@getnoan/wizard 0.1.7 → 0.1.8

package/README.md

@@ -46,7 +46,11 @@ Run it again any time; every write is a merge, and nothing you have is overwritt
    to your account, verifies and stores your model and Resend keys (and optionally a Postgres URL
    and a Firecrawl key) as repository secrets, runs the pack's seed scripts so each agent's starting
    instructions are in your workspace, records the name and the block slugs as repository variables,
-   and triggers one dry run. Safe mode stays on: the wizard never sets `DRY_RUN` to 0. That switch is yours.
+   and triggers one dry run. Safe mode stays on: the wizard never sets `DRY_RUN` to 0, and a re-run keeps the fork's `DRY_RUN`, and its `STATE_BACKEND` unless you give a Postgres URL. That switch is yours.
+
+   The newsletter signs unsubscribe links with `NEWSLETTER_UNSUB_SECRET`, and your site has to check
+   them with the same value. The wizard creates it once, stores it as a repository secret and in
+   `noan-agent-pack/.env` so you can copy it to your site, and keeps it on every re-run.
 
    The model does not have to be Anthropic's. Set `ANTHROPIC_BASE_URL` in the environment before
    running — `https://openrouter.ai/api`, say, or your own gateway — and the wizard verifies your key

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getnoan/wizard",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "One command from nothing to a grounded agent: sign in to NOAN, wire your coding assistant, install the skill, and set up the agent pack.",
   "license": "MIT",
   "type": "module",

package/src/agents.mjs

@@ -9,7 +9,7 @@ import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { randomBytes } from "node:crypto";
-import { writeEnv } from "./env-file.mjs";
+import { writeEnv, readEnvValue } from "./env-file.mjs";
 
 export const PACK_REPO = "getnoan/agent-pack";
 
@@ -130,6 +130,23 @@ export function existingVariables(dest, dryRun) {
   const r = spawnSync("gh", ["variable", "list", "--json", "name", "-q", ".[].name"], { cwd: dest, encoding: "utf8" });
   return new Set(r.status === 0 ? r.stdout.split("\n").map(s => s.trim()).filter(Boolean) : []);
 }
+/** The variables a re-run must not undo. DRY_RUN=1 only on a fork that has none, since it's the
+ *  user's switch for taking agents live. STATE_BACKEND follows a Postgres URL given on this run,
+ *  else keeps the fork's, so leaving the prompt blank doesn't drop the agents' state ledger. */
+export function forkStateVars(have, { db = "" } = {}) {
+  const set = {}, kept = [];
+  if (have.has("DRY_RUN")) kept.push("DRY_RUN"); else set.DRY_RUN = "1";
+  if (db) set.STATE_BACKEND = "postgres";
+  else if (have.has("STATE_BACKEND")) kept.push("STATE_BACKEND");
+  else set.STATE_BACKEND = "local";
+  return { set, kept };
+}
+/** The repository secrets already set on the fork, by name. Same rules as existingVariables. */
+export function existingSecrets(dest, dryRun) {
+  if (dryRun) return new Set();
+  const r = spawnSync("gh", ["secret", "list", "--json", "name", "-q", ".[].name"], { cwd: dest, encoding: "utf8" });
+  return new Set(r.status === 0 ? r.stdout.split("\n").map(s => s.trim()).filter(Boolean) : []);
+}
 export function setVariable(dest, name, value, dryRun) {
   if (dryRun) return { name, action: "would set" };
   const r = spawnSync("gh", ["variable", "set", name, "--body", value], { cwd: dest, encoding: "utf8" });
@@ -196,5 +213,20 @@ export function dispatchDryRun(dest, workflow, dryRun) {
 
 export const randomSecret = () => randomBytes(24).toString("hex");
 
+export const UNSUB_SECRET = "NEWSLETTER_UNSUB_SECRET";
+
+/** The newsletter signs every unsubscribe link with this secret and the user's own site checks it
+ *  with the same value. A GitHub secret can't be read back, so the clone's .env holds the copy the
+ *  user reads. An existing value is kept: a new one breaks every unsubscribe link already sent. */
+export function unsubSecret(dest, forkSecrets, { dryRun = false } = {}) {
+  const onFork = forkSecrets.has(UNSUB_SECRET);
+  const local = readEnvValue(dest, UNSUB_SECRET);
+  if (local) return { value: local, setOnFork: !onFork, action: onFork ? "kept" : "set from .env" };
+  if (onFork) return { value: null, setOnFork: false, action: "kept, not in .env" };
+  const value = randomSecret();
+  writeEnv(dest, { [UNSUB_SECRET]: value }, { dryRun });
+  return { value, setOnFork: true, action: "created" };
+}
+
 /** Write the pack's .env in the clone so the seeds (and a local run) have what they need. */
 export function writePackEnv(dest, pairs, dryRun) { return writeEnv(dest, pairs, { dryRun }); }

package/src/env-file.mjs

@@ -16,6 +16,14 @@ export function upsertEnv(text, pairs) {
   return out.join("\n") + "\n";
 }
 
+/** One key's value from dir/.env, "" when the file or the key is missing. */
+export function readEnvValue(dir, key) {
+  const p = path.join(dir, ".env");
+  if (!existsSync(p)) return "";
+  const m = readFileSync(p, "utf8").match(new RegExp(`^\\s*(?:export\\s+)?${key}\\s*=\\s*(\\S+)`, "m"));
+  return m ? m[1].replace(/^["']|["']$/g, "") : "";
+}
+
 export function writeEnv(dir, pairs, { dryRun = false } = {}) {
   const p = path.join(dir, ".env");
   const before = existsSync(p) ? readFileSync(p, "utf8") : "";

package/src/run.mjs

@@ -204,12 +204,21 @@ async function setupAgents({ args, ui, dir, key, me, report, shared = {} }) {
   const runKey = roles.runAs === "agent" ? agentKey : key;
 
   const secrets = { NOAN_PERSONAL_API_KEY: runKey, ...(anthropic && { [mName]: anthropic }), ...(resend && { RESEND_API_KEY: resend }),
-                    ...(db && { DATABASE_URL: db }), ...(firecrawl && { FIRECRAWL_API_KEY: firecrawl }), NEWSLETTER_UNSUB_SECRET: pack.randomSecret() };
+                    ...(db && { DATABASE_URL: db }), ...(firecrawl && { FIRECRAWL_API_KEY: firecrawl }) };
+  const unsub = pack.unsubSecret(fork.dest, pack.existingSecrets(fork.dest, args.dryRun), { dryRun: args.dryRun });
+  if (unsub.setOnFork) secrets[pack.UNSUB_SECRET] = unsub.value;
   for (const [n, v] of Object.entries(secrets)) { const r = pack.setSecret(fork.dest, n, v, args.dryRun); out.secrets.push(r); ui.ok(`secret ${n}: ${r.action}${r.error ? ` — ${r.error}` : ""}`); }
+  if (!unsub.setOnFork) { out.secrets.push({ name: pack.UNSUB_SECRET, action: unsub.action }); ui.ok(`secret ${pack.UNSUB_SECRET}: ${unsub.action}`); }
+  if (unsub.action === "kept, not in .env") {
+    ui.warn(`${pack.UNSUB_SECRET} is on the fork but not in ${fork.dest}/.env, so your site can't check newsletter unsubscribe links with it`);
+    report.next.push({ id: "unsub-secret", say: `Before sending a newsletter, pick a new ${pack.UNSUB_SECRET} and set it in ${fork.dest}/.env, as the fork's secret, and on your site.`, why: "the site checks unsubscribe links with the same value the agents sign them with" });
+  }
   // The endpoint is a repository VARIABLE, not a secret: without it the fork holds a gateway key
   // and still calls the default vendor, which is the same "documented is not delivered" trap the
   // pack's own workflows had.
-  const vars = { DRY_RUN: "1", STATE_BACKEND: db ? "postgres" : "local", ...(mBase && { ANTHROPIC_BASE_URL: mBase }), ...(mailFrom && { MAIL_FROM: mailFrom }), ...(replyTo && { REPLY_TO: replyTo }), ...(escalateTo && { ESCALATE_TO: escalateTo }),
+  const have = pack.existingVariables(fork.dest, args.dryRun);
+  const forkState = pack.forkStateVars(have, { db });
+  const vars = { ...forkState.set, ...(mBase && { ANTHROPIC_BASE_URL: mBase }), ...(mailFrom && { MAIL_FROM: mailFrom }), ...(replyTo && { REPLY_TO: replyTo }), ...(escalateTo && { ESCALATE_TO: escalateTo }),
                  ...identity,
                  COMPANY_NAME: me.project?.name || "", ...(roles.agentIds && { AGENT_IDENTITY_IDS: roles.agentIds }), ...(roles.commanders && { COMMANDERS: roles.commanders }) };
   // The seeds need the key in the clone's .env; the pack's own .env.example documents the rest.
@@ -231,7 +240,6 @@ async function setupAgents({ args, ui, dir, key, me, report, shared = {} }) {
   }
   // Who gets work handed back (agent role only, see agentRoles). An env value wins; one already
   // set on the fork is kept, since it is a list a person may have extended with teammates.
-  const have = pack.existingVariables(fork.dest, args.dryRun);
   const handBackKept = [], handBackToYou = [];
   for (const [n, v] of Object.entries(roles.handBack)) {
     const given = (process.env[n] || "").trim();
@@ -243,7 +251,7 @@ async function setupAgents({ args, ui, dir, key, me, report, shared = {} }) {
   for (const [n, v] of Object.entries(vars)) { if (!v) continue; const r = pack.setVariable(fork.dest, n, v, args.dryRun); out.variables.push(r); }
   if (handBackToYou.length) ui.ok(`work the agents hand back goes to ${me.identity?.email || "you"} (fact review, parked tasks, support follow-ups)`);
   if (handBackKept.length) ui.ok(`kept the fork's own ${handBackKept.join(", ")}`);
-  ui.ok(`${out.variables.length} repository variable(s) ${args.dryRun ? "to set" : "set"} (DRY_RUN=1: every agent stays in safe mode)`);
+  ui.ok(`${out.variables.length} repository variable(s) ${args.dryRun ? "to set" : "set"}${forkState.set.DRY_RUN ? " (DRY_RUN=1: every agent stays in safe mode)" : ""}${forkState.kept.length ? `; kept the fork's own ${forkState.kept.join(", ")}` : ""}`);
   // No point dispatching a run that will only fail for a missing key: say what is missing instead.
   if (!anthropic || !resend) {
     const missing = [!anthropic && mName, !resend && "RESEND_API_KEY"].filter(Boolean);