@kendoo.agentdesk/agentdesk 0.19.2 → 0.19.4

package/CHANGELOG.md

@@ -13,6 +13,16 @@ Internal refactors, infrastructure changes, and architectural notes are not list
 ### Added
 - `[UI]` Private-session sharing flow. When someone visits a session URL they don't own, they now see a friendly "Shh… this one's private" page with a one-click "Request access" button instead of a blank error. The session owner sees pending requests in a new header inbox and can grant viewer access for just that session or the whole project. Viewer-granted sessions show up in the teammate's sidebar tagged as a viewer.
 
+## [0.19.4] — 2026-04-19
+
+### Added
+- `[CLI]` `agentdesk bootstrap` — fresh-machine setup for repos already configured on another machine. Reads the committed `.agentdesk.json` for project identity, tracker type, team/project key, and GitHub repo, then only prompts for the per-machine secrets (Linear API key, Jira email + token, GitHub token) that belong in the local `.env`. Previously the only post-clone path was `agentdesk init`, which walked the full wizard and risked overwriting project-wide settings when the user just wanted to paste in their own tokens. Bootstrap never writes `.agentdesk.json` and never pushes to the server, so the first machine's setup stays untouched. `agentdesk login` now points at both `init` (new project) and `bootstrap` (cloned repo) as next steps.
+
+## [0.19.3] — 2026-04-19
+
+### Fixed
+- `[CLI]` `agentdesk init` no longer silently saves tracker credentials that fail verification. Previously a typo in the email, a revoked API token, or a wrong tenant URL would print a one-line warning and proceed — leaving the user with a "valid-looking" `.env` that then failed at `agentdesk team` time with a generic "authentication failed" message. Init now prompts to re-enter credentials, save anyway, or cancel, so broken config is caught at the moment it's typed instead of the next time a session is started.
+
 ## [0.19.2] — 2026-04-18
 
 ### Fixed

package/README.md

@@ -47,6 +47,8 @@ A guided wizard walks you through it: picks up your project type, asks which tas
 
 Re-running `agentdesk init` in a project that already has config offers a "tracker only" shortcut. Use `agentdesk init --quick` to skip the narrative copy for scripted setups.
 
+**On a second machine** (repo cloned from a teammate's setup): run `agentdesk bootstrap` instead of `init`. It reads the committed `.agentdesk.json` for the project-wide settings (tracker type, team/project key, repo) and only prompts for per-machine secrets (Linear API key, Jira email + token, GitHub token) that end up in `.env`. The other machine's `.env` and the server config are left untouched.
+
 `.agentdesk.json` is kept in sync with the server: every CLI run fetches the authoritative config and rewrites the local file as a credential-free snapshot. Credentials live only on the server, encrypted. If a local edit disagreed with the server's value, a one-line warning lists the overridden fields.
 
 ### 4. Run a team session
@@ -72,6 +74,7 @@ Watch the session live at [agentdesk.live](https://agentdesk.live). Each session
 agentdesk login                        Sign in to AgentDesk
 agentdesk logout                       Sign out and remove credentials
 agentdesk init                         Set up project and configure tracker
+agentdesk bootstrap                    Fill in per-machine tokens on a cloned repo
 agentdesk team <TASK-ID>               Run a team session on an existing task
 agentdesk team -d "..."                Describe what you want — task created automatically
 agentdesk <agent> -d "..."             Run a single agent (jane, dennis, sam, bart, vera, luna, mark, nora)

package/bin/agentdesk.mjs

@@ -58,10 +58,16 @@ if (!command || command === "help" || command === "--help") {
     2. agentdesk init           Set up your project (choose tracker, save config)
     3. agentdesk team TASK-123  Run a team session
 
+  On a freshly cloned repo (already set up on another machine):
+    1. agentdesk login          Sign in
+    2. agentdesk bootstrap      Fill in per-machine secrets (tokens)
+    3. agentdesk team TASK-123  Run a team session
+
   Commands:
     agentdesk login                        Sign in to AgentDesk
     agentdesk logout                       Sign out and remove credentials
     agentdesk init [--quick]               Set up project and configure tracker
+    agentdesk bootstrap                    Fill in per-machine tokens on a cloned repo
     agentdesk team <TASK-ID>               Run a team session on an existing task
     agentdesk team -d "..."                Create a task and run a session
     agentdesk <agent> -d "..."             Run a single agent (jane, dennis, sam, bart, vera, luna, mark, nora)
@@ -146,6 +152,11 @@ else if (command === "init") {
   await runInit(process.cwd(), { quick });
 }
 
+else if (command === "bootstrap") {
+  const { runBootstrap } = await import("../cli/bootstrap.mjs");
+  await runBootstrap(process.cwd());
+}
+
 else if (command === "team") {
   // Parse options first to find -d, --cwd, --child-strategy
   let description = "";

package/cli/bootstrap.mjs

@@ -0,0 +1,287 @@
+// `agentdesk bootstrap` — fill in per-machine secrets after cloning a repo
+// that's already been set up on a different machine.
+//
+// Intent: on a fresh clone, `.agentdesk.json` carries the project identity,
+// tracker binding, and GitHub repo — everything that's project-wide. What's
+// missing are the per-machine secrets that live in `.env` (LINEAR_API_KEY,
+// JIRA_EMAIL/JIRA_API_TOKEN, GITHUB_TOKEN). Bootstrap detects which are
+// missing or invalid and prompts only for those.
+//
+// Hard constraints:
+//   - Never write `.agentdesk.json` (besides the cached-server-state rewrite
+//     that loadConfig already does on every CLI run — we don't add new ones).
+//   - Never push to the server. Project-wide config on machine 1 is untouched.
+//   - Only writes to `.env`.
+//   - Idempotent. Running on a fully-configured machine prints "all set" and
+//     exits 0.
+
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+import { createInterface } from "readline";
+import { loadConfig } from "./config.mjs";
+import { getStoredApiKey } from "./login.mjs";
+import { checkTrackerPermissions, resolveCredentialsFromEnv } from "./tracker-check.mjs";
+import { assertPushable, PreflightError } from "./session-preflight.mjs";
+
+const SERVER = process.env.AGENTDESK_SERVER || "https://agentdesk.live";
+
+function ask(rl, question) {
+  return new Promise(resolve => rl.question(question, resolve));
+}
+
+async function promptRequired(rl, label) {
+  while (true) {
+    const v = (await ask(rl, `  ${label}: `)).trim();
+    if (v) return v;
+    console.log(`  ${label} is required. Ctrl+C to abort.`);
+  }
+}
+
+function saveEnvVar(dir, key, value) {
+  const envPath = join(dir, ".env");
+  let content = existsSync(envPath) ? readFileSync(envPath, "utf-8") : "";
+  const re = new RegExp(`^${key}=.*$`, "m");
+  if (re.test(content)) {
+    content = content.replace(re, `${key}=${value}`);
+  } else {
+    content += `${content && !content.endsWith("\n") ? "\n" : ""}${key}=${value}\n`;
+  }
+  writeFileSync(envPath, content);
+}
+
+function loadDotEnvLocal(dir) {
+  const envPath = join(dir, ".env");
+  const out = {};
+  if (!existsSync(envPath)) return out;
+  for (const line of readFileSync(envPath, "utf-8").split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq !== -1) out[trimmed.slice(0, eq)] = trimmed.slice(eq + 1);
+  }
+  return out;
+}
+
+function readLocalConfig(cwd) {
+  const path = join(cwd, ".agentdesk.json");
+  if (!existsSync(path)) return null;
+  try { return JSON.parse(readFileSync(path, "utf-8")); } catch { return null; }
+}
+
+// Compact step list — the init wizard carries the full narrative; bootstrap
+// assumes the user has already seen it on their first machine.
+function printTrackerHint(tracker) {
+  if (tracker === "linear") {
+    console.log("  (Get a Linear API key at https://linear.app/settings/api)");
+  } else if (tracker === "jira") {
+    console.log("  (Create a Jira API token at https://id.atlassian.com/manage-profile/security/api-tokens)");
+  } else if (tracker === "github") {
+    console.log("  (Create a GitHub token at https://github.com/settings/tokens — scope: repo)");
+  }
+}
+
+// Walk missing tracker credentials and prompt for each. Writes to .env.
+// Returns the merged credentials map so the caller can verify.
+async function promptTrackerCreds(rl, cwd, tracker, existing) {
+  const creds = { ...existing };
+  if (tracker === "linear") {
+    if (!creds.LINEAR_API_KEY) {
+      console.log("");
+      printTrackerHint("linear");
+      const v = await promptRequired(rl, "Linear API key");
+      saveEnvVar(cwd, "LINEAR_API_KEY", v);
+      creds.LINEAR_API_KEY = v;
+      console.log("  ✓ Saved LINEAR_API_KEY to .env");
+    }
+  } else if (tracker === "jira") {
+    if (!creds.JIRA_EMAIL) {
+      console.log("");
+      printTrackerHint("jira");
+      const v = await promptRequired(rl, "Your Atlassian login email");
+      saveEnvVar(cwd, "JIRA_EMAIL", v);
+      creds.JIRA_EMAIL = v;
+      console.log("  ✓ Saved JIRA_EMAIL to .env");
+    }
+    if (!creds.JIRA_API_TOKEN) {
+      if (creds.JIRA_EMAIL) console.log("");
+      const v = await promptRequired(rl, "Jira API token");
+      saveEnvVar(cwd, "JIRA_API_TOKEN", v);
+      creds.JIRA_API_TOKEN = v;
+      console.log("  ✓ Saved JIRA_API_TOKEN to .env");
+    }
+  }
+  return creds;
+}
+
+async function promptGitHubToken(rl, cwd) {
+  console.log("");
+  printTrackerHint("github");
+  const v = await promptRequired(rl, "GitHub token");
+  saveEnvVar(cwd, "GITHUB_TOKEN", v);
+  console.log("  ✓ Saved GITHUB_TOKEN to .env");
+  return v;
+}
+
+async function selectOption(rl, prompt, options) {
+  console.log(`  ${prompt}`);
+  console.log("");
+  options.forEach((opt, i) => console.log(`    ${i + 1}) ${opt.label}`));
+  console.log("");
+  while (true) {
+    const answer = await ask(rl, `  Choose (1-${options.length}): `);
+    const num = parseInt(answer.trim(), 10);
+    if (num >= 1 && num <= options.length) return options[num - 1];
+    console.log(`  Please enter a number between 1 and ${options.length}`);
+  }
+}
+
+export async function runBootstrap(cwd = process.cwd()) {
+  console.log("");
+  console.log("  AgentDesk — Bootstrap this machine");
+  console.log("  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━");
+  console.log("");
+
+  // 1. Must be logged in.
+  const apiKey = getStoredApiKey();
+  if (!apiKey) {
+    console.log("  Not logged in. Run `agentdesk login` first.");
+    console.log("");
+    process.exit(1);
+  }
+
+  // 2. Must have a project config committed in this repo.
+  const localConfig = readLocalConfig(cwd);
+  if (!localConfig) {
+    console.log("  No .agentdesk.json in this directory.");
+    console.log("  This command is for repos that were already set up on another machine.");
+    console.log("  For a new project, run: agentdesk init");
+    console.log("");
+    process.exit(1);
+  }
+
+  const projectKey = localConfig.projectKey;
+  if (!projectKey) {
+    console.log("  .agentdesk.json has no projectKey — run `agentdesk init` to repair.");
+    console.log("");
+    process.exit(1);
+  }
+
+  // 3. Load merged config (server-authoritative when reachable). This is the
+  //    same call `agentdesk team` makes, so we see the same view.
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const config = await loadConfig(cwd, { apiKey, serverUrl: SERVER, projectName: projectKey, silent: true });
+
+  const tracker = config.tracker || null;
+  const repo = config.github?.repo || null;
+  const login = config.github?.login || null;
+
+  console.log(`  Project:   ${projectKey}`);
+  console.log(`  Tracker:   ${tracker || "none"}`);
+  if (tracker === "linear" && config.linear?.teamKey) console.log(`  Team:      ${config.linear.teamKey}`);
+  if (tracker === "jira" && config.jira?.project) console.log(`  Project:   ${config.jira.project}`);
+  if (repo) console.log(`  Repo:      ${repo}${login ? ` (@${login})` : ""}`);
+  console.log("");
+
+  // 4. Gap scan + prompt loop. We retry tracker + github verification up to
+  //    three times, matching init's retry/skip/cancel UX.
+  let creds = resolveCredentialsFromEnv(loadDotEnvLocal(cwd));
+  let trackerOk = !tracker; // no tracker → nothing to verify
+  let githubOk = false;
+  let attempts = 0;
+
+  while (attempts < 5) {
+    attempts += 1;
+
+    // Tracker
+    if (tracker && !trackerOk) {
+      const missing =
+        (tracker === "linear" && !creds.LINEAR_API_KEY) ||
+        (tracker === "jira" && (!creds.JIRA_EMAIL || !creds.JIRA_API_TOKEN));
+      if (missing) {
+        creds = await promptTrackerCreds(rl, cwd, tracker, creds);
+      }
+      process.stdout.write("  Verifying tracker access... ");
+      const check = await checkTrackerPermissions({ tracker, config, credentials: creds });
+      if (check.ok) {
+        console.log("✓");
+        if (check.identity?.name || check.identity?.email) {
+          const label = check.identity.name || check.identity.login || check.identity.email;
+          console.log(`  ✓ Posting as: ${label}`);
+        }
+        trackerOk = true;
+      } else {
+        console.log("failed");
+        for (const e of check.errors || []) console.log(`    • ${e}`);
+        console.log("");
+        const next = await selectOption(rl, "What now?", [
+          { label: "Re-enter credentials", value: "retry" },
+          { label: "Skip tracker (fix later in .env)", value: "skip" },
+          { label: "Cancel", value: "cancel" },
+        ]);
+        console.log("");
+        if (next.value === "cancel") { rl.close(); process.exit(1); }
+        if (next.value === "skip") { trackerOk = true; break; }
+        // retry: clear the tracker-specific creds so the next loop re-prompts
+        if (tracker === "linear") delete creds.LINEAR_API_KEY;
+        if (tracker === "jira") { delete creds.JIRA_EMAIL; delete creds.JIRA_API_TOKEN; }
+        continue;
+      }
+    }
+
+    // GitHub — always required (agents push code regardless of tracker)
+    if (!githubOk) {
+      if (!creds.GITHUB_TOKEN) {
+        creds.GITHUB_TOKEN = await promptGitHubToken(rl, cwd);
+      }
+      try {
+        assertPushable({ cwd, creds: { GITHUB_TOKEN: creds.GITHUB_TOKEN }, projectName: projectKey });
+        // Best-effort gh API check to confirm the token is valid and matches
+        // the configured login. Mirrors init.mjs:495-506.
+        try {
+          const { execSync } = await import("child_process");
+          const env = { ...process.env, GH_TOKEN: creds.GITHUB_TOKEN };
+          const who = execSync("gh api user --jq .login", { env, stdio: ["ignore", "pipe", "ignore"], encoding: "utf-8" }).trim();
+          if (who && login && who.toLowerCase() !== login.toLowerCase()) {
+            console.log(`  ⚠  GitHub token authenticates as @${who}, not @${login} (from .agentdesk.json). Agents will post as @${who}.`);
+          } else if (who) {
+            console.log(`  ✓ GitHub verified as @${who}`);
+          }
+        } catch {
+          console.log("  ✓ GITHUB_TOKEN present (couldn't verify via gh — install gh CLI for identity check)");
+        }
+        githubOk = true;
+      } catch (err) {
+        if (err instanceof PreflightError) {
+          console.log(`  ✗ ${err.message}`);
+          console.log("");
+          const next = await selectOption(rl, "What now?", [
+            { label: "Re-enter GITHUB_TOKEN", value: "retry" },
+            { label: "Skip (sessions will fail until fixed)", value: "skip" },
+            { label: "Cancel", value: "cancel" },
+          ]);
+          console.log("");
+          if (next.value === "cancel") { rl.close(); process.exit(1); }
+          if (next.value === "skip") { githubOk = true; break; }
+          delete creds.GITHUB_TOKEN;
+          continue;
+        }
+        throw err;
+      }
+    }
+
+    if (trackerOk && githubOk) break;
+  }
+
+  rl.close();
+
+  console.log("");
+  if (trackerOk && githubOk) {
+    console.log("  Ready. Try:");
+    const prefix = config.linear?.teamKey || config.jira?.project || projectKey.toUpperCase();
+    console.log(`    agentdesk team ${prefix}-123`);
+    console.log("");
+  } else {
+    console.log("  Bootstrap finished with missing pieces — edit .env directly or re-run.");
+    console.log("");
+  }
+}

package/cli/init.mjs

@@ -406,16 +406,54 @@ export async function runInit(cwd, opts = {}) {
     config.github = { repo, login };
   }
 
-  // Verify tracker + fetch available projects to pick from.
+  // Verify tracker + fetch available projects to pick from. If verification
+  // fails (bad email, revoked token, typo in base URL), loop back and let the
+  // user re-enter credentials rather than silently saving broken config.
   let trackerLocation = null;
   if (tracker === "jira") trackerLocation = config.jira?.baseUrl;
+  let verified = { ok: true };
   if (tracker) {
-    const verified = await verifyAndPickTrackerProject({ rl, cwd, finalProjectKey, tracker, config, location: trackerLocation });
-    if (!verified.ok) {
-      console.log("  Continuing without tracker verification.");
-      console.log("  You can re-run `agentdesk init` after fixing credentials.");
+    while (true) {
+      verified = await verifyAndPickTrackerProject({ rl, cwd, finalProjectKey, tracker, config, location: trackerLocation });
+      if (verified.ok) break;
       console.log("");
-    } else if (verified.trackerProjectId) {
+      const next = await selectOption(rl, "What now?", [
+        { label: "Re-enter credentials and try again", value: "retry" },
+        { label: "Save config anyway (will need to fix before `agentdesk team`)", value: "skip" },
+        { label: "Cancel init", value: "cancel" },
+      ]);
+      console.log("");
+      if (next.value === "cancel") {
+        rl.close();
+        return;
+      }
+      if (next.value === "skip") break;
+      // Retry: re-prompt only the tracker auth fields, not the whole wizard.
+      if (tracker === "linear") {
+        const key = await promptRequired(rl, "Linear API key");
+        saveEnvVar(cwd, "LINEAR_API_KEY", key);
+        console.log("  ✓ Updated LINEAR_API_KEY in .env");
+        console.log("");
+      } else if (tracker === "jira") {
+        const baseUrl = (await ask(rl, `  Jira tenant URL [${config.jira?.baseUrl || ""}]: `)).trim() || config.jira?.baseUrl;
+        const email = await promptRequired(rl, "Your Atlassian login email");
+        const token = await promptRequired(rl, "Jira API token");
+        saveEnvVar(cwd, "JIRA_EMAIL", email);
+        saveEnvVar(cwd, "JIRA_API_TOKEN", token);
+        if (baseUrl) {
+          config.jira = { ...(config.jira || {}), baseUrl: baseUrl.replace(/\/+$/, "") };
+          trackerLocation = config.jira.baseUrl;
+        }
+        console.log("  ✓ Updated JIRA_EMAIL and JIRA_API_TOKEN in .env");
+        console.log("");
+      } else if (tracker === "github") {
+        const token = await promptRequired(rl, "GitHub token");
+        saveEnvVar(cwd, "GITHUB_TOKEN", token);
+        console.log("  ✓ Updated GITHUB_TOKEN in .env");
+        console.log("");
+      }
+    }
+    if (verified.ok && verified.trackerProjectId) {
       if (tracker === "linear") config.linear = { ...(config.linear || {}), teamKey: verified.trackerProjectId };
       if (tracker === "jira") config.jira = { ...(config.jira || {}), project: verified.trackerProjectId };
       // Use the tracker's project key as the default agentdesk project key.

package/cli/login.mjs

@@ -114,7 +114,8 @@ export async function runLogin() {
         console.log(`  API key saved to ~/.agentdesk/credentials.json`);
         console.log("");
         console.log("  Next steps:");
-        console.log("    agentdesk init");
+        console.log("    agentdesk init              (new project on this machine)");
+        console.log("    agentdesk bootstrap         (repo cloned from another machine)");
         console.log("    agentdesk team TASK-123");
         console.log("");
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kendoo.agentdesk/agentdesk",
-  "version": "0.19.2",
+  "version": "0.19.4",
   "description": "AI team orchestrator for Claude Code — run collaborative agent sessions from your terminal",
   "type": "module",
   "bin": {