@chorus-aidlc/chorus 0.14.0 → 0.14.2

package/cli/daemon-install-config.mjs

@@ -0,0 +1,213 @@
+// cli/daemon-install-config.mjs
+// The `chorus daemon install` pre-install config phase (fix-daemon-install-config,
+// idea d7592c96). Two pure, dependency-injected helpers that run BEFORE the
+// service unit is written, so a boot-time daemon in systemd/launchd's CLEAN
+// environment can always authenticate and knows which working directories to
+// serve:
+//
+//   resolveInstallCredentials — resolve (flags>env>daemon.json>plugin) → persist
+//     into ~/.chorus/daemon.json → validate against the server → abort (write
+//     nothing) if creds cannot be obtained or the key is invalid. This is the
+//     crux of the fix: a systemd --user unit does NOT inherit the operator's
+//     shell-exported CHORUS_URL/CHORUS_API_KEY, so the creds must live in the
+//     0600 login file the clean boot env reads.
+//
+//   resolveInstallCwds — determine the served working-directory set and persist
+//     it to daemon.json `cwds` (the single source of truth; the unit carries no
+//     --cwd — see cli/daemon-service.mjs buildServiceArgs). Prompts an interactive
+//     add-loop only when nothing is configured and stdin is a TTY.
+//
+// All IO (resolve / validate / persist / prompt / readJson / env / cwd) is
+// injected so the helpers unit-test without real disk, network, or TTY — matching
+// the style of cli/credentials.mjs and cli/daemon-config.mjs.
+
+import { homedir } from "node:os";
+import { resolveCredentials, loginFilePath } from "./credentials.mjs";
+import { updateDaemonConfig, prompt as defaultPrompt } from "./login.mjs";
+import { validateAndFetchIdentity } from "./chorus-client.mjs";
+import { normalizeCwd, cleanCwdList } from "./daemon-config.mjs";
+import { readFileSync } from "node:fs";
+
+/** A non-empty trimmed string, or undefined. */
+function nonEmpty(value) {
+  if (typeof value !== "string") return undefined;
+  const t = value.trim();
+  return t.length > 0 ? t : undefined;
+}
+
+/** Read a JSON file, returning null on any error. Mirrors credentials.mjs. */
+function readJsonSafe(path) {
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Credential preflight for `chorus daemon install`. Resolves credentials, persists
+ * them (with the fetched identity) into ~/.chorus/daemon.json, and validates the
+ * key against the server — all BEFORE the caller writes any service unit.
+ *
+ * Returns `{ ok: true, creds, identity }` on success, or `{ ok: false }` when the
+ * install must abort (no unit should be written). Never throws.
+ *
+ * Behavior (elaboration Q1/Q2/Q8/Q9):
+ *   - Resolve via resolveCredentials (flags > env > daemon.json > plugin).
+ *   - Unresolved + TTY + !skip → prompt login-style (masked key).
+ *   - Unresolved + (skip || !TTY) → abort with the multi-source hint (no prompt).
+ *   - ALWAYS validate the resolved/entered key; abort on failure.
+ *   - On success persist { url, apiKey, agentUuid, agentName } via the 0600
+ *     field-merge writer (preserves cwds / yoloAckAt / sigintTimeoutMs).
+ *
+ * @param {{ url?: string, apiKey?: string }} flags
+ * @param {Record<string,string|undefined>} env
+ * @param {{
+ *   isTTY?: boolean, skip?: boolean,
+ *   resolve?: typeof resolveCredentials,
+ *   validate?: typeof validateAndFetchIdentity,
+ *   writeConfig?: (partial: Record<string, unknown>) => string,
+ *   prompt?: typeof defaultPrompt,
+ *   log?: (m: string) => void,
+ *   errLog?: (m: string) => void,
+ * }} [opts]
+ * @returns {Promise<{ ok: true, creds: {url:string,apiKey:string}, identity: {uuid:string,name:string} } | { ok: false }>}
+ */
+export async function resolveInstallCredentials(flags = {}, env = {}, opts = {}) {
+  const isTTY = opts.isTTY ?? false;
+  const skip = opts.skip ?? false;
+  const resolve = opts.resolve ?? resolveCredentials;
+  const validate = opts.validate ?? validateAndFetchIdentity;
+  const writeConfig = opts.writeConfig ?? updateDaemonConfig;
+  const ask = opts.prompt ?? defaultPrompt;
+  const log = opts.log ?? (() => {});
+  const errLog = opts.errLog ?? (() => {});
+
+  let url;
+  let apiKey;
+
+  // 1. Try the layered resolver. It THROWS (does not return null) when no source
+  //    yields a complete pair — catch it and decide prompt vs abort.
+  try {
+    const resolved = resolve(flags, { env });
+    url = resolved.url;
+    apiKey = resolved.apiKey;
+    log(`[Chorus] credentials resolved from: ${resolved.source}`);
+  } catch (err) {
+    const hint = err instanceof Error ? err.message : String(err);
+    if (!isTTY || skip) {
+      // No way (or no permission) to prompt — abort with the actionable hint
+      // rather than writing a unit that would crash-loop at boot.
+      errLog(hint);
+      return { ok: false };
+    }
+    // TTY + interactive: complete credentials login-style (masked key).
+    log("[Chorus] no credentials found — configuring them now (saved for the boot service).");
+    url = nonEmpty(await ask("Chorus URL: "));
+    apiKey = nonEmpty(await ask("Chorus API key (cho_...): ", { mask: true }));
+    if (!url || !apiKey) {
+      errLog("[Chorus] both a URL and an API key are required — aborting install.");
+      return { ok: false };
+    }
+  }
+
+  // 2. ALWAYS validate against the server before writing anything (Q2/Q9) — even
+  //    in skip mode. A bad/expired key fails the install instead of at boot.
+  let identity;
+  try {
+    identity = await validate({ url, apiKey });
+  } catch (err) {
+    errLog(`[Chorus] credential validation failed: ${err instanceof Error ? err.message : String(err)}`);
+    errLog("[Chorus] credentials were NOT saved and no service was installed.");
+    return { ok: false };
+  }
+
+  // 3. Persist into the 0600 login file so the clean boot env can read it. The
+  //    field-merge writer preserves cwds / yoloAckAt / sigintTimeoutMs.
+  writeConfig({ url, apiKey, agentUuid: identity.uuid, agentName: identity.name });
+  log(`[Chorus] credentials saved for ${identity.name} (${identity.uuid}).`);
+  return { ok: true, creds: { url, apiKey }, identity };
+}
+
+/**
+ * Determine the set of working directories the daemon serves and persist it to
+ * ~/.chorus/daemon.json `cwds` (the single source of truth — the unit carries no
+ * --cwd). Prompts an interactive add-loop only when nothing is configured and
+ * stdin is a TTY (and skip is false).
+ *
+ * "Configured" ⇔ a `--cwd` flag was passed OR daemon.json already has a non-empty
+ * `cwds` array. Configured, or skip/non-TTY, uses that set (or the process cwd
+ * default) with no prompt.
+ *
+ * Returns `{ cwds: string[] }` — the normalized, de-duplicated set that was
+ * persisted. Never throws.
+ *
+ * @param {{ cwd?: string[] }} flags
+ * @param {{
+ *   isTTY?: boolean, skip?: boolean,
+ *   readJson?: (path: string) => (Record<string, unknown>|null),
+ *   loginPath?: string,
+ *   writeConfig?: (partial: Record<string, unknown>) => string,
+ *   prompt?: typeof defaultPrompt,
+ *   home?: string,
+ *   processCwd?: string,
+ *   log?: (m: string) => void,
+ * }} [opts]
+ * @returns {Promise<{ cwds: string[] }>}
+ */
+export async function resolveInstallCwds(flags = {}, opts = {}) {
+  const isTTY = opts.isTTY ?? false;
+  const skip = opts.skip ?? false;
+  const readJson = opts.readJson ?? readJsonSafe;
+  const loginPath = opts.loginPath ?? loginFilePath();
+  const writeConfig = opts.writeConfig ?? updateDaemonConfig;
+  const ask = opts.prompt ?? defaultPrompt;
+  const home = opts.home ?? homedir();
+  const processCwd = opts.processCwd ?? process.cwd();
+  const log = opts.log ?? (() => {});
+
+  // 1. Explicit --cwd flag(s) → configured; normalize + dedup, no prompt.
+  const flagList = Array.isArray(flags.cwd) ? flags.cwd : typeof flags.cwd === "string" ? [flags.cwd] : [];
+  const fromFlags = cleanCwdList(flagList, home);
+  if (fromFlags.length > 0) {
+    writeConfig({ cwds: fromFlags });
+    return { cwds: fromFlags };
+  }
+
+  // 2. Existing daemon.json `cwds` → configured; use as-is (re-persist is a no-op
+  //    merge, so we skip the write and just return them).
+  const file = readJson(loginPath);
+  const fromFile = file && Array.isArray(file.cwds) ? cleanCwdList(file.cwds, home) : [];
+  if (fromFile.length > 0) {
+    return { cwds: fromFile };
+  }
+
+  // 3. Unconfigured. On a non-TTY or in skip mode, fall back to the process cwd
+  //    default with no prompt.
+  const defaultCwd = normalizeCwd(processCwd, home);
+  if (!isTTY || skip) {
+    const cwds = defaultCwd ? [defaultCwd] : [];
+    if (cwds.length > 0) writeConfig({ cwds });
+    return { cwds };
+  }
+
+  // 4. Unconfigured + TTY + !skip → interactive add-loop. Pre-seed the current
+  //    directory as the suggested first entry (Enter accepts it), then keep
+  //    prompting until a blank line ends the loop.
+  const collected = [];
+  log(`[Chorus] Configure the working directories this daemon serves.`);
+  const first = nonEmpty(await ask(`Working directory [${defaultCwd}] (Enter to accept the default): `));
+  collected.push(first ?? defaultCwd);
+  // subsequent adds
+  // eslint-disable-next-line no-constant-condition
+  while (true) {
+    const next = nonEmpty(await ask("Add another working directory (blank to finish): "));
+    if (!next) break;
+    collected.push(next);
+  }
+  const cwds = cleanCwdList(collected, home);
+  const finalCwds = cwds.length > 0 ? cwds : defaultCwd ? [defaultCwd] : [];
+  if (finalCwds.length > 0) writeConfig({ cwds: finalCwds });
+  return { cwds: finalCwds };
+}

package/cli/daemon-service.mjs

@@ -70,17 +70,22 @@ export function resolveScriptPath() {
 
 /**
  * Build the argv the SUPERVISED daemon runs — the normal long-lived daemon
- * (NO `-d`: the supervisor owns the foreground process). Reflects the flags the
- * operator passed to `install` so the boot-time daemon serves the same paths /
- * agent / permission posture. Pure.
+ * (NO `-d`: the supervisor owns the foreground process). Reflects the `--agent`
+ * / `--chorus-only` posture the operator passed to `install`. The served cwd set
+ * is NOT embedded here — it lives in ~/.chorus/daemon.json `cwds` (single source
+ * of truth) and is read by the daemon via resolveDaemonCwds. Pure.
  * @param {{ cwds?: string[], agent?: string, chorusOnly?: boolean, scriptPath: string }} spec
- * @returns {string[]}  e.g. ["/x/chorus.mjs","daemon","--cwd","/a","--cwd","/b"]
+ * @returns {string[]}  e.g. ["/x/chorus.mjs","daemon","--agent","codex"]
  */
 export function buildServiceArgs(spec) {
   const args = [spec.scriptPath, "daemon"];
-  for (const cwd of spec.cwds ?? []) {
-    if (typeof cwd === "string" && cwd) args.push("--cwd", cwd);
-  }
+  // NOTE: --cwd is deliberately NOT emitted. The set of working directories the
+  // daemon serves is persisted to ~/.chorus/daemon.json `cwds` at install time
+  // (the single source of truth) and read back by the daemon via
+  // resolveDaemonCwds. Baking --cwd into the unit too would let the two sources
+  // drift and would hide the paths from a plain `chorus daemon` run
+  // (fix-daemon-install-config, elaboration Q5-A). `spec.cwds` is still accepted
+  // for signature compatibility but ignored here.
   if (spec.agent) args.push("--agent", spec.agent);
   if (spec.chorusOnly) args.push("--chorus-only");
   return args;

package/cli/daemon.mjs

@@ -13,7 +13,11 @@
 // observability idea.
 
 import { resolveCredentials, loginFilePath } from "./credentials.mjs";
-import { prompt, writeLoginFile } from "./login.mjs";
+import { prompt, writeLoginFile, updateDaemonConfig } from "./login.mjs";
+import {
+  resolveInstallCredentials,
+  resolveInstallCwds,
+} from "./daemon-install-config.mjs";
 import {
   resolvePermissionMode,
   yoloWarningLine,
@@ -29,6 +33,7 @@ import { Waker } from "./waker.mjs";
 import { LineageResolver } from "./lineage.mjs";
 import { resolveClaudePath } from "./claude-spawner.mjs";
 import { resolveCodexPath } from "./codex-spawner.mjs";
+import { resolveKiroPath } from "./kiro-spawner.mjs";
 import { selectSpawner } from "./spawner-select.mjs";
 import {
   createExecutionUploadHooks,
@@ -484,6 +489,7 @@ export async function runDaemon(flags = {}, deps = {}) {
   // banner shows the right binary instead of always probing for `claude`.
   const findClaude = deps.resolveClaudePath ?? resolveClaudePath;
   const findCodex = deps.resolveCodexPath ?? resolveCodexPath;
+  const findKiro = deps.resolveKiroPath ?? resolveKiroPath;
   const verbose = flags.verbose === true || env.CHORUS_VERBOSE === "1";
 
   // Resolve the agent backend (default claude-code). An unknown --agent /
@@ -520,7 +526,14 @@ export async function runDaemon(flags = {}, deps = {}) {
   // The preflight dep bundle — built from the same seams runDaemon resolved, so
   // the detach/restart paths run the SAME (injectable) preflight, not the real
   // implementations. Threaded into startDetached so tests can drive it offline.
-  const pfDeps = { flags, env, isTTY, resolve, validate, writeCreds, askPrompt, log, errLog };
+  // writeConfig / readJson / loginPath are optional injectable IO used by the
+  // `install` config phase — default (undefined) means the real 0600 login file.
+  const pfDeps = {
+    flags, env, isTTY, resolve, validate, writeCreds, askPrompt, log, errLog,
+    writeConfig: deps.writeConfig,
+    readJson: deps.readJson,
+    loginPath: deps.loginPath,
+  };
 
   const action = flags.action ?? "run";
   if (action !== "run") {
@@ -557,10 +570,12 @@ export async function runDaemon(flags = {}, deps = {}) {
 
   // Detect the SELECTED backend's executable (non-fatal): the daemon still
   // subscribes when it's missing; a wake surfaces the error visibly when one
-  // arrives. The resolved path (or absence) is shown in the banner below. codex
-  // → resolveCodexPath, otherwise resolveClaudePath — so a `--agent codex` run
-  // probes (and the banner reports) `codex`, not `claude`.
-  const cliPath = agentType === "codex" ? findCodex() : findClaude();
+  // arrives. The resolved path (or absence) is shown in the banner below. Each
+  // backend probes its own binary — codex → resolveCodexPath, kiro →
+  // resolveKiroPath, otherwise resolveClaudePath — so a `--agent kiro` run probes
+  // (and the banner reports) `kiro-cli`, not `claude`.
+  const cliPath =
+    agentType === "codex" ? findCodex() : agentType === "kiro" ? findKiro() : findClaude();
 
   // The daemon.json the layered config readers (credentials, sigint timeout, cwds)
   // consult. Surfacing its absolute path + presence in the banner makes it obvious
@@ -742,11 +757,55 @@ export async function handleLifecycleAction(action, { log, errLog, lifecycle, se
   const svc = service ?? { detectSupervisor: () => ({ kind: "none" }) };
 
   if (action === "install") {
+    // Pre-install config phase (fix-daemon-install-config): BEFORE writing any
+    // unit, guarantee the clean-env boot service can authenticate and knows which
+    // cwds to serve. --yes/-y OR a non-TTY suppress prompts; neither suppresses
+    // the resolve/persist/validate/abort guarantee.
+    const flags = pfDeps?.flags ?? {};
+    const env = pfDeps?.env ?? {};
+    const isTTY = pfDeps?.isTTY ?? false;
+    const skip = flags.yes === true || !isTTY;
+    const installCfg = svc.installConfig ?? {
+      resolveInstallCredentials,
+      resolveInstallCwds,
+    };
+
+    const credResult = await installCfg.resolveInstallCredentials(flags, env, {
+      isTTY,
+      skip,
+      resolve: pfDeps?.resolve,
+      validate: pfDeps?.validate,
+      writeConfig: pfDeps?.writeConfig ?? updateDaemonConfig,
+      prompt: pfDeps?.askPrompt,
+      log,
+      errLog,
+    });
+    if (!credResult.ok) {
+      // Credentials could not be obtained / validated — never install a service
+      // that would fail to authenticate and crash-loop at boot.
+      errLog("[Chorus] install aborted — no service was written.");
+      return 1;
+    }
+
+    // Configure + persist the served cwd set (single source of truth in
+    // daemon.json; the unit carries no --cwd). Never blocks on a non-TTY.
+    // readJson / loginPath are optional injectable seams (default to the real
+    // login file) so the config phase can be exercised hermetically in tests.
+    await installCfg.resolveInstallCwds(flags, {
+      isTTY,
+      skip,
+      writeConfig: pfDeps?.writeConfig ?? updateDaemonConfig,
+      readJson: pfDeps?.readJson,
+      loginPath: pfDeps?.loginPath,
+      prompt: pfDeps?.askPrompt,
+      log,
+    });
+
     const spec = {
       ...svc.resolveServicePaths(),
-      cwds: pfDeps?.flags?.cwd ?? [],
-      agent: pfDeps?.flags?.agent,
-      chorusOnly: pfDeps?.flags?.chorusOnly === true,
+      cwds: flags.cwd ?? [],
+      agent: flags.agent,
+      chorusOnly: flags.chorusOnly === true,
       workingDir: process.cwd(),
     };
     const r = svc.installService(spec);

package/cli/kiro-session-map.mjs

@@ -0,0 +1,49 @@
+// cli/kiro-session-map.mjs
+// Daemon-local persistence of the Kiro `anchor → sessionId` map. Kiro GENERATES
+// its own per-cwd conversation sessionId (unlike Claude, which accepts a
+// client-supplied --session-id), and the daemon works one repo cwd shared by many
+// ideas — so Kiro's native "resume most recent conversation from this directory"
+// would cross-contaminate ideas. Instead we record the generated sessionId keyed
+// by the Chorus session anchor (direct idea uuid, or the entity uuid for an ad-hoc
+// session) and `kiro-cli chat --no-interactive --resume-id <sessionId>` on the
+// next wake for that anchor.
+//
+// Thin wrapper over the generic `createSessionMap` factory (shared with the Codex
+// backend); the store is ~/.chorus/kiro-sessions.json. See session-map.mjs for the
+// best-effort / never-throw contract and the injectable-IO deps.
+
+import { createSessionMap } from "./session-map.mjs";
+
+const map = createSessionMap({ filename: "kiro-sessions.json", logPrefix: "kiro-session-map" });
+
+/** Absolute path to the Kiro session-id map, alongside ~/.chorus/daemon.json. */
+export function kiroSessionMapPath() {
+  return map.mapPath();
+}
+
+/**
+ * Look up the Kiro sessionId recorded for `anchor`, or null when there is none
+ * (no file, no entry, or a non-string entry). Never throws.
+ * @param {string} anchor
+ * @param {{ path?: string, read?: (p: string) => string, logger?: any }} [deps]
+ * @returns {string | null}
+ */
+export function getSessionId(anchor, deps = {}) {
+  return map.get(anchor, deps);
+}
+
+/**
+ * Record `anchor → sessionId`, preserving every other entry. Atomic (temp file +
+ * rename). Best-effort: a blank anchor/sessionId is ignored (no write), and any
+ * IO failure is logged and swallowed — it never throws into the wake path.
+ * @param {string} anchor
+ * @param {string} sessionId
+ * @param {{ path?: string, read?: (p: string) => string,
+ *           write?: (p: string, c: string, o?: object) => void,
+ *           mkdir?: (p: string, o?: object) => void,
+ *           rename?: (from: string, to: string) => void, logger?: any }} [deps]
+ * @returns {void}
+ */
+export function setSessionId(anchor, sessionId, deps = {}) {
+  map.set(anchor, sessionId, deps);
+}