@fastagent-sh/fastagent 0.29.0 → 0.30.1

package/dist/cli/commands/deploy/docker.js

@@ -1,14 +1,14 @@
 /** `deploy docker`: one app service + loopback port + state volume, as a user-owned Compose file. */
 import { mkdir, writeFile } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
-import { webhookPaths } from "../../../deploy/channel-ingress.js";
-import { DOCKER_COMPOSE_FILE, DOCKER_VALUE_FILE, composeHasTunnelService, isGeneratedCompose, planDockerDeploy, toDockerProjectName, } from "../../../deploy/docker/plan.js";
+import { ownPublicUrl } from "../../../deploy/container.js";
+import { DOCKER_COMPOSE_FILE, DOCKER_VALUE_FILE, ingressNotes, isGeneratedCompose, planDockerDeploy, toDockerProjectName, } from "../../../deploy/docker/plan.js";
 import { deployDockerRun } from "../../../deploy/docker/run.js";
 import { spawnRunner } from "../../../deploy/runner.js";
-import { openExternalUrl } from "../../../open-url.js";
-import { SECRET_FILE_MODE, exists, readTextIfExists, resolveStateRoot } from "../../../paths.js";
-import { announceWebhooks } from "../../../tunnel.js";
-import { assembleSecrets } from "../../../deploy/secrets.js";
+import { SECRET_FILE_MODE, exists } from "../../../paths.js";
+import { fileStore } from "../../../deploy/file-store.js";
+import { dotEnvPath } from "../../../value-file.js";
+import { deploySecrets } from "./secrets-step.js";
 import { processShell } from "../../../deploy/box-shell.js";
 import { failStartup } from "../../fail.js";
 import { boxLoginStep, leftToPerson } from "./shared.js";
@@ -26,7 +26,7 @@ export const dockerHost = {
         }
     },
     async deploy(ctx) {
-        const { opts, agentDir, channels, webhookChannels, pre, write } = ctx;
+        const { opts, agentDir, channels, pre, write } = ctx;
         const { modelAuth, boxLogin, container, port, declaredSecrets, values, valueFile } = pre;
         // Compose requires its committed env_file to exist, even when no values are declared.
         const composeValueFile = join(agentDir, DOCKER_VALUE_FILE);
@@ -35,8 +35,8 @@ export const dockerHost = {
             await writeFile(composeValueFile, "", { mode: SECRET_FILE_MODE });
         // Compose interpolates `$VAR` INSIDE env_file values (`format: raw` needs Compose 2.30), so a credential
         // containing `$` reaches the container rewritten — silently, and differently from what this pre-flight read.
-        // No escaping advice: this ONE file is also read literally by `dev`/`start` (`parseEnvContent`) and pushed
-        // as-is by every other host, so `$$` would fix Docker by corrupting all of them.
+        // No escaping advice: this ONE file is also read literally by `dev`/`start` (`parseEnvContent`) and is the source
+        // `secrets push` sets every other host's values from, so `$$` would fix Docker by corrupting all of them.
         const dollarValues = [...values].filter(([, value]) => value.includes("$")).map(([name]) => name);
         if (dollarValues.length > 0) {
             console.error(`[fastagent] warn: ${dollarValues.join(", ")} contain "$", which Compose expands when reading ${valueFile} ` +
@@ -44,109 +44,76 @@ export const dockerHost = {
                 `ONLY — \`fastagent dev\`/\`start\` and the other hosts read this file literally and would keep the extra ` +
                 `"$". Prefer a value without "$".`);
         }
-        const hasDeclaredChannels = channels.length > 0;
-        const projectName = toDockerProjectName(basename(agentDir));
-        const dockerPlan = (tunnel) => planDockerDeploy({
-            projectName,
+        const plan = planDockerDeploy({
+            projectName: toDockerProjectName(basename(agentDir)),
             port,
             boxLogin,
             channels,
-            tunnel,
             secrets: pre.secrets,
             valueFile,
             ...container,
         });
-        const requestedTunnel = !!opts.tunnel && (!hasDeclaredChannels || webhookChannels.length > 0);
-        if (opts.tunnel && hasDeclaredChannels && webhookChannels.length === 0) {
-            console.error(`[fastagent] note: --tunnel skipped — every channel uses a long connection`);
-        }
-        let plan = dockerPlan(requestedTunnel);
-        // An existing Compose file is authoritative: shape its comparison/runbook from the topology on disk, regardless
-        // of the current flag.
-        const composeFile = join(agentDir, plan.composePath);
-        let keptWithoutRequestedTunnel = false;
-        // Same ownership question as fly.toml: a hand-owned compose file survives --force, so the plan must describe the
-        // topology that will actually be there.
-        const composeText = await readTextIfExists(composeFile).catch(failStartup);
-        if (composeText !== undefined && (!opts.force || !isGeneratedCompose(composeText))) {
-            const existingHasTunnel = composeHasTunnelService(composeText);
-            plan = dockerPlan(existingHasTunnel);
-            keptWithoutRequestedTunnel = requestedTunnel && !existingHasTunnel;
-        }
         await write(plan.artifacts, { force: !!opts.force });
         if (opts.run) {
             return runDeployDocker({
                 agentDir,
                 composeFile: plan.composePath,
                 port,
-                requireTunnel: requestedTunnel,
                 modelAuth,
+                modelKey: pre.modelKey,
                 boxLogin,
                 answerer: ctx.answerer,
+                api: ctx.api,
                 channels,
                 declaredSecrets,
                 values,
                 valueFile,
+                publicUrl: ownPublicUrl(container.config),
+                config: opts.config,
             });
         }
-        if (keptWithoutRequestedTunnel) {
-            console.error(`[fastagent] warn: --tunnel was requested but kept ${plan.composePath} has no "tunnel" service — ` +
-                `edit it, delete it and regenerate, or pass --force`);
-        }
         console.log(plan.runbook.join("\n"));
         return `http://127.0.0.1:${port}`;
     },
 };
 /** `deploy docker --run`: reconcile the user-owned local topology, then log the box in if it must. */
 async function runDeployDocker(params) {
-    const { agentDir, composeFile, port, requireTunnel, channels } = params;
+    const { agentDir, composeFile, port, channels } = params;
     const leave = leftToPerson(params.answerer);
-    const { secrets, missingSecrets } = assembleSecrets({
+    const valueFile = dotEnvPath(agentDir);
+    const provide = deploySecrets({
+        host: "docker",
+        label: "Docker",
+        agentDir,
+        opts: { config: params.config },
+        answerer: params.answerer,
+        api: params.api,
         modelAuth: params.modelAuth,
-        declared: params.declaredSecrets,
+        modelKey: params.modelKey,
+        declaredSecrets: params.declaredSecrets,
+        valueFile: params.valueFile,
         values: params.values,
     });
     const outcome = await deployDockerRun({
         composeFile,
         port,
-        secrets,
-        missingSecrets,
-        valueFile: params.valueFile,
-        requireTunnel,
-        channels,
+        provideSecrets: () => provide(fileStore(agentDir, valueFile)),
         ...boxLoginStep("docker", params, () => composeShell(composeFile, agentDir)),
-        announce: (tunnelUrl) => announceWebhooks(agentDir, tunnelUrl, channels, {
-            // A ticket's process opens no browser: its person is told, through `leave`.
-            ...(leave === undefined ? { openUrl: openExternalUrl } : { leave }),
-            stateRoot: resolveStateRoot(agentDir),
-            env: Object.fromEntries(params.values),
-        }),
     }, spawnRunner("docker", agentDir), (message) => console.error(`[fastagent] ${message}`));
     const compose = `docker compose -f ${composeFile}`;
     // Compose reached "up" iff the driver could report where it is.
-    const isUp = outcome.ok || outcome.url !== undefined || outcome.tunnelUrl !== undefined;
+    const isUp = outcome.ok || outcome.url !== undefined;
     if (outcome.url)
         console.error(`[fastagent] running → ${outcome.url}`);
     if (isUp) {
         console.error(`[fastagent] logs: ${compose} logs -f agent`);
         console.error(`[fastagent] stop: ${compose} down (state volume is kept)`);
     }
-    // BEFORE failStartup: a registration gate says "re-run this deploy", and a re-run rebuilds the tunnel service.
-    if (outcome.tunnelUrl) {
-        console.error(`[fastagent] note: Quick Tunnel URLs are ephemeral — after the tunnel container/Docker daemon ` +
-            `restarts, re-run this deploy so webhooks receive the new URL`);
-    }
     if (!outcome.ok)
         failStartup(new Error(`deploy stopped: ${outcome.gate}`));
-    if (outcome.tunnelUrl)
-        return outcome.tunnelUrl;
-    const paths = webhookPaths(channels);
-    if (paths.length > 0) {
-        const unreached = `${paths.join(", ")} receive nothing until a public URL reaches this container — re-run with --tunnel for a ` +
-            `Quick Tunnel, or configure your own tunnel/proxy and point those webhook path(s) (or your remapped channel ` +
-            `routes) at it`;
-        console.error(`[fastagent] note: ${unreached}`);
-        leave?.(unreached);
+    for (const note of ingressNotes(channels, params.publicUrl, outcome.url && `${outcome.url}/health`)) {
+        console.error(`[fastagent] note: ${note}`);
+        leave?.(note);
     }
     return outcome.url;
 }

package/dist/cli/commands/deploy/fly.js

@@ -5,11 +5,12 @@ import { deployFlyRun } from "../../../deploy/fly/run.js";
 import { spawnRunner } from "../../../deploy/runner.js";
 import { readTextIfExists } from "../../../paths.js";
 import { residencyFor } from "../../../deploy/residency.js";
-import { assembleSecrets } from "../../../deploy/secrets.js";
 import { processShell } from "../../../deploy/box-shell.js";
+import { withPublicUrl } from "../../../deploy/container.js";
 import { failStartup } from "../../fail.js";
+import { deploySecrets } from "./secrets-step.js";
 import { FLY_LOGIN, hostLogin } from "./host-login.js";
-import { boxLoginStep, registrarsFor } from "./shared.js";
+import { boxLoginStep, registrarsFor, urlRecorder } from "./shared.js";
 export const flyHost = {
     isOurs: (path, content) => path.endsWith("fly.toml") && isGeneratedFlyToml(content),
     async shell(agentDir) {
@@ -47,6 +48,8 @@ export const flyHost = {
                 console.error(`[fastagent] warn: ${msg}`);
             }
         }
+        const reachedAt = `https://${appName}.fly.dev`;
+        const delivered = withPublicUrl(container.config, reachedAt);
         const plan = planFlyDeploy({
             appName,
             port,
@@ -55,21 +58,27 @@ export const flyHost = {
             secrets: pre.secrets,
             hasCron,
             ...container,
+            // The app's URL is known before the build, so the image names it: the box points its own channels there.
+            config: delivered.config,
+            publicUrl: delivered.publicUrl,
         });
         await write(plan.artifacts, { force: !!opts.force });
-        const reachedAt = `https://${appName}.fly.dev`;
         if (opts.run) {
             await runDeployFly({
                 agentDir,
                 appName,
                 modelAuth,
+                modelKey: pre.modelKey,
                 boxLogin,
                 answerer: ctx.answerer,
+                api: ctx.api,
                 rerun: ctx.rerun,
                 channels,
                 declaredSecrets,
                 values,
                 valueFile,
+                publicUrl: delivered.publicUrl,
+                config: opts.config,
             });
             return reachedAt;
         }
@@ -85,23 +94,30 @@ async function runDeployFly(params) {
     if ((await fly(["version"], { capture: true })).code === 127) {
         failStartup(new Error(`flyctl not found — install it: https://fly.io/docs/flyctl/install, then re-run`));
     }
-    const { secrets, missingSecrets } = assembleSecrets({
-        modelAuth: params.modelAuth,
-        declared: params.declaredSecrets,
-        values: params.values,
-    });
     const outcome = await deployFlyRun({
         appName,
-        secrets,
-        missingSecrets,
-        valueFile: params.valueFile,
+        provideSecrets: deploySecrets({
+            host: "fly",
+            label: "Fly",
+            agentDir,
+            opts: { config: params.config },
+            answerer: params.answerer,
+            api: params.api,
+            modelAuth: params.modelAuth,
+            modelKey: params.modelKey,
+            declaredSecrets: params.declaredSecrets,
+            valueFile: params.valueFile,
+            values: params.values,
+        }),
         channels,
         flyConfig: "fly.toml",
         dockerfile: "Dockerfile",
         ...boxLoginStep("fly", params, () => flyShell(appName, agentDir)),
         ...hostLogin(FLY_LOGIN, params.answerer, agentDir),
         forAgent: `${params.rerun} --json`,
-    }, fly, (m) => console.error(`[fastagent] ${m}`), registrarsFor(agentDir, params.values, params.answerer));
+        publicUrl: params.publicUrl,
+        ...urlRecorder(agentDir, params.config, params.values, params.answerer),
+    }, fly, (m) => console.error(`[fastagent] ${m}`), registrarsFor(params.values, params.answerer));
     if (!outcome.ok)
         failStartup(new Error(`deploy stopped: ${outcome.gate}`));
     console.error(`[fastagent] deployed → https://${appName}.fly.dev`);

package/dist/cli/commands/deploy/railway.js

@@ -3,18 +3,27 @@
  * planRailwayDeploy).
  */
 import { basename } from "node:path";
+import { RAILWAYIGNORE_FILE, isGeneratedRailwayignore, keptRailwayignoreProblem, } from "../../../deploy/railway/ignore.js";
 import { planRailwayDeploy, toRailwayName } from "../../../deploy/railway/plan.js";
 import { deployRailwayRun } from "../../../deploy/railway/run.js";
 import { spawnRunner } from "../../../deploy/runner.js";
-import { assembleSecrets } from "../../../deploy/secrets.js";
 import { processShell } from "../../../deploy/box-shell.js";
+import { deliveredConfigArtifact, withPublicUrl } from "../../../deploy/container.js";
 import { failStartup } from "../../fail.js";
+import { deploySecrets } from "./secrets-step.js";
 import { RAILWAY_LOGIN, hostLogin } from "./host-login.js";
-import { boxLoginStep, registrarsFor } from "./shared.js";
+import { boxLoginStep, registrarsFor, urlRecorder } from "./shared.js";
 export const railwayHost = {
-    // Railway's only artifacts are the container's, which planArtifacts owns for every host.
-    isOurs: () => false,
+    isOurs: (path, content) => path === RAILWAYIGNORE_FILE && isGeneratedRailwayignore(content),
     shell: async (agentDir) => railwayShell(toRailwayName(basename(agentDir)), agentDir),
+    validate({ opts, agentDir }) {
+        const problem = keptRailwayignoreProblem(agentDir);
+        if (problem === undefined)
+            return;
+        if (opts.run)
+            failStartup(new Error(`deploy stopped: ${problem}`));
+        console.error(`[fastagent] warn: ${problem}`);
+    },
     async deploy(ctx) {
         const { opts, agentDir, pre, channels, write } = ctx;
         const { hasCron, modelAuth, boxLogin, container, declaredSecrets, values, valueFile } = pre;
@@ -31,16 +40,25 @@ export const railwayHost = {
         if (opts.run) {
             return runDeployRailway({
                 agentDir,
+                // The URL Railway mints is read before the upload, and the image delivers it as `http.publicUrl`.
+                deliverPublicUrl: async (url) => {
+                    const delivered = withPublicUrl(container.config, url);
+                    await write([deliveredConfigArtifact(delivered.config)], { force: true });
+                    return delivered.publicUrl;
+                },
                 name: serviceName,
                 modelAuth,
+                modelKey: pre.modelKey,
                 boxLogin,
                 answerer: ctx.answerer,
+                api: ctx.api,
                 rerun: ctx.rerun,
                 channels,
                 declaredSecrets,
                 values,
                 valueFile,
                 intoLinked: !!opts.intoLinked,
+                config: opts.config,
             });
         }
         console.log(plan.runbook.join("\n"));
@@ -56,23 +74,30 @@ async function runDeployRailway(params) {
     if ((await railway(["--version"], { capture: true })).code === 127) {
         failStartup(new Error(`railway CLI not found — install it: https://docs.railway.com/guides/cli, then re-run`));
     }
-    const { secrets, missingSecrets } = assembleSecrets({
-        modelAuth: params.modelAuth,
-        declared: params.declaredSecrets,
-        values: params.values,
-    });
     const outcome = await deployRailwayRun({
         name,
         mountPath: "/data",
-        secrets,
-        missingSecrets,
-        valueFile: params.valueFile,
+        provideSecrets: deploySecrets({
+            host: "railway",
+            label: "Railway",
+            agentDir,
+            opts: { config: params.config },
+            answerer: params.answerer,
+            api: params.api,
+            modelAuth: params.modelAuth,
+            modelKey: params.modelKey,
+            declaredSecrets: params.declaredSecrets,
+            valueFile: params.valueFile,
+            values: params.values,
+        }),
         channels,
         intoLinked,
+        deliverPublicUrl: params.deliverPublicUrl,
+        ...urlRecorder(agentDir, params.config, params.values, params.answerer),
         ...boxLoginStep("railway", params, () => railwayShell(name, agentDir)),
         ...hostLogin(RAILWAY_LOGIN, params.answerer, agentDir),
         forAgent: `${params.rerun} --json`,
-    }, railway, (m) => console.error(`[fastagent] ${m}`), registrarsFor(agentDir, params.values, params.answerer));
+    }, railway, (m) => console.error(`[fastagent] ${m}`), registrarsFor(params.values, params.answerer));
     if (!outcome.ok)
         failStartup(new Error(`deploy stopped: ${outcome.gate}`));
     console.error(`[fastagent] deployed → ${outcome.url}`);

package/dist/cli/commands/deploy/secrets-step.d.ts

@@ -0,0 +1,19 @@
+import type { DeclaredSecret } from "../../../declared-secrets.ts";
+import { type SecretStore } from "../../../deploy/secret-store.ts";
+import { type DeploymentApi } from "../../../deploy/api.ts";
+import { type ModelKey } from "../../../deploy/secrets.ts";
+import type { Answerer, DeployOptions } from "./shared.ts";
+export declare function deploySecrets(input: {
+    host: string;
+    label: string;
+    agentDir: string;
+    opts: Pick<DeployOptions, "config">;
+    answerer: Answerer;
+    api: DeploymentApi;
+    modelAuth: string | undefined;
+    modelKey: ModelKey;
+    declaredSecrets: readonly DeclaredSecret[];
+    /** The production value file this deploy loaded, and its values. */
+    valueFile: string;
+    values: ReadonlyMap<string, string>;
+}): (store: SecretStore) => Promise<string | undefined>;

package/dist/cli/commands/deploy/secrets-step.js

@@ -0,0 +1,66 @@
+/**
+ * A deploy's step that makes the target hold every value the deployment needs (secret-store.ts), written once for the
+ * hosts that keep their values in a store of their own: who is asked is the deploy's answerer, and the file a source
+ * reads is the production value file the deploy already loaded.
+ */
+import { confirm, isCancel, password } from "@clack/prompts";
+import { provideSecrets, } from "../../../deploy/secret-store.js";
+import { mintApiKey } from "../../../deploy/api.js";
+import { declaredNames, secretNeeds } from "../../../deploy/secrets.js";
+import { API_KEY_VARIABLE } from "../../../http/server.js";
+import { unprotectedSecretsNote, writeValues } from "../../../value-file.js";
+import { displayPath } from "../../../paths.js";
+import { shellArg } from "../../shared.js";
+/** The questions of a person at this terminal; a cancel stops the deploy. */
+const terminalAsker = {
+    async confirm(question) {
+        const answer = await confirm({ message: question, initialValue: true });
+        if (isCancel(answer))
+            throw new Error("cancelled");
+        return answer;
+    },
+    async secret(need) {
+        const answer = await password({ message: `${need.name} (${need.hint})` });
+        if (isCancel(answer))
+            throw new Error("cancelled");
+        const value = String(answer);
+        if (value.trim() === "")
+            throw new Error(`${need.name} is empty`);
+        return value;
+    },
+};
+/** The `fastagent secrets` commands for `host` as this deploy would have them run: its agent directory and configuration. */
+function secretsCommands(host, agentDir, config) {
+    const agent = displayPath(process.cwd(), agentDir);
+    const rest = `${agent === undefined ? "" : ` ${shellArg(agent)}`}${config === undefined ? "" : ` --config ${shellArg(config)}`}`;
+    return {
+        push: `fastagent secrets push ${host}${rest}`,
+        set: (name) => `fastagent secrets set ${host} ${name}${rest}`,
+    };
+}
+export function deploySecrets(input) {
+    const { host, label, agentDir, opts, answerer, api, modelAuth, modelKey, declaredSecrets, valueFile, values } = input;
+    return (store) => provideSecrets({
+        host: label,
+        store,
+        needs: secretNeeds(modelAuth, declaredSecrets, modelKey),
+        known: [...declaredNames(modelAuth, declaredSecrets, modelKey), ...(api.served ? [API_KEY_VARIABLE] : [])],
+        ...(values.size === 0 ? {} : { source: { file: valueFile, values } }),
+        ...(answerer.kind === "terminal" ? { asker: terminalAsker } : {}),
+        commands: secretsCommands(host, agentDir, opts.config),
+        say: (line) => {
+            console.error(`[fastagent] note: ${line}`);
+            if (answerer.kind === "ticket")
+                answerer.step.person.afterwards(line);
+        },
+        inform: (line) => console.error(`[fastagent] note: ${line}`),
+        ...(api.served ? { mint: [mintApiKey()] } : {}),
+        onMinted: async (minted) => {
+            const names = Object.keys(minted);
+            console.error(`[fastagent] made ${names.join(", ")} for the Agent API, set on ${label} and kept in ${valueFile}`);
+            const { unprotectedSecretsDir } = await writeValues(agentDir, "Agent API", names.map((name) => ({ name, value: minted[name] })), names);
+            if (unprotectedSecretsDir !== undefined)
+                console.error(`[fastagent] note: ${unprotectedSecretsNote(unprotectedSecretsDir)}`);
+        },
+    });
+}

package/dist/cli/commands/deploy/shared.d.ts

@@ -1,15 +1,17 @@
 import type { DeclaredChannel } from "../../../channels/discover.ts";
-import type { Registrars } from "../../../deploy/channel-ingress.ts";
+import type { Registrars, UrlRecorder } from "../../../deploy/channel-ingress.ts";
 import type { DeployPreflight } from "../../../deploy/preflight.ts";
-import type { AgentConfig } from "../../../harnesses/pi-durable/define.ts";
+import type { DeploymentApi } from "../../../deploy/api.ts";
+import type { EffectiveConfig } from "../../../harnesses/pi-durable/config.ts";
 import { type BoxLoginStep, type BoxShell } from "../../../deploy/box-shell.ts";
 import type { TicketStep } from "../../ticket.ts";
 import type { DeployHost } from "../../../deploy/hosts.ts";
 export interface DeployOptions {
     run?: boolean;
-    tunnel?: boolean;
     force?: boolean;
     intoLinked?: boolean;
+    /** `--config <file>`: the instance configuration the deployment delivers. */
+    config?: string;
     /** false ⇔ `--no-input`. */
     input?: boolean;
     /** `--json`: a coding agent's `--run`, run in a ticket that hands each step only a person can take to its user. */
@@ -48,10 +50,12 @@ interface DeployContext {
     /** The command that runs this deploy again, from where it ran: its agent directory and flags. */
     rerun: string;
     agentDir: string;
-    config: AgentConfig;
+    config: EffectiveConfig;
     pre: Extract<DeployPreflight, {
         ok: true;
     }>;
+    /** Whether the deployment serves the Agent API, so whether the deploy mints its key. */
+    api: DeploymentApi;
     channels: readonly DeclaredChannel[];
     webhookChannels: readonly DeclaredChannel[];
     /** Write this host's planned artifacts into the agent directory under the ownership rule. */
@@ -78,8 +82,15 @@ export interface HostDeploy {
 }
 /** Where a step left to the person goes for `answerer`: a ticket's `afterwards`; nowhere else but the log. */
 export declare function leftToPerson(answerer: Answerer): ((step: string) => void) | undefined;
+/**
+ * At a terminal, with a `--config` file to write to: record each URL a person sets on a platform's page once the box
+ * confirms it, so later deploys of that configuration, CI included, report it `registered` from the start.
+ */
+export declare function urlRecorder(agentDir: string, config: string | undefined, values: ReadonlyMap<string, string>, answerer: Answerer): {
+    recordUrl?: UrlRecorder;
+};
 /** The registrars every host driver gets; a channel's manual step also goes to `answerer`'s person. */
-export declare function registrarsFor(agentDir: string, values: ReadonlyMap<string, string>, answerer: Answerer): Registrars;
+export declare function registrarsFor(values: ReadonlyMap<string, string>, answerer: Answerer): Registrars;
 /**
  * The login `--run` starts on the box it just deployed, before any webhook is pointed at it (a host driver's `boxLogin`): for
  * the model's provider, keeping a credential the box already holds (a redeploy), and asking only when a person can

package/dist/cli/commands/deploy/shared.js

@@ -3,28 +3,45 @@
  * ownership rule.
  */
 import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { basename, dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { registerFeishuWebhook } from "../../../channels/feishu/register-webhook.js";
 import { DEPLOY_REGISTRATION_ATTEMPTS } from "../../../channels/registration.js";
-import { registerSlackWebhook } from "../../../channels/slack/register-webhook.js";
 import { registerTelegramWebhook } from "../../../channels/telegram/register-webhook.js";
-import { BUILD_OUTPUTS, IMAGE_DEFINITION_DIR, isGeneratedDockerfile, isGeneratedDockerignore, } from "../../../deploy/container.js";
-import { exists, resolveStateRoot } from "../../../paths.js";
+import { recordChannelUrl } from "../../channel-app.js";
+import { BUILD_OUTPUTS, IMAGE_APP_DIR, isGeneratedDockerfile, isGeneratedDockerignore, } from "../../../deploy/container.js";
+import { exists } from "../../../paths.js";
 import { deploymentLoginCommand } from "../../../deploy/box-shell.js";
 import { loginOnBox, ticketLoginIO } from "../../box-login.js";
 /** Where a step left to the person goes for `answerer`: a ticket's `afterwards`; nowhere else but the log. */
 export function leftToPerson(answerer) {
     return answerer.kind === "ticket" ? (step) => answerer.step.person.afterwards(step) : undefined;
 }
+/**
+ * At a terminal, with a `--config` file to write to: record each URL a person sets on a platform's page once the box
+ * confirms it, so later deploys of that configuration, CI included, report it `registered` from the start.
+ */
+export function urlRecorder(agentDir, config, values, answerer) {
+    if (answerer.kind !== "terminal" || config === undefined)
+        return {};
+    const file = resolve(config);
+    return {
+        recordUrl: {
+            waitMs: 10 * 60_000,
+            write: async (kind, url) => {
+                await recordChannelUrl(agentDir, file, kind, url, values);
+                return file;
+            },
+        },
+    };
+}
 /** The registrars every host driver gets; a channel's manual step also goes to `answerer`'s person. */
-export function registrarsFor(agentDir, values, answerer) {
+export function registrarsFor(values, answerer) {
     const attempts = DEPLOY_REGISTRATION_ATTEMPTS;
     const env = Object.fromEntries(values);
     const leave = leftToPerson(answerer);
     return {
         ...(leave === undefined ? {} : { leave }),
         telegram: (baseUrl) => registerTelegramWebhook(baseUrl, { attempts, env }),
-        slack: (baseUrl) => registerSlackWebhook(baseUrl, { stateRoot: resolveStateRoot(agentDir), environment: "production", attempts }),
         feishu: (baseUrl, kind) => registerFeishuWebhook(baseUrl, kind, { attempts, env }),
     };
 }
@@ -73,7 +90,7 @@ export async function planArtifacts(target, artifacts, options) {
     for (const a of artifacts) {
         const abs = join(target, a.path);
         // Pure build output, not operator-owned configuration. It must track the generated template/runbook.
-        if (BUILD_OUTPUTS.includes(basename(a.path)) || options.alwaysWrite?.includes(a.path)) {
+        if (BUILD_OUTPUTS.includes(a.path) || options.alwaysWrite?.includes(a.path)) {
             write(a.path, abs, a.content);
             continue;
         }
@@ -86,7 +103,7 @@ export async function planArtifacts(target, artifacts, options) {
                 (a.path.endsWith(".dockerignore")
                     ? `; see the preflight warnings for what it must exclude`
                     : a.path.endsWith("Dockerfile")
-                        ? `; deploy still assumes it listens on $PORT and runs \`fastagent start ${IMAGE_DEFINITION_DIR}\``
+                        ? `; deploy still assumes it listens on $PORT and runs \`fastagent start ${IMAGE_APP_DIR}\``
                         : ``));
             continue;
         }