@dylanpiercey/work 0.1.0 → 0.2.0

package/README.md

@@ -80,13 +80,50 @@ from then on. A refused request gets a page saying which setting it needs.
 Everything (pages, API, and the `/term` websockets) serves from the single
 app port, so route the whole hostname to it.
 
+**Tailscale** is the zero-config way. On a machine logged in to Tailscale
+(1.52 or newer), `work setup` offers to run `tailscale serve --bg <port>`,
+which puts work at `https://<machine>.<tailnet>.ts.net/` for your devices on
+the tailnet alone (never Funnel, which would publish it to the internet),
+and adds that name to `WORK_ALLOWED_HOSTS`: open it on a phone signed in to
+the same tailnet. `work setup --tailscale` does it without asking and
+`--no-tailscale` skips the question; `--yes` alone leaves Tailscale's config
+as it is. A serve config already pointing at work only has its name
+allowed, and `work doctor` says which of these holds.
+
+**Direct connections.** Behind a proxy, a tunnel or a relay, terminals
+move to a direct WebRTC connection to this machine when it is measurably
+faster than the path through the proxy (Settings → Terminal → Direct
+connection: Auto by default, Always, or Off, one setting for every device). Pages,
+the API and sign-in still go through your proxy; the direct path is set up
+over the app's authenticated events socket, carries terminal traffic
+alone, encrypted (DTLS), to UDP port `WORK_RTC_PORT` (by default the app's
+port number), and ends when that login does. That port is held by a helper
+process of work's own, only while direct connections are in use: it
+starts at the first one and exits ten minutes after the last. Proxy-side inspection or
+logging does not see terminal traffic that goes direct: turn the feature
+off (per device in Settings, or `WORK_RTC=off` for the machine) where it
+must. On the LAN the direct path needs nothing more; from another network
+(a phone on cellular) the UDP port has to be reachable through your router.
+Settings → Terminal can allow work to open it on the router when needed
+(UPnP, off by default): only after a device failed to connect without it,
+leased, and given back once unused. A host firewall has to let the port
+in too: `work doctor` says when one likely drops it (firewalld's
+FedoraServer zone does, for one), with the command that admits it, and
+`work setup` offers to add that rule, named `work` so it is removed as one
+(`--firewall` adds it without asking, `--no-firewall` skips the question).
+macOS's firewall admits programs rather than ports, so there it is the
+node the service runs that `work doctor` checks and `work setup` lets in. `WORK_RTC_STUN` names the STUN servers that find this machine's
+public address (Cloudflare's by default; empty for none).
+
 **Opening workspace ports remotely.** The port chips in the sidebar link to
 `http://<host>:<port>`, which only works where the machine is reachable
-directly. Through a tunnel, route a wildcard hostname to the app port as
-well and work proxies it — HTTP and websockets, so HMR works — to
-`localhost:<port>`. `WORK_PORT_HOSTS` picks the hostname shape the chips
-link to; `sub` is always accepted, `dash` only when picked, and only for a
-name of three labels or more:
+directly — under a tailnet name too, since `tailscale serve` has no
+wildcard names: there a chip reaches a dev server that listens beyond
+loopback (`--host`), and one on loopback says so. Through a tunnel, route
+a wildcard hostname to the app port as well and work proxies it — HTTP and
+websockets, so HMR works — to `localhost:<port>`. `WORK_PORT_HOSTS` picks
+the hostname shape the chips link to; `sub` is always accepted, `dash` only
+when picked, and only for a name of three labels or more:
 
 - `sub` (default): `https://3000.work.example.com`. Needs a wildcard
   `*.work.example.com` route and a certificate that covers it (your own
@@ -147,6 +184,9 @@ targeting that branch.
 | `WORK_PORT_HOSTS`         | `sub`                 | Port-chip hostname shape: `sub` / `dash` (see above) |
 | `WORK_USER` / `WORK_HOST` | current user/host     | Branch-name prefix parts                             |
 | `WORK_BRANCH_PREFIX`      | `<user>-<host>`       | Whole branch-name prefix, overriding the parts       |
+| `WORK_RTC`                | on                    | `off` turns direct connections off (see Access)      |
+| `WORK_RTC_PORT`           | the app port          | UDP port of direct connections                       |
+| `WORK_RTC_STUN`           | Cloudflare's STUN     | Their STUN servers, comma-separated (empty: none)    |
 
 The usage panel (and `work usage`) reads plan/quota windows straight from each
 agent CLI's own credentials on disk — Claude, Codex, Cursor, Grok, and Copilot

package/bin/work.mjs

@@ -2,6 +2,11 @@
 // work CLI — ships with the npm package (no dependencies; plain node).
 //
 //   work setup    install missing tools, sign in, install/refresh the background service
+//                 (--tailscale serves work on the tailnet with `tailscale serve`, which
+//                 it otherwise offers when Tailscale is logged in; --no-tailscale skips that;
+//                 --firewall adds a `work` rule for direct connections' UDP port to a host
+//                 firewall that likely drops it, or on macOS lets the service's node in,
+//                 which it otherwise offers; --no-firewall skips that)
 //   work doctor   report machine readiness (--json, --fix to install what's missing)
 //   work start    run the server in the foreground
 //   work update   upgrade the npm package and refresh the service
@@ -26,8 +31,23 @@ import { execFileSync, spawnSync } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import readline from "node:readline/promises";
+import tty from "node:tty";
 import { fileURLToPath } from "node:url";
-import { doctor, formatDoctor, setupPath } from "../lib/setup/doctor.mjs";
+import {
+  doctor,
+  formatDoctor,
+  setupPath,
+  tailscaleProbe,
+  tilde,
+  which,
+} from "../lib/setup/doctor.mjs";
+import { allowHost, stateText } from "../lib/setup/tailscale.mjs";
+import {
+  applyPlan,
+  firewallProbe,
+  serviceNode,
+} from "../lib/setup/firewall.mjs";
 import { installTool, repairGhHelpers } from "../lib/setup/install.mjs";
 import { bridgeCommands, bridgeIfNeeded } from "../lib/setup/bridge.mjs";
 import { dialHost, listenStream } from "../lib/setup/listen.mjs";
@@ -638,17 +658,24 @@ function until(iso) {
 
 async function setup() {
   await bridge();
-  await fix(await doctor());
+  const d = await doctor(doctorOpts());
+  await fix(d);
+  // Before the service is written: a tailnet name to answer goes into the
+  // WORK_ALLOWED_HOSTS it carries.
+  const tailnet = await tailscale(d.tailscale);
+  await firewall();
 
   const running = installService();
   const port = serviceEnv().PORT;
-  maybeTunnel(port);
+  if (!tailnet) maybeTunnel(port);
   if (running) {
     if (await waitForServer()) log(`done — http://localhost:${port}`);
     else
       warn(
         `service started but nothing answered on port ${port} within 30s — check the logs`,
       );
+    if (tailnet)
+      log(`on your phone and other devices on the tailnet: ${tailnet}`);
   } else {
     // A fresh install's shell may not have mise on PATH yet — name the shim.
     const shim = path.join(
@@ -725,28 +752,195 @@ async function update() {
     "@dylanpiercey/work@latest",
   ]);
   // Re-exec the (possibly new) CLI to finish with fresh code.
-  sh("work", ["setup", ...(yes ? ["--yes"] : [])]);
+  sh("work", [
+    "setup",
+    ...(yes ? ["--yes"] : []),
+    ...args.filter((a) =>
+      ["--tailscale", "--no-tailscale", "--firewall", "--no-firewall"].includes(
+        a,
+      ),
+    ),
+  ]);
 }
 
 /** Machine readiness from lib/setup — the same probe the Settings page runs. */
 async function doctorCmd() {
-  let d = await doctor();
+  let d = await doctor(doctorOpts());
   if (args.includes("--fix")) {
     await fix(d);
-    d = await doctor();
+    d = await doctor(doctorOpts());
   }
+  const installs = await workInstalls();
   if (args.includes("--json")) {
-    console.log(JSON.stringify(d, null, 2));
+    console.log(JSON.stringify({ ...d, work: installs }, null, 2));
   } else {
     console.log(formatDoctor(d));
     const access = accessNote();
     if (access) warn(access);
+    for (const note of installNotes(installs)) warn(note);
   }
   // exitCode, not exit(): a pipe on macOS is written asynchronously, and
   // exiting at once can cut the JSON short for whatever reads it.
   if (!d.ready) process.exitCode = 1;
 }
 
+/**
+ * This `work`, every other one on PATH (the first is what `work` runs),
+ * each with its version, and the version the running service reports
+ * (null when none answers). A package manager's global left behind — a
+ * Homebrew node's under mise's — shadows the one kept up to date, and the
+ * doctor it runs is then old code describing a machine it no longer knows.
+ */
+async function workInstalls() {
+  const self = realpathOr(fileURLToPath(import.meta.url));
+  const onPath = [];
+  const seen = new Set();
+  for (const dir of (process.env.PATH || "").split(path.delimiter)) {
+    if (!dir) continue;
+    const file = path.join(dir, "work");
+    let real;
+    try {
+      if (!fs.statSync(file).isFile()) continue;
+      real = fs.realpathSync(file);
+    } catch {
+      continue;
+    }
+    if (seen.has(real)) continue;
+    seen.add(real);
+    onPath.push({ path: file, real, version: installVersion(real, file) });
+  }
+  let service = null;
+  try {
+    const res = await fetch(`${serverUrl()}/api/boot`, {
+      signal: AbortSignal.timeout(2000),
+    });
+    if (res.ok) service = (await res.json()).version ?? null;
+  } catch {}
+  return { self: { path: self, version: pkg.version }, onPath, service };
+}
+
+function realpathOr(file) {
+  try {
+    return fs.realpathSync(file);
+  } catch {
+    return file;
+  }
+}
+
+/** An install's version: an npm global's bin links into the package, whose
+ * package.json says; a shim (mise's) is asked. */
+function installVersion(real, file) {
+  let dir = path.dirname(real);
+  for (let i = 0; i < 3; i++) {
+    try {
+      const p = JSON.parse(fs.readFileSync(path.join(dir, "package.json")));
+      if (p.name === "@dylanpiercey/work") return p.version ?? null;
+    } catch {}
+    dir = path.dirname(dir);
+  }
+  const out = spawnSync(file, ["version"], { encoding: "utf8", timeout: 5000 });
+  return /^\d+\.\d+\.\d+\S*/.exec((out.stdout || "").trim())?.[0] ?? null;
+}
+
+/** How to remove an install: the npm beside the node whose global it is. */
+function removeHint(real) {
+  const m =
+    /^(.*)\/lib\/node_modules\/@dylanpiercey\/work\/bin\/work\.mjs$/.exec(real);
+  return m
+    ? `${m[1]}/bin/npm uninstall -g @dylanpiercey/work`
+    : `remove ${real}`;
+}
+
+function newest(versions) {
+  const parts = (v) => (v || "0").split(/[.-]/).map((n) => Number(n) || 0);
+  return versions.reduce((a, b) => {
+    const [x, y] = [parts(a), parts(b)];
+    for (let i = 0; i < 3; i++) if (x[i] !== y[i]) return x[i] > y[i] ? a : b;
+    return a;
+  }, null);
+}
+
+/** The doctor's warnings about which `work` this is. */
+function installNotes({ self, onPath, service }) {
+  const notes = [];
+  if (service && service !== self.version) {
+    const theirs = onPath.find((w) => w.version === service);
+    notes.push(
+      `this work is ${self.version} (${tilde(self.path)}), but the running service is ${service}, so what this doctor says is an older or newer release's${theirs ? `: the service's is ${tilde(theirs.path)}` : ""}`,
+    );
+  }
+  if (onPath.length > 1) {
+    // A stray is one at another release than the service's (or, with no
+    // service answering, than the newest here).
+    const current = service ?? newest(onPath.map((w) => w.version));
+    const lines = onPath.map(
+      (w, i) =>
+        `  ${tilde(w.path)} → ${w.version ?? "unknown version"}${i === 0 ? "  (what \`work\` runs)" : ""}${w.version === current ? "" : `\n      remove: ${removeHint(w.real)}`}`,
+    );
+    notes.push(`more than one work is on PATH:\n${lines.join("\n")}`);
+  }
+  return notes;
+}
+
+/** What the doctor's Tailscale probe checks against: the port and allowed
+ * names the service runs with (or will, after `work setup`). */
+function doctorOpts() {
+  const env = serviceEnv();
+  return {
+    port: env.PORT,
+    allowedHosts: env.WORK_ALLOWED_HOSTS || "",
+    rtcPort: env.WORK_RTC_PORT || "",
+    listen: env.WORK_LISTEN,
+    rtc: env.WORK_RTC || "",
+    firewall: serviceFirewall(),
+  };
+}
+
+/**
+ * The host firewall as the service meets it. macOS's admits programs, so
+ * the node that counts is the one the service runs, which need not be this
+ * shell's: asked of the running server first (`GET /api/direct`, its own
+ * reading), else read here for the node its definition runs
+ * (`serviceNode`), else for this one's, which the result says
+ * (`nodeFrom`). `fresh` skips the server's few minutes of keeping it.
+ */
+async function serviceFirewall({ fresh = false } = {}) {
+  const env = serviceEnv();
+  try {
+    const res = await fetch(
+      `${serverUrl()}/api/direct${fresh ? "?fresh=1" : ""}`,
+      { signal: AbortSignal.timeout(3000) },
+    );
+    const live = res.ok ? await res.json() : null;
+    if (live && "firewall" in live)
+      return (
+        live.firewall && {
+          ...live.firewall,
+          node: live.firewall.node ?? live.node,
+          nodeFrom: "service",
+        }
+      );
+  } catch {}
+  let definition = null;
+  try {
+    definition = fs.readFileSync(serviceFile(), "utf8");
+  } catch {}
+  const fromUnit =
+    definition &&
+    serviceNode(definition, { PATH: installedServiceEnv().PATH || "" });
+  const node = fromUnit || process.execPath;
+  const f = await firewallProbe({
+    rtcPort: env.WORK_RTC_PORT,
+    appPort: env.PORT,
+    listen: env.WORK_LISTEN,
+    rtc: env.WORK_RTC,
+    node,
+  });
+  return (
+    f && { ...f, node: f.node ?? node, nodeFrom: fromUnit ? "unit" : "shell" }
+  );
+}
+
 /** Said when the service listens beyond this machine with nothing declared
  * to answer there: every other machine is refused (server/access.ts), which
  * is safe, but likely not what the listening was for. */
@@ -956,6 +1150,9 @@ function serviceEnv() {
     "WORK_ALLOWED_HOSTS",
     "WORK_LISTEN",
     "WORK_TRUSTED_PROXIES",
+    "WORK_RTC",
+    "WORK_RTC_PORT",
+    "WORK_RTC_STUN",
   ]) {
     // `in` rather than a truthy check, so `WORK_ALLOWED_HOSTS= work setup`
     // can deliberately clear a setting the installed service still carries.
@@ -1312,8 +1509,250 @@ function maybeTunnel(port = appPort) {
   if (yes || have("cloudflared")) return;
   console.log(`
 To reach work from your phone or other devices, put it behind something
-that terminates TLS and authenticates, e.g. a Cloudflare Tunnel with
+that terminates TLS and authenticates, e.g. Tailscale (\`work setup
+--tailscale\` runs \`tailscale serve\` for you) or a Cloudflare Tunnel with
 Access (https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/)
-pointing at http://localhost:${port}, or Tailscale. The server itself has
-no auth of its own.`);
+pointing at http://localhost:${port}. The server itself has no auth of its
+own.`);
+}
+
+/**
+ * `tailscale serve` in front of work: https://<machine>.<tailnet>.ts.net/,
+ * TLS and the tailnet's own sign-in in the local daemon, proxied to work's
+ * port, so requests arrive from this machine under that name — which goes
+ * into WORK_ALLOWED_HOSTS. Tailnet only, never Funnel: Funnel publishes to
+ * the internet, and work has no login of its own. Tailscale's config is
+ * changed only on an explicit yes, the prompt's or `--tailscale`; `--yes`
+ * is how the installer, `work update` and the app's own update run setup
+ * unattended, and none of them asked for it. A serve config already
+ * pointing at work only has its name allowed. Returns the URL work is
+ * served at, or null.
+ */
+async function tailscale(ts) {
+  if (args.includes("--no-tailscale")) return null;
+  const asked = args.includes("--tailscale");
+  const port = serviceEnv().PORT;
+  if (!ts?.installed) {
+    if (asked)
+      warn(
+        "Tailscale is not installed: https://tailscale.com/download, then work setup --tailscale",
+      );
+    return null;
+  }
+  if (ts.serve) {
+    if (!allowTailnet(ts.serve)) return null;
+    if (ts.running) return servedAt(ts.serve.url);
+    // A serve config outlives a logout, and serves again once it is up.
+    log(
+      `Tailscale is ${stateText(ts)}: work is at ${ts.serve.url} once it is up`,
+    );
+    return null;
+  }
+  if (!ts.running) {
+    if (asked)
+      warn(
+        `Tailscale is ${stateText(ts)}: ${ts.state === null ? "start tailscaled" : "run `tailscale up`"}, then work setup --tailscale`,
+      );
+    return null;
+  }
+  const input = yes ? null : terminal();
+  try {
+    const refusal = serveRefusal(ts, port);
+    if (refusal) {
+      if (asked || input) warn(refusal);
+      return null;
+    }
+    const target = serveTarget(port);
+    const command = `tailscale serve --bg ${target}`;
+    if (!asked) {
+      if (!input) {
+        log(
+          `Tailscale is logged in: \`work setup --tailscale\` serves work at https://${ts.name}/ on your tailnet`,
+        );
+        return null;
+      }
+      console.log(`
+Tailscale is logged in here as ${ts.name}.
+\`${command}\` puts work at https://${ts.name}/
+for your devices on the tailnet (only them: never Funnel), proxied by the
+local Tailscale daemon to port ${port}.${ts.https === false ? "\nHTTPS certificates are off on your tailnet: tailscale prints a link that\nturns them on." : ""}`);
+      if (!(await confirm(input, `Run \`${command}\`? [y/N] `))) {
+        log(
+          "left Tailscale as it was (work setup --tailscale serves work later; --no-tailscale skips this question)",
+        );
+        return null;
+      }
+    } else if (ts.https === false && !input) {
+      // tailscale serve would wait, unattended, for someone to follow the
+      // link it prints.
+      warn(
+        "HTTPS certificates are off on your tailnet: turn them on (https://login.tailscale.com/admin/dns), then run work setup --tailscale",
+      );
+      return null;
+    }
+    log(command);
+    spawnSync(which("tailscale"), ["serve", "--bg", target], {
+      stdio: "inherit",
+    });
+  } finally {
+    if (input && input !== process.stdin) input.destroy();
+  }
+  // Its exit status is no proof: it exits 0 having only printed how to
+  // turn HTTPS on, when it does not wait for that.
+  const after = await tailscaleProbe({ port, allowedHosts: "" });
+  if (!after.serve) {
+    warn(
+      "tailscale serve did not serve work (see above); once it does, run work setup again",
+    );
+    return null;
+  }
+  return allowTailnet(after.serve) ? servedAt(after.serve.url) : null;
+}
+
+/**
+ * A rule in the host firewall for direct connections' UDP port (and the
+ * app's TCP port too when the service listens beyond this machine), named
+ * `work` so it is found and removed as one: a firewalld service enabled in
+ * the active zone, or ufw rules with that comment (lib/setup/firewall.mjs);
+ * on macOS, whose firewall admits programs, the service's node let in
+ * (`serviceFirewall`; "Block all incoming connections" is only said).
+ * Added with sudo, and only on an explicit yes, the prompt's or
+ * `--firewall`: `--yes` is how the installer, `work update` and the app's
+ * own update run setup unattended, and none of them asked for it. What it
+ * runs is printed as it runs.
+ */
+async function firewall() {
+  if (args.includes("--no-firewall")) return;
+  const asked = args.includes("--firewall");
+  const env = serviceEnv();
+  const f = await serviceFirewall();
+  if (!f) {
+    if (asked && env.WORK_RTC !== "off")
+      log("no active host firewall: nothing to add");
+    return;
+  }
+  if (f.admits) {
+    if (asked) log(`${f.what} already admits UDP ${f.port}`);
+    return;
+  }
+  const drops = `${f.what} ${f.exact ? "drops" : "likely drops"} UDP ${f.port}${f.why ? ` (${f.why})` : ""}, which direct connections from your other devices use`;
+  if (!f.plan.length) {
+    if (asked || !yes) warn(`${drops}: ${f.fix}`);
+    return;
+  }
+  // macOS's firewall admits a program: the service's node, as found.
+  const adds =
+    f.kind === "macos" ? `let ${f.node} in` : "add a rule named `work`";
+  if (f.kind === "macos" && f.nodeFrom === "shell")
+    warn(
+      `neither a running service nor its definition said which node it runs: this is for this shell's, ${f.node}`,
+    );
+  const input = yes || asked ? null : terminal();
+  try {
+    if (!asked) {
+      if (!input) {
+        log(`${drops}: \`work setup --firewall\` can ${adds}`);
+        return;
+      }
+      console.log(`
+${drops}.
+\`work setup\` can ${adds} for it, with sudo:
+  ${f.plan.map((cmd) => cmd.join(" ")).join("\n  ")}`);
+      if (!(await confirm(input, "Add it? [y/N] "))) {
+        log(
+          "left the firewall as it was (work setup --firewall adds it later; --no-firewall skips this question)",
+        );
+        return;
+      }
+    }
+  } finally {
+    if (input && input !== process.stdin) input.destroy();
+  }
+  const applied = applyPlan(f.plan, log);
+  if (!applied.ok) {
+    warn(
+      `\`${applied.failed?.join(" ")}\` failed, so the rule may be part-made: run the rest of\n  ${f.plan.map((c) => c.join(" ")).join("\n  ")}`,
+    );
+    return;
+  }
+  const after = await serviceFirewall({ fresh: true });
+  if (after?.admits) log(`${after.what} admits UDP ${after.port}`);
+  else warn(`${f.what} still looks shut to UDP ${f.port}: see work doctor`);
+}
+
+function servedAt(url) {
+  log(`Tailscale serves work at ${url} (tailnet only)`);
+  return url;
+}
+
+/** Why `tailscale serve --bg <port>` is not run here, or null. */
+function serveRefusal(ts, port) {
+  if (!ts.serveCli)
+    return `tailscale ${ts.version || "(unknown version)"} predates \`tailscale serve --bg <port>\` (1.52): update Tailscale, then run work setup --tailscale`;
+  // It would replace whatever serves the name's root now.
+  if (ts.rootTaken)
+    return `https://${ts.name}/ already serves ${ts.rootTaken}, which work leaves alone. To serve work beside it: tailscale serve --bg --https=8443 ${port}, then work setup`;
+  if (!serveTarget(port))
+    return `work listens on ${serviceEnv().WORK_LISTEN} alone, and tailscale serve proxies to loopback: WORK_LISTEN= work setup --tailscale`;
+  return null;
+}
+
+/** What `tailscale serve` proxies to: work's port on loopback, where
+ * requests are this machine's (server/access.ts). Null when work listens
+ * on one other address only, which loopback does not reach. */
+function serveTarget(port) {
+  const listen = serviceEnv().WORK_LISTEN;
+  if (listen === "::1") return `http://[::1]:${port}`;
+  return ["127.0.0.1", "0.0.0.0", "::", "*"].includes(listen)
+    ? String(port)
+    : null;
+}
+
+/** Put the name tailscale serve serves work under in WORK_ALLOWED_HOSTS,
+ * for installService() to write — or, when Funnel publishes that name to
+ * the internet, take it out, so work refuses the internet there. False
+ * then. */
+function allowTailnet(serve) {
+  const current = serviceEnv().WORK_ALLOWED_HOSTS || "";
+  const next = allowHost(current, serve.host, !serve.funnel);
+  if (next !== current) {
+    process.env.WORK_ALLOWED_HOSTS = next;
+    log(
+      `${serve.funnel ? "refusing" : "allowing"} ${serve.host} (WORK_ALLOWED_HOSTS=${next})`,
+    );
+  }
+  if (serve.funnel) {
+    warn(
+      `Tailscale Funnel publishes ${serve.url} to the internet, and work has no login, so work refuses that name. Turn Funnel off (tailscale funnel --https=${new URL(serve.url).port || 443} off), then run work setup again`,
+    );
+    return false;
+  }
+  return true;
+}
+
+/** Where to ask the user something: stdin when it is a terminal, else the
+ * controlling terminal, since the curl installer pipes its script into the
+ * shell this runs under. Null with no terminal at all. */
+function terminal() {
+  if (process.stdin.isTTY) return process.stdin;
+  try {
+    return new tty.ReadStream(fs.openSync("/dev/tty", "r"));
+  } catch {
+    return null;
+  }
+}
+
+/** A yes/no question, no unless answered yes. Line-buffered by the
+ * terminal itself, so Ctrl-C stops setup as it would anywhere else. */
+async function confirm(input, question) {
+  const rl = readline.createInterface({
+    input,
+    output: process.stdout,
+    terminal: false,
+  });
+  try {
+    return /^y(es)?$/i.test((await rl.question(question)).trim());
+  } finally {
+    rl.close();
+  }
 }