(workdir)} ]; then stat -c %U ${shellQuote(workdir)}; fi`,
+    ]);
+    if (checkResult.exitCode !== 0)
+        return;
+    const owner = checkResult.stdout.trim();
+    if (!owner || owner === "sprite")
+        return;
+    status.stage("Fixing workdir ownership");
+    const chownResult = await client.exec(canonical, [
+        "/bin/bash",
+        "-lc",
+        `sudo -n chown -R sprite:sprite ${shellQuote(workdir)}`,
+    ]);
+    if (chownResult.exitCode !== 0) {
+        logger.warn("workdir_chown_failed", {
+            box: canonical,
+            workdir,
+            error: chownResult.stderr || chownResult.stdout,
+        });
+        if (!json) {
+            status.stop();
+            console.warn("Warning: failed to update workdir ownership. Git may refuse to operate until ownership is fixed.");
+        }
+    }
+};
+export const runInit = async (args) => {
+    const parsed = parseInitArgs(args);
+    const statusEnabled = process.stderr.isTTY && !parsed.json;
+    const status = createStatusLine({ enabled: statusEnabled });
+    const run = async () => {
+        status.stage("Detecting repository");
+        const cwd = process.cwd();
+        const repoRoot = await findRepoRoot(cwd);
+        const repoName = path.basename(repoRoot);
+        const slug = slugify(repoName);
+        const localHomeDir = process.env.HOME ?? os.homedir();
+        const repoMarker = await readRepoMarker(repoRoot);
+        const origin = await readRepoOrigin(repoRoot);
+        const normalizedOrigin = origin ? normalizeGitRemoteUrl(origin) : null;
+        const fingerprint = origin
+            ? fingerprintFromOrigin(origin)
+            : repoMarker?.fingerprint ??
+                fingerprintFromRootCommit(await readRootCommit(repoRoot), randomUUID());
+        let initState = await readInitState(repoRoot);
+        const initFingerprintMismatch = Boolean(initState?.fingerprint) && initState?.fingerprint !== fingerprint;
+        if (parsed.resume) {
+            if (initFingerprintMismatch) {
+                throw new Error("Init state does not match this repo. Remove .devbox/init-state.json and run `dvb init` again.");
+            }
+            if (!initState) {
+                throw new Error("No init state to resume. Run `dvb init` to start a new init.");
+            }
+            if (initState.complete) {
+                throw new Error("Init already completed. Run `dvb init` to start a new init.");
+            }
+        }
+        if (initFingerprintMismatch) {
+            initState = null;
+        }
+        const wantsResume = Boolean(parsed.resume);
+        if (parsed.force && initState && !initState.complete && !wantsResume) {
+            initState = null;
+        }
+        const shouldResume = Boolean(wantsResume && initState && !initState.complete);
+        if (!parsed.codexSetupOnly &&
+            !wantsResume &&
+            initState &&
+            !initState.complete &&
+            !parsed.force) {
+            throw new Error("Previous init is incomplete. Run `dvb init --resume` to finish the previous init or `dvb init --force` to restart.");
+        }
+        const ensureInitState = () => {
+            if (!initState || initState.fingerprint !== fingerprint) {
+                initState = {
+                    version: 1,
+                    fingerprint,
+                    steps: {},
+                    updatedAt: new Date().toISOString(),
+                };
+            }
+            return initState;
+        };
+        const updateInitState = async (update) => {
+            const base = ensureInitState();
+            initState = {
+                ...base,
+                ...update,
+                steps: {
+                    ...base.steps,
+                    ...(update.steps ?? {}),
+                },
+                updatedAt: new Date().toISOString(),
+            };
+            await writeInitState(repoRoot, initState);
+        };
+        if (parsed.codexSetupOnly) {
+            if (!repoMarker?.canonical) {
+                throw new Error("Repo is not initialized. Run `dvb init` first.");
+            }
+            const setupDir = path.join(repoRoot, ".devbox");
+            const setupPath = path.join(setupDir, "setup.json");
+            const servicesPath = path.join(setupDir, "services.json");
+            try {
+                await fs.access(setupPath);
+            }
+            catch {
+                throw new Error("Missing .devbox/setup.json. Run `dvb init` first.");
+            }
+            const localArtifactsBundlePath = path.join(setupDir, "setup-artifacts.tgz");
+            const localArtifactsManifestPath = path.join(setupDir, "setup-artifacts.json");
+            let artifactsBundlePath = null;
+            let artifactsManifestPath = null;
+            try {
+                await fs.access(localArtifactsBundlePath);
+                await fs.access(localArtifactsManifestPath);
+                artifactsBundlePath = localArtifactsBundlePath;
+                artifactsManifestPath = localArtifactsManifestPath;
+            }
+            catch {
+                // artifacts are optional in setup-only flow
+            }
+            status.stage("Starting dvbd");
+            const socketInfo = resolveSocketInfo();
+            await ensureDaemonRunning(socketInfo.socketPath);
+            await requireDaemonFeatures(socketInfo.socketPath, ["ports"]);
+            status.stage("Loading devbox config");
+            const config = await loadConfig(process.env.HOME ? { homeDir: process.env.HOME } : undefined);
+            const store = await createSecretStore(config?.tokenStore, process.env.HOME ? { homeDir: process.env.HOME } : undefined);
+            const token = await store.getToken();
+            if (!token) {
+                throw new Error("Sprites token missing. Run `dvb setup` first.");
+            }
+            const apiBaseUrl = resolveSpritesApiUrl(config);
+            const client = createSpritesClient({
+                apiBaseUrl,
+                token,
+            });
+            const canonical = repoMarker.canonical;
+            let expandedWorkdir = expandHome(`~/${slug}`);
+            try {
+                const metaRaw = await client.readFile(canonical, {
+                    path: `/home/sprite/.devbox/projects/${fingerprint}.json`,
+                });
+                const meta = JSON.parse(Buffer.from(metaRaw).toString("utf8"));
+                if (meta.workdir) {
+                    expandedWorkdir = expandHome(meta.workdir);
+                }
+            }
+            catch {
+                // ignore missing project metadata
+            }
+            const remoteSetupPath = path.posix.join(expandedWorkdir, ".devbox", "setup.json");
+            const remoteArtifactsBundlePath = path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.tgz");
+            const remoteArtifactsManifestPath = path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.json");
+            const pathSetup = 'export PATH="$(npm bin -g 2>/dev/null):$PATH"';
+            let servicesPlan = null;
+            try {
+                servicesPlan = await readServicesPlan(servicesPath);
+            }
+            catch {
+                servicesPlan = null;
+            }
+            await uploadSetupPlan({
+                client,
+                canonical,
+                localSetupPath: setupPath,
+                remoteSetupPath,
+                localArtifactsBundlePath: artifactsBundlePath,
+                localArtifactsManifestPath: artifactsManifestPath,
+                remoteArtifactsBundlePath: artifactsBundlePath
+                    ? remoteArtifactsBundlePath
+                    : null,
+                remoteArtifactsManifestPath: artifactsBundlePath
+                    ? remoteArtifactsManifestPath
+                    : null,
+                status,
+            });
+            await runRemoteCodexSetup({
+                client,
+                canonical,
+                expandedWorkdir,
+                remoteSetupPath,
+                remoteArtifactsBundlePath,
+                remoteArtifactsManifestPath,
+                socketInfo,
+                status,
+                pathSetup,
+                entrypoints: servicesPlan?.appEntrypoints ?? [],
+            });
+            status.stop();
+            if (parsed.json) {
+                console.log(JSON.stringify({ ok: true }, null, 2));
+                return;
+            }
+            console.log("Codex setup complete.");
+            return;
+        }
+        status.stage("Starting dvbd");
+        const socketInfo = resolveSocketInfo();
+        await ensureDaemonRunning(socketInfo.socketPath);
+        await requireDaemonFeatures(socketInfo.socketPath, ["registry"]);
+        status.stage("Checking sprites");
+        const existingProject = await requestJson(socketInfo.socketPath, "GET", `/registry/project?fingerprint=${encodeURIComponent(fingerprint)}`, DAEMON_TIMEOUT_MS.registry);
+        const existingEntry = existingProject.body.project ?? null;
+        if (existingEntry && !parsed.force) {
+            if (shouldResume) {
+                if (initState?.canonical &&
+                    existingEntry.canonical !== initState.canonical) {
+                    throw new Error(`Repo already initialized (box: ${existingEntry.canonical}) and does not match pending init (box: ${initState.canonical}).`);
+                }
+            }
+            else if (origin) {
+                const displayOrigin = normalizedOrigin ?? origin;
+                throw new Error(`Repo already initialized for origin ${JSON.stringify(displayOrigin)} (box: ${existingEntry.canonical}).`);
+            }
+            else {
+                throw new Error(`Repo already initialized (box: ${existingEntry.canonical}).`);
+            }
+        }
+        const alias = parsed.alias ?? initState?.alias ?? existingEntry?.alias ?? slug;
+        const canonicalHint = parsed.name ?? initState?.canonical ?? existingEntry?.canonical;
+        const workdir = `~/${slug}`;
+        const expandedWorkdir = expandHome(workdir);
+        const remoteSetupPath = path.posix.join(expandedWorkdir, ".devbox", "setup.json");
+        const remoteArtifactsBundlePath = path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.tgz");
+        const remoteArtifactsManifestPath = path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.json");
+        const pathSetup = 'export PATH="$(npm bin -g 2>/dev/null):$PATH"';
+        status.stage("Loading devbox config");
+        const config = await loadConfig(process.env.HOME ? { homeDir: process.env.HOME } : undefined);
+        const store = await createSecretStore(config?.tokenStore, process.env.HOME ? { homeDir: process.env.HOME } : undefined);
+        const { token, controlPlaneToken } = await ensureSpritesToken(store, (message) => status.stage(message));
+        const apiBaseUrl = resolveSpritesApiUrl(config);
+        const client = createSpritesClient({
+            apiBaseUrl,
+            token,
+        });
+        const username = os.userInfo().username;
+        let canonical = (shouldResume && initState?.canonical ? initState.canonical : null) ??
+            canonicalHint ??
+            `${username}-${slug}`;
+        const createSprite = async (name) => {
+            try {
+                await client.createSprite(name);
+                return "created";
+            }
+            catch (error) {
+                if (error instanceof SpritesApiError) {
+                    const body = error.body.toLowerCase();
+                    if (error.status === 400 ||
+                        error.status === 409 ||
+                        body.includes("exists") ||
+                        body.includes("already")) {
+                        return "exists";
+                    }
+                }
+                throw error;
+            }
+        };
+        const skipCreate = shouldResume && initState?.steps.spritesCreated && initState.canonical;
+        if (!skipCreate) {
+            status.stage("Creating devbox");
+            const createResult = await createSprite(canonical);
+            if (createResult === "exists" && !parsed.force) {
+                if (canonicalHint) {
+                    throw new Error(`Sprite already exists: ${canonical}`);
+                }
+                const suffix = fingerprint.slice(0, 6);
+                canonical = `${canonical}-${suffix}`;
+                status.stage("Resolving devbox name");
+                const second = await createSprite(canonical);
+                if (second === "exists") {
+                    throw new Error(`Sprite already exists: ${canonical}`);
+                }
+            }
+            await updateInitState({
+                canonical,
+                alias,
+                workdir,
+                steps: { spritesCreated: true },
+            });
+        }
+        const aliasLookup = await requestJson(socketInfo.socketPath, "GET", `/registry/alias?alias=${encodeURIComponent(alias)}`, DAEMON_TIMEOUT_MS.registry);
+        if (aliasLookup.body.canonical &&
+            aliasLookup.body.canonical !== canonical &&
+            !parsed.force) {
+            throw new Error(`Alias already in use: ${alias}`);
+        }
+        const projectCreatedAt = existingEntry?.createdAt ?? new Date().toISOString();
+        const projectLocalPaths = mergeLocalPaths(existingEntry?.localPaths, repoRoot);
+        const projectOrigin = normalizedOrigin ?? existingEntry?.origin ?? undefined;
+        const buildProjectEntry = (initStatus) => ({
+            fingerprint,
+            canonical,
+            alias,
+            origin: projectOrigin,
+            createdAt: projectCreatedAt,
+            initStatus,
+            initUpdatedAt: new Date().toISOString(),
+            localPaths: projectLocalPaths,
+        });
+        const updateRegistryProjectStatus = async (initStatus) => {
+            try {
+                await requestJson(socketInfo.socketPath, "POST", "/registry/upsert", DAEMON_TIMEOUT_MS.registry, {
+                    project: buildProjectEntry(initStatus),
+                });
+            }
+            catch (error) {
+                logger.warn("registry_project_update_failed", {
+                    box: canonical,
+                    status: initStatus,
+                    error: String(error),
+                });
+            }
+        };
+        status.stage("Bootstrapping devbox");
+        try {
+            await bootstrapDevbox(client, canonical);
+        }
+        catch (error) {
+            logger.warn("devbox_bootstrap_failed", {
+                box: canonical,
+                error: String(error),
+            });
+            if (!parsed.json) {
+                status.stop();
+                const message = error instanceof Error && error.message
+                    ? error.message
+                    : String(error);
+                console.warn(`Warning: devbox bootstrap failed. ${message}`);
+            }
+        }
+        const initialStatus = resolveInitStatus(initState?.steps, initState?.complete);
+        if (!shouldResume || !initState?.steps.registrySynced) {
+            status.stage("Syncing sprites");
+            await requestJson(socketInfo.socketPath, "POST", "/registry/upsert", DAEMON_TIMEOUT_MS.registry, {
+                project: buildProjectEntry(initialStatus),
+                box: {
+                    canonical,
+                    org: config?.org,
+                    createdAt: new Date().toISOString(),
+                },
+                alias: { alias, canonical },
+            });
+            await updateInitState({
+                canonical,
+                alias,
+                workdir,
+                steps: { registrySynced: true },
+            });
+        }
+        if (!shouldResume || !initState?.steps.daemonInstalled) {
+            status.stage("Installing sprite daemon");
+            try {
+                const convexUrl = getConvexUrl();
+                if (!controlPlaneToken) {
+                    throw new Error("Control plane session required to install daemon.");
+                }
+                if (!convexUrl) {
+                    throw new Error("Convex URL unavailable.");
+                }
+                const release = await fetchSpriteDaemonRelease(controlPlaneToken);
+                if (!release) {
+                    throw new Error("No sprite daemon release available.");
+                }
+                const heartbeatToken = await issueSpriteDaemonToken(controlPlaneToken, canonical);
+                if (!heartbeatToken) {
+                    throw new Error("Daemon token unavailable.");
+                }
+                await installSpriteDaemon({
+                    client,
+                    spriteName: canonical,
+                    release,
+                    convexUrl,
+                    heartbeatToken,
+                });
+                await updateInitState({ steps: { daemonInstalled: true } });
+            }
+            catch (error) {
+                logger.warn("sprite_daemon_install_failed", {
+                    box: canonical,
+                    error: String(error),
+                });
+                if (!parsed.json) {
+                    status.stop();
+                    const message = error instanceof Error && error.message
+                        ? error.message
+                        : String(error);
+                    console.warn(`Warning: failed to install sprite daemon. ${message}`);
+                }
+            }
+        }
+        status.stage("Ensuring sprite daemon service");
+        try {
+            await ensureSpriteDaemonService({ client, spriteName: canonical });
+            await updateInitState({ steps: { daemonServiceEnsured: true } });
+        }
+        catch (error) {
+            logger.warn("sprite_daemon_service_failed", {
+                box: canonical,
+                error: String(error),
+            });
+            if (!parsed.json) {
+                status.stop();
+                const message = error instanceof Error && error.message
+                    ? error.message
+                    : String(error);
+                console.warn(`Warning: failed to ensure sprite daemon service. ${message}`);
+            }
+        }
+        const setupDir = path.join(repoRoot, ".devbox");
+        const setupPath = path.join(setupDir, "setup.json");
+        const servicesPath = path.join(setupDir, "services.json");
+        let setupArtifacts = null;
+        const nonInteractive = !process.stdin.isTTY || parsed.json;
+        const skipSetupPlan = shouldResume && initState?.steps.setupPlanWritten;
+        const skipServicesPlan = shouldResume && initState?.steps.servicesPlanWritten;
+        const skipServicesConfig = shouldResume && initState?.steps.servicesConfigWritten;
+        const skipSetupUpload = nonInteractive || (shouldResume && initState?.steps.setupUploaded);
+        const skipCodexApply = nonInteractive || (shouldResume && initState?.steps.codexApplied);
+        let approvedPlan = null;
+        let approvedServices = null;
+        const setupTempDir = await fs.mkdtemp(path.join(os.tmpdir(), "devbox-setup-"));
+        try {
+            await fs.mkdir(setupDir, { recursive: true });
+            if (!skipSetupPlan || !skipServicesPlan) {
+                let setupSchemaPath = null;
+                let servicesSchemaPath = null;
+                if (!skipSetupPlan) {
+                    setupSchemaPath = await writeSetupSchema(setupTempDir);
+                }
+                if (!skipServicesPlan) {
+                    servicesSchemaPath = await writeServicesSchema(setupTempDir);
+                }
+                if (!skipSetupPlan && !setupSchemaPath) {
+                    throw new Error("Setup schema path missing.");
+                }
+                if (!skipServicesPlan && !servicesSchemaPath) {
+                    throw new Error("Services schema path missing.");
+                }
+                status.stage("Analyzing local environment");
+                await Promise.all([
+                    skipSetupPlan
+                        ? Promise.resolve()
+                        : runLocalSetupScan({
+                            cwd: repoRoot,
+                            schemaPath: setupSchemaPath,
+                            outputPath: setupPath,
+                            homeDir: localHomeDir,
+                            onProgress: (message) => {
+                                const base = "Analyzing local environment — setup";
+                                status.stage(`${base} — ${message}`);
+                            },
+                        }),
+                    skipServicesPlan
+                        ? Promise.resolve()
+                        : runLocalServicesScan({
+                            cwd: repoRoot,
+                            schemaPath: servicesSchemaPath,
+                            outputPath: servicesPath,
+                            homeDir: localHomeDir,
+                            onProgress: (message) => {
+                                const base = "Analyzing local environment — services";
+                                status.stage(`${base} — ${message}`);
+                            },
+                        }),
+                ]);
+            }
+            if (!skipSetupPlan) {
+                const setupPlan = await readSetupPlan(setupPath);
+                if (nonInteractive) {
+                    approvedPlan = setupPlan;
+                }
+                else {
+                    if (!process.stdin.isTTY || parsed.json) {
+                        throw new Error("Interactive terminal required to approve setup.");
+                    }
+                    status.stage("Reviewing setup findings");
+                    status.stop();
+                    approvedPlan = await promptForPlanApproval(setupPlan);
+                }
+                await writeSetupPlan(setupPath, approvedPlan);
+                await updateInitState({ steps: { setupPlanWritten: true } });
+            }
+            else {
+                approvedPlan = await readSetupPlan(setupPath);
+            }
+            if (!skipServicesPlan) {
+                const servicesPlan = await readServicesPlan(servicesPath);
+                if (nonInteractive) {
+                    approvedServices = servicesPlan;
+                }
+                else {
+                    if (!process.stdin.isTTY || parsed.json) {
+                        throw new Error("Interactive terminal required to approve services.");
+                    }
+                    status.stage("Reviewing run services findings");
+                    status.stop();
+                    approvedServices = await promptForServicesApproval(servicesPlan);
+                }
+                await writeServicesPlan(servicesPath, approvedServices);
+                await updateInitState({ steps: { servicesPlanWritten: true } });
+            }
+            else {
+                approvedServices = await readServicesPlan(servicesPath);
+            }
+            if (!skipSetupUpload) {
+                status.stage("Packaging setup artifacts");
+                setupArtifacts = await createSetupArtifacts({
+                    repoRoot,
+                    plan: approvedPlan,
+                    outputDir: setupDir,
+                    tempDir: setupTempDir,
+                    homeDir: localHomeDir,
+                });
+            }
+        }
+        finally {
+            await fs.rm(setupTempDir, { recursive: true, force: true });
+        }
+        const skipProvision = shouldResume && initState?.steps.workdirProvisioned;
+        if (!skipProvision || !skipSetupUpload) {
+            if (!skipProvision) {
+                status.stage("Packaging repo");
+            }
+            const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "devbox-init-"));
+            const bundlePath = path.join(tempDir, "repo.bundle");
+            const archivePath = path.join(tempDir, "repo.tgz");
+            const gitMetaPath = path.join(tempDir, "git-meta.tgz");
+            const gitMetaListPath = path.join(tempDir, "git-meta.list");
+            const stagedPatchPath = path.join(tempDir, "staged.patch");
+            const unstagedPatchPath = path.join(tempDir, "unstaged.patch");
+            const untrackedPath = path.join(tempDir, "untracked.tgz");
+            const untrackedListPath = path.join(tempDir, "untracked.list");
+            const globalGitConfigSources = await readGlobalGitConfigFiles(repoRoot);
+            const globalGitConfigMappings = mapGlobalGitConfigDestinations(globalGitConfigSources, localHomeDir);
+            try {
+                const remoteBundlePath = "/home/sprite/.devbox/upload.bundle";
+                const remoteArchivePath = "/home/sprite/.devbox/upload.tgz";
+                const remoteGitMetaPath = "/home/sprite/.devbox/git-meta.tgz";
+                const remoteStagedPatchPath = "/home/sprite/.devbox/staged.patch";
+                const remoteUnstagedPatchPath = "/home/sprite/.devbox/unstaged.patch";
+                const remoteUntrackedPath = "/home/sprite/.devbox/untracked.tgz";
+                status.stage("Checking remote git");
+                const gitCheck = await client.exec(canonical, [
+                    "/bin/bash",
+                    "-lc",
+                    "git --version",
+                ]);
+                const remoteHasGit = gitCheck.exitCode === 0;
+                const remoteDirs = new Set();
+                remoteDirs.add(path.posix.dirname(remoteBundlePath));
+                remoteDirs.add(path.posix.dirname(remoteArchivePath));
+                remoteDirs.add(path.posix.dirname(remoteGitMetaPath));
+                remoteDirs.add(path.posix.dirname(remoteStagedPatchPath));
+                remoteDirs.add(path.posix.dirname(remoteUnstagedPatchPath));
+                remoteDirs.add(path.posix.dirname(remoteUntrackedPath));
+                for (const mapping of globalGitConfigMappings) {
+                    remoteDirs.add(path.posix.dirname(mapping.dest));
+                }
+                if (remoteDirs.size > 0) {
+                    status.stage("Preparing remote directories");
+                    const prepResult = await client.exec(canonical, [
+                        "/bin/bash",
+                        "-lc",
+                        `mkdir -p ${[...remoteDirs].map(shellQuote).join(" ")}`,
+                    ]);
+                    if (prepResult.exitCode !== 0) {
+                        throw new Error(prepResult.stderr || "Failed to prepare remote dirs");
+                    }
+                }
+                let headState = null;
+                let gitCommonDir = "";
+                let worktreeState = null;
+                let copyWorktree = false;
+                if (!skipProvision) {
+                    status.stage("Inspecting git state");
+                    headState = await readHeadState(repoRoot);
+                    const resolved = await resolveGitCommonDir(repoRoot);
+                    gitCommonDir = resolved.commonDir;
+                    worktreeState = await readWorktreeState(repoRoot);
+                    const hasWorktreeChanges = worktreeState.staged.length > 0 ||
+                        worktreeState.unstaged.length > 0 ||
+                        worktreeState.untracked.length > 0;
+                    if (hasWorktreeChanges && process.stdin.isTTY && !parsed.json) {
+                        status.stop();
+                        copyWorktree = await confirmCopyWorktree(worktreeState);
+                    }
+                    else if (hasWorktreeChanges) {
+                        copyWorktree = true;
+                    }
+                }
+                let gitMetaCreated = false;
+                let stagedPatchCreated = false;
+                let unstagedPatchCreated = false;
+                let untrackedCreated = false;
+                if (remoteHasGit) {
+                    if (!skipProvision) {
+                        status.stage("Packaging repo bundle");
+                        await runCommand(repoRoot, "git", [
+                            "bundle",
+                            "create",
+                            bundlePath,
+                            "--all",
+                        ]);
+                    }
+                    if (!skipProvision) {
+                        status.stage("Packaging git metadata");
+                        gitMetaCreated = await createGitMetaArchive(gitCommonDir, gitMetaPath, gitMetaListPath);
+                    }
+                    if (copyWorktree && worktreeState) {
+                        status.stage("Packaging worktree changes");
+                        stagedPatchCreated = await writePatch(repoRoot, ["diff", "--binary", "--cached"], stagedPatchPath);
+                        unstagedPatchCreated = await writePatch(repoRoot, ["diff", "--binary"], unstagedPatchPath);
+                        untrackedCreated = await createFileListArchive(repoRoot, worktreeState.untracked, untrackedPath, untrackedListPath);
+                    }
+                    if (!skipProvision) {
+                        status.stage("Uploading repo bundle");
+                        const bundleData = await fs.readFile(bundlePath);
+                        await client.writeFile(canonical, remoteBundlePath, bundleData);
+                    }
+                    if (gitMetaCreated) {
+                        status.stage("Uploading git metadata");
+                        const gitMetaData = await fs.readFile(gitMetaPath);
+                        await client.writeFile(canonical, remoteGitMetaPath, gitMetaData);
+                    }
+                    if (stagedPatchCreated) {
+                        status.stage("Uploading staged changes");
+                        await client.writeFile(canonical, remoteStagedPatchPath, await fs.readFile(stagedPatchPath));
+                    }
+                    if (unstagedPatchCreated) {
+                        status.stage("Uploading unstaged changes");
+                        await client.writeFile(canonical, remoteUnstagedPatchPath, await fs.readFile(unstagedPatchPath));
+                    }
+                    if (untrackedCreated) {
+                        status.stage("Uploading untracked files");
+                        await client.writeFile(canonical, remoteUntrackedPath, await fs.readFile(untrackedPath));
+                    }
+                    if (!skipProvision && globalGitConfigMappings.length > 0) {
+                        status.stage("Uploading git config");
+                        for (const mapping of globalGitConfigMappings) {
+                            const data = await fs.readFile(mapping.source);
+                            await client.writeFile(canonical, mapping.dest, data);
+                        }
+                    }
+                    if (!skipProvision) {
+                        const backup = `${expandedWorkdir}.bak-${Date.now()}`;
+                        const checkoutCommand = headState?.branch
+                            ? `git checkout -B ${shellQuote(headState.branch)} ${shellQuote(headState.commit)}`
+                            : `git checkout --detach ${shellQuote(headState?.commit ?? "")}`;
+                        status.stage("Provisioning workdir");
+                        const remoteCommand = [
+                            "set -euo pipefail",
+                            "unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE",
+                            `if [ -d ${shellQuote(expandedWorkdir)} ]; then`,
+                            parsed.force
+                                ? `  mv ${shellQuote(expandedWorkdir)} ${shellQuote(backup)}`
+                                : `  echo "Target exists: ${expandedWorkdir}" >&2; exit 1`,
+                            "fi",
+                            `mkdir -p ${shellQuote(path.dirname(expandedWorkdir))}`,
+                            `git init -b devbox-init ${shellQuote(expandedWorkdir)}`,
+                            `cd ${shellQuote(expandedWorkdir)}`,
+                            `git fetch ${shellQuote(remoteBundlePath)} 'refs/*:refs/*'`,
+                            `if [ -f ${shellQuote(remoteGitMetaPath)} ]; then`,
+                            `  tar -xzf ${shellQuote(remoteGitMetaPath)} -C .git`,
+                            "fi",
+                            checkoutCommand,
+                            `if [ -f ${shellQuote(remoteStagedPatchPath)} ]; then`,
+                            `  git apply --index ${shellQuote(remoteStagedPatchPath)}`,
+                            "fi",
+                            `if [ -f ${shellQuote(remoteUnstagedPatchPath)} ]; then`,
+                            `  git apply ${shellQuote(remoteUnstagedPatchPath)}`,
+                            "fi",
+                            `if [ -f ${shellQuote(remoteUntrackedPath)} ]; then`,
+                            `  tar -xzf ${shellQuote(remoteUntrackedPath)} -C .`,
+                            "fi",
+                        ].join("\n");
+                        const execResult = await client.exec(canonical, [
+                            "/bin/bash",
+                            "--noprofile",
+                            "--norc",
+                            "-e",
+                            "-u",
+                            "-o",
+                            "pipefail",
+                            "-c",
+                            remoteCommand,
+                        ]);
+                        if (execResult.exitCode !== 0) {
+                            throw new Error(execResult.stderr || "Remote init failed");
+                        }
+                        await updateInitState({ steps: { workdirProvisioned: true } });
+                    }
+                }
+                else if (!skipProvision) {
+                    status.stage("Packaging repo (archive)");
+                    if (copyWorktree) {
+                        const workingFiles = await readNullSeparatedPaths(repoRoot, [
+                            "ls-files",
+                            "--cached",
+                            "--others",
+                            "--exclude-standard",
+                        ]);
+                        await createFileListArchive(repoRoot, workingFiles, archivePath, untrackedListPath);
+                    }
+                    else {
+                        await runCommand(repoRoot, "git", [
+                            "archive",
+                            "--format=tar.gz",
+                            "-o",
+                            archivePath,
+                            "HEAD",
+                        ]);
+                    }
+                    status.stage("Uploading repo archive");
+                    await client.writeFile(canonical, remoteArchivePath, await fs.readFile(archivePath));
+                    if (globalGitConfigMappings.length > 0) {
+                        status.stage("Uploading git config");
+                        for (const mapping of globalGitConfigMappings) {
+                            const data = await fs.readFile(mapping.source);
+                            await client.writeFile(canonical, mapping.dest, data);
+                        }
+                    }
+                    const backup = `${expandedWorkdir}.bak-${Date.now()}`;
+                    status.stage("Provisioning workdir");
+                    const remoteCommand = [
+                        "set -euo pipefail",
+                        "unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE",
+                        `if [ -d ${shellQuote(expandedWorkdir)} ]; then`,
+                        parsed.force
+                            ? `  mv ${shellQuote(expandedWorkdir)} ${shellQuote(backup)}`
+                            : `  echo "Target exists: ${expandedWorkdir}" >&2; exit 1`,
+                        "fi",
+                        `mkdir -p ${shellQuote(expandedWorkdir)}`,
+                        `tar -xzf ${shellQuote(remoteArchivePath)} -C ${shellQuote(expandedWorkdir)}`,
+                    ].join("\n");
+                    const execResult = await client.exec(canonical, [
+                        "/bin/bash",
+                        "--noprofile",
+                        "--norc",
+                        "-e",
+                        "-u",
+                        "-o",
+                        "pipefail",
+                        "-c",
+                        remoteCommand,
+                    ]);
+                    if (execResult.exitCode !== 0) {
+                        throw new Error(execResult.stderr || "Remote init failed");
+                    }
+                    await updateInitState({ steps: { workdirProvisioned: true } });
+                }
+                if (!skipSetupUpload) {
+                    await uploadSetupPlan({
+                        client,
+                        canonical,
+                        localSetupPath: setupPath,
+                        remoteSetupPath,
+                        localArtifactsBundlePath: setupArtifacts?.bundlePath ?? null,
+                        localArtifactsManifestPath: setupArtifacts?.manifestPath ?? null,
+                        remoteArtifactsBundlePath: setupArtifacts
+                            ? path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.tgz")
+                            : null,
+                        remoteArtifactsManifestPath: setupArtifacts
+                            ? path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.json")
+                            : null,
+                        status,
+                    });
+                    await updateInitState({ steps: { setupUploaded: true } });
+                    await updateRegistryProjectStatus(resolveInitStatus(initState?.steps, initState?.complete));
+                }
+            }
+            finally {
+                await fs.rm(tempDir, { recursive: true, force: true });
+            }
+        }
+        await ensureWorkdirOwnership({
+            client,
+            canonical,
+            workdir: expandedWorkdir,
+            status,
+            json: parsed.json === true,
+        });
+        const skipSshdConfig = shouldResume && initState?.steps.sshdConfigured;
+        if (!skipSshdConfig) {
+            status.stage("Configuring SSH mount access");
+            await ensureLocalMountKey();
+            await ensureKnownHostsFile();
+            const publicKey = await readLocalMountPublicKey();
+            await ensureRemoteMountAccess(client, canonical, publicKey);
+            await ensureSshdService(client, canonical);
+            await updateInitState({ steps: { sshdConfigured: true } });
+        }
+        const skipSshAuth = nonInteractive ||
+            (shouldResume && initState?.steps.sshAuthConfigured);
+        if (!skipSshAuth) {
+            status.stage("Configuring git SSH auth");
+            const remoteOrigin = await readRemoteOrigin(client, canonical, expandedWorkdir);
+            if (!remoteOrigin) {
+                if (!parsed.json) {
+                    status.stop();
+                    console.warn("Warning: unable to detect remote origin on sprite. Skipping SSH setup.");
+                }
+            }
+            else {
+                const remoteInfo = parseGitRemote(remoteOrigin);
+                if (!remoteInfo) {
+                    if (!parsed.json) {
+                        status.stop();
+                        console.warn(`Warning: unrecognized git remote format (${remoteOrigin}). Skipping SSH setup.`);
+                    }
+                }
+                else {
+                    let activeOrigin = remoteOrigin;
+                    if (remoteInfo.protocol === "https") {
+                        if (!parsed.json) {
+                            status.stop();
+                            console.log(`Origin is HTTPS (${remoteOrigin}). SSH auth will not work unless we switch this remote to SSH.`);
+                        }
+                        const shouldSwitch = await promptYesNo("Switch origin to SSH for sprite git auth?", false);
+                        if (!shouldSwitch) {
+                            if (!parsed.json) {
+                                console.warn("Skipping SSH auth setup. Configure git credentials for this repo manually before pulling or pushing.");
+                            }
+                            activeOrigin = "";
+                        }
+                        else {
+                            status.stage("Switching git remote to SSH");
+                            await setRemoteOrigin(client, canonical, expandedWorkdir, remoteInfo.sshUrl);
+                            activeOrigin = remoteInfo.sshUrl;
+                        }
+                    }
+                    if (activeOrigin) {
+                        status.stage("Generating SSH key");
+                        const publicKey = await ensureSshKey(client, canonical, `${alias}@devbox`);
+                        status.stage("Updating SSH config");
+                        await ensureSshConfig(client, canonical, remoteInfo.host);
+                        if (!parsed.json) {
+                            status.stop();
+                            console.log("");
+                            console.log(`Add this SSH public key to ${remoteInfo.host}:`);
+                            console.log(publicKey);
+                            console.log(`Open: ${remoteInfo.settingsUrl}`);
+                            const copied = await copyToClipboard(publicKey);
+                            if (copied) {
+                                console.log("Copied the SSH public key to your clipboard.");
+                            }
+                            else {
+                                console.log("Could not copy the SSH key automatically.");
+                            }
+                            const shouldOpen = await promptToContinue("Press Enter to open the SSH key page in your browser...");
+                            if (shouldOpen) {
+                                const opened = openBrowser(remoteInfo.settingsUrl);
+                                if (!opened) {
+                                    console.log("Unable to open the browser automatically.");
+                                }
+                            }
+                        }
+                        const added = await promptYesNo("Have you added the SSH key?", false);
+                        if (!added) {
+                            if (!parsed.json) {
+                                console.warn("Skipping SSH verification. Add the key and re-run `dvb init --resume` to verify.");
+                            }
+                        }
+                        else {
+                            status.stage("Verifying git SSH auth");
+                            const verified = await verifySshAuth(client, canonical, remoteInfo.host, expandedWorkdir);
+                            if (!verified) {
+                                if (!parsed.json) {
+                                    status.stop();
+                                    console.warn("SSH auth verification failed. Confirm the key is added and that the repo access is granted.");
+                                }
+                            }
+                            else {
+                                await updateInitState({
+                                    steps: { sshAuthConfigured: true },
+                                });
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        if (!shouldResume || !initState?.steps.weztermMuxInstalled) {
+            status.stage("Installing WezTerm mux server");
+            try {
+                await installWeztermMux({ client, spriteName: canonical });
+                await updateInitState({ steps: { weztermMuxInstalled: true } });
+            }
+            catch (error) {
+                logger.warn("wezterm_mux_install_failed", {
+                    box: canonical,
+                    error: String(error),
+                });
+                if (!parsed.json) {
+                    status.stop();
+                    const message = error instanceof Error && error.message
+                        ? error.message
+                        : String(error);
+                    console.warn(`Warning: failed to install WezTerm mux server. ${message}`);
+                }
+            }
+        }
+        status.stage("Ensuring WezTerm mux service");
+        try {
+            await ensureWeztermMuxService({ client, spriteName: canonical });
+            await updateInitState({ steps: { weztermMuxServiceEnsured: true } });
+        }
+        catch (error) {
+            logger.warn("wezterm_mux_service_failed", {
+                box: canonical,
+                error: String(error),
+            });
+            if (!parsed.json) {
+                status.stop();
+                const message = error instanceof Error && error.message
+                    ? error.message
+                    : String(error);
+                console.warn(`Warning: failed to ensure WezTerm mux service. ${message}`);
+            }
+        }
+        if (!skipServicesConfig) {
+            if (!approvedServices) {
+                throw new Error("Missing services plan output.");
+            }
+            status.stage("Writing devbox.toml services");
+            await writeRemoteServicesToml({
+                client,
+                canonical,
+                workdir: expandedWorkdir,
+                services: approvedServices.backgroundServices,
+            });
+            await updateInitState({ steps: { servicesConfigWritten: true } });
+        }
+        status.stage("Registering project");
+        const projectMeta = {
+            fingerprint,
+            canonical,
+            alias,
+            workdir,
+            origin: projectOrigin,
+            createdAt: projectCreatedAt,
+        };
+        await client.writeFile(canonical, `/home/sprite/.devbox/projects/${fingerprint}.json`, Buffer.from(JSON.stringify(projectMeta, null, 2)));
+        status.stage("Writing local metadata");
+        await ensureDevboxToml(repoRoot, repoName, slug);
+        await writeRepoMarker(repoRoot, { fingerprint, canonical, alias });
+        status.stage("Updating Codex config on sprite");
+        try {
+            await writeRemoteCodexConfig(client, canonical, repoName);
+        }
+        catch (error) {
+            logger.warn("codex_config_update_failed", {
+                error: String(error),
+            });
+            if (!parsed.json) {
+                status.stop();
+                console.warn("Warning: failed to update /home/sprite/.codex/config.toml for full-access sandbox settings.");
+            }
+        }
+        try {
+            const gitignore = await fs.readFile(path.join(repoRoot, ".gitignore"), "utf8");
+            if (!gitignore.includes(".devbox")) {
+                console.log("Note: add .devbox/ to .gitignore to keep local marker private.");
+            }
+        }
+        catch {
+            // ignore missing .gitignore
+        }
+        if (!skipCodexApply) {
+            await runRemoteCodexSetup({
+                client,
+                canonical,
+                expandedWorkdir,
+                remoteSetupPath,
+                remoteArtifactsBundlePath,
+                remoteArtifactsManifestPath,
+                socketInfo,
+                status,
+                pathSetup,
+                entrypoints: approvedServices?.appEntrypoints ?? [],
+            });
+            await updateInitState({ steps: { codexApplied: true } });
+            await updateRegistryProjectStatus(resolveInitStatus(initState?.steps, initState?.complete));
+        }
+        await updateInitState({ complete: true });
+        await updateRegistryProjectStatus("complete");
+        status.stop();
+        if (parsed.json) {
+            console.log(JSON.stringify({ ok: true, canonical, alias, workdir, fingerprint }, null, 2));
+            return;
+        }
+        console.log(`devbox initialized: ${alias} -> ${canonical}`);
+        console.log(`workdir: ${workdir}`);
+        console.log("sprites: synced to control plane");
+    };
+    try {
+        await run();
+    }
+    catch (error) {
+        status.fail("Init failed");
+        throw error;
+    }
+    finally {
+        status.stop();
+    }
+};
+//# sourceMappingURL=index.js.map