@catalyst-cloud/cli 0.14.6 → 0.14.8

package/dist/onboard-runtime.js

@@ -1,18 +1,22 @@
 import { existsSync, realpathSync } from "node:fs";
 import { userInfo } from "node:os";
 import { join } from "node:path";
-import { openBrowser } from "./browser.js";
+import { openConsentBrowser } from "./consent-browser.js";
 import { defaultSkillsDirFor, loadConfig, normalizeBaseUrl, readManifest, } from "./config.js";
 import { CliError } from "./errors.js";
 import { cmdLegacy, findLegacy } from "./legacy.js";
-import { bearerFor } from "./oauth.js";
 import { personalConsentAdapter } from "./onboard-personal.js";
 import { boundedOnboardSignin } from "./onboard-signin.js";
 import { existingLinearAdapters } from "./onboard-existing.js";
 import { linearWorkspaceAdapter } from "./onboard-workspace.js";
-import { existingRepositoryAdapter } from "./onboard-repositories.js";
+import { firstProjectAdapters } from "./onboard-projects.js";
+import { onboardCapacityAdapter } from "./onboard-capacity.js";
+import { onboardAutomationManagementAdapter } from "./onboard-automation-management.js";
+import { onboardWorkflowVerificationAdapter } from "./onboard-workflow.js";
+import { onboardAccountsAdapter } from "./onboard-accounts.js";
 import { githubInstallationAdapter } from "./onboard-github.js";
 import { guardOnboardCapabilities, } from "./onboard-capabilities.js";
+import { onboardSettingsAdapter, } from "./onboard-settings.js";
 import { fetchMe } from "./transport.js";
 const waiting = (reason) => ({
     state: "waiting",
@@ -45,7 +49,56 @@ export function createOnboardRuntime(args, ctx, hooks) {
                 (journal.baseUrl &&
                     normalizeBaseUrl(journal.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))))
             throw new CliError("the saved setup belongs to another workspace or member", "onboard-identity-mismatch", 12);
-        const me = await fetchMe(cfg.baseUrl, await bearerFor(stepCtx, cfg), stepCtx.fetch);
+        // The Q1 preview reads the current token directly; stopping setup must not rotate saved credentials.
+        const expiry = cfg.auth
+            ? Date.parse(cfg.auth.expiresAt) - stepCtx.now().getTime()
+            : 0;
+        const bearer = cfg.key ||
+            (cfg.auth && Number.isFinite(expiry) && expiry > 30_000
+                ? cfg.auth.accessToken
+                : undefined);
+        if (!bearer)
+            throw new CliError("Renew your login with catalyst login, then run catalyst onboard.", "onboard-login-refresh-required", 11);
+        const owned = new AbortController();
+        const signal = hooks.ui
+            ? AbortSignal.any([owned.signal, hooks.ui.signal])
+            : owned.signal;
+        const timer = setTimeout(() => owned.abort(), 30_000);
+        let remove = () => { };
+        let me;
+        try {
+            me = await new Promise((resolve, reject) => {
+                const stopped = () => reject(new CliError("Your membership could not be checked. Run catalyst onboard to retry.", "onboard-membership-unavailable", 11));
+                if (signal.aborted) {
+                    stopped();
+                    return;
+                }
+                signal.addEventListener("abort", stopped, { once: true });
+                remove = () => signal.removeEventListener("abort", stopped);
+                const boundedFetch = ((url, init) => {
+                    if (signal.aborted)
+                        return Promise.reject(new Error("membership_read_stopped"));
+                    return stepCtx.fetch(url, {
+                        ...init,
+                        redirect: "error",
+                        signal: init?.signal
+                            ? AbortSignal.any([signal, init.signal])
+                            : signal,
+                    });
+                });
+                fetchMe(cfg.baseUrl, bearer, boundedFetch).then((value) => (signal.aborted ? stopped() : resolve(value)), reject);
+            });
+        }
+        finally {
+            clearTimeout(timer);
+            remove();
+        }
+        const current = loadConfig(stepCtx.home);
+        if (!current?.user ||
+            current.account !== cfg.account ||
+            current.user.id !== cfg.user.id ||
+            normalizeBaseUrl(current.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))
+            throw new CliError("Your saved login changed while membership was checked. Run catalyst onboard again.", "onboard-identity-mismatch", 12);
         if (!me.user || me.account !== cfg.account || me.user.id !== cfg.user.id)
             throw new CliError("the saved login and live member do not match", "onboard-identity-mismatch", 12);
         // /me names a person within the account, not an independently exposed membership-row ID.
@@ -54,6 +107,12 @@ export function createOnboardRuntime(args, ctx, hooks) {
             membershipId: me.user.id,
             baseUrl: normalizeBaseUrl(cfg.baseUrl),
             role: me.user.role,
+            display: {
+                personLabel: me.user.label,
+                email: me.user.email,
+                workspaceName: me.name,
+                workspaceSlug: me.slug,
+            },
         };
     };
     const legacyCheck = async (stepCtx) => {
@@ -71,7 +130,7 @@ export function createOnboardRuntime(args, ctx, hooks) {
     };
     const personalAdapter = (provider) => personalConsentAdapter({
         provider,
-        openBrowser: hooks.openBrowser ?? openBrowser,
+        openBrowser: hooks.openBrowser ?? openConsentBrowser,
         sleep: hooks.sleep,
         wait: hooks.ui
             ? (message, run) => hooks.ui.wait(message, run)
@@ -147,22 +206,49 @@ export function createOnboardRuntime(args, ctx, hooks) {
         ...linear,
         "linear.workspace": linearWorkspaceAdapter({
             fallback: linear["linear.workspace"],
-            openBrowser: hooks.openBrowser ?? openBrowser,
+            openBrowser: hooks.openBrowser ?? openConsentBrowser,
             wait: hooks.ui
                 ? (message, work) => hooks.ui.wait(message, work)
                 : undefined,
             sleep: hooks.sleep,
         }),
         "github.install": githubInstallationAdapter({
-            openBrowser: hooks.openBrowser ?? openBrowser,
+            openBrowser: hooks.openBrowser ?? openConsentBrowser,
             wait: hooks.ui
                 ? (message, work) => hooks.ui.wait(message, work)
                 : undefined,
             sleep: hooks.sleep,
         }),
-        "github.repos": existingRepositoryAdapter(args, hooks.ui?.chooseRepositories
-            ? (repositories) => hooks.ui.chooseRepositories(repositories.map((row) => ({ ...row })))
-            : undefined),
+        settings: onboardSettingsAdapter({
+            ...hooks.settings,
+            review: hooks.ui?.reviewSettings
+                ? (summaries) => hooks.ui.reviewSettings(summaries)
+                : hooks.settings?.review,
+            message: hooks.ui
+                ? (text) => hooks.ui.message(text)
+                : (text) => ctx.stderr(text),
+        }),
+        ...firstProjectAdapters(args, {
+            chooseExisting: hooks.ui?.chooseRepositories
+                ? (rows) => hooks.ui.chooseRepositories(rows.map((row) => ({ ...row })))
+                : undefined,
+            chooseFirst: hooks.ui?.chooseFirstRepository
+                ? (rows) => hooks.ui.chooseFirstRepository(rows.map((row) => ({ ...row })))
+                : undefined,
+            message: (text) => (hooks.ui ? hooks.ui.message(text) : ctx.stderr(text)),
+        }),
+        accounts: onboardAccountsAdapter({
+            message: (text) => (hooks.ui ? hooks.ui.message(text) : ctx.stderr(text)),
+        }),
+        capacity: onboardCapacityAdapter({
+            message: (text) => (hooks.ui ? hooks.ui.message(text) : ctx.stderr(text)),
+        }),
+        "linear.adopt": onboardWorkflowVerificationAdapter({
+            message: (text) => (hooks.ui ? hooks.ui.message(text) : ctx.stderr(text)),
+        }),
+        "linear.automations": onboardAutomationManagementAdapter({
+            message: (text) => (hooks.ui ? hooks.ui.message(text) : ctx.stderr(text)),
+        }),
         "linear.personal": personalAdapter("linear"),
         "github.personal": personalAdapter("github"),
         daemon: {
@@ -220,11 +306,19 @@ export function createOnboardRuntime(args, ctx, hooks) {
             ],
             fallback: "connections",
         },
-        "linear.automations": {
-            check: [get("/api/v1/agent/tenant/readiness")],
+        "github.repos": {
+            check: [get("/api/v1/repos"), get("/api/v1/agent/contract")],
             fallback: "connections",
         },
-        "github.repos": {
+        settings: {
+            check: [
+                get("/api/v1/agent/teams"),
+                get("/api/v1/repos"),
+                get("/api/v1/agent/contract"),
+            ],
+            fallback: "connections",
+        },
+        projects: {
             check: [get("/api/v1/repos"), get("/api/v1/agent/contract")],
             fallback: "connections",
         },
@@ -246,6 +340,7 @@ export function createOnboardRuntime(args, ctx, hooks) {
     // tenant-bound step guards can run. Unsupported/local-only steps make no endpoint requests.
     return {
         identity: (journal) => identity(ctx, journal),
+        ...(hooks.stageSignin ? { stageSignin: hooks.stageSignin } : {}),
         bindSignals: true,
         ui: hooks.ui,
         adapters,

package/dist/onboard-settings-context.js

@@ -0,0 +1,141 @@
+import { verifyOnboardRoutes } from "./onboard-capabilities.js";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { loadConfig, normalizeBaseUrl } from "./config.js";
+import { readExistingOnboardJson, readOnboardTeamInventory, selectedOnboardTeam, } from "./onboard-existing.js";
+import { readOnboardRepositoryInventory, selectedOnboardRepositories, } from "./onboard-repositories.js";
+import { readLocalSettings, } from "./env/settings-authority.js";
+const run = promisify(execFile);
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value
+    : null;
+const repoKey = (repo) => `${repo.owner}/${repo.name}`.toLowerCase();
+/** Read only Git's local origin; no credential helper, provider call, hook or repo command runs. */
+export async function readLocalRepositoryName(repoRoot, signal) {
+    try {
+        if (signal?.aborted)
+            return null;
+        const result = await run("git", ["config", "--local", "--get-all", "remote.origin.url"], {
+            cwd: repoRoot,
+            timeout: 3_000,
+            maxBuffer: 16_384,
+            signal,
+            env: {
+                PATH: process.env.PATH,
+                GIT_CONFIG_GLOBAL: "/dev/null",
+                GIT_CONFIG_SYSTEM: "/dev/null",
+                GIT_CONFIG_NOSYSTEM: "1",
+                GIT_TERMINAL_PROMPT: "0",
+            },
+        });
+        const urls = result.stdout.trim().split(/\r?\n/);
+        if (urls.length !== 1 || signal?.aborted)
+            return null;
+        const raw = urls[0];
+        if (/[\u0000-\u0020\u007f]/.test(raw))
+            return null;
+        const ssh = /^git@github\.com:([A-Za-z0-9][A-Za-z0-9-]{0,38})\/([A-Za-z0-9._-]{1,100}?)(?:\.git)?$/.exec(raw);
+        if (ssh)
+            return `${ssh[1]}/${ssh[2]}`.toLowerCase();
+        const url = new URL(raw);
+        if (url.protocol !== "https:" ||
+            url.hostname !== "github.com" ||
+            url.port ||
+            url.username ||
+            url.password ||
+            url.search ||
+            url.hash)
+            return null;
+        const path = url.pathname.replace(/^\//, "").replace(/\.git$/, "");
+        return /^[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9._-]{1,100}$/.test(path)
+            ? path.toLowerCase()
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Fresh account/member, team inventory and personal repository ACL establish authority. The
+ * journal chooses identifiers only; neither its done state nor the disk contract is proof. */
+export function onboardSettingsAuthorityPorts(input) {
+    const selected = { ...input.repository };
+    const root = input.repoRoot;
+    return {
+        readSettings: readLocalSettings,
+        readContext: async (signal) => {
+            try {
+                const { ctx, journal } = input;
+                const cfg = loadConfig(ctx.home);
+                const account = journal.account ?? journal.tenant;
+                if (signal?.aborted ||
+                    !cfg?.user ||
+                    !account ||
+                    account !== cfg.account ||
+                    journal.membershipId !== cfg.user.id ||
+                    !journal.baseUrl ||
+                    normalizeBaseUrl(journal.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))
+                    return null;
+                const teamId = selectedOnboardTeam(journal);
+                if (!teamId ||
+                    teamId !== selected.teamId ||
+                    !selectedOnboardRepositories(journal).some((repo) => repoKey(repo) === repoKey(selected) &&
+                        repo.repoId === selected.repoId &&
+                        repo.teamId === teamId))
+                    return null;
+                const supported = await verifyOnboardRoutes(ctx, journal, [
+                    { method: "GET", path: "/api/v1/agent/teams" },
+                    { method: "GET", path: "/api/v1/repos" },
+                    { method: "GET", path: "/api/v1/agent/contract" },
+                ], signal);
+                if ("reason" in supported || signal?.aborted)
+                    return null;
+                const meRead = await readExistingOnboardJson(ctx, "/api/v1/me", signal);
+                if ("reason" in meRead)
+                    return null;
+                const me = object(meRead.body);
+                const user = object(me?.user);
+                if (me?.account !== account ||
+                    user?.id !== cfg.user.id ||
+                    typeof user.role !== "string" ||
+                    !["owner", "admin"].includes(user.role))
+                    return null;
+                const teams = await readOnboardTeamInventory(ctx, signal);
+                if ("reason" in teams)
+                    return null;
+                const team = teams.teams.find((row) => row.id === teamId);
+                if (!team || !/^[A-Z][A-Z0-9]{0,15}$/.test(team.key))
+                    return null;
+                const inventory = await readOnboardRepositoryInventory(ctx, journal, signal);
+                if ("reason" in inventory ||
+                    !inventory.repositories.some((repo) => repoKey(repo) === repoKey(selected) &&
+                        repo.repoId === selected.repoId &&
+                        repo.teamId === selected.teamId))
+                    return null;
+                const local = await (input.readRepositoryName ?? readLocalRepositoryName)(root, signal);
+                if (local !== repoKey(selected) || signal?.aborted)
+                    return null;
+                const current = loadConfig(ctx.home);
+                if (!current?.user ||
+                    current.account !== cfg.account ||
+                    current.user.id !== cfg.user.id ||
+                    normalizeBaseUrl(current.baseUrl) !== normalizeBaseUrl(cfg.baseUrl) ||
+                    !["owner", "admin"].includes(current.user.role))
+                    return null;
+                return {
+                    accountId: account,
+                    personId: cfg.user.id,
+                    baseUrl: normalizeBaseUrl(cfg.baseUrl),
+                    role: user.role,
+                    teamId,
+                    teamKey: team.key,
+                    repoId: selected.repoId,
+                    repoName: repoKey(selected),
+                    repoRoot: root,
+                };
+            }
+            catch {
+                return null;
+            }
+        },
+    };
+}

package/dist/onboard-settings-import.js

@@ -0,0 +1,127 @@
+import { verifyOnboardRoutes } from "./onboard-capabilities.js";
+import { loadConfig, normalizeBaseUrl } from "./config.js";
+import { createSelectedImportWriter, } from "./env/selected-import-writer.js";
+const uncertain = () => new Error("selected import outcome uncertain");
+const bind = (context) => JSON.stringify([
+    context.accountId,
+    context.personId,
+    context.baseUrl,
+    context.role,
+    context.teamId,
+    context.teamKey,
+    context.repoId,
+    context.repoName,
+    context.repoRoot,
+]);
+/** The review boundary owns declaration authority. Each actual write additionally rechecks
+ * current access and identity; neither the disk contract nor the receipt supplies a scope. */
+export function createOnboardSettingsWriter(input) {
+    const expected = { ...input.context };
+    const binding = bind(expected);
+    try {
+        const url = new URL(expected.baseUrl);
+        if (url.protocol !== "https:" ||
+            url.origin !== expected.baseUrl ||
+            !["owner", "admin"].includes(expected.role))
+            throw uncertain();
+    }
+    catch {
+        throw uncertain();
+    }
+    const post = async (path, body) => {
+        const owned = new AbortController();
+        const signal = input.signal
+            ? AbortSignal.any([input.signal, owned.signal])
+            : owned.signal;
+        let timer;
+        let remove = () => { };
+        try {
+            return await new Promise((resolve, reject) => {
+                const stopped = () => reject(uncertain());
+                if (signal.aborted) {
+                    stopped();
+                    return;
+                }
+                signal.addEventListener("abort", stopped, { once: true });
+                remove = () => signal.removeEventListener("abort", stopped);
+                timer = setTimeout(() => owned.abort(), 30_000);
+                Promise.resolve()
+                    .then(async () => {
+                    const current = await input.ports.readContext(signal);
+                    if (!current || bind(current) !== binding || signal.aborted)
+                        throw uncertain();
+                    const cfg = loadConfig(input.ctx.home);
+                    if (!cfg?.user ||
+                        cfg.account !== expected.accountId ||
+                        cfg.user.id !== expected.personId ||
+                        normalizeBaseUrl(cfg.baseUrl) !== expected.baseUrl ||
+                        !["owner", "admin"].includes(cfg.user.role))
+                        throw uncertain();
+                    const expiry = cfg.auth
+                        ? Date.parse(cfg.auth.expiresAt) - input.ctx.now().getTime()
+                        : 0;
+                    const bearer = cfg.key ||
+                        (cfg.auth && Number.isFinite(expiry) && expiry > 30_000
+                            ? cfg.auth.accessToken
+                            : undefined);
+                    if (!bearer || signal.aborted)
+                        throw uncertain();
+                    const supported = await verifyOnboardRoutes(input.ctx, {
+                        account: expected.accountId,
+                        tenant: expected.accountId,
+                        membershipId: expected.personId,
+                        baseUrl: expected.baseUrl,
+                    }, [{ method: "POST", path }], signal);
+                    if ("reason" in supported || signal.aborted)
+                        throw uncertain();
+                    const response = await input.ctx.fetch(`${expected.baseUrl}${path}`, {
+                        method: "POST",
+                        redirect: "error",
+                        signal,
+                        headers: {
+                            authorization: `Bearer ${bearer}`,
+                            accept: "application/json",
+                            "content-type": "application/json",
+                        },
+                        body: JSON.stringify(body),
+                    });
+                    // Refusal bodies may contain unsafe text. The adapter needs their status only.
+                    const result = {
+                        status: response.status,
+                        body: response.ok
+                            ? (await response.json())
+                            : undefined,
+                    };
+                    if (signal.aborted)
+                        throw uncertain();
+                    return result;
+                })
+                    .then((value) => (signal.aborted ? stopped() : resolve(value)), () => reject(uncertain()));
+            });
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+            remove();
+        }
+    };
+    const writer = createSelectedImportWriter({
+        kind: input.kind,
+        writeVariable: (name, value) => post("/me/env-vars", {
+            scope: "repo",
+            repoId: expected.repoId,
+            name,
+            value,
+        }),
+        importSecrets: (text) => post("/me/secrets/import", {
+            repo: expected.repoName,
+            text,
+            rotateExisting: [],
+            source: "onboarding selected import",
+        }),
+    });
+    return async (text, names) => {
+        const result = await writer(text, names);
+        return { writtenNames: result.written, failedNames: result.failed };
+    };
+}