@gurulu/cli 0.4.3 → 0.4.4

package/dist/commands/install.js

@@ -52,15 +52,20 @@ exports.resolveWorkspaceRoot = resolveWorkspaceRoot;
 exports.resolveScriptsDir = resolveScriptsDir;
 exports.detectPackageManager = detectPackageManager;
 exports.packageInstallArgs = packageInstallArgs;
+exports.parseEnvFile = parseEnvFile;
 exports.mergeEnvFile = mergeEnvFile;
 exports.createDefaultDeps = createDefaultDeps;
 exports.runInstallFlow = runInstallFlow;
+exports.isTelemetryDisabled = isTelemetryDisabled;
+exports.maybePromptTelemetryConsent = maybePromptTelemetryConsent;
 exports.repoHashOf = repoHashOf;
 exports.pickSite = pickSite;
 exports.emitInstallTelemetry = emitInstallTelemetry;
+exports.detectCiEnv = detectCiEnv;
 exports.runAuthenticatedInstallFlow = runAuthenticatedInstallFlow;
 exports.installCommand = installCommand;
 const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const crypto = __importStar(require("crypto"));
 const child_process_1 = require("child_process");
@@ -79,13 +84,69 @@ const install_intent_proposal_1 = require("../install-intent-proposal");
 // interactively. The resolved path becomes `repoRoot` for the rest of the
 // install flow.
 // ---------------------------------------------------------------------------
+function walkForPackageJson(root, depth, out) {
+    // FA-1 P1-7 — recursive walker for `**/*` and `apps/**` style globs used by
+    // Turborepo and Yarn berry monorepos. We cap depth to avoid descending into
+    // node_modules / .git / huge build trees, and we only collect directories
+    // that actually contain a package.json.
+    if (depth < 0)
+        return;
+    let entries;
+    try {
+        entries = fs.readdirSync(root, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const e of entries) {
+        if (!e.isDirectory())
+            continue;
+        if (e.name === 'node_modules' || e.name === '.git' || e.name.startsWith('.'))
+            continue;
+        const abs = path.join(root, e.name);
+        if (fs.existsSync(path.join(abs, 'package.json')))
+            out.push(abs);
+        walkForPackageJson(abs, depth - 1, out);
+    }
+}
 function expandWorkspaceGlobs(repoRoot, globs) {
-    const out = [];
-    for (const g of globs) {
-        // Accept only the simple `dir/*` and bare `dir` forms — anything fancier
-        // (negation, `**`, alternation) falls through to the manual prompt.
-        if (g.includes('**') || g.startsWith('!'))
+    // FA-1 P1-7 — workspace glob support now covers:
+    //   - bare `dir`               (single workspace)
+    //   - `dir/*`                  (immediate children — npm/pnpm/yarn classic)
+    //   - `dir/**`, `dir/**/*`     (Turborepo / Yarn berry recursive)
+    //   - `!packages/excluded`     (negation filter, applied after expansion)
+    //   - `workspace:*` protocol   (Yarn berry — skipped, not a glob)
+    const positives = [];
+    const negatives = [];
+    for (const raw of globs) {
+        if (!raw || typeof raw !== 'string')
+            continue;
+        // Yarn berry sometimes lists `workspace:*` protocol entries — skip; they
+        // are dependency declarations, not workspace path globs.
+        if (raw.startsWith('workspace:'))
+            continue;
+        if (raw.startsWith('!')) {
+            negatives.push(raw.slice(1));
+        }
+        else {
+            positives.push(raw);
+        }
+    }
+    const collected = new Set();
+    for (const g of positives) {
+        // `dir/**`, `dir/**/*` — recursive walk up to 4 levels deep.
+        if (g.endsWith('/**') || g.endsWith('/**/*') || g === '**' || g === '**/*') {
+            const root = g === '**' || g === '**/*'
+                ? repoRoot
+                : path.join(repoRoot, g.replace(/\/\*\*(\/\*)?$/, ''));
+            if (!fs.existsSync(root))
+                continue;
+            const acc = [];
+            walkForPackageJson(root, 4, acc);
+            for (const a of acc)
+                collected.add(a);
             continue;
+        }
         if (g.endsWith('/*')) {
             const parent = path.join(repoRoot, g.slice(0, -2));
             if (!fs.existsSync(parent))
@@ -95,22 +156,35 @@ function expandWorkspaceGlobs(repoRoot, globs) {
                     const abs = path.join(parent, entry);
                     if (fs.statSync(abs).isDirectory() &&
                         fs.existsSync(path.join(abs, 'package.json'))) {
-                        out.push(abs);
+                        collected.add(abs);
                     }
                 }
             }
             catch {
                 /* ignore */
             }
+            continue;
         }
-        else {
-            const abs = path.join(repoRoot, g);
-            if (fs.existsSync(abs) && fs.existsSync(path.join(abs, 'package.json'))) {
-                out.push(abs);
+        // Bare directory.
+        const abs = path.join(repoRoot, g);
+        if (fs.existsSync(abs) && fs.existsSync(path.join(abs, 'package.json'))) {
+            collected.add(abs);
+        }
+    }
+    // Apply negations as simple suffix-match against the relative path.
+    if (negatives.length > 0) {
+        for (const dir of Array.from(collected)) {
+            const rel = path.relative(repoRoot, dir);
+            for (const n of negatives) {
+                const negResolved = n.replace(/\/\*+$/, '');
+                if (rel === negResolved || rel.startsWith(negResolved + path.sep)) {
+                    collected.delete(dir);
+                    break;
+                }
             }
         }
     }
-    return out;
+    return Array.from(collected);
 }
 async function resolveWorkspaceRoot(repoRoot, args, deps) {
     const pkgPath = path.join(repoRoot, 'package.json');
@@ -180,6 +254,14 @@ function resolveScriptsDir(startDir = __dirname) {
 // Package-manager detection
 // ---------------------------------------------------------------------------
 function detectPackageManager(repoRoot) {
+    // FA-1 P1-6 — Bun support. Bun ships either `bun.lockb` (binary) or
+    // `bun.lock` (text, newer Bun releases). Detect both before falling back
+    // to pnpm/yarn/npm so monorepos using Bun don't get installed with the
+    // wrong package manager.
+    if (fs.existsSync(path.join(repoRoot, 'bun.lockb')) ||
+        fs.existsSync(path.join(repoRoot, 'bun.lock'))) {
+        return 'bun';
+    }
     if (fs.existsSync(path.join(repoRoot, 'pnpm-lock.yaml')))
         return 'pnpm';
     if (fs.existsSync(path.join(repoRoot, 'yarn.lock')))
@@ -191,8 +273,94 @@ function packageInstallArgs(pm) {
         return ['add', '@gurulu/web'];
     if (pm === 'yarn')
         return ['add', '@gurulu/web'];
+    if (pm === 'bun')
+        return ['add', '@gurulu/web'];
     return ['install', '@gurulu/web'];
 }
+// FA-1 P1-8 — full dotenv-compatible parser. The previous one-line
+// `KEY=value` split mis-handled (a) quoted values with `=` inside,
+// (b) multi-line values inside double-quotes (escape `\n`), and (c) the
+// `export KEY=value` form some teams use. This parser walks the file
+// character-by-character, tracking whether we're inside a quoted value, so
+// the existing-keys set actually contains every declared key — preventing
+// duplicate writes that would override the user's values.
+function parseEnvFile(text) {
+    const keys = new Set();
+    let i = 0;
+    const n = text.length;
+    while (i < n) {
+        // Skip leading whitespace + newlines.
+        while (i < n && (text[i] === ' ' || text[i] === '\t' || text[i] === '\r' || text[i] === '\n')) {
+            i++;
+        }
+        if (i >= n)
+            break;
+        // Comment line.
+        if (text[i] === '#') {
+            while (i < n && text[i] !== '\n')
+                i++;
+            continue;
+        }
+        // Optional `export ` prefix.
+        if (text.startsWith('export ', i) || text.startsWith('export\t', i)) {
+            i += 7;
+            while (i < n && (text[i] === ' ' || text[i] === '\t'))
+                i++;
+        }
+        // Key.
+        const keyStart = i;
+        while (i < n && text[i] !== '=' && text[i] !== '\n' && text[i] !== '#')
+            i++;
+        const key = text.slice(keyStart, i).trim();
+        if (text[i] !== '=') {
+            // No `=` on this line — skip to next newline.
+            while (i < n && text[i] !== '\n')
+                i++;
+            continue;
+        }
+        if (key && /^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+            keys.add(key);
+        }
+        i++; // consume '='
+        // Value — handles "..." (multi-line, escape-aware), '...', and bare.
+        if (text[i] === '"') {
+            i++;
+            while (i < n) {
+                if (text[i] === '\\' && i + 1 < n) {
+                    i += 2;
+                    continue;
+                }
+                if (text[i] === '"') {
+                    i++;
+                    break;
+                }
+                i++;
+            }
+        }
+        else if (text[i] === "'") {
+            i++;
+            while (i < n && text[i] !== "'")
+                i++;
+            if (i < n)
+                i++;
+        }
+        else if (text[i] === '`') {
+            i++;
+            while (i < n && text[i] !== '`')
+                i++;
+            if (i < n)
+                i++;
+        }
+        else {
+            while (i < n && text[i] !== '\n' && text[i] !== '#')
+                i++;
+        }
+        // Skip rest of the line (trailing comment / whitespace).
+        while (i < n && text[i] !== '\n')
+            i++;
+    }
+    return keys;
+}
 function mergeEnvFile(repoRoot, framework, vars) {
     const isNext = framework.startsWith('nextjs') || framework === 'nextjs';
     const filename = isNext ? '.env.local' : '.env';
@@ -201,11 +369,9 @@ function mergeEnvFile(repoRoot, framework, vars) {
     if (fs.existsSync(filePath)) {
         existing = fs.readFileSync(filePath, 'utf8');
     }
-    const existingKeys = new Set(existing
-        .split('\n')
-        .map((l) => l.trim())
-        .filter((l) => l && !l.startsWith('#'))
-        .map((l) => l.split('=')[0].trim()));
+    // FA-1 P1-8 — proper quoted/multiline-aware parse so we don't shadow keys
+    // the user already defined inside `KEY="multi\nline"` blocks.
+    const existingKeys = parseEnvFile(existing);
     const added = [];
     const skipped = [];
     const linesToAppend = [];
@@ -214,7 +380,13 @@ function mergeEnvFile(repoRoot, framework, vars) {
             skipped.push(key);
             continue;
         }
-        linesToAppend.push(`${key}=${value}`);
+        // Quote values that contain whitespace, `=`, `#`, or quotes themselves so
+        // they round-trip through any standard dotenv parser.
+        const needsQuote = /[\s="#\\]/.test(value);
+        const serialized = needsQuote
+            ? `"${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`
+            : value;
+        linesToAppend.push(`${key}=${serialized}`);
         added.push(key);
     }
     if (linesToAppend.length > 0) {
@@ -460,6 +632,16 @@ async function runInstallFlow(args, deps, scriptsDir) {
             planArgs.push('--intent-result', args.intentResultPath);
         }
     }
+    // FA-1 P0-2 — forward self-hosted overrides so the dry-run plan, the
+    // applied tracker tag, and the LLM endpoint base all agree. Without this
+    // self-hosted installs render `<script src="https://gurulu.io/t.js">` even
+    // when the user pointed `--ingest-url` at their own host.
+    if (args.ingestUrl) {
+        planArgs.push('--ingest-url', args.ingestUrl);
+    }
+    if (args.scriptSrc) {
+        planArgs.push('--script-src', args.scriptSrc);
+    }
     const planRes = await deps.runNode(planArgs);
     summary.planDiff = planRes.stdout;
     if (planRes.code !== 0) {
@@ -510,6 +692,14 @@ async function runInstallFlow(args, deps, scriptsDir) {
                 applyArgs.push('--intent-result', args.intentResultPath);
             }
         }
+        // FA-1 P0-2 — also forward to --apply so the file actually written to
+        // disk uses the correct tracker URL.
+        if (args.ingestUrl) {
+            applyArgs.push('--ingest-url', args.ingestUrl);
+        }
+        if (args.scriptSrc) {
+            applyArgs.push('--script-src', args.scriptSrc);
+        }
         const applyRes = await deps.runNode(applyArgs);
         // Sprint E1.1 — exit code 5 means the agentic-install script auto-rolled
         // back due to an auto-instrument failure. Mark the summary as rolled back
@@ -529,9 +719,25 @@ async function runInstallFlow(args, deps, scriptsDir) {
         }
         // Sprint E1.7 — record components that were successfully installed for
         // partial-install diagnostics in the summary.
-        summary.installedComponents = ['script-tag', 'patch-log'];
+        // CLI@0.4.4 — re-run idempotency: dedupe via Set so a second `gurulu install`
+        // pass on the same project does not double-list components. Component IDs
+        // hash siteId + framework + path so two different sites in the same repo
+        // remain distinct.
+        const componentScope = `${args.site || args.siteId || 'unknown'}::${args.framework || 'auto'}::${args.path || process.cwd()}`;
+        const existingComponents = new Set(summary.installedComponents || []);
+        const addComponent = (id) => {
+            const key = `${id}@${componentScope}`;
+            if (existingComponents.has(key)) {
+                log(deps, 'info', `Skipping ${id} — already installed for this scope`);
+                return;
+            }
+            existingComponents.add(key);
+        };
+        addComponent('script-tag');
+        addComponent('patch-log');
         if (args.autoInstrument)
-            summary.installedComponents.push('auto-instrument');
+            addComponent('auto-instrument');
+        summary.installedComponents = Array.from(existingComponents);
         // Parse the machine-readable auto-instrument result line if present.
         if (args.autoInstrument) {
             const lines = (applyRes.stdout || '').split('\n');
@@ -780,7 +986,91 @@ async function runInstallFlow(args, deps, scriptsDir) {
     }
     return summary;
 }
+// ---------------------------------------------------------------------------
+// FA-1 P0-5 — Telemetry consent gate (GDPR).
+//
+// `emitInstallTelemetry` previously fired on every install with a repo hash,
+// framework, and CLI version — no consent recorded. We now:
+//   1. Honor opt-out via env (`GURULU_TELEMETRY=off|0`, `DO_NOT_TRACK=1`),
+//      CLI flag (`--no-telemetry`), and persisted CLI config
+//      (`~/.gurulu/config.json` → `telemetry: false`).
+//   2. Prompt for consent on first interactive install and persist the
+//      answer in the same config file.
+//   3. Skip `repoHashOf` computation entirely when telemetry is disabled.
+// ---------------------------------------------------------------------------
+function cliConfigPath() {
+    if (process.env.GURULU_CONFIG_HOME) {
+        return path.join(process.env.GURULU_CONFIG_HOME, 'config.json');
+    }
+    return path.join(os.homedir(), '.gurulu', 'config.json');
+}
+function readCliConfig() {
+    try {
+        const p = cliConfigPath();
+        if (!fs.existsSync(p))
+            return {};
+        const txt = fs.readFileSync(p, 'utf8');
+        const parsed = JSON.parse(txt);
+        return parsed && typeof parsed === 'object' ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+function writeCliConfig(patch) {
+    try {
+        const p = cliConfigPath();
+        const dir = path.dirname(p);
+        if (!fs.existsSync(dir))
+            fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const current = readCliConfig();
+        const next = { ...current, ...patch };
+        fs.writeFileSync(p, JSON.stringify(next, null, 2));
+        try {
+            fs.chmodSync(p, 0o600);
+        }
+        catch {
+            /* non-unix */
+        }
+    }
+    catch {
+        /* best-effort persistence */
+    }
+}
+function isTelemetryDisabled() {
+    const env = (process.env.GURULU_TELEMETRY || '').toLowerCase();
+    if (env === 'off' || env === '0' || env === 'false' || env === 'no')
+        return true;
+    if (process.env.DO_NOT_TRACK === '1')
+        return true;
+    if (process.argv.includes('--no-telemetry'))
+        return true;
+    const cfg = readCliConfig();
+    if (cfg.telemetry === false)
+        return true;
+    return false;
+}
+/**
+ * First-run consent prompt. Persists the decision so we never re-ask.
+ * No-op when telemetry is already disabled, when a decision is already
+ * recorded, or in non-interactive (`--yes` / `--no-interactive`) mode.
+ */
+async function maybePromptTelemetryConsent(ask, args = {}) {
+    if (isTelemetryDisabled())
+        return;
+    const cfg = readCliConfig();
+    if (typeof cfg.telemetry === 'boolean')
+        return; // already decided
+    if (args.yes)
+        return; // non-interactive: don't ask, default-on but unrecorded
+    const answer = await ask('  Send anonymous install telemetry (framework, CLI version, repo hash) to improve Gurulu? [Y/n]: ');
+    const decided = !answer || !/^n/i.test(answer.trim());
+    writeCliConfig({ telemetry: decided, telemetry_decided_at: new Date().toISOString() });
+}
 function repoHashOf(repoRoot, remoteUrl = null) {
+    // Consent-gated: when telemetry is off, never compute the hash.
+    if (isTelemetryDisabled())
+        return '';
     const h = crypto.createHash('sha256');
     h.update(path.resolve(repoRoot));
     if (remoteUrl)
@@ -797,6 +1087,12 @@ function pickSite(sites, target) {
 }
 /** Send a telemetry POST. Never throws — quota errors are surfaced via `ok`. */
 async function emitInstallTelemetry(deps, payload) {
+    // FA-1 P0-5 — GDPR consent gate. Skip the POST entirely when the user has
+    // opted out via env/flag/config. Returns ok:true so callers don't surface
+    // a fake failure for an intentional opt-out.
+    if (isTelemetryDisabled()) {
+        return { ok: true, quotaExceeded: false };
+    }
     try {
         const res = await deps.postVerify({
             source: 'cli',
@@ -810,7 +1106,48 @@ async function emitInstallTelemetry(deps, payload) {
         return { ok: false, quotaExceeded: false };
     }
 }
+// FA-1 P0-1 — Detect popular CI environments. When a CI is detected and the
+// caller didn't already pass `--yes`, we force non-interactive mode so any
+// `prompt()` calls fall through to the documented default instead of blocking
+// on a closed stdin (which causes the entire install to hang in CI).
+const CI_ENV_VARS = [
+    'CI',
+    'VERCEL',
+    'GITHUB_ACTIONS',
+    'NETLIFY',
+    'GITLAB_CI',
+    'CIRCLECI',
+    'TRAVIS',
+    'BUILDKITE',
+];
+function detectCiEnv(env = process.env) {
+    return CI_ENV_VARS.some((v) => {
+        const raw = env[v];
+        if (!raw)
+            return false;
+        const lower = String(raw).toLowerCase();
+        return lower === '1' || lower === 'true';
+    });
+}
 async function runAuthenticatedInstallFlow(args, authDeps, installDeps, scriptsDir) {
+    // FA-1 P0-1 — CI environments do not have an interactive stdin. Without
+    // this guard every `prompt()` (`Continue with install? [Y/n]`, workspace
+    // picker, telemetry consent, auto-instrument confirm, etc.) blocks on EOF
+    // and the CI job times out instead of failing fast. Default to `--yes` so
+    // every prompt accepts the documented default and the flow can complete.
+    if (!args.yes && detectCiEnv()) {
+        installDeps.log?.info('[install] CI environment detected, defaulting to --yes');
+        args = { ...args, yes: true };
+    }
+    // FA-1 P0-5 — telemetry consent prompt on first interactive install.
+    // Persisted to ~/.gurulu/config.json so we never re-ask.
+    try {
+        const ask = authDeps.prompt || ((q) => installDeps.prompt(q));
+        await maybePromptTelemetryConsent(ask, { yes: args.yes });
+    }
+    catch {
+        /* never block install on consent prompt errors */
+    }
     // Site selection
     let selected = pickSite(authDeps.sites, args.site);
     if (!selected) {
@@ -1127,6 +1464,13 @@ async function installCommand(args) {
     // verify as strictly opt-in: only `args.verify === true` runs it. We also
     // patch the CLI option default in `src/index.ts` so the flag matches.
     args = { ...args, verify: args.verify === true };
+    // FA-1 P0-1 — top-level CI guard so the legacy unauthenticated path also
+    // skips interactive prompts when run from CI. (The authenticated flow
+    // re-checks inside `runAuthenticatedInstallFlow` for unit-test clarity.)
+    if (!args.yes && detectCiEnv()) {
+        console.log('[install] CI environment detected, defaulting to --yes');
+        args = { ...args, yes: true };
+    }
     // Legacy unauthenticated path: --site-id passed explicitly and no active profile.
     const profile = await (0, config_1.getActiveProfile)({ profile: args.profile });
     const legacyMode = !!args.siteId && !profile;
@@ -1188,18 +1532,33 @@ async function installCommand(args) {
         },
         intent: {
             analyze: async (signals) => {
-                const res = await (0, api_client_1.cliApi)('/api/cli/install/analyze-intent', {
-                    method: 'POST',
-                    preloadedProfile: profile,
-                    body: JSON.stringify({ signals }),
-                    noExitOnError: true,
-                });
-                const text = await res.text();
-                const parsed = text ? JSON.parse(text) : {};
-                if (!res.ok) {
-                    throw new Error((parsed && parsed.message) || `HTTP ${res.status}`);
+                // FA-1 P0-3 — bound the LLM round-trip. Without this guard a hung
+                // upstream stalls the whole install (Sprint E1.2 fallback never
+                // fires until the request finally errors out). 30s mirrors the
+                // tryLlmExtraction timeout in scripts/gurulu-agentic-install.mjs.
+                try {
+                    const res = await (0, api_client_1.cliApi)('/api/cli/install/analyze-intent', {
+                        method: 'POST',
+                        preloadedProfile: profile,
+                        body: JSON.stringify({ signals }),
+                        noExitOnError: true,
+                        signal: AbortSignal.timeout(30_000),
+                    });
+                    const text = await res.text();
+                    const parsed = text ? JSON.parse(text) : {};
+                    if (!res.ok) {
+                        throw new Error((parsed && parsed.message) || `HTTP ${res.status}`);
+                    }
+                    return parsed.intent;
+                }
+                catch (err) {
+                    const e = err;
+                    if (e && (e.name === 'AbortError' || e.name === 'TimeoutError')) {
+                        console.warn('[install] LLM analyze-intent timeout — falling back to heuristic intent');
+                        throw new Error('analyze-intent timeout');
+                    }
+                    throw err;
                 }
-                return parsed.intent;
             },
             preSeed: async (body) => {
                 const res = await (0, api_client_1.cliApi)('/api/cli/install/pre-seed', {

package/dist/commands/secrets.d.ts

@@ -0,0 +1,19 @@
+/**
+ * CLI@0.4.4 — `gurulu secrets` — list & rotate keys in the tenant credential vault.
+ *
+ * Subcommands:
+ *   gurulu secrets list                       (key names only — never values)
+ *   gurulu secrets rotate --key API_TOKEN     (issues new value, keeps old in 24h grace window)
+ *
+ * TODO(Sprint K): backend endpoints below are not yet live. The CLI command
+ * surface is implemented now so customers can wire automation.
+ *   - GET   /api/cli/secrets/list                     -> { secrets: [{ key, lastRotatedAt, rotationStatus }] }
+ *   - POST  /api/cli/secrets/rotate { key }           -> { key, newRevealedOnce: string, graceUntil: ISO }
+ */
+export interface SecretsArgs {
+    action?: string;
+    key?: string;
+    json?: boolean;
+    profile?: string;
+}
+export declare function secretsCommand(args: SecretsArgs): Promise<void>;