@dylanpiercey/work 0.0.221 → 0.0.223

package/README.md

@@ -32,7 +32,7 @@ re-run the installer).
 
 ## Develop
 
-Requires Linux or macOS with `git`, `tmux`, `gh` (authenticated), and Node 22+.
+Requires Linux or macOS with `git`, `tmux`, `gh` (authenticated), and Node 24+.
 The bootstrap script installs everything via [mise](https://mise.jdx.dev),
 offers the agent CLIs, and runs `pnpm install`:
 
@@ -94,8 +94,9 @@ the whole hostname to it.
 `http://<host>:<port>`, which only works where the machine is reachable
 directly. Through a tunnel, route a wildcard hostname to the app port as
 well and work proxies it — HTTP and websockets, so HMR works — to
-`localhost:<port>`. Two hostname shapes are accepted; `WORK_PORT_HOSTS`
-picks which one the chips link to:
+`localhost:<port>`. `WORK_PORT_HOSTS` picks the hostname shape the chips
+link to; `sub` is always accepted, `dash` only when picked, and only for a
+name of three labels or more:
 
 - `sub` (default): `https://3000.work.example.com`. Needs a wildcard
   `*.work.example.com` route and a certificate that covers it (your own
@@ -133,7 +134,9 @@ commits, uncommitted or untracked
 files, ignored files that are not build junk — and waits for a decision.
 
 **Restore** (Settings → Backup, or `work restore <file> --yes`) installs
-what the file names that the machine lacks and re-creates the workspaces
+what the file names that the machine lacks — a tool outside work's catalog
+or a new GitHub host only when ticked (or named with `--allow`), since it
+installs and runs whatever the file says — and re-creates the workspaces
 as rows; each one's repos then clone in the background, one workspace at
 a time, on the branch the manifest recorded (from origin, or fresh from
 the base when it was never pushed). Archived workspaces clone when they

package/bin/work.mjs

@@ -12,7 +12,9 @@
 //   work procs [id|name]      a workspace's running processes and ports
 //   work review [id|name]     pending review comments as markdown (--json for rows)
 //   work export [file]        write a backup manifest (workspaces, settings, skills, tool pins)
-//   work restore <file>       bring a manifest's workspaces and machine setup back (--yes to run)
+//   work restore <file>       bring a manifest's workspaces and machine setup back (--yes to run;
+//                             --allow <spec|host>, repeated, for each tool outside work's catalog
+//                             or new GitHub host it names — skipped otherwise)
 //   work share [id|name]      print a workspace's invite (paste into New → Join / work join)
 //   work join [file]          join a workspace from an invite (file, or stdin)
 //   work version  print the installed version
@@ -25,7 +27,6 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { createRequire } from "node:module";
 import { doctor, formatDoctor, setupPath } from "../lib/setup/doctor.mjs";
 import { installTool } from "../lib/setup/install.mjs";
 import { dialHost, listenStream } from "../lib/setup/listen.mjs";
@@ -58,7 +59,7 @@ const yes = args.includes("--yes") || args.includes("-y");
 const jsonOut = args.includes("--json");
 /** `--name <value>` style flags take the next arg; keep it out of the
  * positionals so `work join --name x` still reads stdin. */
-const VALUED = new Set(["--name"]);
+const VALUED = new Set(["--name", "--allow"]);
 const positional = args.filter(
   (a, i) => a === "-" || (!a.startsWith("-") && !VALUED.has(args[i - 1])),
 );
@@ -69,6 +70,14 @@ const flagValue = (flag) => {
     die(`${flag} needs a value`);
   return args[i + 1];
 };
+/** Every value of a flag given more than once (`--allow a --allow b`). */
+const flagValues = (flag) =>
+  args.flatMap((a, i) => {
+    if (a !== flag) return [];
+    if (i + 1 >= args.length || args[i + 1].startsWith("-"))
+      die(`${flag} needs a value`);
+    return [args[i + 1]];
+  });
 
 switch (command) {
   case "start":
@@ -473,7 +482,7 @@ async function exportCmd() {
 }
 
 function readManifest(file) {
-  if (!file) die("usage: work restore <file> [--yes]");
+  if (!file) die("usage: work restore <file> [--yes] [--allow <spec|host>]...");
   let manifest;
   try {
     manifest = JSON.parse(fs.readFileSync(file, "utf8"));
@@ -483,35 +492,76 @@ function readManifest(file) {
   return manifest;
 }
 
+/** A word as a shell reads it back: specs come from the file, so one
+ * printed in a command to copy is quoted, never pasted as shell. */
+function shellWord(s) {
+  return /^[\w@%+=:,./-]+$/.test(s) ? s : `'${s.replaceAll("'", `'\\''`)}'`;
+}
+
 /** Preview, then (with --yes) restore everything the file names that this
- * machine does not have. Workspaces already here are skipped. */
+ * machine does not have. Workspaces already here are skipped. A tool
+ * outside work's catalog installs and runs whatever it names, and a new
+ * GitHub host is one work signs in to and clones from, so each is taken
+ * only when `--allow` names it exactly as listed. */
 async function restoreCmd() {
   const manifest = readManifest(positional[0]);
   const preview = await apiPost("/api/backup/preview", manifest);
   if (jsonOut && !yes) return console.log(JSON.stringify(preview, null, 2));
   const pick = (list) => list.filter((x) => !x.installed);
   const say = jsonOut ? () => {} : console.log;
+  const allow = new Set(flagValues("--allow"));
+  const extraTools = pick(preview.tools)
+    .filter((t) => !t.catalog)
+    .map((t) => t.spec);
+  const newHosts = preview.hosts.filter((h) => !h.known).map((h) => h.host);
+  for (const a of allow) {
+    if (!extraTools.includes(a) && !newHosts.includes(a))
+      warn(`--allow ${a} names nothing this file would add`);
+  }
   say(`from ${preview.from.host} on ${preview.from.exportedAt.slice(0, 10)}`);
   const workspaces = preview.workspaces.filter(
-    (w) => !w.exists && !w.unknownHost,
+    (w) => !w.exists && (!w.unknownHost || allow.has(w.unknownHost)),
   );
   for (const w of preview.workspaces) {
     const note = w.exists
       ? "already here"
-      : w.unknownHost
+      : w.unknownHost && !allow.has(w.unknownHost)
         ? `unknown host ${w.unknownHost}`
         : w.status;
     say(`  ${pad(w.name, 24)} ${pad(note, 14)} ${w.repos.join(", ")}`);
   }
-  const tools = pick(preview.tools).map((t) => t.name);
+  const tools = pick(preview.tools)
+    .filter((t) => t.catalog)
+    .map((t) => t.name);
   const skills = pick(preview.skills).map((s) => s.id);
   const agents = pick(preview.agents).map((a) => a.label);
-  const hosts = preview.hosts.filter((h) => !h.known).map((h) => h.host);
   if (tools.length) say(`  tools to install:  ${tools.join(", ")}`);
   if (skills.length) say(`  skills to add:     ${skills.join(", ")}`);
   if (agents.length) say(`  agents to install: ${agents.join(", ")}`);
-  if (hosts.length) say(`  hosts to add:      ${hosts.join(", ")}`);
   if (preview.settings) say(`  settings:          ${preview.settings}`);
+  const extras = [
+    ...extraTools.map((name) => ({ kind: "tool", name })),
+    ...newHosts.map((name) => ({ kind: "host", name })),
+  ];
+  if (extras.length) {
+    say(
+      "  not in work's catalog — a tool installs and runs whatever it names,",
+    );
+    say(
+      "  a host is one work signs in to and clones from; each only with --allow:",
+    );
+    for (const x of extras)
+      say(
+        `    ${pad(x.kind, 5)} ${x.name}${allow.has(x.name) ? "  (allowed)" : ""}`,
+      );
+    const missing = extras.filter((x) => !allow.has(x.name));
+    if (missing.length) {
+      say("  to take them too, if you trust this file:");
+      say(
+        `    work restore ${shellWord(positional[0])} --yes ${missing.map((x) => `--allow ${shellWord(x.name)}`).join(" ")}`,
+      );
+    }
+  }
   if (!yes) {
     say("");
     log("re-run with --yes to restore");
@@ -522,6 +572,8 @@ async function restoreCmd() {
     selection: {
       workspaces: workspaces.map((w) => w.id),
       tools: true,
+      extraTools: extraTools.filter((s) => allow.has(s)),
+      hosts: newHosts.filter((h) => allow.has(h)),
       skills: true,
       agents: true,
       settings: true,
@@ -962,9 +1014,9 @@ function serviceEnv() {
 
 /** True when `cmd` is a work *server* (not `work setup` / `work update`).
  * Must not match the tmux that hosts agent sessions: `tmux -L work
- * start-server` used to hit `\bwork\s+start\b` because `\b` fires on the
- * `t`/`-` boundary in `start-server`, so `work update` killed tmux mid-
- * setup and never reached `systemctl restart`. */
+ * start-server` hits `\bwork\s+start\b` because `\b` fires on the
+ * `t`/`-` boundary in `start-server`, and `work update` would kill tmux
+ * mid-setup and never reach `systemctl restart`. */
 function isWorkServerCmd(cmd) {
   if (/\btmux\b/.test(cmd)) return false;
   if (/\bwork(\.mjs)?\s+(setup|update|version)\b/.test(cmd)) return false;
@@ -1125,10 +1177,11 @@ function stopOldCopies(port) {
 }
 
 /** Wait for the service to answer before we tell anyone it is up. Both
- * service managers return as soon as the job is spawned, so `done — http://…`
- * used to print at a port that answers a second or two later — which reads as
- * an update that broke the app. Any HTTP reply proves the server is serving;
- * the status the route returns is not this function's business. */
+ * service managers return as soon as the job is spawned, so without this
+ * `done — http://…` would print at a port that answers a second or two
+ * later — which reads as an update that broke the app. Any HTTP reply
+ * proves the server is serving; the status the route returns is not this
+ * function's business. */
 async function waitForServer(timeoutMs = 30_000) {
   const deadline = Date.now() + timeoutMs;
   for (;;) {