@kendoo.agentdesk/agentdesk 0.19.3 → 0.19.5

package/CHANGELOG.md

@@ -13,6 +13,16 @@ Internal refactors, infrastructure changes, and architectural notes are not list
 ### Added
 - `[UI]` Private-session sharing flow. When someone visits a session URL they don't own, they now see a friendly "Shh… this one's private" page with a one-click "Request access" button instead of a blank error. The session owner sees pending requests in a new header inbox and can grant viewer access for just that session or the whole project. Viewer-granted sessions show up in the teammate's sidebar tagged as a viewer.
 
+## [0.19.5] — 2026-04-19
+
+### Changed
+- `[CLI]` `agentdesk bootstrap` now works even when the cloned repo has no committed `.agentdesk.json`. If the project config file is absent, bootstrap fetches the user's project list from the server, tries to auto-match by the git remote (`origin`), and falls back to a numbered picker of the account's projects. Once picked, a minimal `.agentdesk.json` is written locally (prompting the user to commit it so future clones skip the picker) and the rest of the gap-scan continues unchanged. Previous behavior required the file to already be present.
+
+## [0.19.4] — 2026-04-19
+
+### Added
+- `[CLI]` `agentdesk bootstrap` — fresh-machine setup for repos already configured on another machine. Reads the committed `.agentdesk.json` for project identity, tracker type, team/project key, and GitHub repo, then only prompts for the per-machine secrets (Linear API key, Jira email + token, GitHub token) that belong in the local `.env`. Previously the only post-clone path was `agentdesk init`, which walked the full wizard and risked overwriting project-wide settings when the user just wanted to paste in their own tokens. Bootstrap never writes `.agentdesk.json` and never pushes to the server, so the first machine's setup stays untouched. `agentdesk login` now points at both `init` (new project) and `bootstrap` (cloned repo) as next steps.
+
 ## [0.19.3] — 2026-04-19
 
 ### Fixed

package/README.md

@@ -47,6 +47,8 @@ A guided wizard walks you through it: picks up your project type, asks which tas
 
 Re-running `agentdesk init` in a project that already has config offers a "tracker only" shortcut. Use `agentdesk init --quick` to skip the narrative copy for scripted setups.
 
+**On a second machine** (repo cloned from a teammate's setup): run `agentdesk bootstrap` instead of `init`. It reads the committed `.agentdesk.json` for the project-wide settings (tracker type, team/project key, repo) and only prompts for per-machine secrets (Linear API key, Jira email + token, GitHub token) that end up in `.env`. The other machine's `.env` and the server config are left untouched.
+
 `.agentdesk.json` is kept in sync with the server: every CLI run fetches the authoritative config and rewrites the local file as a credential-free snapshot. Credentials live only on the server, encrypted. If a local edit disagreed with the server's value, a one-line warning lists the overridden fields.
 
 ### 4. Run a team session
@@ -72,6 +74,7 @@ Watch the session live at [agentdesk.live](https://agentdesk.live). Each session
 agentdesk login                        Sign in to AgentDesk
 agentdesk logout                       Sign out and remove credentials
 agentdesk init                         Set up project and configure tracker
+agentdesk bootstrap                    Fill in per-machine tokens on a cloned repo
 agentdesk team <TASK-ID>               Run a team session on an existing task
 agentdesk team -d "..."                Describe what you want — task created automatically
 agentdesk <agent> -d "..."             Run a single agent (jane, dennis, sam, bart, vera, luna, mark, nora)

package/bin/agentdesk.mjs

@@ -58,10 +58,16 @@ if (!command || command === "help" || command === "--help") {
     2. agentdesk init           Set up your project (choose tracker, save config)
     3. agentdesk team TASK-123  Run a team session
 
+  On a freshly cloned repo (already set up on another machine):
+    1. agentdesk login          Sign in
+    2. agentdesk bootstrap      Fill in per-machine secrets (tokens)
+    3. agentdesk team TASK-123  Run a team session
+
   Commands:
     agentdesk login                        Sign in to AgentDesk
     agentdesk logout                       Sign out and remove credentials
     agentdesk init [--quick]               Set up project and configure tracker
+    agentdesk bootstrap                    Fill in per-machine tokens on a cloned repo
     agentdesk team <TASK-ID>               Run a team session on an existing task
     agentdesk team -d "..."                Create a task and run a session
     agentdesk <agent> -d "..."             Run a single agent (jane, dennis, sam, bart, vera, luna, mark, nora)
@@ -146,6 +152,11 @@ else if (command === "init") {
   await runInit(process.cwd(), { quick });
 }
 
+else if (command === "bootstrap") {
+  const { runBootstrap } = await import("../cli/bootstrap.mjs");
+  await runBootstrap(process.cwd());
+}
+
 else if (command === "team") {
   // Parse options first to find -d, --cwd, --child-strategy
   let description = "";

package/cli/bootstrap.mjs

@@ -0,0 +1,399 @@
+// `agentdesk bootstrap` — fill in per-machine secrets after cloning a repo
+// that's already been set up on a different machine.
+//
+// Intent: on a fresh clone, `.agentdesk.json` carries the project identity,
+// tracker binding, and GitHub repo — everything that's project-wide. What's
+// missing are the per-machine secrets that live in `.env` (LINEAR_API_KEY,
+// JIRA_EMAIL/JIRA_API_TOKEN, GITHUB_TOKEN). Bootstrap detects which are
+// missing or invalid and prompts only for those.
+//
+// Hard constraints:
+//   - Never write `.agentdesk.json` (besides the cached-server-state rewrite
+//     that loadConfig already does on every CLI run — we don't add new ones).
+//   - Never push to the server. Project-wide config on machine 1 is untouched.
+//   - Only writes to `.env`.
+//   - Idempotent. Running on a fully-configured machine prints "all set" and
+//     exits 0.
+
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+import { createInterface } from "readline";
+import { execSync } from "child_process";
+import { loadConfig } from "./config.mjs";
+import { getStoredApiKey } from "./login.mjs";
+import { checkTrackerPermissions, resolveCredentialsFromEnv } from "./tracker-check.mjs";
+import { assertPushable, PreflightError } from "./session-preflight.mjs";
+
+const SERVER = process.env.AGENTDESK_SERVER || "https://agentdesk.live";
+
+function detectGitRemote(dir) {
+  try {
+    const url = execSync("git remote get-url origin", { cwd: dir, stdio: ["ignore", "pipe", "ignore"], encoding: "utf-8" }).trim();
+    const m = url.match(/github\.com[:/]([^/]+)\/([^/.]+?)(?:\.git)?$/);
+    if (m) return `${m[1]}/${m[2]}`;
+  } catch {}
+  return null;
+}
+
+async function fetchProjects(apiKey) {
+  try {
+    const res = await fetch(`${SERVER}/api/projects`, {
+      headers: { "x-api-key": apiKey },
+      signal: AbortSignal.timeout(8000),
+    });
+    if (!res.ok) return null;
+    return await res.json();
+  } catch { return null; }
+}
+
+async function fetchProjectSettings(apiKey, projectId) {
+  try {
+    const res = await fetch(`${SERVER}/api/projects/${projectId}/settings`, {
+      headers: { "x-api-key": apiKey },
+      signal: AbortSignal.timeout(5000),
+    });
+    if (!res.ok) return {};
+    return await res.json();
+  } catch { return {}; }
+}
+
+// Discover the server-side project for this clone when .agentdesk.json is
+// absent. Strategy:
+//   1. Fetch the user's projects list.
+//   2. For each, fetch settings so we can see github.repo.
+//   3. If we can match the local git remote to exactly one project's repo,
+//      auto-select (confirmation prompt).
+//   4. Otherwise show a numbered picker of all the user's projects.
+//   5. Write a minimal `.agentdesk.json` locally so loadConfig takes over
+//      from here.
+// Returns the chosen projectKey, or null if the user aborts.
+async function discoverProject(rl, cwd, apiKey) {
+  const remote = detectGitRemote(cwd);
+  if (remote) console.log(`  Detected git remote: ${remote}`);
+  console.log("  Fetching your projects from the server...");
+
+  const projects = await fetchProjects(apiKey);
+  if (!projects || projects.length === 0) {
+    console.log("");
+    console.log("  No projects found on your account.");
+    console.log("  Run `agentdesk init` on the primary machine first, then retry here.");
+    console.log("");
+    return null;
+  }
+
+  // Fetch settings in parallel so we can display/match the configured repo.
+  const settings = await Promise.all(projects.map(p => fetchProjectSettings(apiKey, p.id)));
+  const rows = projects.map((p, i) => {
+    const repo = settings[i]?.github?.repo || null;
+    const matches = remote && repo && repo.toLowerCase() === remote.toLowerCase();
+    return { project: p, settings: settings[i] || {}, repo, matches };
+  });
+
+  const exactMatches = rows.filter(r => r.matches);
+  let chosen = null;
+
+  if (exactMatches.length === 1) {
+    const r = exactMatches[0];
+    console.log(`  ✓ Match: ${r.project.name} (${r.project.id}) — repo ${r.repo}`);
+    console.log("");
+    const ans = (await askInline(rl, `  Use this project? [Y/n]: `)).trim().toLowerCase();
+    if (ans === "" || ans === "y" || ans === "yes") chosen = r;
+  }
+
+  if (!chosen) {
+    console.log("");
+    console.log("  Pick the project this repo maps to:");
+    console.log("");
+    rows.forEach((r, i) => {
+      const tag = r.matches ? " ← matches git remote" : "";
+      const repoStr = r.repo ? ` [${r.repo}]` : "";
+      console.log(`    ${i + 1}) ${r.project.name} (${r.project.id})${repoStr}${tag}`);
+    });
+    console.log("");
+    while (true) {
+      const answer = await askInline(rl, `  Choose (1-${rows.length}, or 'c' to cancel): `);
+      const trimmed = answer.trim().toLowerCase();
+      if (trimmed === "c" || trimmed === "cancel") return null;
+      const num = parseInt(trimmed, 10);
+      if (num >= 1 && num <= rows.length) { chosen = rows[num - 1]; break; }
+      console.log(`  Please enter a number between 1 and ${rows.length}`);
+    }
+  }
+
+  // Write a minimal .agentdesk.json — loadConfig will merge server state
+  // into it on the next call, producing the full cached view.
+  const minimal = { projectKey: chosen.project.id };
+  writeFileSync(join(cwd, ".agentdesk.json"), JSON.stringify(minimal, null, 2) + "\n");
+  console.log("");
+  console.log(`  ✓ Wrote .agentdesk.json (projectKey: ${chosen.project.id})`);
+  console.log("    (commit this file so future clones skip the picker)");
+  return chosen.project.id;
+}
+
+function askInline(rl, question) {
+  return new Promise(resolve => rl.question(question, resolve));
+}
+
+function ask(rl, question) {
+  return new Promise(resolve => rl.question(question, resolve));
+}
+
+async function promptRequired(rl, label) {
+  while (true) {
+    const v = (await ask(rl, `  ${label}: `)).trim();
+    if (v) return v;
+    console.log(`  ${label} is required. Ctrl+C to abort.`);
+  }
+}
+
+function saveEnvVar(dir, key, value) {
+  const envPath = join(dir, ".env");
+  let content = existsSync(envPath) ? readFileSync(envPath, "utf-8") : "";
+  const re = new RegExp(`^${key}=.*$`, "m");
+  if (re.test(content)) {
+    content = content.replace(re, `${key}=${value}`);
+  } else {
+    content += `${content && !content.endsWith("\n") ? "\n" : ""}${key}=${value}\n`;
+  }
+  writeFileSync(envPath, content);
+}
+
+function loadDotEnvLocal(dir) {
+  const envPath = join(dir, ".env");
+  const out = {};
+  if (!existsSync(envPath)) return out;
+  for (const line of readFileSync(envPath, "utf-8").split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq !== -1) out[trimmed.slice(0, eq)] = trimmed.slice(eq + 1);
+  }
+  return out;
+}
+
+function readLocalConfig(cwd) {
+  const path = join(cwd, ".agentdesk.json");
+  if (!existsSync(path)) return null;
+  try { return JSON.parse(readFileSync(path, "utf-8")); } catch { return null; }
+}
+
+// Compact step list — the init wizard carries the full narrative; bootstrap
+// assumes the user has already seen it on their first machine.
+function printTrackerHint(tracker) {
+  if (tracker === "linear") {
+    console.log("  (Get a Linear API key at https://linear.app/settings/api)");
+  } else if (tracker === "jira") {
+    console.log("  (Create a Jira API token at https://id.atlassian.com/manage-profile/security/api-tokens)");
+  } else if (tracker === "github") {
+    console.log("  (Create a GitHub token at https://github.com/settings/tokens — scope: repo)");
+  }
+}
+
+// Walk missing tracker credentials and prompt for each. Writes to .env.
+// Returns the merged credentials map so the caller can verify.
+async function promptTrackerCreds(rl, cwd, tracker, existing) {
+  const creds = { ...existing };
+  if (tracker === "linear") {
+    if (!creds.LINEAR_API_KEY) {
+      console.log("");
+      printTrackerHint("linear");
+      const v = await promptRequired(rl, "Linear API key");
+      saveEnvVar(cwd, "LINEAR_API_KEY", v);
+      creds.LINEAR_API_KEY = v;
+      console.log("  ✓ Saved LINEAR_API_KEY to .env");
+    }
+  } else if (tracker === "jira") {
+    if (!creds.JIRA_EMAIL) {
+      console.log("");
+      printTrackerHint("jira");
+      const v = await promptRequired(rl, "Your Atlassian login email");
+      saveEnvVar(cwd, "JIRA_EMAIL", v);
+      creds.JIRA_EMAIL = v;
+      console.log("  ✓ Saved JIRA_EMAIL to .env");
+    }
+    if (!creds.JIRA_API_TOKEN) {
+      if (creds.JIRA_EMAIL) console.log("");
+      const v = await promptRequired(rl, "Jira API token");
+      saveEnvVar(cwd, "JIRA_API_TOKEN", v);
+      creds.JIRA_API_TOKEN = v;
+      console.log("  ✓ Saved JIRA_API_TOKEN to .env");
+    }
+  }
+  return creds;
+}
+
+async function promptGitHubToken(rl, cwd) {
+  console.log("");
+  printTrackerHint("github");
+  const v = await promptRequired(rl, "GitHub token");
+  saveEnvVar(cwd, "GITHUB_TOKEN", v);
+  console.log("  ✓ Saved GITHUB_TOKEN to .env");
+  return v;
+}
+
+async function selectOption(rl, prompt, options) {
+  console.log(`  ${prompt}`);
+  console.log("");
+  options.forEach((opt, i) => console.log(`    ${i + 1}) ${opt.label}`));
+  console.log("");
+  while (true) {
+    const answer = await ask(rl, `  Choose (1-${options.length}): `);
+    const num = parseInt(answer.trim(), 10);
+    if (num >= 1 && num <= options.length) return options[num - 1];
+    console.log(`  Please enter a number between 1 and ${options.length}`);
+  }
+}
+
+export async function runBootstrap(cwd = process.cwd()) {
+  console.log("");
+  console.log("  AgentDesk — Bootstrap this machine");
+  console.log("  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━");
+  console.log("");
+
+  // 1. Must be logged in.
+  const apiKey = getStoredApiKey();
+  if (!apiKey) {
+    console.log("  Not logged in. Run `agentdesk login` first.");
+    console.log("");
+    process.exit(1);
+  }
+
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+
+  // 2. Find the server-side project for this clone. Prefer a committed
+  //    .agentdesk.json (clean path); fall back to discovering from the
+  //    user's server-side project list when the file is missing.
+  let localConfig = readLocalConfig(cwd);
+  let projectKey = localConfig?.projectKey || null;
+
+  if (!projectKey) {
+    if (localConfig) {
+      console.log("  .agentdesk.json has no projectKey — discovering project from server.");
+    } else {
+      console.log("  No .agentdesk.json in this directory — discovering project from server.");
+    }
+    console.log("");
+    projectKey = await discoverProject(rl, cwd, apiKey);
+    if (!projectKey) { rl.close(); process.exit(1); }
+    localConfig = readLocalConfig(cwd);
+    console.log("");
+  }
+
+  // 3. Load merged config (server-authoritative when reachable). This is the
+  //    same call `agentdesk team` makes, so we see the same view.
+  const config = await loadConfig(cwd, { apiKey, serverUrl: SERVER, projectName: projectKey, silent: true });
+
+  const tracker = config.tracker || null;
+  const repo = config.github?.repo || null;
+  const login = config.github?.login || null;
+
+  console.log(`  Project:   ${projectKey}`);
+  console.log(`  Tracker:   ${tracker || "none"}`);
+  if (tracker === "linear" && config.linear?.teamKey) console.log(`  Team:      ${config.linear.teamKey}`);
+  if (tracker === "jira" && config.jira?.project) console.log(`  Project:   ${config.jira.project}`);
+  if (repo) console.log(`  Repo:      ${repo}${login ? ` (@${login})` : ""}`);
+  console.log("");
+
+  // 4. Gap scan + prompt loop. We retry tracker + github verification up to
+  //    three times, matching init's retry/skip/cancel UX.
+  let creds = resolveCredentialsFromEnv(loadDotEnvLocal(cwd));
+  let trackerOk = !tracker; // no tracker → nothing to verify
+  let githubOk = false;
+  let attempts = 0;
+
+  while (attempts < 5) {
+    attempts += 1;
+
+    // Tracker
+    if (tracker && !trackerOk) {
+      const missing =
+        (tracker === "linear" && !creds.LINEAR_API_KEY) ||
+        (tracker === "jira" && (!creds.JIRA_EMAIL || !creds.JIRA_API_TOKEN));
+      if (missing) {
+        creds = await promptTrackerCreds(rl, cwd, tracker, creds);
+      }
+      process.stdout.write("  Verifying tracker access... ");
+      const check = await checkTrackerPermissions({ tracker, config, credentials: creds });
+      if (check.ok) {
+        console.log("✓");
+        if (check.identity?.name || check.identity?.email) {
+          const label = check.identity.name || check.identity.login || check.identity.email;
+          console.log(`  ✓ Posting as: ${label}`);
+        }
+        trackerOk = true;
+      } else {
+        console.log("failed");
+        for (const e of check.errors || []) console.log(`    • ${e}`);
+        console.log("");
+        const next = await selectOption(rl, "What now?", [
+          { label: "Re-enter credentials", value: "retry" },
+          { label: "Skip tracker (fix later in .env)", value: "skip" },
+          { label: "Cancel", value: "cancel" },
+        ]);
+        console.log("");
+        if (next.value === "cancel") { rl.close(); process.exit(1); }
+        if (next.value === "skip") { trackerOk = true; break; }
+        // retry: clear the tracker-specific creds so the next loop re-prompts
+        if (tracker === "linear") delete creds.LINEAR_API_KEY;
+        if (tracker === "jira") { delete creds.JIRA_EMAIL; delete creds.JIRA_API_TOKEN; }
+        continue;
+      }
+    }
+
+    // GitHub — always required (agents push code regardless of tracker)
+    if (!githubOk) {
+      if (!creds.GITHUB_TOKEN) {
+        creds.GITHUB_TOKEN = await promptGitHubToken(rl, cwd);
+      }
+      try {
+        assertPushable({ cwd, creds: { GITHUB_TOKEN: creds.GITHUB_TOKEN }, projectName: projectKey });
+        // Best-effort gh API check to confirm the token is valid and matches
+        // the configured login. Mirrors init.mjs:495-506.
+        try {
+          const { execSync } = await import("child_process");
+          const env = { ...process.env, GH_TOKEN: creds.GITHUB_TOKEN };
+          const who = execSync("gh api user --jq .login", { env, stdio: ["ignore", "pipe", "ignore"], encoding: "utf-8" }).trim();
+          if (who && login && who.toLowerCase() !== login.toLowerCase()) {
+            console.log(`  ⚠  GitHub token authenticates as @${who}, not @${login} (from .agentdesk.json). Agents will post as @${who}.`);
+          } else if (who) {
+            console.log(`  ✓ GitHub verified as @${who}`);
+          }
+        } catch {
+          console.log("  ✓ GITHUB_TOKEN present (couldn't verify via gh — install gh CLI for identity check)");
+        }
+        githubOk = true;
+      } catch (err) {
+        if (err instanceof PreflightError) {
+          console.log(`  ✗ ${err.message}`);
+          console.log("");
+          const next = await selectOption(rl, "What now?", [
+            { label: "Re-enter GITHUB_TOKEN", value: "retry" },
+            { label: "Skip (sessions will fail until fixed)", value: "skip" },
+            { label: "Cancel", value: "cancel" },
+          ]);
+          console.log("");
+          if (next.value === "cancel") { rl.close(); process.exit(1); }
+          if (next.value === "skip") { githubOk = true; break; }
+          delete creds.GITHUB_TOKEN;
+          continue;
+        }
+        throw err;
+      }
+    }
+
+    if (trackerOk && githubOk) break;
+  }
+
+  rl.close();
+
+  console.log("");
+  if (trackerOk && githubOk) {
+    console.log("  Ready. Try:");
+    const prefix = config.linear?.teamKey || config.jira?.project || projectKey.toUpperCase();
+    console.log(`    agentdesk team ${prefix}-123`);
+    console.log("");
+  } else {
+    console.log("  Bootstrap finished with missing pieces — edit .env directly or re-run.");
+    console.log("");
+  }
+}

package/cli/login.mjs

@@ -114,7 +114,8 @@ export async function runLogin() {
         console.log(`  API key saved to ~/.agentdesk/credentials.json`);
         console.log("");
         console.log("  Next steps:");
-        console.log("    agentdesk init");
+        console.log("    agentdesk init              (new project on this machine)");
+        console.log("    agentdesk bootstrap         (repo cloned from another machine)");
         console.log("    agentdesk team TASK-123");
         console.log("");
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kendoo.agentdesk/agentdesk",
-  "version": "0.19.3",
+  "version": "0.19.5",
   "description": "AI team orchestrator for Claude Code — run collaborative agent sessions from your terminal",
   "type": "module",
   "bin": {