@kendoo.agentdesk/agentdesk 0.19.8 → 0.20.0

package/cli/setup-helpers.mjs

@@ -0,0 +1,243 @@
+// Shared helpers for `agentdesk init` (new + existing flows) and
+// `agentdesk bootstrap`. Kept here so the two entry commands can compose
+// the same building blocks without importing from each other.
+
+import { existsSync, readFileSync, readdirSync, writeFileSync } from "fs";
+import { join } from "path";
+import { execSync, execFileSync } from "child_process";
+import { checkTrackerPermissions, resolveCredentialsFromEnv } from "./tracker-check.mjs";
+import { assertPushable, PreflightError, getGitRemoteUrl } from "./session-preflight.mjs";
+
+// ---------- .env read/write ----------
+
+export function loadDotEnv(dir) {
+  const envPath = join(dir, ".env");
+  const out = {};
+  if (!existsSync(envPath)) return out;
+  for (const line of readFileSync(envPath, "utf-8").split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq !== -1) out[trimmed.slice(0, eq)] = trimmed.slice(eq + 1);
+  }
+  return out;
+}
+
+export function saveEnvVar(dir, key, value) {
+  const envPath = join(dir, ".env");
+  let content = existsSync(envPath) ? readFileSync(envPath, "utf-8") : "";
+  const re = new RegExp(`^${key}=.*$`, "m");
+  if (re.test(content)) {
+    content = content.replace(re, `${key}=${value}`);
+  } else {
+    content += `${content && !content.endsWith("\n") ? "\n" : ""}${key}=${value}\n`;
+  }
+  writeFileSync(envPath, content);
+}
+
+// ---------- Git detection + parsing ----------
+
+// Parse "owner/repo" or a GitHub URL. Rejects non-github URLs.
+// Returns { owner, repo } or null.
+export function parseGitHubRef(input) {
+  const s = String(input || "").trim();
+  if (!s) return null;
+  // Reject non-github hosts early.
+  if (/^(https?:\/\/|git@|ssh:\/\/)/.test(s) && !/github\.com/i.test(s)) return null;
+  // SSH / HTTPS / short form — pull out owner/repo from the tail.
+  const m = s.match(/(?:github\.com[:/])?([^/@:\s]+)\/([^/.\s]+?)(?:\.git)?\/?$/i);
+  if (!m) return null;
+  return { owner: m[1], repo: m[2] };
+}
+
+export function detectGitRepo(cwd) {
+  try {
+    execFileSync("git", ["-C", cwd, "rev-parse", "--is-inside-work-tree"], {
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+  } catch { return { inRepo: false, remote: null, ownerRepo: null }; }
+  const url = getGitRemoteUrl(cwd);
+  if (!url) return { inRepo: true, remote: null, ownerRepo: null };
+  const parsed = parseGitHubRef(url);
+  return {
+    inRepo: true,
+    remote: url,
+    ownerRepo: parsed ? `${parsed.owner}/${parsed.repo}` : null,
+  };
+}
+
+// ---------- GitHub API ----------
+
+// Fetch the authenticated user's login via the REST API. No gh CLI dependency.
+// Returns the login string or null.
+export async function fetchGitHubLogin(token) {
+  try {
+    const res = await fetch("https://api.github.com/user", {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/vnd.github+json",
+        "User-Agent": "agentdesk-cli",
+      },
+      signal: AbortSignal.timeout(8000),
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data?.login || null;
+  } catch { return null; }
+}
+
+// Check push access on a specific repo. Returns { ok, canPush, error? }.
+export async function checkGitHubRepoAccess(token, owner, repo) {
+  try {
+    const res = await fetch(`https://api.github.com/repos/${owner}/${repo}`, {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/vnd.github+json",
+        "User-Agent": "agentdesk-cli",
+      },
+      signal: AbortSignal.timeout(8000),
+    });
+    if (res.status === 404) return { ok: false, canPush: false, error: `Repo ${owner}/${repo} not found or not accessible` };
+    if (!res.ok) return { ok: false, canPush: false, error: `GitHub API returned ${res.status}` };
+    const data = await res.json();
+    const canPush = !!data?.permissions?.push;
+    return { ok: true, canPush, error: canPush ? null : "Token lacks push access to this repo" };
+  } catch (e) {
+    return { ok: false, canPush: false, error: e.message };
+  }
+}
+
+// ---------- Clone ----------
+
+// Clone github.com/<owner>/<repo> into <cwd>/<repo> using the provided token.
+// Token is embedded in the URL via the x-access-token username (GitHub's
+// documented pattern). Disables terminal prompts so a bad token fails fast
+// instead of hanging waiting for a password.
+export function cloneRepoWithToken({ cwd, owner, repo, token }) {
+  const targetDir = join(cwd, repo);
+  if (existsSync(targetDir)) {
+    const entries = readdirSync(targetDir);
+    if (entries.length > 0) {
+      throw new Error(`./${repo} already exists and is not empty — remove it or run from another directory`);
+    }
+  }
+  const url = `https://x-access-token:${token}@github.com/${owner}/${repo}.git`;
+  // Execute with env override so we don't echo the token into the user's
+  // shell history; stdio inherited so the user sees clone progress.
+  execFileSync("git", ["clone", url, targetDir], {
+    stdio: "inherit",
+    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
+  });
+  return targetDir;
+}
+
+// ---------- Access checks (summary checklist) ----------
+
+export async function checkAgentDeskAccess(apiKey, serverUrl) {
+  try {
+    const res = await fetch(`${serverUrl}/api/sessions`, {
+      headers: { "x-api-key": apiKey },
+      signal: AbortSignal.timeout(5000),
+    });
+    if (res.ok) return { ok: true };
+    return { ok: false, error: `Server returned ${res.status}` };
+  } catch (e) {
+    return { ok: false, error: e.message };
+  }
+}
+
+// Run all three access checks for the final summary and return the results.
+// No prompts — the caller decides whether to abort or let the user save
+// anyway based on the outcome.
+export async function runAccessChecks({ apiKey, serverUrl, cwd, config, creds }) {
+  const results = { agentdesk: null, github: null, tracker: null };
+
+  // agentdesk.live
+  results.agentdesk = await checkAgentDeskAccess(apiKey, serverUrl);
+
+  // GitHub — token presence + (if we know the repo) push access
+  if (creds?.GITHUB_TOKEN) {
+    const login = await fetchGitHubLogin(creds.GITHUB_TOKEN);
+    if (!login) {
+      results.github = { ok: false, error: "Token did not authenticate with GitHub" };
+    } else if (config?.github?.repo) {
+      const [owner, repo] = String(config.github.repo).split("/");
+      const access = await checkGitHubRepoAccess(creds.GITHUB_TOKEN, owner, repo);
+      results.github = access.ok && access.canPush
+        ? { ok: true, login, repo: config.github.repo }
+        : { ok: false, error: access.error || "Insufficient GitHub repo access", login };
+    } else {
+      results.github = { ok: true, login };
+    }
+
+    // Also fail early if the local git remote is SSH or if the token is
+    // missing — same preflight a session run would do.
+    try {
+      assertPushable({ cwd, creds: { GITHUB_TOKEN: creds.GITHUB_TOKEN }, projectName: config?.projectKey || "(project)" });
+    } catch (err) {
+      if (err instanceof PreflightError) {
+        results.github = { ok: false, error: err.message };
+      } else { throw err; }
+    }
+  } else {
+    results.github = { ok: false, error: "No GITHUB_TOKEN in .env" };
+  }
+
+  // Tracker
+  if (config?.tracker) {
+    const check = await checkTrackerPermissions({
+      tracker: config.tracker,
+      config,
+      credentials: resolveCredentialsFromEnv(creds),
+    });
+    results.tracker = check.ok
+      ? { ok: true, identity: check.identity }
+      : { ok: false, error: (check.errors || ["Verification failed"])[0] };
+  } else {
+    results.tracker = { ok: true, skipped: true };
+  }
+
+  return results;
+}
+
+// Pretty-print the checklist the user sees in the review/confirm step.
+export function printAccessChecks(results, { tracker } = {}) {
+  console.log("  Access checks");
+  console.log("  ─────────────");
+  if (results.agentdesk?.ok) {
+    console.log("    ✓ agentdesk.live");
+  } else {
+    console.log(`    ✗ agentdesk.live    ${results.agentdesk?.error || "unknown error"}`);
+  }
+  if (results.github?.ok) {
+    const detail = [
+      results.github.login ? `@${results.github.login}` : null,
+      results.github.repo ? `push access to ${results.github.repo}` : null,
+    ].filter(Boolean).join(", ");
+    console.log(`    ✓ GitHub            ${detail}`);
+  } else {
+    console.log(`    ✗ GitHub            ${results.github?.error || "unknown error"}`);
+  }
+  if (results.tracker?.skipped) {
+    // No tracker configured — omit the tracker line entirely.
+  } else if (results.tracker?.ok) {
+    const name = results.tracker.identity?.name || results.tracker.identity?.login || results.tracker.identity?.email || "";
+    const t = tracker || "tracker";
+    console.log(`    ✓ ${t.padEnd(18)}${name ? `authenticated as ${name}` : "verified"}`);
+  } else {
+    const t = tracker || "tracker";
+    console.log(`    ✗ ${t.padEnd(18)}${results.tracker?.error || "unknown error"}`);
+  }
+}
+
+// ---------- Local config read ----------
+
+export function readLocalConfig(cwd) {
+  const path = join(cwd, ".agentdesk.json");
+  if (!existsSync(path)) return null;
+  try { return JSON.parse(readFileSync(path, "utf-8")); } catch { return null; }
+}
+
+export function writeMinimalLocalConfig(cwd, projectKey) {
+  writeFileSync(join(cwd, ".agentdesk.json"), JSON.stringify({ projectKey }, null, 2) + "\n");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kendoo.agentdesk/agentdesk",
-  "version": "0.19.8",
+  "version": "0.20.0",
   "description": "AI team orchestrator for Claude Code — run collaborative agent sessions from your terminal",
   "type": "module",
   "bin": {