@jhizzard/termdeck 0.6.3 → 0.6.4

package/README.md

@@ -171,7 +171,7 @@ Honest limits, stated upfront so the skeptic has nothing to chase:
 - **Not a replacement for reading docs.** It's the shortest path to a memory you already wrote. If the memory isn't there, the feature does nothing.
 - **Not fully local by default.** Tier 2+ reaches out to Supabase for storage and OpenAI for embeddings. Tier 1 is fully local. A fully-local Tier 2 (local Postgres + local embeddings) is on the roadmap.
 - **Not free forever.** Tier 2+ pays OpenAI fractions of a cent per memory for embeddings. Self-hosted embeddings via Ollama are on the roadmap.
-- **Not proven at scale.** v0.6.1, validated against 4,590 memories in one developer's production store. The Rumen 2026-04-19 re-kickstart processed 166 sessions into 166 insights in ~5.5 minutes. No multi-user data yet. Bug reports and issues welcome.
+- **Not proven at scale.** v0.6.4, validated against 4,669 memories in one developer's production store. The Rumen 2026-04-19 re-kickstart processed 166 sessions into 166 insights in ~5.5 minutes. No multi-user data yet. Bug reports and issues welcome.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jhizzard/termdeck",
-  "version": "0.6.3",
+  "version": "0.6.4",
   "description": "Browser-based terminal multiplexer with metadata overlays, panel flashback memory recall, and AI-aware session management",
   "bin": {
     "termdeck": "./packages/cli/src/index.js"

package/packages/cli/src/init-mnestra.js

@@ -22,6 +22,11 @@
 //                       set is already on disk (otherwise the wizard asks
 //                       interactively before reusing)
 //   --reset             Ignore saved secrets and re-prompt for everything
+//   --from-env          Skip every prompt; read all five secrets from the
+//                       process environment (SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY,
+//                       DATABASE_URL, OPENAI_API_KEY, ANTHROPIC_API_KEY).
+//                       Required for terminals that fight with our raw-mode
+//                       secret prompt and for CI / scripted installs.
 //   --dry-run           Print what the wizard would do; don't touch the DB or filesystem
 //   --skip-verify       Skip the final memory_status_aggregation() check
 //
@@ -52,6 +57,12 @@ const HELP = [
   '  --yes             Reuse saved secrets without prompting (if a complete',
   '                    set is already on disk in ~/.termdeck/secrets.env)',
   '  --reset           Ignore saved secrets and re-prompt for everything',
+  '  --from-env        Skip every prompt; read SUPABASE_URL,',
+  '                    SUPABASE_SERVICE_ROLE_KEY, DATABASE_URL, OPENAI_API_KEY,',
+  '                    ANTHROPIC_API_KEY from environment variables instead.',
+  '                    Useful for terminals that fight with raw-mode secret',
+  '                    prompts (MobaXterm SSH, some Windows shells) and for',
+  '                    CI / scripted installs.',
   '  --dry-run         Print the plan without touching the database or filesystem',
   '  --skip-verify     Skip the final memory_status_aggregation() sanity call',
   '',
@@ -70,17 +81,91 @@ const HELP = [
 ].join('\n');
 
 function parseFlags(argv) {
-  const out = { help: false, yes: false, reset: false, dryRun: false, skipVerify: false };
+  const out = {
+    help: false,
+    yes: false,
+    reset: false,
+    fromEnv: false,
+    dryRun: false,
+    skipVerify: false
+  };
   for (const a of argv) {
     if (a === '--help' || a === '-h') out.help = true;
     else if (a === '--yes' || a === '-y') out.yes = true;
     else if (a === '--reset') out.reset = true;
+    else if (a === '--from-env') out.fromEnv = true;
     else if (a === '--dry-run') out.dryRun = true;
     else if (a === '--skip-verify') out.skipVerify = true;
   }
   return out;
 }
 
+// Build inputs from process.env directly, skipping every askSecret prompt.
+// Used by --from-env so callers on terminals that fight with our raw-mode
+// secret prompt (Brad's MobaXterm SSH report 2026-04-25, fourth occurrence)
+// can hand the wizard their secrets via env vars instead. Also makes the
+// wizard scriptable for CI / one-shot installers. Returns the same shape
+// as collectInputs() so the rest of main() doesn't care which path filled
+// it. Throws with an actionable message when a required env var is missing
+// or fails its shape check — `--from-env` is strict by design (no fallback
+// to prompts), since callers using it have explicitly opted into the
+// non-interactive path.
+function inputsFromEnv() {
+  const env = process.env;
+  const missing = [];
+  const required = {
+    SUPABASE_URL: env.SUPABASE_URL,
+    SUPABASE_SERVICE_ROLE_KEY: env.SUPABASE_SERVICE_ROLE_KEY,
+    DATABASE_URL: env.DATABASE_URL,
+    OPENAI_API_KEY: env.OPENAI_API_KEY
+  };
+  for (const [k, v] of Object.entries(required)) {
+    if (!v || !v.trim()) missing.push(k);
+  }
+  if (missing.length > 0) {
+    throw new Error(
+      `--from-env is missing required environment variable(s): ${missing.join(', ')}.\n` +
+      'Set every required key in your shell or pass them on the command line, e.g.:\n' +
+      '  SUPABASE_URL=https://xyz.supabase.co \\\n' +
+      '  SUPABASE_SERVICE_ROLE_KEY=sb_secret_... \\\n' +
+      '  DATABASE_URL=postgres://postgres.<ref>:<pw>@<pooler-host>:6543/postgres \\\n' +
+      '  OPENAI_API_KEY=sk-proj-... \\\n' +
+      '  ANTHROPIC_API_KEY=sk-ant-... \\\n' +
+      '  termdeck init --mnestra --from-env'
+    );
+  }
+
+  const projectUrl = urlHelper.parseProjectUrl(required.SUPABASE_URL);
+  if (!projectUrl.ok) {
+    throw new Error(`SUPABASE_URL is malformed: ${projectUrl.error}`);
+  }
+
+  const dbErr = urlHelper.looksLikePostgresUrl(required.DATABASE_URL);
+  if (dbErr) throw new Error(`DATABASE_URL: ${dbErr}`);
+
+  const srErr = urlHelper.looksLikeServiceRole(required.SUPABASE_SERVICE_ROLE_KEY);
+  if (srErr) throw new Error(`SUPABASE_SERVICE_ROLE_KEY: ${srErr}`);
+
+  const oaErr = urlHelper.looksLikeOpenAiKey(required.OPENAI_API_KEY);
+  if (oaErr) throw new Error(`OPENAI_API_KEY: ${oaErr}`);
+
+  const anthropicKey = (env.ANTHROPIC_API_KEY || '').trim() || null;
+  if (anthropicKey) {
+    const aErr = urlHelper.looksLikeAnthropicKey(anthropicKey);
+    if (aErr) {
+      process.stdout.write(`  (warning: ANTHROPIC_API_KEY ${aErr} — storing anyway)\n`);
+    }
+  }
+
+  return {
+    projectUrl,
+    serviceRoleKey: required.SUPABASE_SERVICE_ROLE_KEY,
+    databaseUrl: required.DATABASE_URL,
+    openaiKey: required.OPENAI_API_KEY,
+    anthropicKey
+  };
+}
+
 function printBanner() {
   process.stdout.write(`
 TermDeck Mnestra Setup
@@ -100,6 +185,8 @@ This wizard configures TermDeck's Tier 2 memory layer (Mnestra) by:
 
 If you already have a complete ~/.termdeck/secrets.env, the wizard will
 offer to reuse it (or pass --yes to skip the prompt and resume directly).
+If your terminal fights with the secret prompt, set the five env vars and
+pass --from-env to skip every prompt entirely.
 
 Press Ctrl+C at any time to cancel.
 
@@ -354,11 +441,25 @@ async function main(argv) {
   printBanner();
 
   let inputs;
-  try {
-    inputs = await collectInputs({ yes: flags.yes, reset: flags.reset });
-  } catch (err) {
-    process.stderr.write(`\n[init --mnestra] ${err.message}\n`);
-    return 2;
+  if (flags.fromEnv) {
+    // Skip every interactive prompt — secrets come from process.env. Used
+    // when the user's terminal fights with the raw-mode secret prompt
+    // (Brad/MobaXterm SSH, 2026-04-25 fourth report) or when the wizard
+    // is being driven from a CI/install script.
+    process.stdout.write('Reading secrets from environment variables (--from-env).\n\n');
+    try {
+      inputs = inputsFromEnv();
+    } catch (err) {
+      process.stderr.write(`\n[init --mnestra] ${err.message}\n`);
+      return 2;
+    }
+  } else {
+    try {
+      inputs = await collectInputs({ yes: flags.yes, reset: flags.reset });
+    } catch (err) {
+      process.stderr.write(`\n[init --mnestra] ${err.message}\n`);
+      return 2;
+    }
   }
 
   // Persist secrets BEFORE pg work. If the wizard dies past this point

package/packages/cli/src/init-rumen.js

@@ -210,6 +210,35 @@ function runShellCaptured(command, args, opts = {}) {
   return { ok: r.status === 0, code: r.status, stdout: r.stdout || '', stderr: r.stderr || '' };
 }
 
+// Detect the "no access token" signature in `supabase link` stderr so the
+// wizard can surface a path-aware hint instead of dumping raw CLI output at
+// the user. Brad hit this on 2026-04-26 00:25 UTC on MobaXterm SSH after
+// v0.6.3 unblocked init --mnestra: he had no SUPABASE_ACCESS_TOKEN env var
+// and `supabase login` requires a browser, which his SSH session doesn't
+// have. The actionable path on a non-desktop install is always a PAT from
+// the dashboard — link() now points users straight at it.
+function looksLikeMissingAccessToken(stderr) {
+  if (!stderr) return false;
+  return /Access token not provided/i.test(stderr) ||
+    /SUPABASE_ACCESS_TOKEN environment variable/i.test(stderr);
+}
+
+function printAccessTokenHint() {
+  process.stderr.write(
+    '\nThe Supabase CLI needs a Personal Access Token to link your project.\n' +
+    'On a desktop install you can run `supabase login`, but that opens a\n' +
+    'browser, so SSH/headless users should use the env-var path instead:\n' +
+    '\n' +
+    '  1. Generate a token: https://supabase.com/dashboard/account/tokens\n' +
+    '  2. Export it in your shell:\n' +
+    '       export SUPABASE_ACCESS_TOKEN=sbp_...\n' +
+    '  3. Re-run: termdeck init --rumen\n' +
+    '\n' +
+    'TermDeck does not store this token — it only lives in your shell\n' +
+    'environment for the duration of the install.\n'
+  );
+}
+
 async function link(projectRef, dryRun) {
   step(`Running: supabase link --project-ref ${projectRef}...`);
   if (dryRun) { ok('(dry-run)'); return true; }
@@ -217,6 +246,7 @@ async function link(projectRef, dryRun) {
   if (!r.ok) {
     fail(`supabase link failed (exit ${r.code})`);
     if (r.stderr) process.stderr.write(r.stderr + '\n');
+    if (looksLikeMissingAccessToken(r.stderr)) printAccessTokenHint();
     return false;
   }
   ok();
@@ -512,3 +542,6 @@ if (require.main === module) {
 }
 
 module.exports = main;
+// Test surface — kept on the same export object so the regression suite can
+// pin the access-token detection without spawning a real `supabase` binary.
+module.exports._looksLikeMissingAccessToken = looksLikeMissingAccessToken;