@catalyst-cloud/cli 0.14.6 → 0.14.8

package/dist/onboard-accounts.js

@@ -0,0 +1,259 @@
+import { loadConfig, normalizeBaseUrl } from "./config.js";
+import { readExistingOnboardJson } from "./onboard-existing.js";
+import { verifyOnboardRoutes } from "./onboard-capabilities.js";
+const listPath = "/api/v1/coding-accounts";
+const validatePath = "/api/v1/coding-accounts/:slot/validate";
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value
+    : null;
+const waiting = (reason) => ({
+    state: "waiting",
+    reason,
+});
+const slotPattern = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+function binding(ctx, journal) {
+    const cfg = loadConfig(ctx.home);
+    if (!cfg?.user ||
+        cfg.account !== (journal.account ?? journal.tenant) ||
+        cfg.user.id !== journal.membershipId ||
+        !journal.baseUrl ||
+        normalizeBaseUrl(cfg.baseUrl) !== normalizeBaseUrl(journal.baseUrl))
+        return null;
+    return {
+        account: cfg.account,
+        person: cfg.user.id,
+        origin: normalizeBaseUrl(cfg.baseUrl),
+        role: cfg.user.role,
+    };
+}
+const equal = (a, b) => a?.account === b.account &&
+    a.person === b.person &&
+    a.origin === b.origin &&
+    a.role === b.role;
+async function inventory(ctx, journal, signal) {
+    const identity = binding(ctx, journal);
+    if (!identity)
+        return { reason: "account_identity_unverified" };
+    const support = await verifyOnboardRoutes(ctx, journal, [{ method: "GET", path: listPath }], signal);
+    if ("reason" in support)
+        return support;
+    if (!equal(binding(ctx, journal), identity))
+        return { reason: "account_identity_unverified" };
+    const read = await readExistingOnboardJson(ctx, listPath, signal);
+    if (!equal(binding(ctx, journal), identity))
+        return { reason: "account_identity_unverified" };
+    if ("reason" in read)
+        return { reason: "account_inventory_unavailable" };
+    const body = object(read.body);
+    const now = ctx.now().getTime();
+    if (!Array.isArray(body?.accounts) ||
+        body.accounts.length > 1000 ||
+        typeof body.observedAtMs !== "number" ||
+        !Number.isSafeInteger(body.observedAtMs) ||
+        body.observedAtMs > now + 5000 ||
+        body.observedAtMs < now - 30000)
+        return { reason: "account_inventory_unverified" };
+    const slots = [], seen = new Set();
+    for (const value of body.accounts) {
+        const row = object(value);
+        if (!row ||
+            typeof row.accountSlot !== "string" ||
+            !slotPattern.test(row.accountSlot) ||
+            seen.has(row.accountSlot) ||
+            typeof row.provider !== "string" ||
+            !/^[a-z][a-z0-9_-]{0,63}$/.test(row.provider) ||
+            typeof row.declaredState !== "string" ||
+            !["active", "inactive"].includes(row.declaredState) ||
+            typeof row.ownedByMe !== "boolean" ||
+            typeof row.needsCredential !== "boolean" ||
+            typeof row.walled !== "boolean" ||
+            typeof row.quarantined !== "boolean" ||
+            ![null, "renews", "canceled"].includes(row.renewalStatus) ||
+            !(row.revokedAtMs === null ||
+                (typeof row.revokedAtMs === "number" &&
+                    Number.isSafeInteger(row.revokedAtMs))) ||
+            !(row.accessEndsAtMs === null ||
+                (typeof row.accessEndsAtMs === "number" &&
+                    Number.isSafeInteger(row.accessEndsAtMs))))
+            return { reason: "account_inventory_unverified" };
+        seen.add(row.accountSlot);
+        // Project only metadata we need. Unknown server fields never enter output or receipts.
+        slots.push({
+            accountSlot: row.accountSlot,
+            provider: row.provider,
+            declaredState: row.declaredState,
+            ownedByMe: row.ownedByMe,
+            needsCredential: row.needsCredential,
+            walled: row.walled,
+            quarantined: row.quarantined,
+            renewalStatus: row.renewalStatus,
+            revokedAtMs: row.revokedAtMs,
+            accessEndsAtMs: row.accessEndsAtMs,
+        });
+    }
+    return { slots, identity };
+}
+/** Verify one existing Claude slot per run. A stored login, cached poll or Codex shape is not
+ * fresh provider access. Enrollment and a phase's actual lease eligibility remain separate. */
+export function onboardAccountsAdapter(input = {}) {
+    let proof = null;
+    let attempted = false;
+    const candidate = (slots, now) => slots
+        .filter((row) => row.provider === "claude" &&
+        row.declaredState === "active" &&
+        row.ownedByMe &&
+        !row.needsCredential &&
+        !row.walled &&
+        !row.quarantined &&
+        row.renewalStatus !== "canceled" &&
+        row.revokedAtMs === null &&
+        (row.accessEndsAtMs === null || row.accessEndsAtMs > now))
+        .sort((a, b) => a.accountSlot.localeCompare(b.accountSlot))[0];
+    const check = async (ctx, journal, signal) => {
+        const live = await inventory(ctx, journal, signal);
+        if ("reason" in live)
+            return waiting(live.reason);
+        const selected = candidate(live.slots, ctx.now().getTime());
+        if (proof &&
+            equal(live.identity, proof) &&
+            live.slots.some((row) => row.accountSlot === proof.slot &&
+                row.provider === proof.provider &&
+                row.declaredState === "active" &&
+                row.ownedByMe &&
+                !row.needsCredential &&
+                !row.walled &&
+                !row.quarantined &&
+                row.renewalStatus !== "canceled" &&
+                row.revokedAtMs === null &&
+                (row.accessEndsAtMs === null ||
+                    row.accessEndsAtMs > ctx.now().getTime())) &&
+            proof.checkedAtMs <= ctx.now().getTime() + 5000 &&
+            proof.checkedAtMs >= ctx.now().getTime() - 30000)
+            return {
+                state: "done",
+                evidence: {
+                    accountSlot: proof.slot,
+                    provider: proof.provider,
+                    checkedAt: new Date(proof.checkedAtMs).toISOString(),
+                },
+            };
+        proof = null;
+        if (!live.slots.length)
+            return waiting("account_enrollment_required");
+        if (!selected)
+            return waiting(live.slots.some((row) => row.provider === "codex")
+                ? "codex_provider_access_unverified"
+                : "account_provider_access_unverified");
+        if (attempted)
+            return waiting("account_provider_access_unverified");
+        const cfg = loadConfig(ctx.home);
+        if (!cfg?.user || !["owner", "admin"].includes(cfg.user.role))
+            return waiting("account_validation_admin_required");
+        return { state: "pending" };
+    };
+    return {
+        check,
+        act: async (ctx, journal, external) => {
+            if (attempted)
+                return waiting("account_provider_access_unverified");
+            const live = await inventory(ctx, journal, external);
+            if ("reason" in live)
+                return waiting(live.reason);
+            const selected = candidate(live.slots, ctx.now().getTime());
+            if (!selected)
+                return waiting("account_provider_access_unverified");
+            const support = await verifyOnboardRoutes(ctx, journal, [{ method: "POST", path: validatePath }], external);
+            if ("reason" in support)
+                return waiting(support.reason);
+            const cfg = loadConfig(ctx.home);
+            if (!equal(binding(ctx, journal), live.identity) ||
+                !cfg?.user ||
+                !["owner", "admin"].includes(cfg.user.role))
+                return waiting("account_identity_unverified");
+            const expiry = cfg.auth
+                ? Date.parse(cfg.auth.expiresAt) - ctx.now().getTime()
+                : 0;
+            const bearer = cfg.key ||
+                (cfg.auth && Number.isFinite(expiry) && expiry > 30000
+                    ? cfg.auth.accessToken
+                    : undefined);
+            if (!bearer)
+                return waiting("account_login_refresh_required");
+            input.message?.("Checking one stored Claude account with a one-token provider request. This may use Claude quota. Codex credentials are not refreshed. Phase eligibility is checked separately.");
+            // A display callback must not be able to switch the identity used for this request.
+            if (!equal(binding(ctx, journal), live.identity))
+                return waiting("account_identity_unverified");
+            const deadline = new AbortController();
+            const signal = external
+                ? AbortSignal.any([external, deadline.signal])
+                : deadline.signal;
+            const timer = setTimeout(() => deadline.abort(), 15000);
+            let remove = () => { };
+            try {
+                return await new Promise((resolve) => {
+                    const stopped = () => resolve(waiting(external?.aborted
+                        ? "interrupted"
+                        : "account_validation_unavailable"));
+                    if (signal.aborted) {
+                        stopped();
+                        return;
+                    }
+                    signal.addEventListener("abort", stopped, { once: true });
+                    remove = () => signal.removeEventListener("abort", stopped);
+                    Promise.resolve()
+                        .then(async () => {
+                        if (signal.aborted)
+                            return waiting("interrupted");
+                        // UI callbacks can queue a config change before this deferred send executes.
+                        if (!equal(binding(ctx, journal), live.identity))
+                            return waiting("account_identity_unverified");
+                        attempted = true;
+                        const response = await ctx.fetch(`${support.origin}/api/v1/coding-accounts/${encodeURIComponent(selected.accountSlot)}/validate`, {
+                            method: "POST",
+                            redirect: "error",
+                            signal,
+                            headers: {
+                                authorization: `Bearer ${bearer}`,
+                                accept: "application/json",
+                            },
+                        });
+                        if (response.status !== 200)
+                            return waiting("account_validation_unavailable");
+                        const body = object(await response.json());
+                        if (signal.aborted ||
+                            !equal(binding(ctx, journal), live.identity))
+                            return waiting("account_identity_unverified");
+                        const now = ctx.now().getTime();
+                        if (!body ||
+                            body.provider !== selected.provider ||
+                            typeof body.checkedAtMs !== "number" ||
+                            !Number.isSafeInteger(body.checkedAtMs) ||
+                            body.checkedAtMs > now + 5000 ||
+                            body.checkedAtMs < now - 30000 ||
+                            !["working", "walled", "rejected", "inconclusive"].includes(String(body.result)))
+                            return waiting("account_validation_unverified");
+                        if (body.result !== "working")
+                            return waiting(body.result === "walled"
+                                ? "account_provider_walled"
+                                : body.result === "rejected"
+                                    ? "account_provider_rejected"
+                                    : "account_provider_access_unverified");
+                        proof = {
+                            ...live.identity,
+                            slot: selected.accountSlot,
+                            provider: selected.provider,
+                            checkedAtMs: body.checkedAtMs,
+                        };
+                        input.message?.("Claude provider access was verified. This does not reserve a runner or prove that a phase can start.");
+                        return check(ctx, journal, signal);
+                    })
+                        .then((result) => (signal.aborted ? stopped() : resolve(result)), () => stopped());
+                });
+            }
+            finally {
+                clearTimeout(timer);
+                remove();
+            }
+        },
+    };
+}

package/dist/onboard-automation-management.js

@@ -0,0 +1,15 @@
+/** Rule management is unbuilt. This disposition does not assess the customer's actual rules.
+ * Cloud readiness and first-ticket eligibility must still reject conflicting or unreadable rules.
+ */
+export function onboardAutomationManagementAdapter(input = {}) {
+    return {
+        check: async (_ctx, _journal, signal) => {
+            if (signal?.aborted)
+                return { state: "waiting", reason: "interrupted" };
+            input.message?.("Linear automation management is unavailable. Setup made no automation change. Cloud readiness still checks your existing rules.");
+            if (signal?.aborted)
+                return { state: "waiting", reason: "interrupted" };
+            return { state: "skipped", reason: "automation_management_unavailable" };
+        },
+    };
+}

package/dist/onboard-bootstrap.js

@@ -0,0 +1,162 @@
+import { createHash } from "node:crypto";
+import { isAbsolute, normalize } from "node:path";
+import { CliError } from "./errors.js";
+function refused() {
+    throw new CliError("The staged installation plan could not be verified. Run setup again.", "onboard-bootstrap-plan", 12);
+}
+function record(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return refused();
+    return value;
+}
+function exactKeys(value, keys) {
+    if (Object.keys(value).length !== keys.length ||
+        keys.some((key) => !Object.hasOwn(value, key)))
+        refused();
+}
+function text(value) {
+    if (typeof value !== "string" ||
+        value.length === 0 ||
+        value.length > 4096 ||
+        /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/.test(value))
+        refused();
+    return value;
+}
+function path(value) {
+    const result = text(value);
+    if (!isAbsolute(result) || normalize(result) !== result || result === "/")
+        refused();
+    return result;
+}
+function origin(value) {
+    const result = text(value);
+    let url;
+    try {
+        url = new URL(result);
+    }
+    catch {
+        return refused();
+    }
+    if (url.protocol !== "https:" ||
+        url.origin !== result ||
+        url.username ||
+        url.password ||
+        url.search ||
+        url.hash)
+        refused();
+    return result;
+}
+/** Copies a closed DTO before freezing it; a mutable caller object cannot alter the displayed plan. */
+export function parseBootstrapPlan(input) {
+    const value = record(input);
+    exactKeys(value, [
+        "schema",
+        "home",
+        "origin",
+        "platform",
+        "arch",
+        "cliPath",
+        "skillsPath",
+        "statePath",
+        "dailyUpdate",
+        "artifacts",
+    ]);
+    if (value.schema !== 1 ||
+        (value.platform !== "darwin" && value.platform !== "linux") ||
+        (value.arch !== "arm64" && value.arch !== "x64") ||
+        typeof value.dailyUpdate !== "boolean" ||
+        !Array.isArray(value.artifacts) ||
+        value.artifacts.length !== 4)
+        refused();
+    const kinds = new Set();
+    const artifacts = value.artifacts
+        .map((input) => {
+        const item = record(input);
+        exactKeys(item, ["kind", "version", "sha256"]);
+        if (item.kind !== "runtime" &&
+            item.kind !== "cli" &&
+            item.kind !== "skills" &&
+            item.kind !== "installer")
+            refused();
+        if (kinds.has(item.kind))
+            refused();
+        kinds.add(item.kind);
+        const version = text(item.version);
+        if (!/^[0-9A-Za-z][0-9A-Za-z.+_-]{0,127}$/.test(version) ||
+            typeof item.sha256 !== "string" ||
+            !/^[a-f0-9]{64}$/.test(item.sha256))
+            refused();
+        return Object.freeze({ kind: item.kind, version, sha256: item.sha256 });
+    })
+        .sort((a, b) => a.kind.localeCompare(b.kind));
+    const home = path(value.home), cliPath = path(value.cliPath), skillsPath = path(value.skillsPath), statePath = path(value.statePath);
+    if (new Set([home, cliPath, skillsPath, statePath]).size !== 4)
+        refused();
+    return Object.freeze({
+        schema: 1,
+        home,
+        origin: origin(value.origin),
+        platform: value.platform,
+        arch: value.arch,
+        cliPath,
+        skillsPath,
+        statePath,
+        dailyUpdate: value.dailyUpdate,
+        artifacts: Object.freeze(artifacts),
+    });
+}
+export function bootstrapPlanHash(plan) {
+    return createHash("sha256")
+        .update(JSON.stringify(parseBootstrapPlan(plan)))
+        .digest("hex");
+}
+export function bootstrapPlanLines(plan) {
+    return [
+        `Install on ${plan.platform}/${plan.arch} for ${plan.home}`,
+        `Catalyst cloud: ${plan.origin}`,
+        `Command: ${plan.cliPath}`,
+        `Skills: ${plan.skillsPath}`,
+        `Setup record: ${plan.statePath}`,
+        `Daily update: ${plan.dailyUpdate ? "schedule after installation" : "not selected"}`,
+        ...plan.artifacts.map((artifact) => `${artifact.kind} ${artifact.version} (SHA-256 ${artifact.sha256})`),
+    ];
+}
+/** A prepared native continuation is consumed before entering the first persistent machine stage.
+ * Retry after a partial install constructs a new preview from the actual machine and journal.
+ */
+export function createBootstrapPreview(input, ports) {
+    const plan = parseBootstrapPlan(input);
+    const planHash = bootstrapPlanHash(plan);
+    let consumed = false;
+    return Object.freeze({
+        plan,
+        async recheck() {
+            if (consumed)
+                refused();
+            await ports.recheck();
+        },
+        assertCurrent() {
+            if (consumed)
+                refused();
+            ports.assertCurrent();
+        },
+        async continue(approved, signal) {
+            if (consumed ||
+                signal.aborted ||
+                approved.planHash !== planHash ||
+                bootstrapPlanHash(approved.plan) !== planHash ||
+                approved.origin !== plan.origin ||
+                !approved.account ||
+                !approved.person ||
+                !approved.runId ||
+                !Number.isSafeInteger(approved.ownerPid) ||
+                approved.ownerPid < 1 ||
+                !approved.ownerToken ||
+                !isAbsolute(approved.lockPath))
+                refused();
+            consumed = true;
+            ports.assertCurrent();
+            await ports.continue(approved, signal);
+        },
+    });
+}

package/dist/onboard-capabilities.js

@@ -119,7 +119,7 @@ async function read(ctx, journal, timeoutMs, external) {
                         !["GET", "POST"].includes(row.method) ||
                         typeof row.path !== "string" ||
                         row.path.length > 240 ||
-                        !/^\/(?:api\/v1\/|connect\/|me\/)[A-Za-z0-9_/-]+$/.test(row.path) ||
+                        !(/^\/(?:api\/v1\/|connect\/|me\/)[A-Za-z0-9_/-]+$/.test(row.path) || row.path === "/api/v1/coding-accounts/:slot/validate") ||
                         row.personalBearer !== true)
                         return { reason: "onboarding_capability_unavailable", origin };
                     const key = `${row.method} ${row.path}`;
@@ -142,6 +142,17 @@ async function read(ctx, journal, timeoutMs, external) {
         remove();
     }
 }
+/** Read current route support for context checks and selected writes without refreshing a token. */
+export async function verifyOnboardRoutes(ctx, binding, requirements, signal, timeoutMs = 30_000) {
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 30_000)
+        throw new Error("onboarding_capability_timeout_invalid");
+    const result = await read(ctx, binding, timeoutMs, signal);
+    if ("reason" in result)
+        return result;
+    if (requirements.some((route) => !result.capabilities.routes.has(routeKey(route))))
+        return { reason: "cloud_capability_unavailable", origin: result.origin };
+    return { origin: result.origin };
+}
 /** Guard both the observation and action before their first endpoint request. A route's real
  * refusal is preserved only after the same-account cloud advertised personal bearer support. */
 export function guardOnboardCapabilities(adapter, options) {
@@ -149,12 +160,9 @@ export function guardOnboardCapabilities(adapter, options) {
     if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 30_000)
         throw new Error("onboarding_capability_timeout_invalid");
     const run = async (ctx, journal, signal, requirements, work) => {
-        const advertised = await read(ctx, journal, timeoutMs, signal);
-        if ("reason" in advertised ||
-            requirements.some((route) => !advertised.capabilities.routes.has(routeKey(route)))) {
-            const reason = "reason" in advertised
-                ? advertised.reason
-                : "cloud_capability_unavailable";
+        const advertised = await verifyOnboardRoutes(ctx, journal, requirements, signal, timeoutMs);
+        if ("reason" in advertised) {
+            const reason = advertised.reason;
             const url = advertised.origin
                 ? `${advertised.origin}${safePages[options.fallback]}`
                 : undefined;