@dylanpiercey/work 0.0.222 → 0.1.0

package/README.md

@@ -32,7 +32,7 @@ re-run the installer).
 
 ## Develop
 
-Requires Linux or macOS with `git`, `tmux`, `gh` (authenticated), and Node 22+.
+Requires Linux or macOS with `git`, `tmux`, `gh` (authenticated), and Node 24+.
 The bootstrap script installs everything via [mise](https://mise.jdx.dev),
 offers the agent CLIs, and runs `pnpm install`:
 
@@ -44,12 +44,6 @@ offers the agent CLIs, and runs `pnpm install`:
 
 ```sh
 pnpm dev                  # http://localhost:7171
-```
-
-For a production build plus a background service (systemd on Linux, launchd on macOS):
-
-```sh
-./scripts/setup-prod.sh   # build + install + start the service
 
 # While hacking on work itself, point the background service at a checkout
 # (and back at the npm install when done):
@@ -58,8 +52,6 @@ work-source local          # this tree (or: work-source local /path/to/work)
 work-source rebuild        # rebuild + restart without rewriting the unit
 work-source prod           # global @dylanpiercey/work again
 work-source                # status
-./scripts/run-prod.sh     # or: build with --no-service and run manually
-./scripts/update.sh       # later: pull latest, rebuild, restart
 ```
 
 ### Access
@@ -85,17 +77,16 @@ Access, `tailscale serve` — and tell work about it:
 Set them when installing (`WORK_ALLOWED_HOSTS=… WORK_TRUSTED_PROXIES=…
 WORK_LISTEN=0.0.0.0 work setup`); `work setup` keeps them in the service
 from then on. A refused request gets a page saying which setting it needs.
-Installs from before this default keep listening on every interface, and
-other machines see that page until they are configured. Everything (pages,
-API, and the `/term` websockets) serves from the single app port, so route
-the whole hostname to it.
+Everything (pages, API, and the `/term` websockets) serves from the single
+app port, so route the whole hostname to it.
 
 **Opening workspace ports remotely.** The port chips in the sidebar link to
 `http://<host>:<port>`, which only works where the machine is reachable
 directly. Through a tunnel, route a wildcard hostname to the app port as
 well and work proxies it — HTTP and websockets, so HMR works — to
-`localhost:<port>`. Two hostname shapes are accepted; `WORK_PORT_HOSTS`
-picks which one the chips link to:
+`localhost:<port>`. `WORK_PORT_HOSTS` picks the hostname shape the chips
+link to; `sub` is always accepted, `dash` only when picked, and only for a
+name of three labels or more:
 
 - `sub` (default): `https://3000.work.example.com`. Needs a wildcard
   `*.work.example.com` route and a certificate that covers it (your own
@@ -113,11 +104,6 @@ auth as the app. API writes and the terminal websockets refuse a foreign
 `Origin`, so a page a workspace serves cannot drive work with the shared
 login cookie.
 
-> **Upgrading from the two-port layout:** older setups routed `/term/*` to a
-> separate terminal port (7172). That port no longer exists — remove the
-> `/term` rule from your tunnel/proxy config and send all traffic to the app
-> port, or terminals will fail to connect.
-
 ## Backup, restore, join
 
 A `work` machine holds almost nothing that lives only there: branches are
@@ -133,7 +119,9 @@ commits, uncommitted or untracked
 files, ignored files that are not build junk — and waits for a decision.
 
 **Restore** (Settings → Backup, or `work restore <file> --yes`) installs
-what the file names that the machine lacks and re-creates the workspaces
+what the file names that the machine lacks — a tool outside work's catalog
+or a new GitHub host only when ticked (or named with `--allow`), since it
+installs and runs whatever the file says — and re-creates the workspaces
 as rows; each one's repos then clone in the background, one workspace at
 a time, on the branch the manifest recorded (from origin, or fresh from
 the base when it was never pushed). Archived workspaces clone when they
@@ -160,16 +148,6 @@ targeting that branch.
 | `WORK_USER` / `WORK_HOST` | current user/host     | Branch-name prefix parts                             |
 | `WORK_BRANCH_PREFIX`      | `<user>-<host>`       | Whole branch-name prefix, overriding the parts       |
 
-Ports and paths can be exported before `scripts/setup-prod.sh` to bake them into
-the service. For settings that should outlive an update, put them in an untracked
-`.env.local` at the repo root instead — `scripts/run-prod.sh` reads it on every
-start (the dev server does not), only `WORK_*` names apply, and the
-surrounding environment still takes precedence:
-
-```sh
-WORK_BRANCH_PREFIX=rturnq
-```
-
 The usage panel (and `work usage`) reads plan/quota windows straight from each
 agent CLI's own credentials on disk — Claude, Codex, Cursor, Grok, and Copilot
 (via `gh`'s token). Providers you are not signed into simply say so.

package/bin/work.mjs

@@ -12,7 +12,9 @@
 //   work procs [id|name]      a workspace's running processes and ports
 //   work review [id|name]     pending review comments as markdown (--json for rows)
 //   work export [file]        write a backup manifest (workspaces, settings, skills, tool pins)
-//   work restore <file>       bring a manifest's workspaces and machine setup back (--yes to run)
+//   work restore <file>       bring a manifest's workspaces and machine setup back (--yes to run;
+//                             --allow <spec|host>, repeated, for each tool outside work's catalog
+//                             or new GitHub host it names — skipped otherwise)
 //   work share [id|name]      print a workspace's invite (paste into New → Join / work join)
 //   work join [file]          join a workspace from an invite (file, or stdin)
 //   work version  print the installed version
@@ -25,9 +27,9 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { createRequire } from "node:module";
 import { doctor, formatDoctor, setupPath } from "../lib/setup/doctor.mjs";
-import { installTool } from "../lib/setup/install.mjs";
+import { installTool, repairGhHelpers } from "../lib/setup/install.mjs";
+import { bridgeCommands, bridgeIfNeeded } from "../lib/setup/bridge.mjs";
 import { dialHost, listenStream } from "../lib/setup/listen.mjs";
 import { commentMarkdown } from "../lib/review/markdown.mjs";
 import { formatInvite, parseInvite } from "../lib/share/manifest.mjs";
@@ -58,7 +60,7 @@ const yes = args.includes("--yes") || args.includes("-y");
 const jsonOut = args.includes("--json");
 /** `--name <value>` style flags take the next arg; keep it out of the
  * positionals so `work join --name x` still reads stdin. */
-const VALUED = new Set(["--name"]);
+const VALUED = new Set(["--name", "--allow"]);
 const positional = args.filter(
   (a, i) => a === "-" || (!a.startsWith("-") && !VALUED.has(args[i - 1])),
 );
@@ -69,6 +71,14 @@ const flagValue = (flag) => {
     die(`${flag} needs a value`);
   return args[i + 1];
 };
+/** Every value of a flag given more than once (`--allow a --allow b`). */
+const flagValues = (flag) =>
+  args.flatMap((a, i) => {
+    if (a !== flag) return [];
+    if (i + 1 >= args.length || args[i + 1].startsWith("-"))
+      die(`${flag} needs a value`);
+    return [args[i + 1]];
+  });
 
 switch (command) {
   case "start":
@@ -78,9 +88,12 @@ switch (command) {
     await setup();
     break;
   case "install-service":
-    // Service installation only — no doctor/fix, no migrate. Used by
-    // scripts/setup-prod.sh so npm and source installs share one
-    // definition; WORK_SERVICE_EXEC points it at a checkout's run-prod.sh.
+    // Service installation only — no doctor/fix. Used by
+    // scripts/work-source.sh so a checkout and the npm package share one
+    // definition; WORK_SERVICE_EXEC points it at the checkout's
+    // run-local.sh. The database is brought to the baseline first all the
+    // same: a server this checkout builds cannot open one from before it.
+    await bridge();
     if (!installService()) {
       process.exitCode = 1;
     } else if (await waitForServer()) {
@@ -92,12 +105,6 @@ switch (command) {
       process.exitCode = 1;
     }
     break;
-  case "migrate":
-    // The one-shot cleanups alone, against the service's settings (and the
-    // checkout's .env.local when WORK_SERVICE_EXEC names one). Used by
-    // scripts/update.sh ahead of setup-prod.sh.
-    process.exitCode = migrate();
-    break;
   case "doctor":
     await doctorCmd();
     break;
@@ -142,7 +149,7 @@ switch (command) {
     break;
   default:
     console.log(
-      `work ${pkg.version}\n\nusage: work <setup|install-service|migrate|doctor|start|update|usage|workspaces|workspace|repos|procs|review|export|restore|share|join|version> [--json]`,
+      `work ${pkg.version}\n\nusage: work <setup|install-service|doctor|start|update|usage|workspaces|workspace|repos|procs|review|export|restore|share|join|version> [--json]`,
     );
 }
 
@@ -473,7 +480,7 @@ async function exportCmd() {
 }
 
 function readManifest(file) {
-  if (!file) die("usage: work restore <file> [--yes]");
+  if (!file) die("usage: work restore <file> [--yes] [--allow <spec|host>]...");
   let manifest;
   try {
     manifest = JSON.parse(fs.readFileSync(file, "utf8"));
@@ -483,35 +490,76 @@ function readManifest(file) {
   return manifest;
 }
 
+/** A word as a shell reads it back: specs come from the file, so one
+ * printed in a command to copy is quoted, never pasted as shell. */
+function shellWord(s) {
+  return /^[\w@%+=:,./-]+$/.test(s) ? s : `'${s.replaceAll("'", `'\\''`)}'`;
+}
+
 /** Preview, then (with --yes) restore everything the file names that this
- * machine does not have. Workspaces already here are skipped. */
+ * machine does not have. Workspaces already here are skipped. A tool
+ * outside work's catalog installs and runs whatever it names, and a new
+ * GitHub host is one work signs in to and clones from, so each is taken
+ * only when `--allow` names it exactly as listed. */
 async function restoreCmd() {
   const manifest = readManifest(positional[0]);
   const preview = await apiPost("/api/backup/preview", manifest);
   if (jsonOut && !yes) return console.log(JSON.stringify(preview, null, 2));
   const pick = (list) => list.filter((x) => !x.installed);
   const say = jsonOut ? () => {} : console.log;
+  const allow = new Set(flagValues("--allow"));
+  const extraTools = pick(preview.tools)
+    .filter((t) => !t.catalog)
+    .map((t) => t.spec);
+  const newHosts = preview.hosts.filter((h) => !h.known).map((h) => h.host);
+  for (const a of allow) {
+    if (!extraTools.includes(a) && !newHosts.includes(a))
+      warn(`--allow ${a} names nothing this file would add`);
+  }
   say(`from ${preview.from.host} on ${preview.from.exportedAt.slice(0, 10)}`);
   const workspaces = preview.workspaces.filter(
-    (w) => !w.exists && !w.unknownHost,
+    (w) => !w.exists && (!w.unknownHost || allow.has(w.unknownHost)),
   );
   for (const w of preview.workspaces) {
     const note = w.exists
       ? "already here"
-      : w.unknownHost
+      : w.unknownHost && !allow.has(w.unknownHost)
         ? `unknown host ${w.unknownHost}`
         : w.status;
     say(`  ${pad(w.name, 24)} ${pad(note, 14)} ${w.repos.join(", ")}`);
   }
-  const tools = pick(preview.tools).map((t) => t.name);
+  const tools = pick(preview.tools)
+    .filter((t) => t.catalog)
+    .map((t) => t.name);
   const skills = pick(preview.skills).map((s) => s.id);
   const agents = pick(preview.agents).map((a) => a.label);
-  const hosts = preview.hosts.filter((h) => !h.known).map((h) => h.host);
   if (tools.length) say(`  tools to install:  ${tools.join(", ")}`);
   if (skills.length) say(`  skills to add:     ${skills.join(", ")}`);
   if (agents.length) say(`  agents to install: ${agents.join(", ")}`);
-  if (hosts.length) say(`  hosts to add:      ${hosts.join(", ")}`);
   if (preview.settings) say(`  settings:          ${preview.settings}`);
+  const extras = [
+    ...extraTools.map((name) => ({ kind: "tool", name })),
+    ...newHosts.map((name) => ({ kind: "host", name })),
+  ];
+  if (extras.length) {
+    say(
+      "  not in work's catalog — a tool installs and runs whatever it names,",
+    );
+    say(
+      "  a host is one work signs in to and clones from; each only with --allow:",
+    );
+    for (const x of extras)
+      say(
+        `    ${pad(x.kind, 5)} ${x.name}${allow.has(x.name) ? "  (allowed)" : ""}`,
+      );
+    const missing = extras.filter((x) => !allow.has(x.name));
+    if (missing.length) {
+      say("  to take them too, if you trust this file:");
+      say(
+        `    work restore ${shellWord(positional[0])} --yes ${missing.map((x) => `--allow ${shellWord(x.name)}`).join(" ")}`,
+      );
+    }
+  }
   if (!yes) {
     say("");
     log("re-run with --yes to restore");
@@ -522,6 +570,8 @@ async function restoreCmd() {
     selection: {
       workspaces: workspaces.map((w) => w.id),
       tools: true,
+      extraTools: extraTools.filter((s) => allow.has(s)),
+      hosts: newHosts.filter((h) => allow.has(h)),
       skills: true,
       agents: true,
       settings: true,
@@ -587,10 +637,9 @@ function until(iso) {
 }
 
 async function setup() {
+  await bridge();
   await fix(await doctor());
 
-  migrate();
-
   const running = installService();
   const port = serviceEnv().PORT;
   maybeTunnel(port);
@@ -617,19 +666,24 @@ async function setup() {
   }
 }
 
-/** One-shot cleanups between versions (scripts/migrate.mjs), run against
- * the settings the service actually uses: migrate.mjs exits quietly when it
- * finds no db, so an ambient environment missing WORK_DATA_DIR skips every
- * sweep. A checkout's .env.local sits under both, as it does when its run
- * script starts the server. Returns the exit status. */
-function migrate() {
-  const script = path.join(pkgRoot, "scripts", "migrate.mjs");
-  if (!fs.existsSync(script)) return 0;
-  return (
-    spawnSync(process.execPath, [script], {
-      stdio: "inherit",
-      env: { ...checkoutEnvLocal(), ...process.env, ...serviceEnv() },
-    }).status ?? 1
+/** Bring a database from before 0.1 to the baseline this release starts
+ * from (lib/setup/bridge.mjs), before anything touches the service: the
+ * server it would restart refuses such a database. Run with the settings
+ * the service uses (a checkout's .env.local under them, as its run script
+ * has it), so it finds the data dir the server opens rather than whatever
+ * this shell has. On failure the service is left as it was, and what to
+ * run by hand ends the output. */
+async function bridge() {
+  const env = { ...checkoutEnvLocal(), ...process.env, ...serviceEnv() };
+  const dataDir =
+    env.WORK_DATA_DIR ||
+    path.join(
+      env.XDG_DATA_HOME || path.join(os.homedir(), ".local", "share"),
+      "work",
+    );
+  if (bridgeIfNeeded(dataDir, env, log)) return;
+  die(
+    `${path.join(dataDir, "work.db")} is still from before 0.1, so the service was left as it was. Run:\n  ${bridgeCommands(dataDir).join("\n  ")}`,
   );
 }
 
@@ -737,6 +791,13 @@ async function fix(d) {
         "GitHub is not signed in. Open the app and use Settings → GitHub → Sign in",
       );
   }
+  if (d.staleGhHelpers.length) {
+    try {
+      repairGhHelpers(d.staleGhHelpers, { log });
+    } catch (err) {
+      warn(`could not repair git's gh credential helper: ${err.message}`);
+    }
+  }
   // Agent CLIs are installed from the app (Settings → Agents), where each
   // one is a click and the picker updates immediately — no prompt here.
   if (!d.agents.some((a) => a.installed)) {
@@ -781,25 +842,6 @@ function serviceFile() {
       );
 }
 
-/** Whether an installed service with no WORK_LISTEN line was installed
- * before the this-machine-only default. On Linux its shape tells: under the
- * default, work.socket binds an address (`127.0.0.1:7171`), where an older
- * service had no socket or bound a bare port. A launchd agent has no such
- * tell. */
-function predatesListenDefault() {
-  if (!fs.existsSync(serviceFile())) return false;
-  if (process.platform === "darwin") return true;
-  try {
-    const socket = fs.readFileSync(
-      path.join(path.dirname(serviceFile()), "work.socket"),
-      "utf8",
-    );
-    return /^ListenStream=\d+\s*$/m.test(socket);
-  } catch {
-    return true;
-  }
-}
-
 /** One Environment= line systemd reads back as exactly this value. A value
  * holding whitespace, a quote, `\` or `%` is quoted, with `\` and `"`
  * escaped and `%` doubled, since systemd expands specifiers there: bare, a
@@ -849,8 +891,8 @@ function installedServiceEnv() {
     }
     return installed;
   }
-  // unitEnvLine's quoted form, or an older service's bare `KEY=value`,
-  // which was never escaped either.
+  // unitEnvLine's quoted form, or the bare `KEY=value` it writes for a
+  // plain value, which is not escaped either.
   const re =
     /^Environment=(?:"([A-Za-z_][A-Za-z0-9_]*)=((?:[^"\\]|\\.)*)"|([A-Za-z_][A-Za-z0-9_]*)=(.*))$/gm;
   for (const [, qKey, qValue, key, value] of text.matchAll(re)) {
@@ -864,9 +906,9 @@ function installedServiceEnv() {
 }
 
 /** WORK_* from the .env.local of the checkout WORK_SERVICE_EXEC runs, read
- * as scripts/env-local.sh reads it: that script exports them at start, under
- * whatever the service sets. Never written into the service, which would
- * shadow later edits of the file. */
+ * as scripts/run-local.sh reads it: that script exports them at start,
+ * under whatever the service sets. Never written into the service, which
+ * would shadow later edits of the file. */
 function checkoutEnvLocal() {
   const exec = process.env.WORK_SERVICE_EXEC;
   const out = {};
@@ -920,18 +962,8 @@ function serviceEnv() {
     const value = key in process.env ? process.env[key] : installed[key];
     if (value) env[key] = value;
   }
-  // A new install listens on this machine only, and its service says so, so
-  // that a missing line only ever means a service from before that default.
-  // Those listened on every interface, and other machines (a phone, the
-  // proxy in front of it) may be reaching it that way: keep it listening,
-  // so they get work's page naming the setting to add (server/access.ts)
-  // rather than a connection that is simply refused.
-  if (!env.WORK_LISTEN) {
-    env.WORK_LISTEN =
-      !("WORK_LISTEN" in process.env) && predatesListenDefault()
-        ? "0.0.0.0"
-        : "127.0.0.1";
-  }
+  // This machine only unless set, and the service says so.
+  env.WORK_LISTEN ||= "127.0.0.1";
   // entry.ts prefers PORT, so carrying WORK_APP_PORT forward without this
   // would leave the service on the default port anyway. A checkout's run
   // script serves the port its .env.local names, so the socket binds that
@@ -962,17 +994,15 @@ function serviceEnv() {
 
 /** True when `cmd` is a work *server* (not `work setup` / `work update`).
  * Must not match the tmux that hosts agent sessions: `tmux -L work
- * start-server` used to hit `\bwork\s+start\b` because `\b` fires on the
- * `t`/`-` boundary in `start-server`, so `work update` killed tmux mid-
- * setup and never reached `systemctl restart`. */
+ * start-server` hits `\bwork\s+start\b` because `\b` fires on the
+ * `t`/`-` boundary in `start-server`, and `work update` would kill tmux
+ * mid-setup and never reach `systemctl restart`. */
 function isWorkServerCmd(cmd) {
   if (/\btmux\b/.test(cmd)) return false;
   if (/\bwork(\.mjs)?\s+(setup|update|version)\b/.test(cmd)) return false;
   if (
     /\bwork\.mjs\s+start(?:\s|$)/.test(cmd) ||
-    /(?:^|[\s/])work\s+start(?:\s|$)/.test(cmd) ||
-    /--why=work server is running/.test(cmd) ||
-    /--why="work server is running"/.test(cmd)
+    /(?:^|[\s/])work\s+start(?:\s|$)/.test(cmd)
   )
     return true;
   // A built server or run script, by the absolute path an interpreter was
@@ -983,9 +1013,7 @@ function isWorkServerCmd(cmd) {
   const argv = cmd.split(/\s+/);
   return argv.some((arg, i) => {
     if (
-      !/^\/.*\/(?:(?:dist|\.run)\/index\.mjs|scripts\/run-(?:prod|local)\.sh)$/.test(
-        arg,
-      )
+      !/^\/.*\/(?:(?:dist|\.run)\/index\.mjs|scripts\/run-local\.sh)$/.test(arg)
     )
       return false;
     const runner = argv
@@ -1077,10 +1105,9 @@ function killPids(pids, signal) {
   }
 }
 
-/** Stop the managed service *and* any leftover checkout / `work start`
- * process still bound to the port. A pre-npm install often wasn't the
- * current unit (or was a bare node), so restarting work.service left it
- * sitting in front of the new one. */
+/** Stop the managed service *and* any other work server still bound to
+ * the port — a `work start` left in a terminal, a checkout's — which would
+ * otherwise sit in front of the new one. */
 function stopOldCopies(port) {
   log("stopping any previous work server");
   if (process.platform === "darwin") {
@@ -1088,28 +1115,6 @@ function stopOldCopies(port) {
     spawnSync("launchctl", ["bootout", `gui/${uid}/dev.work.app`], {
       stdio: "ignore",
     });
-    const agents = path.join(os.homedir(), "Library/LaunchAgents");
-    try {
-      for (const name of fs.readdirSync(agents)) {
-        if (!name.endsWith(".plist")) continue;
-        const file = path.join(agents, name);
-        const text = fs.readFileSync(file, "utf8");
-        if (
-          !/dev\.work\.app|work\.mjs|run-prod\.sh|run-local\.sh|@dylanpiercey\/work/.test(
-            text,
-          )
-        )
-          continue;
-        const label = text.match(
-          /<key>Label<\/key>\s*<string>([^<]+)<\/string>/,
-        )?.[1];
-        if (label) {
-          spawnSync("launchctl", ["bootout", `gui/${uid}/${label}`], {
-            stdio: "ignore",
-          });
-        }
-      }
-    } catch {}
   } else if (have("systemctl")) {
     spawnSync("systemctl", ["--user", "stop", "work.service"], {
       stdio: "ignore",
@@ -1125,10 +1130,11 @@ function stopOldCopies(port) {
 }
 
 /** Wait for the service to answer before we tell anyone it is up. Both
- * service managers return as soon as the job is spawned, so `done — http://…`
- * used to print at a port that answers a second or two later — which reads as
- * an update that broke the app. Any HTTP reply proves the server is serving;
- * the status the route returns is not this function's business. */
+ * service managers return as soon as the job is spawned, so without this
+ * `done — http://…` would print at a port that answers a second or two
+ * later — which reads as an update that broke the app. Any HTTP reply
+ * proves the server is serving; the status the route returns is not this
+ * function's business. */
 async function waitForServer(timeoutMs = 30_000) {
   const deadline = Date.now() + timeoutMs;
   for (;;) {
@@ -1148,8 +1154,8 @@ function installService() {
   const port = serviceEnv().PORT;
   stopOldCopies(port);
   const cliPath = fileURLToPath(import.meta.url);
-  // One service definition serves both installers. A source install
-  // (scripts/setup-prod.sh) points the unit at this checkout's run-prod.sh
+  // One service definition serves the npm package and a checkout:
+  // scripts/work-source.sh points the unit at the checkout's run-local.sh
   // instead of the CLI — that script carries its own sleep inhibitor and
   // PORT handling, so no awake prefix is layered on top.
   const execOverride = process.env.WORK_SERVICE_EXEC;
@@ -1197,15 +1203,8 @@ ${envXml}
         stdio: "ignore",
       }).status === 0;
     if (!started) {
-      // A launchd that only speaks the legacy verbs: `load -w` honours
-      // RunAtLoad the same way.
-      started =
-        spawnSync("launchctl", ["load", "-w", plist], { stdio: "ignore" })
-          .status === 0;
-    }
-    if (!started) {
-      // Both refused because the job is loaded already (a bootout that did
-      // not take). Nothing spawned it with the new definition, and it is old
+      // Refused because the job is loaded already (a bootout that did not
+      // take). Nothing spawned it with the new definition, and it is old
       // enough not to be throttled, so restart it.
       started =
         spawnSync("launchctl", ["kickstart", "-k", label], { stdio: "ignore" })