@catalyst-cloud/cli 0.14.3 → 0.14.5

package/dist/onboard-personal.js

@@ -0,0 +1,231 @@
+import { loadConfig, normalizeBaseUrl, } from "./config.js";
+import { pollConsent } from "./onboard-consent.js";
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value
+    : null;
+const waiting = (reason) => ({
+    state: "waiting",
+    reason,
+});
+const same = (a, b) => !!b?.user &&
+    !!a.user &&
+    a.account === b.account &&
+    a.user.id === b.user.id &&
+    normalizeBaseUrl(a.baseUrl) === normalizeBaseUrl(b.baseUrl);
+/** Headers and body share an owned deadline; abandoned reads cannot rotate local credentials. */
+async function read(ctx, journal, path, timeoutMs, external) {
+    const cfg = loadConfig(ctx.home);
+    if (!cfg?.user)
+        return { reason: "personal_login_required" };
+    if (((journal.account ?? journal.tenant) &&
+        (journal.account ?? journal.tenant) !== cfg.account) ||
+        (journal.membershipId && journal.membershipId !== cfg.user.id) ||
+        (journal.baseUrl &&
+            normalizeBaseUrl(journal.baseUrl) !== normalizeBaseUrl(cfg.baseUrl)))
+        return { reason: "personal_identity_refused" };
+    const expiry = cfg.auth
+        ? Date.parse(cfg.auth.expiresAt) - ctx.now().getTime()
+        : 0;
+    const bearer = cfg.key ||
+        (cfg.auth && Number.isFinite(expiry) && expiry > 30_000
+            ? cfg.auth.accessToken
+            : undefined);
+    if (!bearer)
+        return { reason: "personal_login_refresh_required" };
+    const owned = new AbortController();
+    const timer = setTimeout(() => owned.abort(), timeoutMs);
+    const signal = external
+        ? AbortSignal.any([external, owned.signal])
+        : owned.signal;
+    let remove = () => { };
+    try {
+        return await new Promise((resolve) => {
+            const stopped = () => resolve({
+                reason: external?.aborted
+                    ? "interrupted"
+                    : "personal_status_unavailable",
+            });
+            if (signal.aborted) {
+                stopped();
+                return;
+            }
+            signal.addEventListener("abort", stopped, { once: true });
+            remove = () => signal.removeEventListener("abort", stopped);
+            Promise.resolve()
+                .then(async () => {
+                if (signal.aborted)
+                    return { reason: "interrupted" };
+                const response = await ctx.fetch(`${normalizeBaseUrl(cfg.baseUrl)}${path}`, {
+                    method: "GET",
+                    redirect: "error",
+                    headers: {
+                        authorization: `Bearer ${bearer}`,
+                        accept: "application/json",
+                    },
+                    signal,
+                });
+                if (response.status !== 200)
+                    return { status: response.status };
+                const body = await response.json();
+                if (!same(cfg, loadConfig(ctx.home)))
+                    return { reason: "personal_identity_refused" };
+                return { status: 200, body };
+            })
+                .then((value) => (signal.aborted ? stopped() : resolve(value)), () => signal.aborted
+                ? stopped()
+                : resolve({ reason: "personal_status_unavailable" }));
+        });
+    }
+    finally {
+        clearTimeout(timer);
+        remove();
+    }
+}
+function failure(value, start = false) {
+    if ("reason" in value)
+        return ["personal_login_required", "personal_identity_refused"].includes(value.reason)
+            ? { state: "refused", reason: value.reason }
+            : waiting(value.reason);
+    if (value.status === 401 || value.status === 403)
+        return { state: "refused", reason: "personal_consent_refused" };
+    if (value.status === 503)
+        return waiting("personal_status_unavailable");
+    if ([404, 405].includes(value.status))
+        return waiting("cloud_capability_unavailable");
+    return value.status === 200
+        ? null
+        : {
+            state: "failed",
+            reason: start
+                ? "personal_consent_start_failed"
+                : "personal_status_failed",
+        };
+}
+function handoff(body, provider, cfg, now) {
+    const row = object(body);
+    if (!row ||
+        typeof row.authorizationUrl !== "string" ||
+        row.authorizationUrl.length > 8192 ||
+        /[\u0000-\u0020\u007f]/.test(row.authorizationUrl) ||
+        typeof row.expiresAt !== "number" ||
+        !Number.isFinite(row.expiresAt) ||
+        row.expiresAt <= now ||
+        row.expiresAt > now + 630_000)
+        return null;
+    try {
+        const url = new URL(row.authorizationUrl);
+        const keys = [...url.searchParams.keys()];
+        const token = url.searchParams.get("handoff");
+        if (url.protocol !== "https:" ||
+            url.origin !== new URL(normalizeBaseUrl(cfg.baseUrl)).origin ||
+            url.username ||
+            url.password ||
+            url.pathname !== `/connect/${provider}/personal/start` ||
+            url.hash ||
+            keys.length !== 1 ||
+            keys[0] !== "handoff" ||
+            !token ||
+            token.length > 4096 ||
+            /[\s\u0000-\u001f\u007f]/.test(token))
+            return null;
+        return url.toString();
+    }
+    catch {
+        return null;
+    }
+}
+/** The supported personal status reports server-resolved grant availability. A warm grant is
+ * not a new provider viewer probe, repository authorization, or workspace installation verdict. */
+export function personalConsentAdapter(options) {
+    const timeout = options.requestTimeoutMs ?? 30_000;
+    const consentTimeout = options.consentTimeoutMs ?? 600_000;
+    if (!["linear", "github"].includes(options.provider) ||
+        !Number.isSafeInteger(timeout) ||
+        timeout < 1 ||
+        timeout > 30_000 ||
+        !Number.isSafeInteger(consentTimeout) ||
+        consentTimeout < 1 ||
+        consentTimeout > 600_000)
+        throw new Error("personal_timeout_invalid");
+    const statusPath = `/api/v1/me/connections/${options.provider}/personal`;
+    const inspect = async (ctx, journal, signal) => {
+        const response = await read(ctx, journal, statusPath, timeout, signal);
+        const failed = failure(response);
+        if (failed)
+            return failed;
+        const body = object("body" in response ? response.body : undefined);
+        if (!body ||
+            typeof body.connected !== "boolean" ||
+            (body.reason !== undefined &&
+                (body.connected || body.reason !== "lapsed")))
+            return { state: "failed", reason: "personal_status_shape" };
+        return body.connected
+            ? {
+                state: "done",
+                evidence: {
+                    provider: options.provider,
+                    checkedAt: ctx.now().getTime(),
+                },
+            }
+            : { state: "pending" };
+    };
+    return {
+        check: inspect,
+        act: async (ctx, journal, signal) => {
+            if (signal?.aborted)
+                return waiting("interrupted");
+            const cfg = loadConfig(ctx.home);
+            if (!cfg?.user)
+                return { state: "refused", reason: "personal_login_required" };
+            const before = await inspect(ctx, journal, signal);
+            if (before.state !== "pending")
+                return before;
+            const start = await read(ctx, journal, `/connect/${options.provider}/personal/start`, timeout, signal);
+            if ("status" in start &&
+                start.status === 409 &&
+                options.provider === "linear")
+                return waiting("linear_workspace_required");
+            const failed = failure(start, true);
+            if (failed)
+                return failed;
+            const url = handoff("body" in start ? start.body : undefined, options.provider, cfg, ctx.now().getTime());
+            if (!url)
+                return { state: "refused", reason: "personal_consent_handoff" };
+            if (signal?.aborted)
+                return waiting("interrupted");
+            if (!same(cfg, loadConfig(ctx.home)))
+                return { state: "refused", reason: "personal_identity_refused" };
+            const name = options.provider === "linear" ? "Linear" : "GitHub";
+            ctx.stderr(`Approve your personal ${name} connection in the browser.`);
+            // Signed continuation credentials belong only to the browser, never transcript or journal.
+            try {
+                options.openBrowser(url);
+            }
+            catch {
+                return waiting("personal_browser_unavailable");
+            }
+            let latest = waiting("personal_status_unavailable");
+            const run = () => pollConsent({
+                timeoutMs: consentTimeout,
+                signal,
+                sleep: options.sleep,
+                readStatus: async (pollSignal) => {
+                    latest = await inspect(ctx, journal, pollSignal);
+                    if (latest.reason === "cloud_capability_unavailable")
+                        return { outcome: "waiting", reason: latest.reason };
+                    if (latest.state === "done")
+                        return { outcome: "connected" };
+                    if (latest.state === "refused" || latest.state === "failed")
+                        return { outcome: latest.state, reason: latest.reason };
+                    return {
+                        outcome: latest.state === "pending" ? "absent" : "unavailable",
+                    };
+                },
+            });
+            const result = options.wait
+                ? await options.wait(`Waiting for your ${name} approval`, run)
+                : await run();
+            return result.state === "done" ? latest : result;
+        },
+    };
+}

package/dist/onboard-runtime.js

@@ -2,17 +2,22 @@ import { existsSync, realpathSync } from "node:fs";
 import { userInfo } from "node:os";
 import { join } from "node:path";
 import { openBrowser } from "./browser.js";
-import { defaultSkillsDirFor, loadConfig, normalizeBaseUrl, readManifest } from "./config.js";
+import { defaultSkillsDirFor, loadConfig, normalizeBaseUrl, readManifest, } from "./config.js";
 import { CliError } from "./errors.js";
 import { cmdLegacy, findLegacy } from "./legacy.js";
 import { bearerFor } from "./oauth.js";
-import { pollConsent } from "./onboard-consent.js";
+import { personalConsentAdapter } from "./onboard-personal.js";
 import { boundedOnboardSignin } from "./onboard-signin.js";
 import { existingLinearAdapters } from "./onboard-existing.js";
 import { linearWorkspaceAdapter } from "./onboard-workspace.js";
 import { existingRepositoryAdapter } from "./onboard-repositories.js";
+import { githubInstallationAdapter } from "./onboard-github.js";
+import { guardOnboardCapabilities, } from "./onboard-capabilities.js";
 import { fetchMe } from "./transport.js";
-const waiting = (reason) => ({ state: "waiting", reason });
+const waiting = (reason) => ({
+    state: "waiting",
+    reason,
+});
 function sameHome(a, b) {
     try {
         return realpathSync(a) === realpathSync(b);
@@ -28,130 +33,221 @@ export function createOnboardRuntime(args, ctx, hooks) {
         if (!cfg)
             return null;
         const requested = args.baseUrl ?? stepCtx.env.CATALYST_CLOUD_BASE_URL;
-        if (requested && normalizeBaseUrl(requested) !== normalizeBaseUrl(cfg.baseUrl))
+        if (requested &&
+            normalizeBaseUrl(requested) !== normalizeBaseUrl(cfg.baseUrl))
             throw new CliError("the saved login uses another cloud; resume against that cloud", "onboard-base-url-mismatch", 12);
         if (!cfg.user)
             throw new CliError("sign in as yourself to set up Catalyst", "onboard-person-required", 12);
-        if (journal && (((journal.account ?? journal.tenant) && (journal.account ?? journal.tenant) !== cfg.account) ||
-            (journal.membershipId && journal.membershipId !== cfg.user.id) ||
-            (journal.baseUrl && normalizeBaseUrl(journal.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))))
+        if (journal &&
+            (((journal.account ?? journal.tenant) &&
+                (journal.account ?? journal.tenant) !== cfg.account) ||
+                (journal.membershipId && journal.membershipId !== cfg.user.id) ||
+                (journal.baseUrl &&
+                    normalizeBaseUrl(journal.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))))
             throw new CliError("the saved setup belongs to another workspace or member", "onboard-identity-mismatch", 12);
         const me = await fetchMe(cfg.baseUrl, await bearerFor(stepCtx, cfg), stepCtx.fetch);
         if (!me.user || me.account !== cfg.account || me.user.id !== cfg.user.id)
             throw new CliError("the saved login and live member do not match", "onboard-identity-mismatch", 12);
         // /me names a person within the account, not an independently exposed membership-row ID.
-        return { account: me.account, membershipId: me.user.id, baseUrl: normalizeBaseUrl(cfg.baseUrl), role: me.user.role };
+        return {
+            account: me.account,
+            membershipId: me.user.id,
+            baseUrl: normalizeBaseUrl(cfg.baseUrl),
+            role: me.user.role,
+        };
     };
     const legacyCheck = async (stepCtx) => {
-        const found = findLegacy(stepCtx.home, hooks.legacy?.platform ?? process.platform).filter(item => !item.data).length;
+        const found = findLegacy(stepCtx.home, hooks.legacy?.platform ?? process.platform).filter((item) => !item.data).length;
         if (!sameHome(stepCtx.home, (hooks.realHome ?? (() => userInfo().homedir))()))
-            return { state: "skipped", reason: "fake_home_report_only", evidence: { found, remaining: found } };
-        return { state: found ? "pending" : "done", evidence: { found, remaining: found } };
+            return {
+                state: "skipped",
+                reason: "fake_home_report_only",
+                evidence: { found, remaining: found },
+            };
+        return {
+            state: found ? "pending" : "done",
+            evidence: { found, remaining: found },
+        };
     };
-    const unsupported = { check: async () => waiting("cloud_capability_unavailable"), act: async () => waiting("cloud_capability_unavailable") };
-    const personalStatus = async (provider, stepCtx, signal) => {
-        const cfg = loadConfig(stepCtx.home);
-        if (!cfg || !cfg.user)
-            return { outcome: "refused", reason: "personal_login_required" };
-        const response = await stepCtx.fetch(`${normalizeBaseUrl(cfg.baseUrl)}/api/v1/me/connections/${provider}/personal`, {
-            headers: { authorization: `Bearer ${await bearerFor(stepCtx, cfg)}`, accept: "application/json" },
-            signal: signal ?? AbortSignal.timeout(30_000),
-        });
-        if (response.status === 401 || response.status === 403)
-            return { outcome: "refused", reason: "personal_consent_refused" };
-        if (response.status === 503)
-            return { outcome: "unavailable" };
-        if (!response.ok)
-            return { outcome: "failed", reason: "personal_status_failed" };
-        const body = await response.json();
-        if (!body || typeof body !== "object" || !("connected" in body))
-            return { outcome: "failed", reason: "personal_status_shape" };
-        if (body.connected === true)
-            return { outcome: "connected" };
-        if (body.connected !== false)
-            return { outcome: "failed", reason: "personal_status_shape" };
-        return { outcome: "reason" in body && body.reason === "lapsed" ? "lapsed" : "absent" };
+    const personalAdapter = (provider) => personalConsentAdapter({
+        provider,
+        openBrowser: hooks.openBrowser ?? openBrowser,
+        sleep: hooks.sleep,
+        wait: hooks.ui
+            ? (message, run) => hooks.ui.wait(message, run)
+            : undefined,
+    });
+    const linear = existingLinearAdapters(args, hooks.ui?.chooseTeam
+        ? (teams) => hooks.ui.chooseTeam(teams.map((team) => ({ ...team })))
+        : undefined);
+    const adapters = {
+        machine: {
+            check: async () => process.platform === "darwin" || process.platform === "linux"
+                ? { state: "done", evidence: { provider: process.platform } }
+                : waiting("machine_platform_unsupported"),
+        },
+        cli: {
+            check: async () => ({
+                state: "done",
+                evidence: { version: readManifest().version },
+            }),
+        },
+        skills: {
+            check: async (stepCtx) => {
+                const cfg = loadConfig(stepCtx.home);
+                const dir = stepCtx.env.CATALYST_SKILLS_DIR ??
+                    cfg?.skillsDir ??
+                    defaultSkillsDirFor(stepCtx.home);
+                const names = hooks.skillNames ?? [];
+                const count = names.filter((name) => existsSync(join(dir, name, "SKILL.md"))).length;
+                return names.length > 0 && count === names.length
+                    ? { state: "done", evidence: { count, path: dir } }
+                    : waiting("skills_install_unverified");
+            },
+        },
+        legacy: {
+            check: legacyCheck,
+            act: async (stepCtx) => {
+                const before = await legacyCheck(stepCtx);
+                if (before.state !== "pending")
+                    return before;
+                // Provider/process output is not trusted to be secret-free; keep it out of the receipt/log.
+                const quiet = { ...stepCtx, stdout: () => { }, stderr: () => { } };
+                const code = await cmdLegacy({
+                    ...args,
+                    command: "legacy",
+                    subcommand: null,
+                    rest: [],
+                    flags: { remove: true, yes: true },
+                    json: false,
+                }, quiet, hooks.legacy);
+                return code === 0
+                    ? legacyCheck(stepCtx)
+                    : { state: "failed", reason: "legacy_cleanup_failed" };
+            },
+        },
+        signin: {
+            check: async (stepCtx, journal) => {
+                const who = await identity(stepCtx, journal);
+                return who
+                    ? {
+                        state: "done",
+                        evidence: {
+                            account: who.account,
+                            membershipId: who.membershipId,
+                            role: who.role,
+                        },
+                    }
+                    : { state: "pending" };
+            },
+            act: async (stepCtx, _journal, signal) => {
+                return boundedOnboardSignin({ ...stepCtx, stdout: stepCtx.stderr }, hooks.login, signal, hooks.signinTimeoutMs);
+            },
+        },
+        ...linear,
+        "linear.workspace": linearWorkspaceAdapter({
+            fallback: linear["linear.workspace"],
+            openBrowser: hooks.openBrowser ?? openBrowser,
+            wait: hooks.ui
+                ? (message, work) => hooks.ui.wait(message, work)
+                : undefined,
+            sleep: hooks.sleep,
+        }),
+        "github.install": githubInstallationAdapter({
+            openBrowser: hooks.openBrowser ?? openBrowser,
+            wait: hooks.ui
+                ? (message, work) => hooks.ui.wait(message, work)
+                : undefined,
+            sleep: hooks.sleep,
+        }),
+        "github.repos": existingRepositoryAdapter(args, hooks.ui?.chooseRepositories
+            ? (repositories) => hooks.ui.chooseRepositories(repositories.map((row) => ({ ...row })))
+            : undefined),
+        "linear.personal": personalAdapter("linear"),
+        "github.personal": personalAdapter("github"),
+        daemon: {
+            check: async (_stepCtx, journal) => (journal.localSync ?? args.flags["local-sync"] === true)
+                ? waiting("local_sync_capability_unavailable")
+                : {
+                    state: "skipped",
+                    reason: "local_sync_not_selected",
+                    evidence: { provider: "cloud" },
+                },
+        },
+        housekeeping: {
+            check: async () => waiting("housekeeping_service_unverified"),
+        },
+        ready: { check: hooks.ready },
     };
-    const personalAdapter = (provider) => ({
-        check: async (stepCtx) => {
-            const result = await personalStatus(provider, stepCtx);
-            if (result.outcome === "connected")
-                return { state: "done" };
-            if (result.outcome === "refused" || result.outcome === "failed")
-                return { state: result.outcome, reason: result.reason };
-            return result.outcome === "unavailable" ? waiting("personal_status_unavailable") : { state: "pending" };
-        }, act: async (stepCtx, _journal, signal) => {
-            const cfg = loadConfig(stepCtx.home);
-            if (!cfg || !cfg.user)
-                return { state: "refused", reason: "personal_login_required" };
-            const response = await stepCtx.fetch(`${normalizeBaseUrl(cfg.baseUrl)}/connect/${provider}/personal/start`, {
-                headers: { authorization: `Bearer ${await bearerFor(stepCtx, cfg)}`, accept: "application/json" }, signal: AbortSignal.timeout(30_000),
+    const get = (path) => ({ method: "GET", path });
+    const capabilities = {
+        "linear.workspace": {
+            check: [get("/api/v1/me/connections/linear/workspace")],
+            act: [
+                get("/api/v1/me/connections/linear/workspace"),
+                get("/api/v1/me/connections/linear/workspace/start"),
+            ],
+            fallback: "connections",
+        },
+        "linear.personal": {
+            check: [get("/api/v1/me/connections/linear/personal")],
+            act: [
+                get("/api/v1/me/connections/linear/personal"),
+                get("/connect/linear/personal/start"),
+            ],
+            fallback: "personalConnections",
+        },
+        "github.install": {
+            check: [get("/api/v1/me/connections/github/workspace")],
+            act: [
+                get("/api/v1/me/connections/github/workspace"),
+                get("/api/v1/me/connections/github/workspace/start"),
+            ],
+            fallback: "connections",
+        },
+        "github.personal": {
+            check: [get("/api/v1/me/connections/github/personal")],
+            act: [
+                get("/api/v1/me/connections/github/personal"),
+                get("/connect/github/personal/start"),
+            ],
+            fallback: "personalConnections",
+        },
+        "linear.team": {
+            check: [
+                get("/api/v1/agent/teams"),
+                get("/api/v1/agent/tenant/readiness"),
+            ],
+            fallback: "connections",
+        },
+        "linear.automations": {
+            check: [get("/api/v1/agent/tenant/readiness")],
+            fallback: "connections",
+        },
+        "github.repos": {
+            check: [get("/api/v1/repos"), get("/api/v1/agent/contract")],
+            fallback: "connections",
+        },
+        ready: {
+            check: [get("/api/v1/agent/contract")],
+            fallback: "connections",
+        },
+    };
+    for (const [id, options] of Object.entries(capabilities)) {
+        const step = id;
+        const adapter = adapters[step];
+        if (adapter)
+            adapters[step] = guardOnboardCapabilities(adapter, {
+                ...options,
+                message: (text) => hooks.ui ? hooks.ui.message(text) : ctx.stderr(text),
             });
-            if (response.status === 409)
-                return waiting(provider === "linear" ? "linear_workspace_required" : "github_workspace_required");
-            if (response.status === 401 || response.status === 403)
-                return { state: "refused", reason: "personal_consent_refused" };
-            if (!response.ok)
-                return { state: "failed", reason: "personal_consent_start_failed" };
-            const body = await response.json();
-            if (typeof body.authorizationUrl !== "string" || typeof body.expiresAt !== "number")
-                return { state: "failed", reason: "personal_consent_shape" };
-            let url;
-            try {
-                url = new URL(body.authorizationUrl);
-            }
-            catch {
-                return { state: "failed", reason: "personal_consent_shape" };
-            }
-            if (url.protocol !== "https:" || url.origin !== new URL(cfg.baseUrl).origin || url.username || url.password)
-                return { state: "refused", reason: "personal_consent_origin" };
-            stepCtx.stderr(`Approve your personal ${provider === "linear" ? "Linear" : "GitHub"} connection in the browser.`);
-            stepCtx.stderr(url.toString());
-            (hooks.openBrowser ?? openBrowser)(url.toString());
-            const poll = () => pollConsent({ readStatus: pollSignal => personalStatus(provider, stepCtx, pollSignal), sleep: hooks.sleep, signal });
-            return hooks.ui ? hooks.ui.wait(`Waiting for your ${provider === "linear" ? "Linear" : "GitHub"} approval`, poll) : poll();
-        }
-    });
-    const linear = existingLinearAdapters(args, hooks.ui?.chooseTeam ? teams => hooks.ui.chooseTeam(teams.map(team => ({ ...team }))) : undefined);
+    }
+    // Public auth discovery and the existing /me sign-in bootstrap establish identity before the
+    // tenant-bound step guards can run. Unsupported/local-only steps make no endpoint requests.
     return {
-        identity: journal => identity(ctx, journal), bindSignals: true, ui: hooks.ui,
-        adapters: {
-            machine: { check: async () => process.platform === "darwin" || process.platform === "linux"
-                    ? { state: "done", evidence: { provider: process.platform } } : waiting("machine_platform_unsupported") },
-            cli: { check: async () => ({ state: "done", evidence: { version: readManifest().version } }) },
-            skills: { check: async (stepCtx) => {
-                    const cfg = loadConfig(stepCtx.home);
-                    const dir = stepCtx.env.CATALYST_SKILLS_DIR ?? cfg?.skillsDir ?? defaultSkillsDirFor(stepCtx.home);
-                    const names = hooks.skillNames ?? [];
-                    const count = names.filter(name => existsSync(join(dir, name, "SKILL.md"))).length;
-                    return names.length > 0 && count === names.length ? { state: "done", evidence: { count, path: dir } } : waiting("skills_install_unverified");
-                } },
-            legacy: { check: legacyCheck, act: async (stepCtx) => {
-                    const before = await legacyCheck(stepCtx);
-                    if (before.state !== "pending")
-                        return before;
-                    // Provider/process output is not trusted to be secret-free; keep it out of the receipt/log.
-                    const quiet = { ...stepCtx, stdout: () => { }, stderr: () => { } };
-                    const code = await cmdLegacy({ ...args, command: "legacy", subcommand: null, rest: [], flags: { remove: true, yes: true }, json: false }, quiet, hooks.legacy);
-                    return code === 0 ? legacyCheck(stepCtx) : { state: "failed", reason: "legacy_cleanup_failed" };
-                } },
-            signin: { check: async (stepCtx, journal) => {
-                    const who = await identity(stepCtx, journal);
-                    return who ? { state: "done", evidence: { account: who.account, membershipId: who.membershipId, role: who.role } } : { state: "pending" };
-                }, act: async (stepCtx, _journal, signal) => {
-                    return boundedOnboardSignin({ ...stepCtx, stdout: stepCtx.stderr }, hooks.login, signal, hooks.signinTimeoutMs);
-                } },
-            ...linear,
-            "linear.workspace": linearWorkspaceAdapter({ fallback: linear["linear.workspace"], openBrowser: hooks.openBrowser ?? openBrowser,
-                wait: hooks.ui ? (message, work) => hooks.ui.wait(message, work) : undefined, sleep: hooks.sleep }),
-            "github.install": unsupported,
-            "github.repos": existingRepositoryAdapter(args, hooks.ui?.chooseRepositories ? repositories => hooks.ui.chooseRepositories(repositories.map(row => ({ ...row }))) : undefined),
-            "linear.personal": personalAdapter("linear"),
-            "github.personal": personalAdapter("github"),
-            daemon: { check: async (_stepCtx, journal) => (journal.localSync ?? args.flags["local-sync"] === true) ? waiting("local_sync_capability_unavailable")
-                    : { state: "skipped", reason: "local_sync_not_selected", evidence: { provider: "cloud" } } },
-            housekeeping: { check: async () => waiting("housekeeping_service_unverified") },
-            ready: { check: hooks.ready },
-        },
+        identity: (journal) => identity(ctx, journal),
+        bindSignals: true,
+        ui: hooks.ui,
+        adapters,
     };
 }