@catalyst-cloud/cli 0.14.6 → 0.14.8

package/dist/onboard-settings.js

@@ -0,0 +1,234 @@
+import { realpath } from "node:fs/promises";
+import { storeOnboardDraft } from "./env/onboard-draft-store.js";
+import { isAbsolute, resolve } from "node:path";
+import { validateFullSettings } from "../vendor/settings/index.js";
+import { draftOnboardSettings, } from "./env/onboard-draft.js";
+import { onboardSettingsAuthorityPorts } from "./onboard-settings-context.js";
+import { selectedOnboardRepositories, } from "./onboard-repositories.js";
+import { normalizeBaseUrl } from "./config.js";
+import { selectedOnboardTeam } from "./onboard-existing.js";
+const waiting = (reason, evidence) => ({
+    state: "waiting",
+    reason,
+    ...(evidence ? { evidence } : {}),
+});
+const contextKey = (value) => JSON.stringify([
+    value.accountId,
+    value.personId,
+    value.baseUrl,
+    value.role,
+    value.teamId,
+    value.teamKey,
+    value.repoId,
+    value.repoName,
+    value.repoRoot,
+]);
+const safeLabel = (text) => text.replace(/[\u0000-\u001f\u007f-\u009f]/g, "").slice(0, 240);
+async function boundedRead(work, external, timeoutMs = 30_000) {
+    const owned = new AbortController();
+    const signal = external
+        ? AbortSignal.any([external, owned.signal])
+        : owned.signal;
+    let timer;
+    let remove = () => { };
+    try {
+        return await new Promise((resolve) => {
+            const stopped = () => resolve(null);
+            if (signal.aborted) {
+                stopped();
+                return;
+            }
+            signal.addEventListener("abort", stopped, { once: true });
+            remove = () => signal.removeEventListener("abort", stopped);
+            timer = setTimeout(() => owned.abort(), timeoutMs);
+            Promise.resolve()
+                .then(() => work(signal))
+                .then((result) => resolve(signal.aborted ? null : result), () => resolve(null));
+        });
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        remove();
+    }
+}
+/** Q4 drafts are local review artifacts. A full local validator is not declaration approval;
+ * neither a kept draft nor a valid existing file marks this required step complete. */
+export function onboardSettingsAdapter(hooks = {}) {
+    const storeTimeoutMs = hooks.storeTimeoutMs ?? 30_000;
+    if (!Number.isSafeInteger(storeTimeoutMs) ||
+        storeTimeoutMs < 1 ||
+        storeTimeoutMs > 30_000)
+        throw new Error("settings_storage_timeout_invalid");
+    const observe = async (ctx, journal, signal) => {
+        const repositories = selectedOnboardRepositories(journal);
+        const summaries = [];
+        const candidates = [];
+        for (const repository of repositories) {
+            if (signal?.aborted)
+                return null;
+            const summary = {
+                repository: `${repository.owner}/${repository.name}`,
+                state: "unavailable",
+                variableNames: [],
+                secretNames: [],
+                sources: [],
+            };
+            summaries.push(summary);
+            try {
+                const requested = hooks.repositoryRoot
+                    ? hooks.repositoryRoot({ ...repository })
+                    : process.cwd();
+                if (!requested ||
+                    !isAbsolute(requested) ||
+                    (await realpath(requested)) !== resolve(requested) ||
+                    signal?.aborted)
+                    continue;
+                const ports = (hooks.authorityPorts ??
+                    ((c, j, r, root) => onboardSettingsAuthorityPorts({
+                        ctx: c,
+                        journal: j,
+                        repository: r,
+                        repoRoot: root,
+                    })))(ctx, journal, repository, requested);
+                const before = await ports.readContext(signal);
+                if (!before ||
+                    before.accountId !== (journal.account ?? journal.tenant) ||
+                    before.personId !== journal.membershipId ||
+                    !journal.baseUrl ||
+                    before.baseUrl !== normalizeBaseUrl(journal.baseUrl) ||
+                    !["owner", "admin"].includes(before.role) ||
+                    before.teamId !== selectedOnboardTeam(journal) ||
+                    before.teamId !== repository.teamId ||
+                    !/^[A-Z][A-Z0-9]{0,15}$/.test(before.teamKey) ||
+                    before.repoId !== repository.repoId ||
+                    before.repoName !== summary.repository.toLowerCase() ||
+                    before.repoRoot !== resolve(requested) ||
+                    signal?.aborted)
+                    continue;
+                const binding = contextKey(before);
+                const existing = await ports.readSettings(requested, signal);
+                if (existing !== null) {
+                    const checked = validateFullSettings(existing);
+                    const after = await ports.readContext(signal);
+                    if (!checked.ok ||
+                        checked.linearTeam !== before.teamKey ||
+                        !after ||
+                        contextKey(after) !== binding ||
+                        signal?.aborted)
+                        continue;
+                    Object.assign(summary, {
+                        state: "existing",
+                        variableNames: checked.variableNames,
+                        secretNames: checked.secretNames,
+                        sources: [".catalyst/catalyst.toml"],
+                    });
+                    continue;
+                }
+                const draft = (hooks.draft ?? draftOnboardSettings)(requested, before.teamKey);
+                if (draft.state !== "draft")
+                    continue;
+                const checked = validateFullSettings(draft.toml);
+                const after = await ports.readContext(signal);
+                if (!checked.ok ||
+                    checked.linearTeam !== before.teamKey ||
+                    !after ||
+                    contextKey(after) !== binding ||
+                    signal?.aborted)
+                    continue;
+                Object.assign(summary, {
+                    state: "draft",
+                    variableNames: checked.variableNames,
+                    secretNames: checked.secretNames,
+                    sources: draft.sources.map(safeLabel),
+                });
+                candidates.push({
+                    repository: { ...repository },
+                    context: { ...before },
+                    ports,
+                    draft,
+                });
+            }
+            catch {
+                /* One unavailable checkout cannot approve the other repositories. */
+            }
+        }
+        return { summaries, candidates };
+    };
+    const bounded = (ctx, journal, external) => boundedRead((signal) => observe(ctx, journal, signal), external);
+    return {
+        check: async (ctx, journal, signal) => {
+            const read = await bounded(ctx, journal, signal);
+            if (!read?.summaries.length)
+                return waiting("settings_checkout_unverified");
+            if (read.summaries.some((summary) => summary.state === "unavailable"))
+                return waiting("settings_checkout_unverified");
+            return read.candidates.length
+                ? { state: "pending" }
+                : waiting("settings_approval_unverified");
+        },
+        act: async (ctx, journal, signal) => {
+            const read = await bounded(ctx, journal, signal);
+            if (!read?.summaries.length || signal?.aborted)
+                return waiting("settings_checkout_unverified");
+            for (const summary of read.summaries) {
+                hooks.message?.(`Settings for ${summary.repository}\n  ${summary.state === "unavailable" ? "Local checkout or settings could not be verified." : `Full settings schema validation passed locally (${summary.state === "draft" ? "new draft; private copy pending" : "existing repository file; kept unchanged"}).\n  Variables: ${summary.variableNames.join(", ") || "none"}\n  Secrets: ${summary.secretNames.join(", ") || "none"}\n  Sources: ${summary.sources.join(", ") || "none"}`}`);
+            }
+            const choice = hooks.review
+                ? await boundedRead(async () => hooks.review(read.summaries.map((row) => ({
+                    ...row,
+                    variableNames: [...row.variableNames],
+                    secretNames: [...row.secretNames],
+                    sources: [...row.sources],
+                }))), signal, 600_000)
+                : "keep";
+            if (choice === null && !signal?.aborted)
+                return waiting("settings_review_timeout");
+            if (choice !== "keep" || signal?.aborted)
+                return waiting("interrupted");
+            if (read.summaries.some((summary) => summary.state === "unavailable"))
+                return waiting("settings_checkout_unverified");
+            let stored = 0;
+            for (const candidate of read.candidates) {
+                const current = await boundedRead((owned) => candidate.ports.readContext(owned), signal);
+                if (!current ||
+                    contextKey(current) !== contextKey(candidate.context) ||
+                    signal?.aborted)
+                    return waiting("settings_checkout_unverified", { count: stored });
+                const ownedStore = new AbortController();
+                const storeSignal = signal
+                    ? AbortSignal.any([signal, ownedStore.signal])
+                    : ownedStore.signal;
+                const timer = setTimeout(() => ownedStore.abort(), storeTimeoutMs);
+                let result;
+                try {
+                    // Do not race this promise. The writer settles all IO/owned cleanup before the engine
+                    // may release its receipt lock, including after cancellation or the cooperative budget.
+                    result = await (hooks.storeDraft ?? storeOnboardDraft)({
+                        home: ctx.home,
+                        env: { ...ctx.env },
+                        runId: journal.runId,
+                        repoId: candidate.repository.repoId,
+                        toml: candidate.draft.toml,
+                        signal: storeSignal,
+                    });
+                }
+                catch {
+                    result = { state: "rejected" };
+                }
+                finally {
+                    clearTimeout(timer);
+                }
+                if (storeSignal.aborted)
+                    return waiting(signal?.aborted ? "interrupted" : "settings_draft_storage_timeout", { count: stored });
+                if (result.state !== "stored" || signal?.aborted)
+                    return waiting("settings_draft_storage_unavailable", {
+                        count: stored,
+                    });
+                stored++;
+                hooks.message?.(`Kept a private settings draft copy for ${candidate.repository.owner}/${candidate.repository.name}: ${safeLabel(result.path)}`);
+            }
+            return waiting("settings_approval_unverified", { count: stored });
+        },
+    };
+}

package/dist/onboard-ui.js

@@ -1,5 +1,5 @@
 import { createOnboardProgress, } from "./onboard-progress.js";
-import { ONBOARD_STEPS, ONBOARD_TITLES, } from "./onboard.js";
+import { ONBOARD_STEPS, ONBOARD_TITLES, onboardIdentityLines, onboardNextActions, onboardReadyForWork, onboardStepAction, } from "./onboard.js";
 export function shouldUseOnboardUi(args, stdoutTty) {
     return (stdoutTty &&
         !args.json &&
@@ -38,29 +38,47 @@ export function createClackOnboardUi(prompts, streams, deps = {}) {
     };
     return {
         signal: abort.signal,
-        plan(journal) {
+        plan(journal, identity) {
             stop();
             if (!introduced) {
                 prompts.intro("Catalyst setup", { output: streams.output });
                 introduced = true;
             }
+            if (identity !== undefined)
+                for (const line of onboardIdentityLines(identity))
+                    message(line);
             const steps = new Map(journal.steps.map((step) => [step.id, step]));
             message(ONBOARD_STEPS.map((id) => `· ${ONBOARD_TITLES[id]}${steps.get(id)?.state === "done" ? " (recheck)" : ""}`).join("\n"));
-            message("Use cloud reads by default. Local sync is optional for SQL, offline work or sustained reads.");
+            message("Use cloud reads by default. Local sync is optional for SQL or sustained local reads.");
+            message("Setup may check one stored Claude account using a one-token provider request. This may use Claude quota. It does not refresh Codex credentials.");
         },
-        async confirmPlan(localSync) {
+        async confirmPlan(localSync, signin = "unavailable") {
             stop();
             const answer = await prompts.select({
                 ...options,
                 message: "Continue with this plan?",
-                initialValue: localSync ? "local" : "cloud",
+                initialValue: signin === "required" ? "signin" : localSync ? "local" : "cloud",
                 options: [
-                    {
-                        value: "cloud",
-                        label: "Continue using cloud reads",
-                        hint: "default",
-                    },
-                    { value: "local", label: "Continue and set up local sync" },
+                    ...(signin === "required"
+                        ? []
+                        : [
+                            {
+                                value: "cloud",
+                                label: "Continue using cloud reads",
+                                hint: "default",
+                            },
+                            { value: "local", label: "Continue and set up local sync" },
+                        ]),
+                    ...(signin === "unavailable"
+                        ? []
+                        : [
+                            {
+                                value: "signin",
+                                label: signin === "saved"
+                                    ? "Sign in again before continuing"
+                                    : "Sign in and review this plan",
+                            },
+                        ]),
                     { value: "stop", label: "Stop without changes" },
                 ],
             });
@@ -71,6 +89,7 @@ export function createClackOnboardUi(prompts, streams, deps = {}) {
             return {
                 proceed: answer === "cloud" || answer === "local",
                 localSync: answer === "local",
+                ...(answer === "signin" ? { signin: true } : {}),
             };
         },
         async chooseTeam(teams) {
@@ -115,6 +134,48 @@ export function createClackOnboardUi(prompts, streams, deps = {}) {
                 },
             }
             : {}),
+        async reviewSettings(summaries) {
+            stop();
+            if (!summaries.length || abort.signal.aborted)
+                return "cancel";
+            const answer = await prompts.select({
+                ...options,
+                message: "Review settings for all selected repositories. Keep private copies of new drafts for review?",
+                initialValue: "keep",
+                options: [
+                    {
+                        value: "keep",
+                        label: "Keep private draft copies",
+                        hint: "default; repository files stay unchanged; approval and value import stay pending",
+                    },
+                    { value: "stop", label: "Stop without keeping new copies" },
+                ],
+            });
+            if (prompts.isCancel(answer) || answer === "stop") {
+                abort.abort();
+                return "cancel";
+            }
+            return answer === "keep" ? "keep" : "cancel";
+        },
+        async chooseFirstRepository(repositories) {
+            stop();
+            if (!repositories.length || abort.signal.aborted)
+                return null;
+            const answer = await prompts.select({
+                ...options,
+                message: "Which repository should start this project?",
+                initialValue: `${repositories[0].owner}/${repositories[0].name}`,
+                options: repositories.map((row) => ({
+                    value: `${row.owner}/${row.name}`,
+                    label: `${row.owner}/${row.name}`,
+                })),
+            });
+            if (prompts.isCancel(answer)) {
+                abort.abort();
+                return null;
+            }
+            return typeof answer === "string" ? answer : null;
+        },
         stepStart(id) {
             const next = ["machine", "cli", "skills", "legacy"].includes(id)
                 ? "This computer"
@@ -133,54 +194,9 @@ export function createClackOnboardUi(prompts, streams, deps = {}) {
             }
             start(ONBOARD_TITLES[id]);
         },
-        stepEnd(step) {
+        stepEnd(step, journal) {
             stop();
-            const reasons = {
-                personal_consent_handoff: "The browser approval link could not be verified. Run catalyst onboard to try again.",
-                personal_identity_refused: "Your current login no longer matches this setup. Resume with the original workspace and person.",
-                personal_login_refresh_required: "Renew your login with catalyst login, then run catalyst onboard to resume.",
-                personal_status_unavailable: "Your personal connection could not be checked. Run catalyst onboard to try again.",
-                personal_browser_unavailable: "The browser could not open. Run catalyst onboard to try again.",
-                cloud_capability_unavailable: "This setup step is not available on this server yet. Use the web app link shown above, then resume after the server update.",
-                onboarding_capability_unavailable: "The server's setup capabilities could not be checked. Run catalyst onboard to try again.",
-                onboarding_capability_identity_unverified: "The server's setup capabilities belong to another login or workspace. Sign in to the original workspace to resume.",
-                onboarding_capability_login_refresh_required: "Your login needs a refresh before setup capabilities can be checked. Run catalyst login, then catalyst onboard.",
-                workspace_consent_refused: "The server did not accept this login for Linear workspace setup. Sign in again or ask your workspace administrator.",
-                github_installation_status_unavailable: "Your GitHub App installation could not be checked. Run catalyst onboard to try again.",
-                github_installation_status_shape: "The server returned a GitHub installation result that could not be verified.",
-                github_installation_consent_handoff: "The GitHub installation approval link could not be verified. Run catalyst onboard to try again.",
-                github_installation_consent_refused: "The server did not accept this login for GitHub App setup. Sign in again or ask your workspace administrator.",
-                github_installation_identity_refused: "GitHub setup belongs to another login or workspace. Sign in to the original workspace to resume.",
-                github_installation_admin_required: "A workspace owner or administrator approves the GitHub App installation.",
-                github_installation_login_refresh_required: "Your login needs a refresh. Run catalyst onboard to resume.",
-                github_installation_browser_unavailable: "The GitHub App approval page could not be opened. Use your workspace's Connections page, then resume.",
-                step_not_available_in_this_release: "This setup step is not available yet.",
-                prerequisite_not_ready: "Waiting for an earlier setup step.",
-                local_sync_not_selected: "Using cloud reads. Local sync was not selected.",
-                local_sync_capability_unavailable: "Local sync was selected but could not be verified.",
-                member_scope: "Your workspace administrator handles this step.",
-                onboarding_checks_pending: "Some required checks are still unverified.",
-                interrupted: "Setup paused. Run the same command to resume.",
-                signin_timeout: "Sign-in timed out. Run catalyst onboard to try again.",
-                linear_workspace_unverified: "Your Linear workspace connection could not be verified.",
-                team_inventory_empty: "No existing Linear teams could be verified.",
-                team_inventory_shape: "The cloud returned a team list that could not be verified.",
-                team_read_unavailable: "Your existing Linear teams could not be read. Run catalyst onboard to try again.",
-                team_read_login_refresh_required: "Your login needs a refresh. Run catalyst onboard to resume.",
-                team_choice_required: "Choose an existing team with catalyst onboard --team <team ID or key>.",
-                team_selection_unverified: "Your selected Linear team could not be verified. Run catalyst onboard --team <team ID or key> to choose again.",
-                repository_choice_required: "Choose repositories with catalyst onboard --repo <owner/name>. Repeat --repo to choose more than one.",
-                repository_inventory_empty: "No accessible repositories are registered to this Linear team yet.",
-                repository_read_unavailable: "Your repository list could not be read. Run catalyst onboard to try again.",
-                repository_inventory_shape: "The cloud returned a repository list that could not be verified.",
-                repository_contract_unavailable: "Current repository IDs could not be checked. Run catalyst onboard to try again.",
-                repository_contract_unverified: "The cloud returned repository IDs that could not be verified for this workspace.",
-                repository_id_unverified: "A repository's current ID could not be verified. Keep your selection and try again.",
-                repository_binding_ambiguous: "A repository's Linear team binding is ambiguous. Your administrator needs to check it.",
-                repository_identity_unverified: "Sign in to the original workspace to choose repositories.",
-                repository_selection_unverified: "Your selected repositories could not be verified. Run catalyst onboard --repo <owner/name> to choose again.",
-            };
-            const text = `${ONBOARD_TITLES[step.id]}${step.reason ? `: ${reasons[step.reason] ?? step.reason.replaceAll("_", " ")}` : ""}`;
+            const text = `${ONBOARD_TITLES[step.id]}${step.reason ? `: ${onboardStepAction(journal, step, deps.baseUrl?.())}` : ""}`;
             const kind = step.state === "done"
                 ? "info"
                 : step.state === "failed"
@@ -195,12 +211,22 @@ export function createClackOnboardUi(prompts, streams, deps = {}) {
         message,
         finish(journal, only) {
             stop();
-            let text = "Setup still needs checks. Run catalyst onboard to resume.";
+            let text = [
+                "Setup still needs these steps:",
+                ...onboardNextActions(journal, deps.baseUrl?.(), only),
+                "resume: catalyst onboard",
+            ].join("\n");
             if (abort.signal.aborted)
                 text =
                     "Setup paused. Your progress is saved.\nresume: catalyst onboard";
             else if (journal.complete && journal.exit === 0 && !only)
                 text = "Onboarding complete.";
+            else if (onboardReadyForWork(journal, only))
+                text = [
+                    "Ready for work.",
+                    "Next, when you want:",
+                    ...onboardNextActions(journal, deps.baseUrl?.()),
+                ].join("\n");
             else if (only && journal.exit === 0)
                 text = `${ONBOARD_TITLES[only]} finished. Onboarding still has other steps.\nresume: catalyst onboard`;
             prompts.outro(text, { output: streams.output });