@deepsql/mcp 0.22.0 → 0.26.0

package/src/agent/bootstrap.js

@@ -1,295 +0,0 @@
-"use strict";
-
-// Lazy bootstrap for the DeepSQL Agent (Hermes-based TUI): detect/install the
-// Hermes runtime and provision the `deepsql` profile (model → the backend LLM
-// proxy with the user's token; DeepSQL MCP tools; DBA persona/skills; subtle
-// DeepSQL skin; read-only sandbox). Provisioning is idempotent; the per-launch
-// config rewrite keeps the token/connection fresh.
-
-const fs = require("node:fs");
-const os = require("node:os");
-const path = require("node:path");
-const { spawnSync } = require("node:child_process");
-const { userHome } = require("../user-home");
-
-const HOME = userHome();
-const HERMES_HOME = path.join(HOME, ".hermes");
-const AGENT_DIR = path.join(HERMES_HOME, "hermes-agent");
-const PROFILE = "deepsql";
-const PROFILE_HOME = path.join(HERMES_HOME, "profiles", PROFILE);
-
-const INSTALL_URL = "https://hermes-agent.nousresearch.com/install.sh";
-// Pin the Hermes runtime to the exact commit our bundled TUI (agent-profile/
-// tui/entry.js, HERMES_VERSION 0.17.0) was built against. This makes installs
-// reproducible AND guarantees the branded-TUI overlay's version guard matches,
-// so end users get the DeepSQL wordmark/welcome — not a "latest main" build
-// that drifts in behavior and skips our overlay. Bump alongside the bundle.
-const HERMES_COMMIT = "92d40c2553961243991376bf889d833e8326caf7";
-
-// Extra dirs the Hermes runtime + its installer rely on but a bare GUI/login
-// shell PATH (as seen by a spawned Node process) often lacks: the venv, the
-// installer's `hermes` symlink targets, and Homebrew (uv/node/git).
-function extraPathDirs() {
-  return [
-    path.join(AGENT_DIR, ".venv", "bin"),
-    path.join(HOME, ".local", "bin"),
-    "/usr/local/bin",
-    "/opt/homebrew/bin",
-    "/usr/local/lib/hermes-agent/.venv/bin",
-  ];
-}
-
-// Env for any spawn that runs (or installs) Hermes: augmented PATH so node/uv/
-// git resolve, UV_NO_CONFIG so uv ignores stray project configs, and a pinned
-// HERMES_HOME so the install/profile lands where we expect.
-function hermesEnv(extra = {}) {
-  const sep = path.delimiter;
-  const have = (process.env.PATH || "").split(sep);
-  const merged = [...extraPathDirs().filter((d) => !have.includes(d)), ...have].join(sep);
-  return { ...process.env, PATH: merged, UV_NO_CONFIG: "1", HERMES_HOME, ...extra };
-}
-
-// All the places the official installer may drop a runnable `hermes` for a
-// non-root install (venv) or an FHS/root install (/usr/local), plus the PATH.
-function findHermes() {
-  const candidates = [];
-  if (process.env.HERMES_INSTALL_DIR) {
-    candidates.push(path.join(process.env.HERMES_INSTALL_DIR, ".venv", "bin", "hermes"));
-  }
-  candidates.push(
-    path.join(AGENT_DIR, ".venv", "bin", "hermes"),
-    "/usr/local/lib/hermes-agent/.venv/bin/hermes",
-    path.join(HOME, ".local", "bin", "hermes"),
-    "/usr/local/bin/hermes"
-  );
-  for (const bin of candidates) {
-    if (!fs.existsSync(bin)) continue;
-    if (spawnSync(bin, ["--version"], { stdio: "ignore", env: hermesEnv() }).status === 0) return bin;
-  }
-  // Last resort: a `hermes` already on the (augmented) PATH.
-  if (spawnSync("hermes", ["--version"], { stdio: "ignore", env: hermesEnv() }).status === 0) return "hermes";
-  return null;
-}
-
-function hermesBin() {
-  return findHermes() || path.join(AGENT_DIR, ".venv", "bin", "hermes");
-}
-
-function hermesInstalled() {
-  return findHermes() !== null;
-}
-
-function mcpServerPath() {
-  return path.resolve(__dirname, "..", "..", "deepsql-phase1-server.js");
-}
-
-// Profile distribution (SOUL.md + skills/ + skins/): the bundled copy shipped in
-// the package, else the repo `hermes/` dir during local development.
-function distSource() {
-  const bundled = path.resolve(__dirname, "..", "..", "agent-profile");
-  if (fs.existsSync(path.join(bundled, "distribution.yaml"))) return bundled;
-  const repoHermes = path.resolve(__dirname, "..", "..", "..", "hermes");
-  if (fs.existsSync(path.join(repoHermes, "distribution.yaml"))) return repoHermes;
-  return null;
-}
-
-// Install the Hermes runtime, pinned + non-interactive, with the output teed to
-// a log so a failure surfaces a real cause instead of a vague "can't set up".
-// `quiet` (postinstall) hides the live stream; interactive first-run shows it.
-function ensureHermes(io, { quiet = false } = {}) {
-  const err = (io && io.stderr) || process.stderr;
-  if (hermesInstalled()) return true;
-
-  err.write("DeepSQL Agent: installing the agent runtime (first run; ~1–2 min)…\n");
-  const logFile = path.join(os.tmpdir(), `deepsql-agent-install-${process.pid}.log`);
-  // --commit pins the checkout; --skip-setup/--non-interactive avoid the
-  // wizard + any TTY prompt. tee keeps a persisted log for diagnostics.
-  const script =
-    `curl -fsSL ${INSTALL_URL} | bash -s -- ` +
-    `--skip-setup --non-interactive --commit ${HERMES_COMMIT} 2>&1 | tee ${JSON.stringify(logFile)}`;
-  const r = spawnSync("bash", ["-lc", script], {
-    stdio: quiet ? ["ignore", "ignore", "ignore"] : "inherit",
-    env: hermesEnv(),
-  });
-
-  if (hermesInstalled()) {
-    err.write(quiet
-      ? "✓ DeepSQL Agent runtime installed.\n"
-      : "✓ DeepSQL Agent runtime installed. (Ignore any \"run hermes setup\" note above — DeepSQL configures it for you.)\n");
-    return true;
-  }
-  err.write(
-    "DeepSQL Agent: the runtime install did not complete.\n" +
-      `  Install log: ${logFile}\n` +
-      `  Exit code:   ${r.status == null ? "n/a" : r.status}\n` +
-      "  You can retry, or install Hermes manually: " +
-      `curl -fsSL ${INSTALL_URL} | bash -s -- --commit ${HERMES_COMMIT}\n`
-  );
-  return false;
-}
-
-function q(s) {
-  return `"${String(s).replace(/"/g, '\\"')}"`;
-}
-
-function writeRuntimeConfig(session) {
-  fs.mkdirSync(PROFILE_HOME, { recursive: true });
-  const base = session.baseUrl.replace(/\/?$/, "/"); // ensure single trailing /
-  const proxy = base + "api/llm/v1";
-  const apiBase = base + "api/";
-  const token = session.token;
-  const mcp = mcpServerPath();
-  const conn = session.defaultConnection || "";
-
-  const config =
-`model:
-  default: gpt-5.4
-  provider: custom
-  base_url: ${q(proxy)}
-  api_key: ${q(token)}
-  api_mode: chat_completions
-  context_length: 272000
-mcp_servers:
-  deepsql:
-    command: node
-    args:
-      - ${q(mcp)}
-    env:
-      DEEPSQL_API_BASE_URL: ${q(apiBase)}
-      DEEPSQL_MCP_USER_ID: deepsql-cli
-      DEEPSQL_AUTH_TOKEN: ${q(token)}
-approvals:
-  mode: smart
-display:
-  skin: deepsql
-  interface: tui
-`;
-  fs.writeFileSync(path.join(PROFILE_HOME, "config.yaml"), config);
-
-  // OPENAI_BASE_URL/OPENAI_API_KEY are belt-and-suspenders: Hermes' first-run
-  // guard (_has_any_provider_configured) treats either as "a provider is
-  // configured", so the "run hermes setup" gate can never fire on a fresh
-  // machine even if config-load timing differs. They point at the SAME backend
-  // proxy as the model block, authed by the user's DeepSQL token.
-  const env =
-`DEEPSQL_API_BASE_URL=${apiBase}
-DEEPSQL_AUTH_TOKEN=${token}
-DEEPSQL_MCP_SERVER=${mcp}
-DEEPSQL_DEFAULT_CONNECTION_ID=${conn}
-OPENAI_BASE_URL=${proxy}
-OPENAI_API_KEY=${token}
-HERMES_REVISION=deepsql-cli
-`;
-  fs.writeFileSync(path.join(PROFILE_HOME, ".env"), env, { mode: 0o600 });
-}
-
-// Env for spawning the TUI: augmented PATH (so the TUI's node + the MCP
-// server's node resolve), the provider vars that defeat Hermes' first-run
-// guard regardless of config state, and HERMES_TUI_DIR pointing at our prebuilt
-// branded TUI (when the Hermes version matches) so Hermes runs it directly with
-// no esbuild — branded on the first launch.
-function launchEnv(session) {
-  const base = session.baseUrl.replace(/\/?$/, "/");
-  const extra = {
-    OPENAI_BASE_URL: base + "api/llm/v1",
-    OPENAI_API_KEY: session.token,
-  };
-  const tui = brandedTuiDir();
-  if (tui) extra.HERMES_TUI_DIR = tui;
-  return hermesEnv(extra);
-}
-
-function installProfileAssets(io) {
-  const err = (io && io.stderr) || process.stderr;
-  const src = distSource();
-  if (!src) {
-    err.write("DeepSQL agent profile assets not found in this install.\n");
-    return false;
-  }
-  const bin = hermesBin();
-  const baseEnv = hermesEnv();
-  const inst = spawnSync(
-    bin,
-    ["profile", "install", src, "--name", PROFILE, "--force", "--yes"],
-    { encoding: "utf8", env: baseEnv }
-  );
-  if (inst.status !== 0) {
-    err.write(
-      "DeepSQL Agent: provisioning the profile failed.\n" +
-        `  ${(inst.stderr || inst.stdout || "(no output)").trim().split("\n").slice(-6).join("\n  ")}\n`
-    );
-    return false;
-  }
-  // Skin loads from <profile>/skins/.
-  const skin = path.join(src, "skins", "deepsql.yaml");
-  if (fs.existsSync(skin)) {
-    const dst = path.join(PROFILE_HOME, "skins");
-    fs.mkdirSync(dst, { recursive: true });
-    fs.copyFileSync(skin, path.join(dst, "deepsql.yaml"));
-  }
-  // Read-only sandbox: only deepsql + skills/memory remain. Non-fatal — the
-  // shipped distribution already scopes tools; this is defense in depth.
-  spawnSync(
-    bin,
-    ["tools", "disable", "terminal", "file", "code_execution", "browser", "computer_use",
-     "image_gen", "tts", "vision", "web", "delegation", "cronjob"],
-    { stdio: "ignore", env: hermesEnv({ HERMES_HOME: PROFILE_HOME }) }
-  );
-  return fs.existsSync(PROFILE_HOME);
-}
-
-function ensureProfile(session, io) {
-  if (!fs.existsSync(path.join(PROFILE_HOME, "config.yaml"))) {
-    if (!installProfileAssets(io)) return false;
-  }
-  writeRuntimeConfig(session); // always refresh the token/connection for this launch
-  return true;
-}
-
-// Installed Hermes version (parsed from the runtime's __init__.py). Null if the
-// runtime layout isn't what we expect (e.g. PATH-only install).
-function installedHermesVersion() {
-  try {
-    const init = path.join(AGENT_DIR, "hermes_cli", "__init__.py");
-    const m = fs.readFileSync(init, "utf8").match(/__version__\s*=\s*["']([^"']+)["']/);
-    return m ? m[1] : null;
-  } catch {
-    return null;
-  }
-}
-
-// The DeepSQL-branded prebuilt TUI bundle shipped in the package, as a directory
-// laid out the way Hermes' `HERMES_TUI_DIR` mechanism expects: `<dir>/dist/entry.js`.
-// When that env var points here, Hermes runs our entry.js DIRECTLY — no npm
-// install, no esbuild — so the custom DEEPSQL wordmark / welcome panel / DBA
-// placeholders show on the very FIRST launch. (The earlier copy-into-the-clone
-// approach lost every launch because Hermes "always esbuild"s the normal path.)
-//
-// Guarded by the Hermes version our bundle was built against: a prebuilt entry.js
-// speaks one release's TUI↔CLI protocol, so we only point at it on an exact
-// version match (the runtime is pinned to HERMES_COMMIT, so it matches on our
-// installs). On any mismatch / missing bundle we return null and let Hermes use
-// its own (stock) TUI, which still renders our skin (DeepSQL name + maroon).
-function brandedTuiDir() {
-  try {
-    const tuiDir = path.resolve(__dirname, "..", "..", "agent-profile", "tui");
-    if (!fs.existsSync(path.join(tuiDir, "dist", "entry.js"))) return null;
-    const builtFor = fs.readFileSync(path.join(tuiDir, "HERMES_VERSION"), "utf8").trim();
-    const installed = installedHermesVersion();
-    if (!builtFor || !installed || builtFor !== installed) return null;
-    return tuiDir;
-  } catch {
-    return null;
-  }
-}
-
-module.exports = {
-  ensureHermes,
-  ensureProfile,
-  brandedTuiDir,
-  hermesBin,
-  hermesInstalled,
-  launchEnv,
-  PROFILE,
-  PROFILE_HOME,
-};