@dylanpiercey/work 0.0.223 → 0.1.0

package/README.md

@@ -44,12 +44,6 @@ offers the agent CLIs, and runs `pnpm install`:
 
 ```sh
 pnpm dev                  # http://localhost:7171
-```
-
-For a production build plus a background service (systemd on Linux, launchd on macOS):
-
-```sh
-./scripts/setup-prod.sh   # build + install + start the service
 
 # While hacking on work itself, point the background service at a checkout
 # (and back at the npm install when done):
@@ -58,8 +52,6 @@ work-source local          # this tree (or: work-source local /path/to/work)
 work-source rebuild        # rebuild + restart without rewriting the unit
 work-source prod           # global @dylanpiercey/work again
 work-source                # status
-./scripts/run-prod.sh     # or: build with --no-service and run manually
-./scripts/update.sh       # later: pull latest, rebuild, restart
 ```
 
 ### Access
@@ -85,10 +77,8 @@ Access, `tailscale serve` — and tell work about it:
 Set them when installing (`WORK_ALLOWED_HOSTS=… WORK_TRUSTED_PROXIES=…
 WORK_LISTEN=0.0.0.0 work setup`); `work setup` keeps them in the service
 from then on. A refused request gets a page saying which setting it needs.
-Installs from before this default keep listening on every interface, and
-other machines see that page until they are configured. Everything (pages,
-API, and the `/term` websockets) serves from the single app port, so route
-the whole hostname to it.
+Everything (pages, API, and the `/term` websockets) serves from the single
+app port, so route the whole hostname to it.
 
 **Opening workspace ports remotely.** The port chips in the sidebar link to
 `http://<host>:<port>`, which only works where the machine is reachable
@@ -114,11 +104,6 @@ auth as the app. API writes and the terminal websockets refuse a foreign
 `Origin`, so a page a workspace serves cannot drive work with the shared
 login cookie.
 
-> **Upgrading from the two-port layout:** older setups routed `/term/*` to a
-> separate terminal port (7172). That port no longer exists — remove the
-> `/term` rule from your tunnel/proxy config and send all traffic to the app
-> port, or terminals will fail to connect.
-
 ## Backup, restore, join
 
 A `work` machine holds almost nothing that lives only there: branches are
@@ -163,16 +148,6 @@ targeting that branch.
 | `WORK_USER` / `WORK_HOST` | current user/host     | Branch-name prefix parts                             |
 | `WORK_BRANCH_PREFIX`      | `<user>-<host>`       | Whole branch-name prefix, overriding the parts       |
 
-Ports and paths can be exported before `scripts/setup-prod.sh` to bake them into
-the service. For settings that should outlive an update, put them in an untracked
-`.env.local` at the repo root instead — `scripts/run-prod.sh` reads it on every
-start (the dev server does not), only `WORK_*` names apply, and the
-surrounding environment still takes precedence:
-
-```sh
-WORK_BRANCH_PREFIX=rturnq
-```
-
 The usage panel (and `work usage`) reads plan/quota windows straight from each
 agent CLI's own credentials on disk — Claude, Codex, Cursor, Grok, and Copilot
 (via `gh`'s token). Providers you are not signed into simply say so.

package/bin/work.mjs

@@ -28,7 +28,8 @@ import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { doctor, formatDoctor, setupPath } from "../lib/setup/doctor.mjs";
-import { installTool } from "../lib/setup/install.mjs";
+import { installTool, repairGhHelpers } from "../lib/setup/install.mjs";
+import { bridgeCommands, bridgeIfNeeded } from "../lib/setup/bridge.mjs";
 import { dialHost, listenStream } from "../lib/setup/listen.mjs";
 import { commentMarkdown } from "../lib/review/markdown.mjs";
 import { formatInvite, parseInvite } from "../lib/share/manifest.mjs";
@@ -87,9 +88,12 @@ switch (command) {
     await setup();
     break;
   case "install-service":
-    // Service installation only — no doctor/fix, no migrate. Used by
-    // scripts/setup-prod.sh so npm and source installs share one
-    // definition; WORK_SERVICE_EXEC points it at a checkout's run-prod.sh.
+    // Service installation only — no doctor/fix. Used by
+    // scripts/work-source.sh so a checkout and the npm package share one
+    // definition; WORK_SERVICE_EXEC points it at the checkout's
+    // run-local.sh. The database is brought to the baseline first all the
+    // same: a server this checkout builds cannot open one from before it.
+    await bridge();
     if (!installService()) {
       process.exitCode = 1;
     } else if (await waitForServer()) {
@@ -101,12 +105,6 @@ switch (command) {
       process.exitCode = 1;
     }
     break;
-  case "migrate":
-    // The one-shot cleanups alone, against the service's settings (and the
-    // checkout's .env.local when WORK_SERVICE_EXEC names one). Used by
-    // scripts/update.sh ahead of setup-prod.sh.
-    process.exitCode = migrate();
-    break;
   case "doctor":
     await doctorCmd();
     break;
@@ -151,7 +149,7 @@ switch (command) {
     break;
   default:
     console.log(
-      `work ${pkg.version}\n\nusage: work <setup|install-service|migrate|doctor|start|update|usage|workspaces|workspace|repos|procs|review|export|restore|share|join|version> [--json]`,
+      `work ${pkg.version}\n\nusage: work <setup|install-service|doctor|start|update|usage|workspaces|workspace|repos|procs|review|export|restore|share|join|version> [--json]`,
     );
 }
 
@@ -639,10 +637,9 @@ function until(iso) {
 }
 
 async function setup() {
+  await bridge();
   await fix(await doctor());
 
-  migrate();
-
   const running = installService();
   const port = serviceEnv().PORT;
   maybeTunnel(port);
@@ -669,19 +666,24 @@ async function setup() {
   }
 }
 
-/** One-shot cleanups between versions (scripts/migrate.mjs), run against
- * the settings the service actually uses: migrate.mjs exits quietly when it
- * finds no db, so an ambient environment missing WORK_DATA_DIR skips every
- * sweep. A checkout's .env.local sits under both, as it does when its run
- * script starts the server. Returns the exit status. */
-function migrate() {
-  const script = path.join(pkgRoot, "scripts", "migrate.mjs");
-  if (!fs.existsSync(script)) return 0;
-  return (
-    spawnSync(process.execPath, [script], {
-      stdio: "inherit",
-      env: { ...checkoutEnvLocal(), ...process.env, ...serviceEnv() },
-    }).status ?? 1
+/** Bring a database from before 0.1 to the baseline this release starts
+ * from (lib/setup/bridge.mjs), before anything touches the service: the
+ * server it would restart refuses such a database. Run with the settings
+ * the service uses (a checkout's .env.local under them, as its run script
+ * has it), so it finds the data dir the server opens rather than whatever
+ * this shell has. On failure the service is left as it was, and what to
+ * run by hand ends the output. */
+async function bridge() {
+  const env = { ...checkoutEnvLocal(), ...process.env, ...serviceEnv() };
+  const dataDir =
+    env.WORK_DATA_DIR ||
+    path.join(
+      env.XDG_DATA_HOME || path.join(os.homedir(), ".local", "share"),
+      "work",
+    );
+  if (bridgeIfNeeded(dataDir, env, log)) return;
+  die(
+    `${path.join(dataDir, "work.db")} is still from before 0.1, so the service was left as it was. Run:\n  ${bridgeCommands(dataDir).join("\n  ")}`,
   );
 }
 
@@ -789,6 +791,13 @@ async function fix(d) {
         "GitHub is not signed in. Open the app and use Settings → GitHub → Sign in",
       );
   }
+  if (d.staleGhHelpers.length) {
+    try {
+      repairGhHelpers(d.staleGhHelpers, { log });
+    } catch (err) {
+      warn(`could not repair git's gh credential helper: ${err.message}`);
+    }
+  }
   // Agent CLIs are installed from the app (Settings → Agents), where each
   // one is a click and the picker updates immediately — no prompt here.
   if (!d.agents.some((a) => a.installed)) {
@@ -833,25 +842,6 @@ function serviceFile() {
       );
 }
 
-/** Whether an installed service with no WORK_LISTEN line was installed
- * before the this-machine-only default. On Linux its shape tells: under the
- * default, work.socket binds an address (`127.0.0.1:7171`), where an older
- * service had no socket or bound a bare port. A launchd agent has no such
- * tell. */
-function predatesListenDefault() {
-  if (!fs.existsSync(serviceFile())) return false;
-  if (process.platform === "darwin") return true;
-  try {
-    const socket = fs.readFileSync(
-      path.join(path.dirname(serviceFile()), "work.socket"),
-      "utf8",
-    );
-    return /^ListenStream=\d+\s*$/m.test(socket);
-  } catch {
-    return true;
-  }
-}
-
 /** One Environment= line systemd reads back as exactly this value. A value
  * holding whitespace, a quote, `\` or `%` is quoted, with `\` and `"`
  * escaped and `%` doubled, since systemd expands specifiers there: bare, a
@@ -901,8 +891,8 @@ function installedServiceEnv() {
     }
     return installed;
   }
-  // unitEnvLine's quoted form, or an older service's bare `KEY=value`,
-  // which was never escaped either.
+  // unitEnvLine's quoted form, or the bare `KEY=value` it writes for a
+  // plain value, which is not escaped either.
   const re =
     /^Environment=(?:"([A-Za-z_][A-Za-z0-9_]*)=((?:[^"\\]|\\.)*)"|([A-Za-z_][A-Za-z0-9_]*)=(.*))$/gm;
   for (const [, qKey, qValue, key, value] of text.matchAll(re)) {
@@ -916,9 +906,9 @@ function installedServiceEnv() {
 }
 
 /** WORK_* from the .env.local of the checkout WORK_SERVICE_EXEC runs, read
- * as scripts/env-local.sh reads it: that script exports them at start, under
- * whatever the service sets. Never written into the service, which would
- * shadow later edits of the file. */
+ * as scripts/run-local.sh reads it: that script exports them at start,
+ * under whatever the service sets. Never written into the service, which
+ * would shadow later edits of the file. */
 function checkoutEnvLocal() {
   const exec = process.env.WORK_SERVICE_EXEC;
   const out = {};
@@ -972,18 +962,8 @@ function serviceEnv() {
     const value = key in process.env ? process.env[key] : installed[key];
     if (value) env[key] = value;
   }
-  // A new install listens on this machine only, and its service says so, so
-  // that a missing line only ever means a service from before that default.
-  // Those listened on every interface, and other machines (a phone, the
-  // proxy in front of it) may be reaching it that way: keep it listening,
-  // so they get work's page naming the setting to add (server/access.ts)
-  // rather than a connection that is simply refused.
-  if (!env.WORK_LISTEN) {
-    env.WORK_LISTEN =
-      !("WORK_LISTEN" in process.env) && predatesListenDefault()
-        ? "0.0.0.0"
-        : "127.0.0.1";
-  }
+  // This machine only unless set, and the service says so.
+  env.WORK_LISTEN ||= "127.0.0.1";
   // entry.ts prefers PORT, so carrying WORK_APP_PORT forward without this
   // would leave the service on the default port anyway. A checkout's run
   // script serves the port its .env.local names, so the socket binds that
@@ -1022,9 +1002,7 @@ function isWorkServerCmd(cmd) {
   if (/\bwork(\.mjs)?\s+(setup|update|version)\b/.test(cmd)) return false;
   if (
     /\bwork\.mjs\s+start(?:\s|$)/.test(cmd) ||
-    /(?:^|[\s/])work\s+start(?:\s|$)/.test(cmd) ||
-    /--why=work server is running/.test(cmd) ||
-    /--why="work server is running"/.test(cmd)
+    /(?:^|[\s/])work\s+start(?:\s|$)/.test(cmd)
   )
     return true;
   // A built server or run script, by the absolute path an interpreter was
@@ -1035,9 +1013,7 @@ function isWorkServerCmd(cmd) {
   const argv = cmd.split(/\s+/);
   return argv.some((arg, i) => {
     if (
-      !/^\/.*\/(?:(?:dist|\.run)\/index\.mjs|scripts\/run-(?:prod|local)\.sh)$/.test(
-        arg,
-      )
+      !/^\/.*\/(?:(?:dist|\.run)\/index\.mjs|scripts\/run-local\.sh)$/.test(arg)
     )
       return false;
     const runner = argv
@@ -1129,10 +1105,9 @@ function killPids(pids, signal) {
   }
 }
 
-/** Stop the managed service *and* any leftover checkout / `work start`
- * process still bound to the port. A pre-npm install often wasn't the
- * current unit (or was a bare node), so restarting work.service left it
- * sitting in front of the new one. */
+/** Stop the managed service *and* any other work server still bound to
+ * the port — a `work start` left in a terminal, a checkout's — which would
+ * otherwise sit in front of the new one. */
 function stopOldCopies(port) {
   log("stopping any previous work server");
   if (process.platform === "darwin") {
@@ -1140,28 +1115,6 @@ function stopOldCopies(port) {
     spawnSync("launchctl", ["bootout", `gui/${uid}/dev.work.app`], {
       stdio: "ignore",
     });
-    const agents = path.join(os.homedir(), "Library/LaunchAgents");
-    try {
-      for (const name of fs.readdirSync(agents)) {
-        if (!name.endsWith(".plist")) continue;
-        const file = path.join(agents, name);
-        const text = fs.readFileSync(file, "utf8");
-        if (
-          !/dev\.work\.app|work\.mjs|run-prod\.sh|run-local\.sh|@dylanpiercey\/work/.test(
-            text,
-          )
-        )
-          continue;
-        const label = text.match(
-          /<key>Label<\/key>\s*<string>([^<]+)<\/string>/,
-        )?.[1];
-        if (label) {
-          spawnSync("launchctl", ["bootout", `gui/${uid}/${label}`], {
-            stdio: "ignore",
-          });
-        }
-      }
-    } catch {}
   } else if (have("systemctl")) {
     spawnSync("systemctl", ["--user", "stop", "work.service"], {
       stdio: "ignore",
@@ -1201,8 +1154,8 @@ function installService() {
   const port = serviceEnv().PORT;
   stopOldCopies(port);
   const cliPath = fileURLToPath(import.meta.url);
-  // One service definition serves both installers. A source install
-  // (scripts/setup-prod.sh) points the unit at this checkout's run-prod.sh
+  // One service definition serves the npm package and a checkout:
+  // scripts/work-source.sh points the unit at the checkout's run-local.sh
   // instead of the CLI — that script carries its own sleep inhibitor and
   // PORT handling, so no awake prefix is layered on top.
   const execOverride = process.env.WORK_SERVICE_EXEC;
@@ -1250,15 +1203,8 @@ ${envXml}
         stdio: "ignore",
       }).status === 0;
     if (!started) {
-      // A launchd that only speaks the legacy verbs: `load -w` honours
-      // RunAtLoad the same way.
-      started =
-        spawnSync("launchctl", ["load", "-w", plist], { stdio: "ignore" })
-          .status === 0;
-    }
-    if (!started) {
-      // Both refused because the job is loaded already (a bootout that did
-      // not take). Nothing spawned it with the new definition, and it is old
+      // Refused because the job is loaded already (a bootout that did not
+      // take). Nothing spawned it with the new definition, and it is old
       // enough not to be throttled, so restart it.
       started =
         spawnSync("launchctl", ["kickstart", "-k", label], { stdio: "ignore" })