@devmarketplacenpm/devmp 0.1.1-beta.5

package/lib/commands.js

@@ -0,0 +1,597 @@
+'use strict';
+
+const path = require('path');
+const readline = require('readline');
+const {
+  color,
+  banner,
+  section,
+  success,
+  warn,
+  fail,
+  line,
+  info: info_,
+} = require('./ui');
+const { collectStatus, renderStatusCard, renderDoctor } = require('./status');
+const {
+  loadSession,
+  saveSession,
+  clearSession,
+  sessionPath,
+} = require('./session');
+const {
+  startDeviceAuth,
+  pollDeviceAuth,
+  getTokenBalance,
+  refreshSession,
+  streamRun,
+} = require('./api');
+const { openBrowser } = require('./browser');
+const { readSnapshot, applyFile } = require('./workspace');
+const { isInteractive, confirmOverwrite } = require('./prompt');
+const { runOverWs } = require('./ws-run');
+const { runInteractiveShell } = require('./interactive');
+const {
+  blockedMessage: clientBlockedMessage,
+  updateNotice: clientUpdateNotice,
+} = require('./version');
+const { expandMentions } = require('./mentions');
+
+/**
+ * Read a piped prompt from stdin.
+ *
+ * Lets `devmp run` take its task from a file, a heredoc, or another program —
+ * `git diff | devmp run` — which is how a CLI gets used once it is trusted
+ * enough to appear in scripts. Returns null when stdin is a terminal, so
+ * interactive use is untouched.
+ */
+async function readPipedPrompt() {
+  if (process.stdin.isTTY) return null;
+  let text = '';
+  try {
+    process.stdin.setEncoding('utf8');
+    for await (const chunk of process.stdin) {
+      text += chunk;
+      // A prompt is a task description, not a payload. Stop well before an
+      // accidental `cat huge.log | devmp run` exhausts memory.
+      if (text.length > 100_000) break;
+    }
+  } catch {
+    return null;
+  }
+  const trimmed = text.trim();
+  return trimmed ? trimmed.slice(0, 100_000) : null;
+}
+
+/**
+ * Has the server explicitly rejected this saved session?
+ *
+ * Only a 401/403 counts. If the request fails for any other reason — the API is
+ * down, the machine is offline — we cannot tell, and discarding a login that
+ * still works would be a worse bug than the stale session this guards against.
+ */
+async function sessionRejected(config, saved) {
+  try {
+    await getTokenBalance(activeSession(config, saved));
+    return false;
+  } catch (error) {
+    return error?.status === 401 || error?.status === 403;
+  }
+}
+
+/**
+ * Ask the server what it expects of this client before doing any real work.
+ *
+ * A refusal is worth one cheap round-trip: the alternative is failing halfway
+ * through a build with a protocol error nobody can act on. The check never
+ * fails the command on its own — if the account endpoint is unreachable the
+ * run proceeds, and the real call reports the real problem.
+ */
+async function passesVersionCheck(session) {
+  try {
+    await getTokenBalance(session);
+  } catch {
+    /* not our error to report; let the actual work surface it */
+  }
+  const tooOld = clientBlockedMessage();
+  if (tooOld) {
+    fail(tooOld);
+    process.exitCode = 1;
+    return false;
+  }
+  return true;
+}
+
+/** A one-line nudge when a newer client exists. Silent when there isn't one. */
+function printUpdateNotice() {
+  const notice = clientUpdateNotice();
+  if (!notice) return;
+  console.log('');
+  info_(`  ${color.dim(notice)}`);
+}
+
+// Turn a raw error into a short, actionable message for the user.
+function friendlyError(error) {
+  const status = error && error.status;
+  const message = (error && error.message) || String(error);
+  if (status === 403) {
+    return "You're out of agent tokens for this month, or your account isn't provisioned. Ask an admin for a token grant.";
+  }
+  if (status === 401) {
+    return 'Your session has expired. Run `devmp login` again.';
+  }
+  if (/Could not reach the DevMarketplace API/i.test(message)) {
+    return `${message}\n  Tip: start the backend, or pass --local / --api-base-url.`;
+  }
+  return message;
+}
+
+// The URL a command should talk to: an explicit --local/--api-base-url wins,
+// otherwise stay on the backend the session was created against.
+function activeSession(config, session) {
+  const apiBaseUrl = config.apiExplicit
+    ? config.apiBaseUrl
+    : session.apiBaseUrl || config.apiBaseUrl;
+  return { ...session, apiBaseUrl };
+}
+
+// Signup is the same device flow with a different landing page: register
+// first, then fall through to the approval screen with the code intact.
+function browserAuthUrl(config, userCode, mode = 'login') {
+  if (mode === 'signup') {
+    const url = new URL(`${config.frontendBaseUrl}/register`);
+    url.searchParams.set('callbackUrl', `/cli-auth?code=${userCode}`);
+    url.searchParams.set('cli', '1');
+    return url.toString();
+  }
+  const url = new URL(`${config.frontendBaseUrl}/cli-auth`);
+  url.searchParams.set('code', userCode);
+  url.searchParams.set('cli', '1');
+  return url.toString();
+}
+
+function printBalance(balance) {
+  section('Agent tokens');
+  if (balance.provisioned) {
+    const used = Math.max(0, balance.monthlyLimit - balance.balance);
+    line('Monthly', balance.monthlyLimit.toLocaleString());
+    line('Used', used.toLocaleString());
+    line('Remaining', balance.balance.toLocaleString());
+  } else {
+    line('Status', 'not provisioned (ask an admin for a token grant)');
+  }
+}
+
+/**
+ * A yes/no question before the composer exists. Defaults to yes: it is only
+ * ever asked when the alternative is doing nothing at all.
+ */
+function confirm(question) {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({
+      input: process.stdin,
+      output: process.stdout,
+    });
+    rl.question(`${question} ${color.dim('[Y/n]')} `, (answer) => {
+      rl.close();
+      resolve(!/^n/i.test(answer.trim()));
+    });
+  });
+}
+
+async function login(config, mode = 'login') {
+  banner();
+  const existing = await loadSession();
+  if (existing) {
+    // A session file on disk is not the same thing as being signed in. An
+    // expired one used to send the user in a circle: `status` told them to run
+    // `login`, and `login` told them they were already logged in. Ask the
+    // server which it is, and sign them in again when it says the session died.
+    if (!(await sessionRejected(config, existing))) {
+      warn('Already logged in. Run `devmp logout` to switch accounts.');
+      if (existing.user && existing.user.email) line('Account', existing.user.email);
+      return;
+    }
+    warn('Your previous session expired — signing in again.');
+    await clearSession().catch(() => undefined);
+  }
+
+  section(mode === 'signup' ? 'Create account' : 'Login');
+  const start = await startDeviceAuth(config);
+  const url = browserAuthUrl(config, start.userCode, mode);
+  info_(`  ${color.dim('Code')}  ${color.bold(color.cyan(start.userCode))}`);
+  info_(`  ${color.dim('URL ')}  ${url}`);
+  info_('');
+  info_('Approve this code in your browser to connect the CLI.');
+  if (!openBrowser(url)) warn('Could not open the browser — open the URL above.');
+
+  const session = await pollDeviceAuth(config, start);
+  success('CLI connected.');
+  if (session.user && session.user.email) line('Account', session.user.email);
+  try {
+    printBalance(await getTokenBalance(session));
+  } catch {
+    /* balance is a nicety; never fail login on it */
+  }
+}
+
+async function status(config, { offerNext = true } = {}) {
+  const saved = await loadSession();
+  const session = saved ? activeSession(config, saved) : null;
+  const info = await collectStatus({ session, rootDir: process.cwd() });
+  if (!session) info.apiBaseUrl = config.apiBaseUrl;
+  for (const row of renderStatusCard(info, {
+    rootDir: process.cwd(),
+    env: config.env,
+  })) {
+    console.log(row);
+  }
+  if (!saved && offerNext) {
+    console.log('');
+    info_('Run `devmp login` to connect your account.');
+  }
+  // collectStatus has already called the account endpoint by now, so if a
+  // newer client exists this is the moment the user is most ready to hear it.
+  printUpdateNotice();
+}
+
+async function signup(config) {
+  return login(config, 'signup');
+}
+
+async function doctor(config) {
+  const saved = await loadSession();
+  const session = saved ? activeSession(config, saved) : null;
+  for (const row of await renderDoctor({
+    config,
+    session,
+    rootDir: process.cwd(),
+  })) {
+    console.log(row);
+  }
+}
+
+async function logout() {
+  try {
+    await clearSession();
+    success('Logged out.');
+  } catch (error) {
+    fail(
+      `Could not remove the saved session at ${sessionPath()} — ` +
+        `${error.message}. Your credentials are still on this machine.`,
+    );
+    process.exitCode = 1;
+  }
+}
+
+async function shell(config, options = {}) {
+  let saved = await loadSession();
+  if (!saved) {
+    // The signed-out screen is a state, not an error: show the same card the
+    // shell would, so the answer to "what now" is in the same place as always.
+    await status(config, { offerNext: false });
+
+    // Being told to run a second command to use the first one is a poor way to
+    // meet a tool. At a terminal we can just do it.
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+      process.exitCode = 1;
+      return;
+    }
+    console.log('');
+    if (!(await confirm('Log in now?'))) {
+      process.exitCode = 1;
+      return;
+    }
+    console.log('');
+    await login(config);
+    saved = await loadSession();
+    if (!saved) {
+      process.exitCode = 1;
+      return;
+    }
+    console.log('');
+  }
+  let session = activeSession(config, saved);
+  const shellOptions = {
+    config,
+    rootDir: path.resolve(options.cwd || process.cwd()),
+    provider: options.provider,
+    model: options.model,
+    maxFiles: options.maxFiles,
+    yes: options.yes === true,
+    allowCommands: options.allowCommands === true,
+  };
+  try {
+    await runInteractiveShell({ session, ...shellOptions });
+  } catch (error) {
+    if (!/invalid or expired session/i.test(error?.message || '')) throw error;
+    const refreshed = await refreshSession(session).catch(() => null);
+    if (!refreshed) throw error;
+    session = activeSession(config, refreshed);
+    await runInteractiveShell({ session, ...shellOptions });
+  }
+  // Held until the session ends: an update nudge during a working session is
+  // an interruption, and the shell already carries the version in /status.
+  printUpdateNotice();
+}
+
+// Shared "Done"/"Partial"/error footer for both run modes.
+function renderResult(doneEvent, sawError, written, skipped, rootDir, cancelled = false) {
+  console.log(color.dim('───────────────────────────────────────────────────'));
+  if (cancelled) {
+    warn('Run cancelled.');
+    return;
+  }
+  if (sawError) {
+    fail(sawError);
+    process.exitCode = 1;
+    return;
+  }
+  section(doneEvent && doneEvent.partial ? 'Partial build' : 'Done');
+  // A read-only task legitimately writes nothing; '0 written' reads like a
+  // failure for work that succeeded.
+  line(
+    'Files',
+    written
+      ? `${written} file${written === 1 ? '' : 's'} changed in ${rootDir}`
+      : 'none changed — this answer was read-only',
+  );
+  if (skipped) line('Skipped', `${skipped} existing file(s) left unchanged`);
+  if (doneEvent) {
+    if (doneEvent.summary) {
+      console.log('');
+      console.log(doneEvent.summary);
+    }
+    if (doneEvent.commands && doneEvent.commands.length) {
+      section('Run it');
+      for (const cmd of doneEvent.commands) console.log(`  ${color.cyan('$')} ${cmd}`);
+    }
+    const used = doneEvent.usage
+      ? doneEvent.usage.inputTokens + doneEvent.usage.outputTokens
+      : 0;
+    if (used) line('Tokens', used.toLocaleString());
+  }
+  printUpdateNotice();
+}
+
+async function run(config, options) {
+  banner();
+  const saved = await loadSession();
+  if (!saved) {
+    warn('You need to log in first. Run `devmp login`.');
+    process.exitCode = 1;
+    return;
+  }
+  const session = activeSession(config, saved);
+
+  // An explicit argument wins; otherwise take whatever was piped in.
+  const prompt = options.prompt || (await readPipedPrompt());
+  if (!prompt) {
+    warn('Nothing to build. Usage: devmp run "add a health check route".');
+    info_('  A prompt can also be piped in: echo "…" | devmp run');
+    process.exitCode = 1;
+    return;
+  }
+
+  if (!(await passesVersionCheck(session))) return;
+
+  const rootDir = path.resolve(options.cwd || process.cwd());
+
+  // `@path` in the prompt pulls that file into the turn up front, instead of
+  // waiting for the agent to decide it needs it.
+  const mentioned = await expandMentions(rootDir, prompt);
+
+  section('Run');
+  line('Workspace', rootDir);
+  line('Prompt', prompt.length > 70 ? `${prompt.slice(0, 70)}…` : prompt);
+  if (mentioned.attached.length) {
+    line(
+      'Attached',
+      mentioned.attached
+        .map((f) => (f.truncated ? `${f.path} (truncated)` : f.path))
+        .join(', '),
+    );
+  }
+  line('Mode', options.snapshot ? 'snapshot (HTTP)' : 'live tunnel (WebSocket)');
+  if (!options.snapshot) {
+    line(
+      'Commands',
+      options.allowCommands
+        ? 'auto-approved (--allow-commands)'
+        : 'ask before each (agent may run npm/tests)',
+    );
+  }
+
+  if (options.snapshot) {
+    await runSnapshot(session, rootDir, mentioned.prompt, options);
+  } else {
+    await runLive(session, rootDir, mentioned.prompt, options);
+  }
+}
+
+// Live tunnel: the server drives; the client answers on-demand file ops and
+// writes to local disk. No snapshot upload — the agent lists/reads what it needs.
+async function runLive(session, rootDir, prompt, options) {
+  line('Context', 'live — the agent reads your files on demand');
+  console.log('');
+  console.log(color.dim('── agent ──────────────────────────────────────────'));
+
+  // Distinct paths, not write operations. A rename across five files takes
+  // eleven edits, and reporting "11 written" in a five-file project reads as
+  // though something ran away.
+  const writtenPaths = new Set();
+  let skipped = 0;
+  let sawError = null;
+  let cancelled = false;
+  let doneEvent = null;
+  let atLineStart = true;
+  const nl = () => {
+    if (!atLineStart) {
+      process.stdout.write('\n');
+      atLineStart = true;
+    }
+  };
+
+  try {
+    await runOverWs({
+      session,
+      rootDir,
+      prompt,
+      provider: options.provider,
+      model: options.model,
+      maxFiles: options.maxFiles,
+      yes: options.yes,
+      allowCommands: options.allowCommands,
+      onEvent: (event) => {
+        if (event.type === 'instructions') {
+          // Worth one line: the agent is about to follow rules the user wrote
+          // down somewhere else, and silence here looks like they were ignored.
+          line(
+            'Instructions',
+            event.truncated
+              ? `${event.source} (first 8 KB)`
+              : event.source,
+          );
+          return;
+        }
+        if (event.type === 'text') {
+          process.stdout.write(color.dim(event.delta));
+          atLineStart = event.delta.endsWith('\n');
+        } else if (event.type === 'file-local') {
+          nl();
+          if (event.outcome === 'skipped') {
+            skipped += 1;
+            console.log(`  ${color.dim('skipped')}  ${event.path}`);
+          } else {
+            // One line per file, not per edit. A rename touches some files
+            // three times, and three identical "updated" lines in a row read as
+            // a stutter rather than as progress.
+            const firstTouch = !writtenPaths.has(event.path);
+            writtenPaths.add(event.path);
+            if (firstTouch) {
+              const tag =
+                event.outcome === 'created'
+                  ? color.green('created')
+                  : color.yellow('updated');
+              console.log(`  ${tag}  ${event.path}`);
+            }
+          }
+        } else if (event.type === 'done') {
+          doneEvent = event;
+        } else if (event.type === 'error') {
+          sawError = event.message;
+        } else if (event.type === 'cancelled') {
+          cancelled = true;
+        }
+      },
+    });
+  } catch (error) {
+    nl();
+    fail(friendlyError(error));
+    process.exitCode = 1;
+    return;
+  }
+
+  nl();
+  renderResult(doneEvent, sawError, writtenPaths.size, skipped, rootDir, cancelled);
+}
+
+// Snapshot mode (HTTP fallback, `--snapshot`): upload the folder, stream writes.
+async function runSnapshot(session, rootDir, prompt, options) {
+  // Snapshot the current files so the agent can read/extend them (empty ⇒ new).
+  const { files, truncated, ignoredCount, oversizedCount } =
+    await readSnapshot(rootDir);
+  line('Context', files.length ? `${files.length} local file(s)` : 'empty folder (greenfield)');
+  if (ignoredCount) line('Ignored', `${ignoredCount} path(s) via .gitignore`);
+  if (truncated) warn('Workspace is large — only the first slice of files was sent as context.');
+  if (oversizedCount) {
+    warn(
+      `${oversizedCount} file(s) over 100 KB were left out of the context — ` +
+        'the agent cannot see them in snapshot mode.',
+    );
+  }
+
+  // Files that already existed before this run — overwriting one needs consent
+  // (unless --yes). Files the agent creates fresh this run are written silently.
+  const preExisting = new Set(files.map((f) => f.path));
+  const decided = new Set();
+  let overwriteAll = options.yes === true;
+  const nonInteractive = !isInteractive();
+
+  const body = { prompt, files };
+  if (options.provider) body.provider = options.provider;
+  if (options.model) body.model = options.model;
+  if (options.maxFiles) body.maxFiles = options.maxFiles;
+
+  console.log('');
+  console.log(color.dim('── agent ──────────────────────────────────────────'));
+
+  const written = [];
+  const skipped = [];
+  let sawError = null;
+  let cancelled = false;
+  let doneEvent = null;
+  let atLineStart = true;
+
+  try {
+    for await (const event of streamRun(session, body)) {
+      if (event.type === 'text') {
+        process.stdout.write(color.dim(event.delta));
+        atLineStart = event.delta.endsWith('\n');
+      } else if (event.type === 'file') {
+        if (!atLineStart) process.stdout.write('\n');
+        atLineStart = true;
+
+        // Consent before clobbering a file the user already had.
+        const isUserFile =
+          preExisting.has(event.path) && !decided.has(event.path);
+        if (isUserFile && !overwriteAll) {
+          decided.add(event.path);
+          if (nonInteractive) {
+            skipped.push(event.path);
+            warn(`skipped ${event.path} (exists; re-run with --yes to overwrite)`);
+            continue;
+          }
+          const choice = await confirmOverwrite(event.path);
+          if (choice === 'no') {
+            skipped.push(event.path);
+            console.log(`  ${color.dim('skipped')}  ${event.path}`);
+            continue;
+          }
+          if (choice === 'all') overwriteAll = true;
+        }
+
+        const outcome = await applyFile(rootDir, event.path, event.content);
+        if (outcome === null) {
+          warn(`refused ${event.path} (outside workspace)`);
+        } else {
+          written.push({ path: event.path, outcome });
+          const tag = outcome === 'created' ? color.green('created') : color.yellow('updated');
+          console.log(`  ${tag}  ${event.path}`);
+        }
+      } else if (event.type === 'done') {
+        doneEvent = event;
+      } else if (event.type === 'error') {
+        sawError = event.message;
+      } else if (event.type === 'cancelled') {
+        cancelled = true;
+      }
+    }
+  } catch (error) {
+    fail(friendlyError(error));
+    process.exitCode = 1;
+    return;
+  }
+
+  if (!atLineStart) process.stdout.write('\n');
+  renderResult(
+    doneEvent,
+    sawError,
+    written.length,
+    skipped.length,
+    rootDir,
+    cancelled,
+  );
+}
+
+module.exports = { login, signup, status, doctor, logout, run, shell };