@catalyst-cloud/cli 0.14.6 → 0.14.7

package/dist/onboard-settings-import.js

@@ -0,0 +1,127 @@
+import { verifyOnboardRoutes } from "./onboard-capabilities.js";
+import { loadConfig, normalizeBaseUrl } from "./config.js";
+import { createSelectedImportWriter, } from "./env/selected-import-writer.js";
+const uncertain = () => new Error("selected import outcome uncertain");
+const bind = (context) => JSON.stringify([
+    context.accountId,
+    context.personId,
+    context.baseUrl,
+    context.role,
+    context.teamId,
+    context.teamKey,
+    context.repoId,
+    context.repoName,
+    context.repoRoot,
+]);
+/** The review boundary owns declaration authority. Each actual write additionally rechecks
+ * current access and identity; neither the disk contract nor the receipt supplies a scope. */
+export function createOnboardSettingsWriter(input) {
+    const expected = { ...input.context };
+    const binding = bind(expected);
+    try {
+        const url = new URL(expected.baseUrl);
+        if (url.protocol !== "https:" ||
+            url.origin !== expected.baseUrl ||
+            !["owner", "admin"].includes(expected.role))
+            throw uncertain();
+    }
+    catch {
+        throw uncertain();
+    }
+    const post = async (path, body) => {
+        const owned = new AbortController();
+        const signal = input.signal
+            ? AbortSignal.any([input.signal, owned.signal])
+            : owned.signal;
+        let timer;
+        let remove = () => { };
+        try {
+            return await new Promise((resolve, reject) => {
+                const stopped = () => reject(uncertain());
+                if (signal.aborted) {
+                    stopped();
+                    return;
+                }
+                signal.addEventListener("abort", stopped, { once: true });
+                remove = () => signal.removeEventListener("abort", stopped);
+                timer = setTimeout(() => owned.abort(), 30_000);
+                Promise.resolve()
+                    .then(async () => {
+                    const current = await input.ports.readContext(signal);
+                    if (!current || bind(current) !== binding || signal.aborted)
+                        throw uncertain();
+                    const cfg = loadConfig(input.ctx.home);
+                    if (!cfg?.user ||
+                        cfg.account !== expected.accountId ||
+                        cfg.user.id !== expected.personId ||
+                        normalizeBaseUrl(cfg.baseUrl) !== expected.baseUrl ||
+                        !["owner", "admin"].includes(cfg.user.role))
+                        throw uncertain();
+                    const expiry = cfg.auth
+                        ? Date.parse(cfg.auth.expiresAt) - input.ctx.now().getTime()
+                        : 0;
+                    const bearer = cfg.key ||
+                        (cfg.auth && Number.isFinite(expiry) && expiry > 30_000
+                            ? cfg.auth.accessToken
+                            : undefined);
+                    if (!bearer || signal.aborted)
+                        throw uncertain();
+                    const supported = await verifyOnboardRoutes(input.ctx, {
+                        account: expected.accountId,
+                        tenant: expected.accountId,
+                        membershipId: expected.personId,
+                        baseUrl: expected.baseUrl,
+                    }, [{ method: "POST", path }], signal);
+                    if ("reason" in supported || signal.aborted)
+                        throw uncertain();
+                    const response = await input.ctx.fetch(`${expected.baseUrl}${path}`, {
+                        method: "POST",
+                        redirect: "error",
+                        signal,
+                        headers: {
+                            authorization: `Bearer ${bearer}`,
+                            accept: "application/json",
+                            "content-type": "application/json",
+                        },
+                        body: JSON.stringify(body),
+                    });
+                    // Refusal bodies may contain unsafe text. The adapter needs their status only.
+                    const result = {
+                        status: response.status,
+                        body: response.ok
+                            ? (await response.json())
+                            : undefined,
+                    };
+                    if (signal.aborted)
+                        throw uncertain();
+                    return result;
+                })
+                    .then((value) => (signal.aborted ? stopped() : resolve(value)), () => reject(uncertain()));
+            });
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+            remove();
+        }
+    };
+    const writer = createSelectedImportWriter({
+        kind: input.kind,
+        writeVariable: (name, value) => post("/me/env-vars", {
+            scope: "repo",
+            repoId: expected.repoId,
+            name,
+            value,
+        }),
+        importSecrets: (text) => post("/me/secrets/import", {
+            repo: expected.repoName,
+            text,
+            rotateExisting: [],
+            source: "onboarding selected import",
+        }),
+    });
+    return async (text, names) => {
+        const result = await writer(text, names);
+        return { writtenNames: result.written, failedNames: result.failed };
+    };
+}

package/dist/onboard-settings.js

@@ -0,0 +1,234 @@
+import { realpath } from "node:fs/promises";
+import { storeOnboardDraft } from "./env/onboard-draft-store.js";
+import { isAbsolute, resolve } from "node:path";
+import { validateFullSettings } from "../vendor/settings/index.js";
+import { draftOnboardSettings, } from "./env/onboard-draft.js";
+import { onboardSettingsAuthorityPorts } from "./onboard-settings-context.js";
+import { selectedOnboardRepositories, } from "./onboard-repositories.js";
+import { normalizeBaseUrl } from "./config.js";
+import { selectedOnboardTeam } from "./onboard-existing.js";
+const waiting = (reason, evidence) => ({
+    state: "waiting",
+    reason,
+    ...(evidence ? { evidence } : {}),
+});
+const contextKey = (value) => JSON.stringify([
+    value.accountId,
+    value.personId,
+    value.baseUrl,
+    value.role,
+    value.teamId,
+    value.teamKey,
+    value.repoId,
+    value.repoName,
+    value.repoRoot,
+]);
+const safeLabel = (text) => text.replace(/[\u0000-\u001f\u007f-\u009f]/g, "").slice(0, 240);
+async function boundedRead(work, external, timeoutMs = 30_000) {
+    const owned = new AbortController();
+    const signal = external
+        ? AbortSignal.any([external, owned.signal])
+        : owned.signal;
+    let timer;
+    let remove = () => { };
+    try {
+        return await new Promise((resolve) => {
+            const stopped = () => resolve(null);
+            if (signal.aborted) {
+                stopped();
+                return;
+            }
+            signal.addEventListener("abort", stopped, { once: true });
+            remove = () => signal.removeEventListener("abort", stopped);
+            timer = setTimeout(() => owned.abort(), timeoutMs);
+            Promise.resolve()
+                .then(() => work(signal))
+                .then((result) => resolve(signal.aborted ? null : result), () => resolve(null));
+        });
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        remove();
+    }
+}
+/** Q4 drafts are local review artifacts. A full local validator is not declaration approval;
+ * neither a kept draft nor a valid existing file marks this required step complete. */
+export function onboardSettingsAdapter(hooks = {}) {
+    const storeTimeoutMs = hooks.storeTimeoutMs ?? 30_000;
+    if (!Number.isSafeInteger(storeTimeoutMs) ||
+        storeTimeoutMs < 1 ||
+        storeTimeoutMs > 30_000)
+        throw new Error("settings_storage_timeout_invalid");
+    const observe = async (ctx, journal, signal) => {
+        const repositories = selectedOnboardRepositories(journal);
+        const summaries = [];
+        const candidates = [];
+        for (const repository of repositories) {
+            if (signal?.aborted)
+                return null;
+            const summary = {
+                repository: `${repository.owner}/${repository.name}`,
+                state: "unavailable",
+                variableNames: [],
+                secretNames: [],
+                sources: [],
+            };
+            summaries.push(summary);
+            try {
+                const requested = hooks.repositoryRoot
+                    ? hooks.repositoryRoot({ ...repository })
+                    : process.cwd();
+                if (!requested ||
+                    !isAbsolute(requested) ||
+                    (await realpath(requested)) !== resolve(requested) ||
+                    signal?.aborted)
+                    continue;
+                const ports = (hooks.authorityPorts ??
+                    ((c, j, r, root) => onboardSettingsAuthorityPorts({
+                        ctx: c,
+                        journal: j,
+                        repository: r,
+                        repoRoot: root,
+                    })))(ctx, journal, repository, requested);
+                const before = await ports.readContext(signal);
+                if (!before ||
+                    before.accountId !== (journal.account ?? journal.tenant) ||
+                    before.personId !== journal.membershipId ||
+                    !journal.baseUrl ||
+                    before.baseUrl !== normalizeBaseUrl(journal.baseUrl) ||
+                    !["owner", "admin"].includes(before.role) ||
+                    before.teamId !== selectedOnboardTeam(journal) ||
+                    before.teamId !== repository.teamId ||
+                    !/^[A-Z][A-Z0-9]{0,15}$/.test(before.teamKey) ||
+                    before.repoId !== repository.repoId ||
+                    before.repoName !== summary.repository.toLowerCase() ||
+                    before.repoRoot !== resolve(requested) ||
+                    signal?.aborted)
+                    continue;
+                const binding = contextKey(before);
+                const existing = await ports.readSettings(requested, signal);
+                if (existing !== null) {
+                    const checked = validateFullSettings(existing);
+                    const after = await ports.readContext(signal);
+                    if (!checked.ok ||
+                        checked.linearTeam !== before.teamKey ||
+                        !after ||
+                        contextKey(after) !== binding ||
+                        signal?.aborted)
+                        continue;
+                    Object.assign(summary, {
+                        state: "existing",
+                        variableNames: checked.variableNames,
+                        secretNames: checked.secretNames,
+                        sources: [".catalyst/catalyst.toml"],
+                    });
+                    continue;
+                }
+                const draft = (hooks.draft ?? draftOnboardSettings)(requested, before.teamKey);
+                if (draft.state !== "draft")
+                    continue;
+                const checked = validateFullSettings(draft.toml);
+                const after = await ports.readContext(signal);
+                if (!checked.ok ||
+                    checked.linearTeam !== before.teamKey ||
+                    !after ||
+                    contextKey(after) !== binding ||
+                    signal?.aborted)
+                    continue;
+                Object.assign(summary, {
+                    state: "draft",
+                    variableNames: checked.variableNames,
+                    secretNames: checked.secretNames,
+                    sources: draft.sources.map(safeLabel),
+                });
+                candidates.push({
+                    repository: { ...repository },
+                    context: { ...before },
+                    ports,
+                    draft,
+                });
+            }
+            catch {
+                /* One unavailable checkout cannot approve the other repositories. */
+            }
+        }
+        return { summaries, candidates };
+    };
+    const bounded = (ctx, journal, external) => boundedRead((signal) => observe(ctx, journal, signal), external);
+    return {
+        check: async (ctx, journal, signal) => {
+            const read = await bounded(ctx, journal, signal);
+            if (!read?.summaries.length)
+                return waiting("settings_checkout_unverified");
+            if (read.summaries.some((summary) => summary.state === "unavailable"))
+                return waiting("settings_checkout_unverified");
+            return read.candidates.length
+                ? { state: "pending" }
+                : waiting("settings_approval_unverified");
+        },
+        act: async (ctx, journal, signal) => {
+            const read = await bounded(ctx, journal, signal);
+            if (!read?.summaries.length || signal?.aborted)
+                return waiting("settings_checkout_unverified");
+            for (const summary of read.summaries) {
+                hooks.message?.(`Settings for ${summary.repository}\n  ${summary.state === "unavailable" ? "Local checkout or settings could not be verified." : `Full settings schema validation passed locally (${summary.state === "draft" ? "new draft; private copy pending" : "existing repository file; kept unchanged"}).\n  Variables: ${summary.variableNames.join(", ") || "none"}\n  Secrets: ${summary.secretNames.join(", ") || "none"}\n  Sources: ${summary.sources.join(", ") || "none"}`}`);
+            }
+            const choice = hooks.review
+                ? await boundedRead(async () => hooks.review(read.summaries.map((row) => ({
+                    ...row,
+                    variableNames: [...row.variableNames],
+                    secretNames: [...row.secretNames],
+                    sources: [...row.sources],
+                }))), signal, 600_000)
+                : "keep";
+            if (choice === null && !signal?.aborted)
+                return waiting("settings_review_timeout");
+            if (choice !== "keep" || signal?.aborted)
+                return waiting("interrupted");
+            if (read.summaries.some((summary) => summary.state === "unavailable"))
+                return waiting("settings_checkout_unverified");
+            let stored = 0;
+            for (const candidate of read.candidates) {
+                const current = await boundedRead((owned) => candidate.ports.readContext(owned), signal);
+                if (!current ||
+                    contextKey(current) !== contextKey(candidate.context) ||
+                    signal?.aborted)
+                    return waiting("settings_checkout_unverified", { count: stored });
+                const ownedStore = new AbortController();
+                const storeSignal = signal
+                    ? AbortSignal.any([signal, ownedStore.signal])
+                    : ownedStore.signal;
+                const timer = setTimeout(() => ownedStore.abort(), storeTimeoutMs);
+                let result;
+                try {
+                    // Do not race this promise. The writer settles all IO/owned cleanup before the engine
+                    // may release its receipt lock, including after cancellation or the cooperative budget.
+                    result = await (hooks.storeDraft ?? storeOnboardDraft)({
+                        home: ctx.home,
+                        env: { ...ctx.env },
+                        runId: journal.runId,
+                        repoId: candidate.repository.repoId,
+                        toml: candidate.draft.toml,
+                        signal: storeSignal,
+                    });
+                }
+                catch {
+                    result = { state: "rejected" };
+                }
+                finally {
+                    clearTimeout(timer);
+                }
+                if (storeSignal.aborted)
+                    return waiting(signal?.aborted ? "interrupted" : "settings_draft_storage_timeout", { count: stored });
+                if (result.state !== "stored" || signal?.aborted)
+                    return waiting("settings_draft_storage_unavailable", {
+                        count: stored,
+                    });
+                stored++;
+                hooks.message?.(`Kept a private settings draft copy for ${candidate.repository.owner}/${candidate.repository.name}: ${safeLabel(result.path)}`);
+            }
+            return waiting("settings_approval_unverified", { count: stored });
+        },
+    };
+}

package/dist/onboard-ui.js

@@ -1,5 +1,5 @@
 import { createOnboardProgress, } from "./onboard-progress.js";
-import { ONBOARD_STEPS, ONBOARD_TITLES, } from "./onboard.js";
+import { ONBOARD_STEPS, ONBOARD_TITLES, onboardIdentityLines, } from "./onboard.js";
 export function shouldUseOnboardUi(args, stdoutTty) {
     return (stdoutTty &&
         !args.json &&
@@ -38,29 +38,47 @@ export function createClackOnboardUi(prompts, streams, deps = {}) {
     };
     return {
         signal: abort.signal,
-        plan(journal) {
+        plan(journal, identity) {
             stop();
             if (!introduced) {
                 prompts.intro("Catalyst setup", { output: streams.output });
                 introduced = true;
             }
+            if (identity !== undefined)
+                for (const line of onboardIdentityLines(identity))
+                    message(line);
             const steps = new Map(journal.steps.map((step) => [step.id, step]));
             message(ONBOARD_STEPS.map((id) => `· ${ONBOARD_TITLES[id]}${steps.get(id)?.state === "done" ? " (recheck)" : ""}`).join("\n"));
-            message("Use cloud reads by default. Local sync is optional for SQL, offline work or sustained reads.");
+            message("Use cloud reads by default. Local sync is optional for SQL or sustained local reads.");
+            message("Setup may check one stored Claude account using a one-token provider request. This may use Claude quota. It does not refresh Codex credentials.");
         },
-        async confirmPlan(localSync) {
+        async confirmPlan(localSync, signin = "unavailable") {
             stop();
             const answer = await prompts.select({
                 ...options,
                 message: "Continue with this plan?",
-                initialValue: localSync ? "local" : "cloud",
+                initialValue: signin === "required" ? "signin" : localSync ? "local" : "cloud",
                 options: [
-                    {
-                        value: "cloud",
-                        label: "Continue using cloud reads",
-                        hint: "default",
-                    },
-                    { value: "local", label: "Continue and set up local sync" },
+                    ...(signin === "required"
+                        ? []
+                        : [
+                            {
+                                value: "cloud",
+                                label: "Continue using cloud reads",
+                                hint: "default",
+                            },
+                            { value: "local", label: "Continue and set up local sync" },
+                        ]),
+                    ...(signin === "unavailable"
+                        ? []
+                        : [
+                            {
+                                value: "signin",
+                                label: signin === "saved"
+                                    ? "Sign in again before continuing"
+                                    : "Sign in and review this plan",
+                            },
+                        ]),
                     { value: "stop", label: "Stop without changes" },
                 ],
             });
@@ -71,6 +89,7 @@ export function createClackOnboardUi(prompts, streams, deps = {}) {
             return {
                 proceed: answer === "cloud" || answer === "local",
                 localSync: answer === "local",
+                ...(answer === "signin" ? { signin: true } : {}),
             };
         },
         async chooseTeam(teams) {
@@ -115,6 +134,48 @@ export function createClackOnboardUi(prompts, streams, deps = {}) {
                 },
             }
             : {}),
+        async reviewSettings(summaries) {
+            stop();
+            if (!summaries.length || abort.signal.aborted)
+                return "cancel";
+            const answer = await prompts.select({
+                ...options,
+                message: "Review settings for all selected repositories. Keep private copies of new drafts for review?",
+                initialValue: "keep",
+                options: [
+                    {
+                        value: "keep",
+                        label: "Keep private draft copies",
+                        hint: "default; repository files stay unchanged; approval and value import stay pending",
+                    },
+                    { value: "stop", label: "Stop without keeping new copies" },
+                ],
+            });
+            if (prompts.isCancel(answer) || answer === "stop") {
+                abort.abort();
+                return "cancel";
+            }
+            return answer === "keep" ? "keep" : "cancel";
+        },
+        async chooseFirstRepository(repositories) {
+            stop();
+            if (!repositories.length || abort.signal.aborted)
+                return null;
+            const answer = await prompts.select({
+                ...options,
+                message: "Which repository should start this project?",
+                initialValue: `${repositories[0].owner}/${repositories[0].name}`,
+                options: repositories.map((row) => ({
+                    value: `${row.owner}/${row.name}`,
+                    label: `${row.owner}/${row.name}`,
+                })),
+            });
+            if (prompts.isCancel(answer)) {
+                abort.abort();
+                return null;
+            }
+            return typeof answer === "string" ? answer : null;
+        },
         stepStart(id) {
             const next = ["machine", "cli", "skills", "legacy"].includes(id)
                 ? "This computer"
@@ -136,9 +197,22 @@ export function createClackOnboardUi(prompts, streams, deps = {}) {
         stepEnd(step) {
             stop();
             const reasons = {
+                account_enrollment_required: "No coding account is enrolled. An administrator can add one in the workspace's coding-account settings, then run catalyst onboard again.",
+                account_identity_unverified: "Your login changed while coding accounts were checked. Run catalyst onboard again to verify your person and workspace.",
+                account_inventory_unavailable: "Coding accounts could not be read. Run catalyst onboard again to retry.",
+                account_inventory_unverified: "The server did not return a fresh supported coding-account list. Run catalyst onboard after the server update.",
+                account_validation_admin_required: "An administrator must check the workspace's coding-account access.",
+                account_login_refresh_required: "Renew your login with catalyst login, then run catalyst onboard.",
+                account_validation_unavailable: "The provider check could not finish. Run catalyst onboard again to retry.",
+                account_validation_unverified: "The server did not return a fresh provider check. Run catalyst onboard after the server update.",
+                account_provider_access_unverified: "Coding-account provider access is not freshly verified. Check the account in the workspace's coding-account settings, then resume setup.",
+                codex_provider_access_unverified: "Codex credentials are stored, but provider access is not freshly verified. Setup did not refresh or rotate the Codex login.",
+                account_provider_walled: "Claude's usage limit is spent for now. Check the account's reset time, then run catalyst onboard again.",
+                account_provider_rejected: "Claude refused the stored login. Replace it in the workspace's coding-account settings, then resume setup.",
                 personal_consent_handoff: "The browser approval link could not be verified. Run catalyst onboard to try again.",
                 personal_identity_refused: "Your current login no longer matches this setup. Resume with the original workspace and person.",
                 personal_login_refresh_required: "Renew your login with catalyst login, then run catalyst onboard to resume.",
+                onboard_login_refresh_required: "Renew your login with catalyst login, then run catalyst onboard to resume.",
                 personal_status_unavailable: "Your personal connection could not be checked. Run catalyst onboard to try again.",
                 personal_browser_unavailable: "The browser could not open. Run catalyst onboard to try again.",
                 cloud_capability_unavailable: "This setup step is not available on this server yet. Use the web app link shown above, then resume after the server update.",
@@ -166,6 +240,15 @@ export function createClackOnboardUi(prompts, streams, deps = {}) {
                 team_inventory_empty: "No existing Linear teams could be verified.",
                 team_inventory_shape: "The cloud returned a team list that could not be verified.",
                 team_read_unavailable: "Your existing Linear teams could not be read. Run catalyst onboard to try again.",
+                team_read_identity_unverified: "Your login changed while setup was reading this workspace. Resume with the original workspace and person.",
+                project_identity_unverified: "Your login changed while setup was checking this project. Resume with the original workspace and person.",
+                project_options_unavailable: "Available teams and repositories could not be checked. Run catalyst onboard to try again.",
+                project_provider_inventory_unavailable: "Linear or GitHub access could not be verified. Check this workspace's connections, then resume.",
+                project_options_unverified: "The server returned a team or repository list that could not be verified.",
+                project_registration_visibility_pending: "Your project exists, but its repository binding is not visible yet. Run catalyst onboard to check again.",
+                project_binding_conflict: "This team or repository is already bound to a project. Ask your workspace administrator to check its binding, then resume.",
+                project_login_refresh_required: "Renew your login with catalyst onboard, then review the plan before creating this project.",
+                project_create_unverified: "Project creation could not be confirmed. Run catalyst onboard to check for the project before trying again.",
                 team_read_login_refresh_required: "Your login needs a refresh. Run catalyst onboard to resume.",
                 team_choice_required: "Choose an existing team with catalyst onboard --team <team ID or key>.",
                 team_selection_unverified: "Your selected Linear team could not be verified. Run catalyst onboard --team <team ID or key> to choose again.",
@@ -178,6 +261,11 @@ export function createClackOnboardUi(prompts, streams, deps = {}) {
                 repository_id_unverified: "A repository's current ID could not be verified. Keep your selection and try again.",
                 repository_binding_ambiguous: "A repository's Linear team binding is ambiguous. Your administrator needs to check it.",
                 repository_identity_unverified: "Sign in to the original workspace to choose repositories.",
+                settings_review_timeout: "The settings review timed out. Run catalyst onboard to resume.",
+                settings_checkout_unverified: "A selected repository's local checkout or full settings file could not be verified. Resume from its checkout.",
+                settings_draft_storage_unavailable: "A private settings draft could not be kept. Run catalyst onboard to retry.",
+                settings_draft_storage_timeout: "Keeping your settings draft took too long. Run catalyst onboard to retry.",
+                settings_approval_unverified: "Settings still need review and approval. Kept drafts and local validation do not approve them.",
                 repository_selection_unverified: "Your selected repositories could not be verified. Run catalyst onboard --repo <owner/name> to choose again.",
             };
             const text = `${ONBOARD_TITLES[step.id]}${step.reason ? `: ${reasons[step.reason] ?? step.reason.replaceAll("_", " ")}` : ""}`;