@keydris/cli 0.1.11 → 0.1.13

package/README.md

@@ -1,9 +1,9 @@
 # @keydris/cli
 
-npm distribution for the native Keydris CLI.
+Authority before action. npm distribution for the native Keydris CLI.
 
 ```bash
-npm install --global @keydris/cli
+npm install --global @keydris/cli --foreground-scripts
 keydris init
 ```
 
@@ -22,3 +22,28 @@ config unchanged. npm's `--ignore-scripts` option skips this config step.
 
 The package performs no privileged work during installation. Trust-store changes
 happen only when explicitly requested through `keydris init --trust-store`.
+
+Use [`--foreground-scripts`](https://docs.npmjs.com/cli/v11/using-npm/config/#foreground-scripts) to see the native binary and configuration checks. npm owns download progress; Keydris shows real setup stages in `keydris init`. If lifecycle scripts were disabled, `init` creates missing configuration without replacing an existing file. `KEYDRIS_NO_CONFIG=1` also disables this fallback.
+
+The CLI respects `NO_COLOR` and supports `--color auto|always|never`. Use `keydris status` to check readiness and `keydris reset --dry-run` to preview a reset.
+
+Interactive CLI banners show the ASCII logo in `#F8F7F4`. Set
+`KEYDRIS_LOGO_COLOR=default` for the terminal's own foreground on light themes.
+
+On Windows with **WSL2**, install using Linux Node/npm inside your distribution
+(`node -p 'process.platform'` must print `linux`). Install and run the agent,
+Keydris and proxy there too. Keep certificates and state in the Linux home;
+do not reuse native Windows state. Claude's Linux sandbox requires `bubblewrap`
+and `socat`; `keydris doctor` checks these and namespace availability. WSL1 and
+detected mixed Windows/Linux execution are rejected with recovery guidance.
+After WSL shuts down, run `keydris proxy up` before reopening agent sessions.
+
+VS Code integrated terminals use the normal agent launch commands: `claude`
+or `keydris codex` after onboarding. For WSL, open the folder with VS Code's WSL
+extension and run setup in that terminal. Sidebar integration is separate.
+
+`keydris init` installs a bundled `keydris-authority` skill and a short session
+briefing explaining delegated authority, approvals and denials. Guidance is
+embedded in the native binary; no additional download is needed. Read it with
+`keydris skill` or `keydris skill --brief`. Rerun `init` after upgrades to refresh
+the installed copy. Existing and user-edited skill files are preserved.

package/bin/keydris.js

@@ -6,6 +6,11 @@ import { createRequire } from "node:module";
 
 const require = createRequire(import.meta.url);
 
+if (process.platform === "win32" && (process.env.WSL_DISTRO_NAME || process.env.WSL_INTEROP)) {
+  console.error("keydris: Windows Node.js is running inside WSL. Install Linux Node/npm and @keydris/cli inside your WSL2 distribution, then retry.");
+  process.exit(1);
+}
+
 const nativePackages = new Map([
   ["win32-x64", "@keydris/cli-win32-x64"],
   ["win32-arm64", "@keydris/cli-win32-arm64"],
@@ -47,6 +52,21 @@ function launch() {
   });
 }
 
+// Explicit onboarding repairs a missing config when npm lifecycle scripts were
+// disabled. Existing user config is never overwritten by this fallback.
+const setupArgs = process.argv.slice(2);
+if (setupArgs[0] === "--color") setupArgs.splice(0, 2);
+else if (setupArgs[0]?.startsWith("--color=")) setupArgs.shift();
+if (setupArgs[0] === "init" && !setupArgs.includes("--help") && !setupArgs.includes("-h")) {
+  try {
+    const { installConfig } = await import("../scripts/install-config.mjs");
+    await installConfig({ onlyIfMissing: true });
+  } catch (error) {
+    console.error("keydris: setup could not prepare configuration:", error.message);
+    process.exit(1);
+  }
+}
+
 let result = launch();
 if (process.platform !== "win32" && result.error?.code === "EACCES") {
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keydris/cli",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "Governed, per-session identity and brokered egress for AI agents",
   "type": "module",
   "bin": {
@@ -20,12 +20,12 @@
     "prepublishOnly": "node ../../scripts/prepublish-check.mjs"
   },
   "optionalDependencies": {
-    "@keydris/cli-win32-x64": "0.1.11",
-    "@keydris/cli-win32-arm64": "0.1.11",
-    "@keydris/cli-darwin-x64": "0.1.11",
-    "@keydris/cli-darwin-arm64": "0.1.11",
-    "@keydris/cli-linux-x64": "0.1.11",
-    "@keydris/cli-linux-arm64": "0.1.11"
+    "@keydris/cli-win32-x64": "0.1.13",
+    "@keydris/cli-win32-arm64": "0.1.13",
+    "@keydris/cli-darwin-x64": "0.1.13",
+    "@keydris/cli-darwin-arm64": "0.1.13",
+    "@keydris/cli-linux-x64": "0.1.13",
+    "@keydris/cli-linux-arm64": "0.1.13"
   },
   "keywords": [
     "ai",

package/scripts/install-config.mjs

@@ -1,54 +1,80 @@
-import { copyFile, readFile, writeFile } from "node:fs/promises";
+import { access, copyFile, readFile, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
 import path from "node:path";
 
-async function installConfig() {
+const require = createRequire(import.meta.url);
+const color = Boolean(process.stdout.isTTY) &&
+  process.env.TERM !== "dumb" && !Object.hasOwn(process.env, "NO_COLOR");
+const clean = (value) => String(value).replace(/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/g, " ");
+function line(state, message) {
+  const codes = { ok: 32, warning: 33, inactive: 90 };
+  const label = state === "ok" ? "[OK]" : state === "warning" ? "[!]" : "[-]";
+  console.log((color ? `\x1b[${codes[state]}m${label}\x1b[0m` : label) + " " + clean(message));
+}
+
+// npm downloads the native optional dependency. This script reports only
+// checks/configuration it actually performs; it never fabricates download progress.
+export async function installConfig({ onlyIfMissing = false } = {}) {
+  if (process.platform === "win32" && (process.env.WSL_DISTRO_NAME || process.env.WSL_INTEROP)) {
+    throw new Error("Windows Node.js was launched from WSL; install using Linux Node/npm inside WSL2 to keep Windows and Linux configuration separate");
+  }
   const home = homedir();
-  if (!home) {
-    throw new Error("could not resolve the user's home directory");
+  if (!home || !path.isAbsolute(home)) {
+    throw new Error("could not resolve the user's absolute home directory");
   }
-
-  const manifest = JSON.parse(
-    await readFile(new URL("../package.json", import.meta.url), "utf8")
-  );
-  const channel = manifest.version.includes("-") ? "dev" : "stable";
-  const source = new URL(`../config/${channel}.toml`, import.meta.url);
-  const data = await readFile(source);
   const destination = path.join(home, ".keydris.toml");
-
   if (process.env.KEYDRIS_NO_CONFIG === "1") {
-    console.log(
-      `keydris: KEYDRIS_NO_CONFIG=1; leaving ${destination} unchanged`
-    );
+    if (!onlyIfMissing) line("inactive", `Configuration skipped (KEYDRIS_NO_CONFIG=1): ${destination}`);
     return;
   }
-
   let existing;
-  try {
-    existing = await readFile(destination);
-  } catch (error) {
-    if (error.code !== "ENOENT") {
-      throw error;
-    }
-  }
+  try { existing = await readFile(destination); }
+  catch (error) { if (error.code !== "ENOENT") throw error; }
+  if (existing && onlyIfMissing) return;
 
+  const manifest = JSON.parse(await readFile(new URL("../package.json", import.meta.url), "utf8"));
+  const channel = manifest.version.includes("-") ? "dev" : "stable";
+  const data = await readFile(new URL(`../config/${channel}.toml`, import.meta.url));
   if (existing?.equals(data)) {
-    console.log(`keydris: ${channel} config already up to date at ${destination}`);
+    line("ok", `Configuration already current: ${destination}`);
     return;
   }
-
   if (existing) {
     const backup = `${destination}.bak`;
     await copyFile(destination, backup);
-    console.log(`keydris: backed up existing config to ${backup}`);
+    line("inactive", `Previous configuration backed up: ${backup}`);
   }
-
   await writeFile(destination, data, { mode: 0o644 });
-  console.log(`keydris: wrote ${channel} config to ${destination}`);
+  line("ok", `${channel} configuration installed: ${destination}`);
+}
+
+async function finishInstall() {
+  console.log("\nKeydris · Authority before action");
+  let binaryReady = false;
+  try {
+    const packageName = `@keydris/cli-${process.platform}-${process.arch}`;
+    const executable = require.resolve(packageName);
+    if (!path.isAbsolute(executable)) throw new Error("native binary path is not absolute");
+    await access(executable);
+    binaryReady = true;
+    line("ok", `Native binary available (${process.platform}/${process.arch})`);
+  } catch {
+    line("warning", "Native binary unavailable. Reinstall @keydris/cli without --omit=optional.");
+  }
+  let configReady = true;
+  try { await installConfig(); }
+  catch (error) {
+    configReady = false;
+    line("warning", `Configuration could not be installed: ${error.message}`);
+  }
+  if (binaryReady) {
+    console.log(configReady ? "\nNext: keydris init" : "\nNext: keydris init (retries missing configuration)");
+    console.log("Setup guides you through sign-in, certificates and proxy startup.\n");
+  }
 }
 
-try {
-  await installConfig();
-} catch (error) {
-  console.warn(`keydris: WARNING: could not install ~/.keydris.toml: ${error.message}`);
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  await finishInstall();
 }