@boxes-dev/dvb 1.0.43 → 1.0.44

package/dist/devbox/commands/init/setupPlanFlow.js

@@ -0,0 +1,840 @@
+import path from "node:path";
+import fs from "node:fs/promises";
+import os from "node:os";
+import { confirm as clackConfirm, isCancel, note as clackNote, select as clackSelect, taskLog as clackTaskLog, } from "@clack/prompts";
+import { createSetupArtifacts, promptForPlanApproval, promptForServicesApproval, readSetupPlan, readSetupEnvSecretsPlan, readSetupExternalPlan, readSetupExtraArtifactsPlan, readServicesPlan, runLocalServicesScan, runLocalSetupEnvSecretsScan, runLocalSetupExternalScan, runLocalSetupExtraArtifactsScan, mergeSetupScans, writeSetupPlan, writeSetupEnvSecretsSchema, writeSetupExternalSchema, writeSetupExtraArtifactsSchema, writeServicesSchema, } from "./codex/index.js";
+import { runInitStep } from "./progress.js";
+import { collectMissingSetupArtifacts, remapSelectedPathEntries, } from "./setupArtifactsValidation.js";
+const SETUP_ARTIFACT_REGEN_MAX_ATTEMPTS = 3;
+const toPosixPath = (value) => value.split(path.sep).join(path.posix.sep);
+const toRepoRelativePath = (repoRoot, filePath) => {
+    const resolved = path.isAbsolute(filePath)
+        ? filePath
+        : path.resolve(repoRoot, filePath);
+    const relative = path.relative(repoRoot, resolved) || filePath;
+    return toPosixPath(relative);
+};
+const isOutsideRepoPath = (relativePath) => relativePath === ".." || relativePath.startsWith(`..${path.posix.sep}`);
+const runSetupPlanFlow = async ({ projectDir, repoRoot, localHomeDir, shouldResume, nonInteractive, progressEnabled, parsed, getInitState, updateInitState, initCodexProxyOptions, throwInitCanceled, }) => {
+    const setupDir = projectDir;
+    const setupPath = path.join(setupDir, "setup.json");
+    const scansDir = path.join(setupDir, "scans");
+    const logDir = path.join(setupDir, "logs");
+    const setupEnvSecretsScanPath = path.join(scansDir, "setup-env-secrets.json");
+    const setupExternalScanPath = path.join(scansDir, "setup-external.json");
+    const setupExtraArtifactsScanPath = path.join(scansDir, "setup-extra-artifacts.json");
+    const servicesScanPath = path.join(scansDir, "services.json");
+    const scanThreadsPath = path.join(scansDir, "codex-scan-threads.json");
+    let setupArtifacts = null;
+    const initialState = getInitState();
+    const skipSetupPlan = Boolean(shouldResume && initialState?.steps.setupPlanWritten);
+    const skipServicesConfig = Boolean(shouldResume && initialState?.steps.servicesConfigWritten);
+    const skipServicesEnable = Boolean(shouldResume && initialState?.steps.servicesEnabled);
+    const skipSetupUpload = Boolean(nonInteractive || (shouldResume && initialState?.steps.setupUploaded));
+    let approvedPlan = null;
+    const setupTempDir = await fs.mkdtemp(path.join(os.tmpdir(), "devbox-setup-"));
+    try {
+        await fs.mkdir(setupDir, { recursive: true, mode: 0o700 });
+        try {
+            await fs.chmod(setupDir, 0o700);
+        }
+        catch {
+            // best effort on filesystems that do not support chmod
+        }
+        const tryReadSetupPlan = async () => {
+            try {
+                return await readSetupPlan(setupPath);
+            }
+            catch {
+                return null;
+            }
+        };
+        const tryReadServicesPlan = async () => {
+            try {
+                return await readServicesPlan(servicesScanPath);
+            }
+            catch {
+                return null;
+            }
+        };
+        const tryReadEnvSecretsScan = async () => {
+            try {
+                return await readSetupEnvSecretsPlan(setupEnvSecretsScanPath);
+            }
+            catch {
+                return null;
+            }
+        };
+        const tryReadExternalScan = async () => {
+            try {
+                return await readSetupExternalPlan(setupExternalScanPath);
+            }
+            catch {
+                return null;
+            }
+        };
+        const tryReadExtraArtifactsScan = async () => {
+            try {
+                return await readSetupExtraArtifactsPlan(setupExtraArtifactsScanPath);
+            }
+            catch {
+                return null;
+            }
+        };
+        const tryReadScanThreads = async () => {
+            try {
+                const raw = await fs.readFile(scanThreadsPath, "utf8");
+                const parsed = JSON.parse(raw);
+                if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+                    return {};
+                }
+                const record = parsed;
+                return {
+                    ...(typeof record.envSecretsThreadId === "string"
+                        ? { envSecretsThreadId: record.envSecretsThreadId }
+                        : {}),
+                    ...(typeof record.externalThreadId === "string"
+                        ? { externalThreadId: record.externalThreadId }
+                        : {}),
+                    ...(typeof record.extraArtifactsThreadId === "string"
+                        ? { extraArtifactsThreadId: record.extraArtifactsThreadId }
+                        : {}),
+                    ...(typeof record.servicesThreadId === "string"
+                        ? { servicesThreadId: record.servicesThreadId }
+                        : {}),
+                };
+            }
+            catch {
+                return {};
+            }
+        };
+        let scanThreads = shouldResume
+            ? await tryReadScanThreads()
+            : {};
+        let scanThreadsDirty = false;
+        const persistScanThreads = async () => {
+            await fs.mkdir(scansDir, { recursive: true });
+            await fs.writeFile(scanThreadsPath, JSON.stringify(scanThreads, null, 2), "utf8");
+        };
+        const flushScanThreads = async () => {
+            if (!scanThreadsDirty)
+                return;
+            await persistScanThreads();
+            scanThreadsDirty = false;
+        };
+        const saveScanThreadId = (key, threadId) => {
+            if (!threadId)
+                return;
+            if (scanThreads[key] === threadId)
+                return;
+            scanThreads = { ...scanThreads, [key]: threadId };
+            scanThreadsDirty = true;
+        };
+        const shouldRetryCodexScan = (scanFullyCompleted, ...arrays) => !scanFullyCompleted && arrays.every((array) => array.length === 0);
+        const runCodexScanWithImmediateRetry = async ({ run, read, outputPath, update, shouldRetry, }) => {
+            try {
+                await run();
+                let out = await read();
+                if (shouldRetry(out)) {
+                    update("retrying");
+                    await fs.rm(outputPath, { force: true });
+                    await run();
+                    out = await read();
+                }
+                update("done");
+                return out;
+            }
+            catch (error) {
+                update("failed");
+                throw error;
+            }
+        };
+        let setupPlan = skipSetupPlan || !shouldResume ? null : await tryReadSetupPlan();
+        const needsSetupScan = !skipSetupPlan && !setupPlan;
+        let servicesPlan = !needsSetupScan || !shouldResume ? null : await tryReadServicesPlan();
+        let envSecretsScan = !needsSetupScan || !shouldResume ? null : await tryReadEnvSecretsScan();
+        let externalScan = !needsSetupScan || !shouldResume ? null : await tryReadExternalScan();
+        let extraArtifactsScan = !needsSetupScan || !shouldResume
+            ? null
+            : await tryReadExtraArtifactsScan();
+        if (servicesPlan &&
+            shouldRetryCodexScan(servicesPlan.scanFullyCompleted, servicesPlan.appEntrypoints, servicesPlan.backgroundServices)) {
+            servicesPlan = null;
+        }
+        if (envSecretsScan &&
+            shouldRetryCodexScan(envSecretsScan.scanFullyCompleted, envSecretsScan.envFiles, envSecretsScan.secretFiles)) {
+            envSecretsScan = null;
+        }
+        if (externalScan &&
+            shouldRetryCodexScan(externalScan.scanFullyCompleted, externalScan.externalDependencies, externalScan.externalConfigs)) {
+            externalScan = null;
+        }
+        if (extraArtifactsScan &&
+            shouldRetryCodexScan(extraArtifactsScan.scanFullyCompleted, extraArtifactsScan.extraArtifacts)) {
+            extraArtifactsScan = null;
+        }
+        const needsServicesScan = needsSetupScan && !servicesPlan;
+        const needsEnvSecretsScan = needsSetupScan && !envSecretsScan;
+        const needsExternalScan = needsSetupScan && !externalScan;
+        const needsExtraArtifactsScan = needsSetupScan && !extraArtifactsScan;
+        if (needsSetupScan || needsServicesScan) {
+            const runLocalEnvironmentAnalysis = async ({ updateEnvSecrets, updateExternal, updateExtraArtifacts, updateServices, }) => {
+                let envSecretsSchemaPath = null;
+                let externalSchemaPath = null;
+                let extraArtifactsSchemaPath = null;
+                let servicesSchemaPath = null;
+                if (needsEnvSecretsScan) {
+                    envSecretsSchemaPath = await writeSetupEnvSecretsSchema(setupTempDir);
+                }
+                if (needsExternalScan) {
+                    externalSchemaPath = await writeSetupExternalSchema(setupTempDir);
+                }
+                if (needsExtraArtifactsScan) {
+                    extraArtifactsSchemaPath =
+                        await writeSetupExtraArtifactsSchema(setupTempDir);
+                }
+                if (needsServicesScan) {
+                    servicesSchemaPath = await writeServicesSchema(setupTempDir);
+                }
+                if (needsEnvSecretsScan && !envSecretsSchemaPath) {
+                    throw new Error("Env/secrets schema path missing.");
+                }
+                if (needsExternalScan && !externalSchemaPath) {
+                    throw new Error("External schema path missing.");
+                }
+                if (needsExtraArtifactsScan && !extraArtifactsSchemaPath) {
+                    throw new Error("Extra artifacts schema path missing.");
+                }
+                if (needsServicesScan && !servicesSchemaPath) {
+                    throw new Error("Services schema path missing.");
+                }
+                if (needsSetupScan) {
+                    await fs.mkdir(scansDir, { recursive: true });
+                }
+                const envSecretsPromise = !needsSetupScan
+                    ? Promise.resolve(null)
+                    : !needsEnvSecretsScan
+                        ? Promise.resolve(envSecretsScan)
+                        : runCodexScanWithImmediateRetry({
+                            run: async () => {
+                                const threadId = await runLocalSetupEnvSecretsScan({
+                                    cwd: repoRoot,
+                                    logDir,
+                                    schemaPath: envSecretsSchemaPath,
+                                    outputPath: setupEnvSecretsScanPath,
+                                    ...(initCodexProxyOptions
+                                        ? { proxyOptions: initCodexProxyOptions }
+                                        : {}),
+                                    onProgress: updateEnvSecrets,
+                                });
+                                saveScanThreadId("envSecretsThreadId", threadId);
+                            },
+                            read: async () => await readSetupEnvSecretsPlan(setupEnvSecretsScanPath),
+                            outputPath: setupEnvSecretsScanPath,
+                            update: updateEnvSecrets,
+                            shouldRetry: (plan) => shouldRetryCodexScan(plan.scanFullyCompleted, plan.envFiles, plan.secretFiles),
+                        });
+                const externalPromise = !needsSetupScan
+                    ? Promise.resolve(null)
+                    : !needsExternalScan
+                        ? Promise.resolve(externalScan)
+                        : runCodexScanWithImmediateRetry({
+                            run: async () => {
+                                const threadId = await runLocalSetupExternalScan({
+                                    cwd: repoRoot,
+                                    logDir,
+                                    schemaPath: externalSchemaPath,
+                                    outputPath: setupExternalScanPath,
+                                    homeDir: localHomeDir,
+                                    ...(initCodexProxyOptions
+                                        ? { proxyOptions: initCodexProxyOptions }
+                                        : {}),
+                                    onProgress: updateExternal,
+                                });
+                                saveScanThreadId("externalThreadId", threadId);
+                            },
+                            read: async () => await readSetupExternalPlan(setupExternalScanPath),
+                            outputPath: setupExternalScanPath,
+                            update: updateExternal,
+                            shouldRetry: (plan) => shouldRetryCodexScan(plan.scanFullyCompleted, plan.externalDependencies, plan.externalConfigs),
+                        });
+                const extraArtifactsPromise = !needsSetupScan
+                    ? Promise.resolve(null)
+                    : !needsExtraArtifactsScan
+                        ? Promise.resolve(extraArtifactsScan)
+                        : runCodexScanWithImmediateRetry({
+                            run: async () => {
+                                const threadId = await runLocalSetupExtraArtifactsScan({
+                                    cwd: repoRoot,
+                                    logDir,
+                                    schemaPath: extraArtifactsSchemaPath,
+                                    outputPath: setupExtraArtifactsScanPath,
+                                    ...(initCodexProxyOptions
+                                        ? { proxyOptions: initCodexProxyOptions }
+                                        : {}),
+                                    onProgress: updateExtraArtifacts,
+                                });
+                                saveScanThreadId("extraArtifactsThreadId", threadId);
+                            },
+                            read: async () => await readSetupExtraArtifactsPlan(setupExtraArtifactsScanPath),
+                            outputPath: setupExtraArtifactsScanPath,
+                            update: updateExtraArtifacts,
+                            shouldRetry: (plan) => shouldRetryCodexScan(plan.scanFullyCompleted, plan.extraArtifacts),
+                        });
+                const servicesPromise = !needsServicesScan
+                    ? Promise.resolve(servicesPlan)
+                    : runCodexScanWithImmediateRetry({
+                        run: async () => {
+                            const threadId = await runLocalServicesScan({
+                                cwd: repoRoot,
+                                logDir,
+                                schemaPath: servicesSchemaPath,
+                                outputPath: servicesScanPath,
+                                homeDir: localHomeDir,
+                                ...(initCodexProxyOptions
+                                    ? { proxyOptions: initCodexProxyOptions }
+                                    : {}),
+                                onProgress: updateServices,
+                            });
+                            saveScanThreadId("servicesThreadId", threadId);
+                        },
+                        read: async () => await readServicesPlan(servicesScanPath),
+                        outputPath: servicesScanPath,
+                        update: updateServices,
+                        shouldRetry: (plan) => shouldRetryCodexScan(plan.scanFullyCompleted, plan.appEntrypoints, plan.backgroundServices),
+                    });
+                const [envSecrets, external, extraArtifacts, services] = await Promise.all([
+                    envSecretsPromise,
+                    externalPromise,
+                    extraArtifactsPromise,
+                    servicesPromise,
+                ]);
+                await flushScanThreads();
+                if (needsServicesScan) {
+                    if (!services) {
+                        throw new Error("Services scan missing.");
+                    }
+                    servicesPlan = services;
+                }
+                if (needsSetupScan) {
+                    if (!envSecrets) {
+                        throw new Error("Env/secrets scan missing.");
+                    }
+                    if (!external) {
+                        throw new Error("External scan missing.");
+                    }
+                    if (!extraArtifacts) {
+                        throw new Error("Extra artifacts scan missing.");
+                    }
+                    if (!servicesPlan) {
+                        throw new Error("Services scan missing.");
+                    }
+                    updateEnvSecrets("merging setup plan");
+                    const merged = mergeSetupScans({
+                        envSecrets,
+                        external,
+                        extraArtifacts,
+                        services: {
+                            appEntrypoints: servicesPlan.appEntrypoints,
+                            backgroundServices: servicesPlan.backgroundServices,
+                        },
+                    });
+                    await writeSetupPlan(setupPath, merged);
+                    setupPlan = merged;
+                }
+            };
+            if (!progressEnabled) {
+                await runLocalEnvironmentAnalysis({
+                    updateEnvSecrets: () => { },
+                    updateExternal: () => { },
+                    updateExtraArtifacts: () => { },
+                    updateServices: () => { },
+                });
+            }
+            else {
+                const log = clackTaskLog({
+                    title: "Analyzing local environment",
+                    limit: 1,
+                    spacing: 0,
+                });
+                let active = true;
+                const colorCategory = (label) => {
+                    if (!process.stdout.hasColors?.())
+                        return label;
+                    const undim = "\u001b[22m";
+                    const dim = "\u001b[2m";
+                    const bold = "\u001b[1m";
+                    const teal = "\u001b[36m";
+                    const resetColor = "\u001b[39m";
+                    return `${undim}${teal}${bold}${label}${resetColor}${undim}${dim}`;
+                };
+                const formatRow = (label, message) => {
+                    const normalized = message.replace(/\r?\n/g, " ").trim();
+                    return `${colorCategory(label)}: ${normalized}`;
+                };
+                const envSecretsRow = log.group("");
+                const externalRow = log.group("");
+                const extraArtifactsRow = log.group("");
+                const servicesRow = log.group("");
+                const makeUpdater = (row, label) => (message) => {
+                    if (!active)
+                        return;
+                    row.message(formatRow(label, message));
+                };
+                const updateEnvSecrets = makeUpdater(envSecretsRow, "env/secrets");
+                const updateExternal = makeUpdater(externalRow, "external");
+                const updateExtraArtifacts = makeUpdater(extraArtifactsRow, "extra artifacts");
+                const updateServices = makeUpdater(servicesRow, "services");
+                updateEnvSecrets(needsSetupScan
+                    ? needsEnvSecretsScan
+                        ? "starting"
+                        : "cached"
+                    : "skipped");
+                updateExternal(needsSetupScan
+                    ? needsExternalScan
+                        ? "starting"
+                        : "cached"
+                    : "skipped");
+                updateExtraArtifacts(needsSetupScan
+                    ? needsExtraArtifactsScan
+                        ? "starting"
+                        : "cached"
+                    : "skipped");
+                updateServices(needsServicesScan ? "starting" : "cached");
+                try {
+                    await runLocalEnvironmentAnalysis({
+                        updateEnvSecrets,
+                        updateExternal,
+                        updateExtraArtifacts,
+                        updateServices,
+                    });
+                    active = false;
+                    log.success("Analyzing local environment");
+                }
+                catch (error) {
+                    active = false;
+                    log.error("Analyzing local environment");
+                    throw error;
+                }
+            }
+        }
+        if (!skipSetupPlan && !setupPlan) {
+            setupPlan = await readSetupPlan(setupPath);
+        }
+        if (!skipSetupPlan && !setupPlan) {
+            throw new Error("Setup plan missing.");
+        }
+        const scanStepUpdate = {};
+        const afterScanState = getInitState();
+        if (!skipSetupPlan && setupPlan) {
+            if (!afterScanState?.steps.setupEnvSecretsScanned) {
+                scanStepUpdate.setupEnvSecretsScanned = true;
+            }
+            if (!afterScanState?.steps.setupExternalScanned) {
+                scanStepUpdate.setupExternalScanned = true;
+            }
+            if (!afterScanState?.steps.setupExtraArtifactsScanned) {
+                scanStepUpdate.setupExtraArtifactsScanned = true;
+            }
+            if (!afterScanState?.steps.setupPlanScanned) {
+                scanStepUpdate.setupPlanScanned = true;
+            }
+            if (!afterScanState?.steps.servicesPlanScanned) {
+                scanStepUpdate.servicesPlanScanned = true;
+            }
+        }
+        if (Object.keys(scanStepUpdate).length > 0) {
+            await updateInitState({ steps: scanStepUpdate });
+        }
+        if (skipSetupPlan) {
+            approvedPlan = await readSetupPlan(setupPath);
+        }
+        if (shouldResume && approvedPlan) {
+            const backfillStepUpdate = {};
+            const currentState = getInitState();
+            if (!currentState?.steps.setupEnvSecretsScanned) {
+                backfillStepUpdate.setupEnvSecretsScanned = true;
+            }
+            if (!currentState?.steps.setupExternalScanned) {
+                backfillStepUpdate.setupExternalScanned = true;
+            }
+            if (!currentState?.steps.setupExtraArtifactsScanned) {
+                backfillStepUpdate.setupExtraArtifactsScanned = true;
+            }
+            if (!currentState?.steps.setupPlanScanned) {
+                backfillStepUpdate.setupPlanScanned = true;
+            }
+            if (!currentState?.steps.servicesPlanScanned) {
+                backfillStepUpdate.servicesPlanScanned = true;
+            }
+            if (Object.keys(backfillStepUpdate).length > 0) {
+                await updateInitState({ steps: backfillStepUpdate });
+            }
+        }
+        const formatMissingSetupArtifact = (entry) => {
+            const categoryLabel = entry.category === "envFiles" || entry.category === "secretFiles"
+                ? "env/secrets"
+                : entry.category === "externalConfigs"
+                    ? "external"
+                    : "extra artifacts";
+            return `${categoryLabel}: ${entry.path}`;
+        };
+        const buildMissingPathsFeedback = (categoryLabel, entries) => [
+            `Your previous ${categoryLabel} scan output included path(s) that do not exist on disk right now.`,
+            "Fix the result and return corrected JSON. Only include paths that currently exist.",
+            "Missing paths:",
+            ...entries.map((entry) => `- ${entry.path} (resolved: ${toRepoRelativePath(repoRoot, entry.resolvedPath)})`),
+        ].join("\n");
+        const regenerateSetupPlanForMissingArtifacts = async ({ plan, missingArtifacts, status, }) => {
+            const categories = new Set(missingArtifacts.map((entry) => entry.category));
+            const needsEnvSecrets = categories.has("envFiles") || categories.has("secretFiles");
+            const needsExternal = categories.has("externalConfigs");
+            const needsExtraArtifacts = categories.has("extraArtifacts");
+            let nextPlan = plan;
+            if (needsEnvSecrets) {
+                const envSecretsMissing = missingArtifacts.filter((entry) => entry.category === "envFiles" || entry.category === "secretFiles");
+                const envSecretsSchemaPath = await writeSetupEnvSecretsSchema(setupTempDir);
+                envSecretsScan = await runCodexScanWithImmediateRetry({
+                    run: async () => {
+                        const threadId = await runLocalSetupEnvSecretsScan({
+                            cwd: repoRoot,
+                            logDir,
+                            schemaPath: envSecretsSchemaPath,
+                            outputPath: setupEnvSecretsScanPath,
+                            ...(scanThreads.envSecretsThreadId
+                                ? { resumeThreadId: scanThreads.envSecretsThreadId }
+                                : {}),
+                            retryFeedback: buildMissingPathsFeedback("env/secrets", envSecretsMissing),
+                            ...(initCodexProxyOptions
+                                ? { proxyOptions: initCodexProxyOptions }
+                                : {}),
+                            onProgress: (message) => status.stage(`Regenerating env/secrets scan - ${message}`),
+                        });
+                        saveScanThreadId("envSecretsThreadId", threadId);
+                    },
+                    read: async () => await readSetupEnvSecretsPlan(setupEnvSecretsScanPath),
+                    outputPath: setupEnvSecretsScanPath,
+                    update: (message) => status.stage(`Regenerating env/secrets scan - ${message}`),
+                    shouldRetry: (scan) => shouldRetryCodexScan(scan.scanFullyCompleted, scan.envFiles, scan.secretFiles),
+                });
+                nextPlan = {
+                    ...nextPlan,
+                    envFiles: remapSelectedPathEntries({
+                        selected: nextPlan.envFiles,
+                        refreshed: envSecretsScan.envFiles,
+                    }),
+                    secretFiles: remapSelectedPathEntries({
+                        selected: nextPlan.secretFiles,
+                        refreshed: envSecretsScan.secretFiles,
+                    }),
+                };
+            }
+            if (needsExternal) {
+                const externalMissing = missingArtifacts.filter((entry) => entry.category === "externalConfigs");
+                const externalSchemaPath = await writeSetupExternalSchema(setupTempDir);
+                externalScan = await runCodexScanWithImmediateRetry({
+                    run: async () => {
+                        const threadId = await runLocalSetupExternalScan({
+                            cwd: repoRoot,
+                            logDir,
+                            schemaPath: externalSchemaPath,
+                            outputPath: setupExternalScanPath,
+                            homeDir: localHomeDir,
+                            ...(scanThreads.externalThreadId
+                                ? { resumeThreadId: scanThreads.externalThreadId }
+                                : {}),
+                            retryFeedback: buildMissingPathsFeedback("external", externalMissing),
+                            ...(initCodexProxyOptions
+                                ? { proxyOptions: initCodexProxyOptions }
+                                : {}),
+                            onProgress: (message) => status.stage(`Regenerating external scan - ${message}`),
+                        });
+                        saveScanThreadId("externalThreadId", threadId);
+                    },
+                    read: async () => await readSetupExternalPlan(setupExternalScanPath),
+                    outputPath: setupExternalScanPath,
+                    update: (message) => status.stage(`Regenerating external scan - ${message}`),
+                    shouldRetry: (scan) => shouldRetryCodexScan(scan.scanFullyCompleted, scan.externalDependencies, scan.externalConfigs),
+                });
+                nextPlan = {
+                    ...nextPlan,
+                    externalConfigs: remapSelectedPathEntries({
+                        selected: nextPlan.externalConfigs,
+                        refreshed: externalScan.externalConfigs,
+                    }),
+                };
+            }
+            if (needsExtraArtifacts) {
+                const extraArtifactsMissing = missingArtifacts.filter((entry) => entry.category === "extraArtifacts");
+                const extraArtifactsSchemaPath = await writeSetupExtraArtifactsSchema(setupTempDir);
+                extraArtifactsScan = await runCodexScanWithImmediateRetry({
+                    run: async () => {
+                        const threadId = await runLocalSetupExtraArtifactsScan({
+                            cwd: repoRoot,
+                            logDir,
+                            schemaPath: extraArtifactsSchemaPath,
+                            outputPath: setupExtraArtifactsScanPath,
+                            ...(scanThreads.extraArtifactsThreadId
+                                ? { resumeThreadId: scanThreads.extraArtifactsThreadId }
+                                : {}),
+                            retryFeedback: buildMissingPathsFeedback("extra artifacts", extraArtifactsMissing),
+                            ...(initCodexProxyOptions
+                                ? { proxyOptions: initCodexProxyOptions }
+                                : {}),
+                            onProgress: (message) => status.stage(`Regenerating extra artifacts scan - ${message}`),
+                        });
+                        saveScanThreadId("extraArtifactsThreadId", threadId);
+                    },
+                    read: async () => await readSetupExtraArtifactsPlan(setupExtraArtifactsScanPath),
+                    outputPath: setupExtraArtifactsScanPath,
+                    update: (message) => status.stage(`Regenerating extra artifacts scan - ${message}`),
+                    shouldRetry: (scan) => shouldRetryCodexScan(scan.scanFullyCompleted, scan.extraArtifacts),
+                });
+                nextPlan = {
+                    ...nextPlan,
+                    extraArtifacts: remapSelectedPathEntries({
+                        selected: nextPlan.extraArtifacts,
+                        refreshed: extraArtifactsScan.extraArtifacts,
+                    }),
+                };
+            }
+            await flushScanThreads();
+            return nextPlan;
+        };
+        if (nonInteractive) {
+            if (setupPlan)
+                approvedPlan = setupPlan;
+        }
+        else if (!skipSetupPlan && setupPlan) {
+            if (!process.stdin.isTTY || parsed.json) {
+                throw new Error("Interactive terminal required to approve setup.");
+            }
+            const statCache = new Map();
+            const readPathInfo = async (candidatePath) => {
+                const cached = statCache.get(candidatePath);
+                if (cached)
+                    return cached;
+                const resolved = path.isAbsolute(candidatePath)
+                    ? candidatePath
+                    : path.resolve(repoRoot, candidatePath);
+                const relative = toRepoRelativePath(repoRoot, candidatePath);
+                const outsideRepo = isOutsideRepoPath(relative);
+                let isDirectory = false;
+                try {
+                    const stat = await fs.stat(resolved);
+                    isDirectory = stat.isDirectory();
+                }
+                catch {
+                    isDirectory = false;
+                }
+                const info = { relative, outsideRepo, isDirectory };
+                statCache.set(candidatePath, info);
+                return info;
+            };
+            const buildApprovalSummary = async (plan) => {
+                const lines = [];
+                lines.push("Setup");
+                lines.push(`- .env files: ${plan.envFiles.length}`);
+                for (const entry of plan.envFiles) {
+                    lines.push(`  - ${toRepoRelativePath(repoRoot, entry.path)}`);
+                }
+                lines.push(`- Secret/config files: ${plan.secretFiles.length}`);
+                for (const entry of plan.secretFiles) {
+                    lines.push(`  - ${toRepoRelativePath(repoRoot, entry.path)}`);
+                }
+                lines.push(`- Other artifacts: ${plan.extraArtifacts.length}`);
+                for (const entry of plan.extraArtifacts) {
+                    lines.push(`  - ${toRepoRelativePath(repoRoot, entry.path)}`);
+                }
+                lines.push(`- External dependencies: ${plan.externalDependencies.length}`);
+                for (const entry of plan.externalDependencies) {
+                    lines.push(`  - ${entry.version ? `${entry.name}@${entry.version}` : entry.name}`);
+                }
+                lines.push(`- External config/secret files: ${plan.externalConfigs.length}`);
+                for (const entry of plan.externalConfigs) {
+                    lines.push(`  - ${toRepoRelativePath(repoRoot, entry.path)}`);
+                }
+                lines.push("");
+                lines.push("Services");
+                lines.push(`- App entrypoints: ${plan.services.appEntrypoints.length}`);
+                for (const entry of plan.services.appEntrypoints) {
+                    lines.push(`  - ${entry.command}`);
+                }
+                lines.push(`- Background services: ${plan.services.backgroundServices.length}`);
+                for (const entry of plan.services.backgroundServices) {
+                    lines.push(`  - ${entry.name}`);
+                }
+                const candidatePaths = new Set();
+                for (const entry of [
+                    ...plan.envFiles,
+                    ...plan.secretFiles,
+                    ...plan.extraArtifacts,
+                    ...plan.externalConfigs,
+                ]) {
+                    candidatePaths.add(entry.path);
+                }
+                const outsideRepoPaths = [];
+                const directoryPaths = [];
+                for (const candidatePath of candidatePaths) {
+                    const info = await readPathInfo(candidatePath);
+                    if (info.outsideRepo)
+                        outsideRepoPaths.push(info.relative);
+                    if (info.isDirectory)
+                        directoryPaths.push(info.relative);
+                }
+                outsideRepoPaths.sort();
+                directoryPaths.sort();
+                const hasRisk = outsideRepoPaths.length > 0 || directoryPaths.length > 0;
+                const warningLines = [];
+                if (outsideRepoPaths.length > 0) {
+                    warningLines.push("Outside repo:");
+                    for (const entry of outsideRepoPaths) {
+                        warningLines.push(`- ${entry}`);
+                    }
+                    warningLines.push("");
+                }
+                if (directoryPaths.length > 0) {
+                    warningLines.push("Directories:");
+                    for (const entry of directoryPaths) {
+                        warningLines.push(`- ${entry}`);
+                    }
+                }
+                return {
+                    summary: lines.join("\n"),
+                    warning: warningLines.length > 0 ? warningLines.join("\n") : null,
+                    hasRisk,
+                };
+            };
+            let draftSetup = setupPlan;
+            while (true) {
+                const nextSetup = await promptForPlanApproval({
+                    plan: setupPlan,
+                    repoRoot,
+                    initialPlan: draftSetup,
+                });
+                const nextServices = await promptForServicesApproval({
+                    plan: setupPlan.services,
+                    initialSelection: draftSetup?.services ?? null,
+                });
+                const nextPlan = { ...nextSetup, services: nextServices };
+                const { summary, warning, hasRisk } = await buildApprovalSummary(nextPlan);
+                clackNote(summary, "Selected setup requirements");
+                if (warning) {
+                    clackNote(warning, "Special attention");
+                }
+                const decision = await clackSelect({
+                    message: "Proceed with these selections?",
+                    options: [
+                        { value: "proceed", label: "Proceed" },
+                        { value: "edit", label: "Edit selections" },
+                        { value: "cancel", label: "Cancel" },
+                    ],
+                    initialValue: "proceed",
+                });
+                if (isCancel(decision) || decision === "cancel") {
+                    throwInitCanceled();
+                }
+                if (decision === "edit") {
+                    draftSetup = nextPlan;
+                    continue;
+                }
+                if (hasRisk) {
+                    const confirmed = await clackConfirm({
+                        message: "You selected items outside the repo and/or directories. Continue?",
+                        active: "Continue",
+                        inactive: "Edit selections",
+                        initialValue: true,
+                    });
+                    if (isCancel(confirmed)) {
+                        throwInitCanceled();
+                    }
+                    if (!confirmed) {
+                        draftSetup = nextPlan;
+                        continue;
+                    }
+                }
+                approvedPlan = nextPlan;
+                break;
+            }
+        }
+        if (!approvedPlan) {
+            throw new Error("Setup plan missing.");
+        }
+        let ensuredPlan = approvedPlan;
+        if (!skipSetupPlan) {
+            await writeSetupPlan(setupPath, ensuredPlan);
+            await updateInitState({ steps: { setupPlanWritten: true } });
+        }
+        if (!skipSetupUpload) {
+            setupArtifacts = await runInitStep({
+                enabled: progressEnabled,
+                title: "Packaging setup artifacts",
+                fn: async ({ status }) => {
+                    let planForArtifacts = ensuredPlan;
+                    for (let attempt = 1; attempt <= SETUP_ARTIFACT_REGEN_MAX_ATTEMPTS + 1; attempt += 1) {
+                        const missingArtifacts = await collectMissingSetupArtifacts({
+                            repoRoot,
+                            homeDir: localHomeDir,
+                            plan: planForArtifacts,
+                        });
+                        if (missingArtifacts.length === 0) {
+                            ensuredPlan = planForArtifacts;
+                            approvedPlan = planForArtifacts;
+                            return await createSetupArtifacts({
+                                repoRoot,
+                                plan: planForArtifacts,
+                                outputDir: setupDir,
+                                tempDir: setupTempDir,
+                                homeDir: localHomeDir,
+                            });
+                        }
+                        if (attempt > SETUP_ARTIFACT_REGEN_MAX_ATTEMPTS) {
+                            const lines = missingArtifacts
+                                .map((entry) => `- ${formatMissingSetupArtifact(entry)}`)
+                                .sort((a, b) => a.localeCompare(b));
+                            throw new Error([
+                                "Setup artifact scan returned paths that do not exist locally.",
+                                `Retried regeneration ${SETUP_ARTIFACT_REGEN_MAX_ATTEMPTS} time(s) and still found missing files:`,
+                                ...lines,
+                            ].join("\n"));
+                        }
+                        const needsEnvSecrets = missingArtifacts.some((entry) => entry.category === "envFiles" ||
+                            entry.category === "secretFiles");
+                        const needsExternal = missingArtifacts.some((entry) => entry.category === "externalConfigs");
+                        const needsExtraArtifacts = missingArtifacts.some((entry) => entry.category === "extraArtifacts");
+                        const scanLabels = [
+                            ...(needsEnvSecrets ? ["env/secrets"] : []),
+                            ...(needsExternal ? ["external"] : []),
+                            ...(needsExtraArtifacts ? ["extra artifacts"] : []),
+                        ];
+                        status.stage(`Found ${missingArtifacts.length} missing setup artifact path(s); regenerating ${scanLabels.join(", ")} scan(s) (${attempt}/${SETUP_ARTIFACT_REGEN_MAX_ATTEMPTS})`);
+                        planForArtifacts = await regenerateSetupPlanForMissingArtifacts({
+                            plan: planForArtifacts,
+                            missingArtifacts,
+                            status,
+                        });
+                        await writeSetupPlan(setupPath, planForArtifacts);
+                    }
+                    throw new Error("Unreachable setup artifacts retry path.");
+                },
+            });
+        }
+    }
+    finally {
+        await fs.rm(setupTempDir, { recursive: true, force: true });
+    }
+    if (!approvedPlan) {
+        throw new Error("Setup plan missing.");
+    }
+    const finalApprovedPlan = approvedPlan;
+    return {
+        setupPath,
+        finalApprovedPlan,
+        setupArtifacts,
+        skipServicesConfig,
+        skipServicesEnable,
+        skipSetupUpload,
+    };
+};
+export { runSetupPlanFlow };
+//# sourceMappingURL=setupPlanFlow.js.map