@catalyst-cloud/cli 0.14.1 → 0.14.2

package/dist/onboard-runtime.js

@@ -0,0 +1,153 @@
+import { existsSync, realpathSync } from "node:fs";
+import { userInfo } from "node:os";
+import { join } from "node:path";
+import { openBrowser } from "./browser.js";
+import { defaultSkillsDirFor, loadConfig, normalizeBaseUrl, readManifest } from "./config.js";
+import { CliError } from "./errors.js";
+import { cmdLegacy, findLegacy } from "./legacy.js";
+import { bearerFor } from "./oauth.js";
+import { pollConsent } from "./onboard-consent.js";
+import { boundedOnboardSignin } from "./onboard-signin.js";
+import { existingLinearAdapters } from "./onboard-existing.js";
+import { existingRepositoryAdapter } from "./onboard-repositories.js";
+import { fetchMe } from "./transport.js";
+const waiting = (reason) => ({ state: "waiting", reason });
+function sameHome(a, b) {
+    try {
+        return realpathSync(a) === realpathSync(b);
+    }
+    catch {
+        return false;
+    }
+}
+/** Only existing bearer routes are registered here. Missing server capabilities stay unfinished. */
+export function createOnboardRuntime(args, ctx, hooks) {
+    const identity = async (stepCtx = ctx, journal) => {
+        const cfg = loadConfig(stepCtx.home);
+        if (!cfg)
+            return null;
+        const requested = args.baseUrl ?? stepCtx.env.CATALYST_CLOUD_BASE_URL;
+        if (requested && normalizeBaseUrl(requested) !== normalizeBaseUrl(cfg.baseUrl))
+            throw new CliError("the saved login uses another cloud; resume against that cloud", "onboard-base-url-mismatch", 12);
+        if (!cfg.user)
+            throw new CliError("sign in as yourself to set up Catalyst", "onboard-person-required", 12);
+        if (journal && (((journal.account ?? journal.tenant) && (journal.account ?? journal.tenant) !== cfg.account) ||
+            (journal.membershipId && journal.membershipId !== cfg.user.id) ||
+            (journal.baseUrl && normalizeBaseUrl(journal.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))))
+            throw new CliError("the saved setup belongs to another workspace or member", "onboard-identity-mismatch", 12);
+        const me = await fetchMe(cfg.baseUrl, await bearerFor(stepCtx, cfg), stepCtx.fetch);
+        if (!me.user || me.account !== cfg.account || me.user.id !== cfg.user.id)
+            throw new CliError("the saved login and live member do not match", "onboard-identity-mismatch", 12);
+        // /me names a person within the account, not an independently exposed membership-row ID.
+        return { account: me.account, membershipId: me.user.id, baseUrl: normalizeBaseUrl(cfg.baseUrl), role: me.user.role };
+    };
+    const legacyCheck = async (stepCtx) => {
+        const found = findLegacy(stepCtx.home, hooks.legacy?.platform ?? process.platform).filter(item => !item.data).length;
+        if (!sameHome(stepCtx.home, (hooks.realHome ?? (() => userInfo().homedir))()))
+            return { state: "skipped", reason: "fake_home_report_only", evidence: { found, remaining: found } };
+        return { state: found ? "pending" : "done", evidence: { found, remaining: found } };
+    };
+    const unsupported = { check: async () => waiting("cloud_capability_unavailable"), act: async () => waiting("cloud_capability_unavailable") };
+    const personalStatus = async (provider, stepCtx, signal) => {
+        const cfg = loadConfig(stepCtx.home);
+        if (!cfg || !cfg.user)
+            return { outcome: "refused", reason: "personal_login_required" };
+        const response = await stepCtx.fetch(`${normalizeBaseUrl(cfg.baseUrl)}/api/v1/me/connections/${provider}/personal`, {
+            headers: { authorization: `Bearer ${await bearerFor(stepCtx, cfg)}`, accept: "application/json" },
+            signal: signal ?? AbortSignal.timeout(30_000),
+        });
+        if (response.status === 401 || response.status === 403)
+            return { outcome: "refused", reason: "personal_consent_refused" };
+        if (response.status === 503)
+            return { outcome: "unavailable" };
+        if (!response.ok)
+            return { outcome: "failed", reason: "personal_status_failed" };
+        const body = await response.json();
+        if (!body || typeof body !== "object" || !("connected" in body))
+            return { outcome: "failed", reason: "personal_status_shape" };
+        if (body.connected === true)
+            return { outcome: "connected" };
+        if (body.connected !== false)
+            return { outcome: "failed", reason: "personal_status_shape" };
+        return { outcome: "reason" in body && body.reason === "lapsed" ? "lapsed" : "absent" };
+    };
+    const personalAdapter = (provider) => ({
+        check: async (stepCtx) => {
+            const result = await personalStatus(provider, stepCtx);
+            if (result.outcome === "connected")
+                return { state: "done" };
+            if (result.outcome === "refused" || result.outcome === "failed")
+                return { state: result.outcome, reason: result.reason };
+            return result.outcome === "unavailable" ? waiting("personal_status_unavailable") : { state: "pending" };
+        }, act: async (stepCtx, _journal, signal) => {
+            const cfg = loadConfig(stepCtx.home);
+            if (!cfg || !cfg.user)
+                return { state: "refused", reason: "personal_login_required" };
+            const response = await stepCtx.fetch(`${normalizeBaseUrl(cfg.baseUrl)}/connect/${provider}/personal/start`, {
+                headers: { authorization: `Bearer ${await bearerFor(stepCtx, cfg)}`, accept: "application/json" }, signal: AbortSignal.timeout(30_000),
+            });
+            if (response.status === 409)
+                return waiting(provider === "linear" ? "linear_workspace_required" : "github_workspace_required");
+            if (response.status === 401 || response.status === 403)
+                return { state: "refused", reason: "personal_consent_refused" };
+            if (!response.ok)
+                return { state: "failed", reason: "personal_consent_start_failed" };
+            const body = await response.json();
+            if (typeof body.authorizationUrl !== "string" || typeof body.expiresAt !== "number")
+                return { state: "failed", reason: "personal_consent_shape" };
+            let url;
+            try {
+                url = new URL(body.authorizationUrl);
+            }
+            catch {
+                return { state: "failed", reason: "personal_consent_shape" };
+            }
+            if (url.protocol !== "https:" || url.origin !== new URL(cfg.baseUrl).origin || url.username || url.password)
+                return { state: "refused", reason: "personal_consent_origin" };
+            stepCtx.stderr(`Approve your personal ${provider === "linear" ? "Linear" : "GitHub"} connection in the browser.`);
+            stepCtx.stderr(url.toString());
+            (hooks.openBrowser ?? openBrowser)(url.toString());
+            const poll = () => pollConsent({ readStatus: pollSignal => personalStatus(provider, stepCtx, pollSignal), sleep: hooks.sleep, signal });
+            return hooks.ui ? hooks.ui.wait(`Waiting for your ${provider === "linear" ? "Linear" : "GitHub"} approval`, poll) : poll();
+        }
+    });
+    return {
+        identity: journal => identity(ctx, journal), bindSignals: true, ui: hooks.ui,
+        adapters: {
+            machine: { check: async () => process.platform === "darwin" || process.platform === "linux"
+                    ? { state: "done", evidence: { provider: process.platform } } : waiting("machine_platform_unsupported") },
+            cli: { check: async () => ({ state: "done", evidence: { version: readManifest().version } }) },
+            skills: { check: async (stepCtx) => {
+                    const cfg = loadConfig(stepCtx.home);
+                    const dir = stepCtx.env.CATALYST_SKILLS_DIR ?? cfg?.skillsDir ?? defaultSkillsDirFor(stepCtx.home);
+                    const names = hooks.skillNames ?? [];
+                    const count = names.filter(name => existsSync(join(dir, name, "SKILL.md"))).length;
+                    return names.length > 0 && count === names.length ? { state: "done", evidence: { count, path: dir } } : waiting("skills_install_unverified");
+                } },
+            legacy: { check: legacyCheck, act: async (stepCtx) => {
+                    const before = await legacyCheck(stepCtx);
+                    if (before.state !== "pending")
+                        return before;
+                    // Provider/process output is not trusted to be secret-free; keep it out of the receipt/log.
+                    const quiet = { ...stepCtx, stdout: () => { }, stderr: () => { } };
+                    const code = await cmdLegacy({ ...args, command: "legacy", subcommand: null, rest: [], flags: { remove: true, yes: true }, json: false }, quiet, hooks.legacy);
+                    return code === 0 ? legacyCheck(stepCtx) : { state: "failed", reason: "legacy_cleanup_failed" };
+                } },
+            signin: { check: async (stepCtx, journal) => {
+                    const who = await identity(stepCtx, journal);
+                    return who ? { state: "done", evidence: { account: who.account, membershipId: who.membershipId, role: who.role } } : { state: "pending" };
+                }, act: async (stepCtx, _journal, signal) => {
+                    return boundedOnboardSignin({ ...stepCtx, stdout: stepCtx.stderr }, hooks.login, signal, hooks.signinTimeoutMs);
+                } },
+            ...existingLinearAdapters(args, hooks.ui?.chooseTeam ? teams => hooks.ui.chooseTeam(teams.map(team => ({ ...team }))) : undefined),
+            "github.install": unsupported,
+            "github.repos": existingRepositoryAdapter(args, hooks.ui?.chooseRepositories ? repositories => hooks.ui.chooseRepositories(repositories.map(row => ({ ...row }))) : undefined),
+            "linear.personal": personalAdapter("linear"),
+            "github.personal": personalAdapter("github"),
+            daemon: { check: async (_stepCtx, journal) => (journal.localSync ?? args.flags["local-sync"] === true) ? waiting("local_sync_capability_unavailable")
+                    : { state: "skipped", reason: "local_sync_not_selected", evidence: { provider: "cloud" } } },
+            housekeeping: { check: async () => waiting("housekeeping_service_unverified") },
+            ready: { check: hooks.ready },
+        },
+    };
+}

package/dist/onboard-signin.js

@@ -0,0 +1,43 @@
+import { CliError, UsageError } from "./errors.js";
+const TIMED_OUT = Symbol("signin_timeout");
+const cancelled = () => new CliError("Sign-in paused. Run the same command to resume.", "login-cancelled", 11);
+/** One onboarding budget includes every device-code round and final member verification. */
+export async function boundedOnboardSignin(ctx, login, external, timeoutMs = 600_000) {
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 600_000)
+        throw new UsageError("onboarding sign-in timeout must be 1 to 600000 milliseconds");
+    const deadline = new AbortController();
+    const timer = setTimeout(() => deadline.abort(), timeoutMs);
+    const signal = external ? AbortSignal.any([external, deadline.signal]) : deadline.signal;
+    let removeAbort = () => { };
+    try {
+        const exit = await new Promise((resolve, reject) => {
+            const stopped = () => external?.aborted ? reject(cancelled()) : resolve(TIMED_OUT);
+            if (signal.aborted) {
+                stopped();
+                return;
+            }
+            signal.addEventListener("abort", stopped, { once: true });
+            removeAbort = () => signal.removeEventListener("abort", stopped);
+            const stepCtx = { ...ctx, fetch: (async (input, init) => {
+                    if (signal.aborted)
+                        throw cancelled();
+                    const response = await ctx.fetch(input, { ...init, signal: init?.signal ? AbortSignal.any([signal, init.signal]) : signal });
+                    if (signal.aborted)
+                        throw cancelled();
+                    return response;
+                }) };
+            // Attach both handlers even when a custom callback ignores abort and settles after the budget.
+            Promise.resolve().then(() => {
+                if (signal.aborted)
+                    throw cancelled();
+                return login(stepCtx, signal);
+            }).then(code => signal.aborted ? stopped() : resolve(code), error => signal.aborted ? stopped() : reject(error));
+        });
+        return exit === TIMED_OUT ? { state: "waiting", reason: "signin_timeout" }
+            : exit === 0 ? { state: "done" } : { state: "failed", reason: "signin_failed" };
+    }
+    finally {
+        clearTimeout(timer);
+        removeAbort();
+    }
+}

package/dist/onboard-ui.js

@@ -0,0 +1,155 @@
+import { createOnboardProgress } from "./onboard-progress.js";
+import { ONBOARD_STEPS, ONBOARD_TITLES } from "./onboard.js";
+export function shouldUseOnboardUi(args, stdoutTty) {
+    return stdoutTty && !args.json && args.flags.yes !== true && args.flags["dry-run"] !== true;
+}
+export function createClackOnboardUi(prompts, streams, deps = {}) {
+    const abort = new AbortController();
+    const options = { ...streams, signal: abort.signal };
+    // Clack 1.8.1's spinner calls process.exit(0) on raw Ctrl-C, bypassing receipt/lock cleanup.
+    const spin = deps.progress ?? createOnboardProgress(streams.output, abort.signal, () => abort.abort());
+    const signals = deps.signals ?? process;
+    const interrupt = () => abort.abort();
+    for (const event of ["SIGINT", "SIGTERM", "SIGHUP"])
+        signals.on(event, interrupt);
+    let active = false;
+    let introduced = false;
+    let group;
+    const stop = () => { if (active) {
+        spin.stop();
+        active = false;
+    } };
+    const message = (text) => { stop(); prompts.log.message(text, { output: streams.output }); };
+    const start = (text) => { stop(); if (!abort.signal.aborted) {
+        spin.start(text);
+        active = true;
+    } };
+    return {
+        signal: abort.signal,
+        plan(journal) {
+            stop();
+            if (!introduced) {
+                prompts.intro("Catalyst setup", { output: streams.output });
+                introduced = true;
+            }
+            const steps = new Map(journal.steps.map(step => [step.id, step]));
+            message(ONBOARD_STEPS.map(id => `· ${ONBOARD_TITLES[id]}${steps.get(id)?.state === "done" ? " (recheck)" : ""}`).join("\n"));
+            message("Use cloud reads by default. Local sync is optional for SQL, offline work or sustained reads.");
+        },
+        async confirmPlan(localSync) {
+            stop();
+            const answer = await prompts.select({ ...options, message: "Continue with this plan?", initialValue: localSync ? "local" : "cloud", options: [
+                    { value: "cloud", label: "Continue using cloud reads", hint: "default" },
+                    { value: "local", label: "Continue and set up local sync" },
+                    { value: "stop", label: "Stop without changes" },
+                ] });
+            if (prompts.isCancel(answer)) {
+                abort.abort();
+                return { proceed: false, localSync };
+            }
+            return { proceed: answer === "cloud" || answer === "local", localSync: answer === "local" };
+        },
+        async chooseTeam(teams) {
+            stop();
+            if (!teams.length || abort.signal.aborted)
+                return null;
+            const answer = await prompts.select({ ...options, message: "Which Linear team should this project use?", initialValue: teams[0].id,
+                options: teams.map(team => ({ value: team.id, label: `${team.name || team.key || team.id}${team.key && team.name ? ` (${team.key})` : ""}` })) });
+            if (prompts.isCancel(answer)) {
+                abort.abort();
+                return null;
+            }
+            return typeof answer === "string" ? answer : null;
+        },
+        ...(prompts.multiselect ? { async chooseRepositories(repositories) {
+                stop();
+                if (!repositories.length || abort.signal.aborted)
+                    return null;
+                const answer = await prompts.multiselect({ ...options, message: "Which repositories should use this Linear team?", required: true,
+                    options: repositories.map(row => ({ value: `${row.owner}/${row.name}`, label: `${row.owner}/${row.name}` })) });
+                if (prompts.isCancel(answer)) {
+                    abort.abort();
+                    return null;
+                }
+                return Array.isArray(answer) ? answer : null;
+            } } : {}),
+        stepStart(id) {
+            const next = ["machine", "cli", "skills", "legacy"].includes(id) ? "This computer"
+                : id === "signin" ? "Catalyst sign-in" : id.startsWith("linear.") || id.startsWith("github.") ? "Connections"
+                    : ["projects", "accounts", "settings", "values"].includes(id) ? "Project setup"
+                        : ["capacity", "daemon", "housekeeping"].includes(id) ? "Runner and services" : "Work and readiness";
+            if (next !== group) {
+                message(next);
+                group = next;
+            }
+            start(ONBOARD_TITLES[id]);
+        },
+        stepEnd(step) {
+            stop();
+            const reasons = {
+                cloud_capability_unavailable: "Your cloud does not support this setup step yet.",
+                step_not_available_in_this_release: "This setup step is not available yet.",
+                prerequisite_not_ready: "Waiting for an earlier setup step.",
+                local_sync_not_selected: "Using cloud reads. Local sync was not selected.",
+                local_sync_capability_unavailable: "Local sync was selected but could not be verified.",
+                member_scope: "Your workspace administrator handles this step.",
+                onboarding_checks_pending: "Some required checks are still unverified.",
+                interrupted: "Setup paused. Run the same command to resume.",
+                signin_timeout: "Sign-in timed out. Run catalyst onboard to try again.",
+                linear_workspace_unverified: "Your Linear workspace connection could not be verified.",
+                team_inventory_empty: "No existing Linear teams could be verified.",
+                team_inventory_shape: "The cloud returned a team list that could not be verified.",
+                team_read_unavailable: "Your existing Linear teams could not be read. Run catalyst onboard to try again.",
+                team_read_login_refresh_required: "Your login needs a refresh. Run catalyst onboard to resume.",
+                team_choice_required: "Choose an existing team with catalyst onboard --team <team ID or key>.",
+                team_selection_unverified: "Your selected Linear team could not be verified. Run catalyst onboard --team <team ID or key> to choose again.",
+                repository_choice_required: "Choose repositories with catalyst onboard --repo <owner/name>. Repeat --repo to choose more than one.",
+                repository_inventory_empty: "No accessible repositories are registered to this Linear team yet.",
+                repository_read_unavailable: "Your repository list could not be read. Run catalyst onboard to try again.",
+                repository_inventory_shape: "The cloud returned a repository list that could not be verified.",
+                repository_contract_unavailable: "Current repository IDs could not be checked. Run catalyst onboard to try again.",
+                repository_contract_unverified: "The cloud returned repository IDs that could not be verified for this workspace.",
+                repository_id_unverified: "A repository's current ID could not be verified. Keep your selection and try again.",
+                repository_binding_ambiguous: "A repository's Linear team binding is ambiguous. Your administrator needs to check it.",
+                repository_identity_unverified: "Sign in to the original workspace to choose repositories.",
+                repository_selection_unverified: "Your selected repositories could not be verified. Run catalyst onboard --repo <owner/name> to choose again.",
+            };
+            const text = `${ONBOARD_TITLES[step.id]}${step.reason ? `: ${reasons[step.reason] ?? step.reason.replaceAll("_", " ")}` : ""}`;
+            const kind = step.state === "done" ? "info" : step.state === "failed" ? "error" : step.state === "waiting" || step.state === "pending" ? "warn" : "message";
+            prompts.log[kind](`${step.state === "done" ? "✓ " : ""}${text}`, { output: streams.output });
+        },
+        message,
+        finish(journal, only) {
+            stop();
+            let text = "Setup still needs checks. Run catalyst onboard to resume.";
+            if (abort.signal.aborted)
+                text = "Setup paused. Your progress is saved.\nresume: catalyst onboard";
+            else if (journal.complete && journal.exit === 0 && !only)
+                text = "Onboarding complete.";
+            else if (only && journal.exit === 0)
+                text = `${ONBOARD_TITLES[only]} finished. Onboarding still has other steps.\nresume: catalyst onboard`;
+            prompts.outro(text, { output: streams.output });
+        },
+        async wait(text, run) { start(text); try {
+            return await run();
+        }
+        finally {
+            stop();
+        } },
+        dispose() {
+            try {
+                stop();
+            }
+            finally {
+                abort.abort();
+                try {
+                    spin.dispose();
+                }
+                finally {
+                    for (const event of ["SIGINT", "SIGTERM", "SIGHUP"])
+                        signals.off(event, interrupt);
+                }
+            }
+        },
+    };
+}