@meistrari/tela-cli 0.7.47 → 0.7.48

package/dist/index.js

@@ -6285,6 +6285,7 @@ var require_setup = __commonJS({
     exports2.createGitSshKey = createGitSshKey;
     exports2.resolveCloneRootPath = resolveCloneRootPath;
     exports2.listDiscoveredSshPublicKeys = listDiscoveredSshPublicKeys;
+    exports2.prepareAgentSetupSshKeys = prepareAgentSetupSshKeys;
     exports2.prepareAgentSetup = prepareAgentSetup;
     exports2.findAgentSetupOrganization = findAgentSetupOrganization;
     exports2.validatePreparedAgentSetupInput = validatePreparedAgentSetupInput;
@@ -6296,7 +6297,9 @@ var require_setup = __commonJS({
     var tela_local_config_1 = require_dist();
     var agent_api_1 = require_agent_api();
     var credentials_1 = require_credentials2();
+    var errors_1 = require_errors();
     var config_1 = require_config2();
+    var process_1 = require_process();
     function getHomeDir() {
       return process.env.HOME || (0, node_os_1.homedir)();
     }
@@ -6398,6 +6401,134 @@ var require_setup = __commonJS({
       }
       return (0, node_fs_1.readdirSync)(sshDirectory, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".pub")).map((entry) => loadSshPublicKey((0, node_path_1.join)(sshDirectory, entry.name))).sort((left, right) => left.title.localeCompare(right.title) || left.path.localeCompare(right.path));
     }
+    function listDiscoveredSshKeyPairs(sshDirectory = getSshDirectory()) {
+      return listDiscoveredSshPublicKeys(sshDirectory).map((key) => ({
+        ...key,
+        privateKeyPath: inferSshPrivateKeyPath(key.path)
+      })).filter((key) => (0, node_fs_1.existsSync)(key.privateKeyPath));
+    }
+    function toCreatedSshKey(key) {
+      return {
+        title: key.title,
+        path: key.path,
+        privateKeyPath: key.privateKeyPath
+      };
+    }
+    function hasUsableSavedSshKey(setup) {
+      const sshKey = setup?.gitSshKey;
+      return Boolean(sshKey?.publicKeyPath && sshKey.privateKeyPath && (0, node_fs_1.existsSync)(sshKey.publicKeyPath) && (0, node_fs_1.existsSync)(sshKey.privateKeyPath));
+    }
+    function createSavedSshKeyOption(sshKey) {
+      return {
+        ...loadSshPublicKey(sshKey.publicKeyPath),
+        privateKeyPath: resolveSshPrivateKeyPath(sshKey.privateKeyPath)
+      };
+    }
+    function includePreferredSshKeyOption(sshPublicKeys, preferredKey) {
+      return [
+        preferredKey,
+        ...sshPublicKeys.filter((key) => key.path !== preferredKey.path)
+      ];
+    }
+    function ensureSshDirectory(sshDirectory) {
+      const exists = (0, node_fs_1.existsSync)(sshDirectory);
+      if (!exists) {
+        (0, node_fs_1.mkdirSync)(sshDirectory, { recursive: true, mode: 448 });
+      }
+      const stats = (0, node_fs_1.statSync)(sshDirectory);
+      if (!stats.isDirectory()) {
+        throw (0, errors_1.createUserFacingError)({
+          code: "ssh_directory_invalid",
+          summary: `SSH directory path is not a directory: ${sshDirectory}`,
+          fixes: ["Move or remove that path, then retry Tela CLI setup."]
+        });
+      }
+      if (!exists) {
+        (0, node_fs_1.chmodSync)(sshDirectory, 448);
+      }
+    }
+    function getAvailableGeneratedSshKeyPath(sshDirectory) {
+      const basePath = (0, node_path_1.join)(sshDirectory, "tela_agent_ed25519");
+      const maxAttempts = 1e3;
+      for (let index = 0; index < maxAttempts; index += 1) {
+        const privateKeyPath = index === 0 ? basePath : `${basePath}_${index + 1}`;
+        const publicKeyPath = `${privateKeyPath}.pub`;
+        if (!(0, node_fs_1.existsSync)(privateKeyPath) && !(0, node_fs_1.existsSync)(publicKeyPath)) {
+          return privateKeyPath;
+        }
+      }
+      throw (0, errors_1.createUserFacingError)({
+        code: "ssh_key_path_unavailable",
+        summary: `Could not find an available Tela SSH key path in ${sshDirectory}.`,
+        fixes: ["Remove unused tela_agent_ed25519 key files or create an SSH key manually, then retry setup."]
+      });
+    }
+    async function createGeneratedSshKey(sshDirectory, options) {
+      ensureSshDirectory(sshDirectory);
+      const sshKeygenPath = await options.resolveExecutableFn("ssh-keygen");
+      if (!sshKeygenPath) {
+        throw (0, errors_1.createUserFacingError)({
+          code: "ssh_keygen_missing",
+          summary: "Could not create an SSH key because ssh-keygen was not found.",
+          fixes: ["Install OpenSSH tools or create an ed25519 SSH key manually, then retry Tela CLI setup."]
+        });
+      }
+      const privateKeyPath = getAvailableGeneratedSshKeyPath(sshDirectory);
+      const result = await options.runCommandFn([
+        sshKeygenPath,
+        "-t",
+        "ed25519",
+        "-N",
+        "",
+        "-C",
+        "tela-agent",
+        "-f",
+        privateKeyPath
+      ], {
+        allowFailure: true,
+        timeoutMs: 15e3
+      });
+      if (result.exitCode !== 0) {
+        const details = result.stderr.trim() || result.stdout.trim() || `ssh-keygen exited with code ${result.exitCode}.`;
+        throw (0, errors_1.createUserFacingError)({
+          code: "ssh_key_generation_failed",
+          summary: "Could not create an SSH key for Tela CLI setup.",
+          details,
+          fixes: ["Create an ed25519 SSH key manually, then retry Tela CLI setup."]
+        });
+      }
+      if (!(0, node_fs_1.existsSync)(privateKeyPath) || !(0, node_fs_1.existsSync)(`${privateKeyPath}.pub`)) {
+        throw (0, errors_1.createUserFacingError)({
+          code: "ssh_key_generation_missing_files",
+          summary: "ssh-keygen completed but the expected SSH key files were not created.",
+          fixes: ["Create an ed25519 SSH key manually, then retry Tela CLI setup."]
+        });
+      }
+      (0, node_fs_1.chmodSync)(privateKeyPath, 384);
+      return {
+        ...loadSshPublicKey(`${privateKeyPath}.pub`),
+        privateKeyPath
+      };
+    }
+    async function prepareAgentSetupSshKeys(options = {}) {
+      const sshDirectory = options.sshDirectory ?? getSshDirectory();
+      const existingSshPublicKeys = listDiscoveredSshKeyPairs(sshDirectory);
+      if (existingSshPublicKeys.length > 0) {
+        return {
+          sshPublicKeys: existingSshPublicKeys,
+          createdSshKey: null
+        };
+      }
+      const created = await createGeneratedSshKey(sshDirectory, {
+        runCommandFn: options.runCommandFn ?? process_1.runCommand,
+        resolveExecutableFn: options.resolveExecutableFn ?? process_1.resolveExecutable
+      });
+      const sshPublicKeys = listDiscoveredSshKeyPairs(sshDirectory);
+      return {
+        sshPublicKeys,
+        createdSshKey: toCreatedSshKey(sshPublicKeys.find((key) => key.path === created.path) ?? created)
+      };
+    }
     function createSetupUser(credential, fallbackEmail) {
       const raw = toObject(credential?.raw);
       const rawUser = toObject(raw?.user);
@@ -6435,12 +6566,13 @@ var require_setup = __commonJS({
       if (organizations.length === 0) {
         throw new Error("No Agent API organizations are available for this Tela workspace. Ask the Tela team to register an organization, then try setup again.");
       }
-      const sshPublicKeys = listDiscoveredSshPublicKeys().map((key) => ({
-        ...key,
-        privateKeyPath: inferSshPrivateKeyPath(key.path)
-      })).filter((key) => (0, node_fs_1.existsSync)(key.privateKeyPath));
-      const selectedSshPublicKeyPath = existingSetup?.gitSshKey?.publicKeyPath ?? sshPublicKeys[0]?.path ?? "";
-      const selectedSshPrivateKeyPath = existingSetup?.gitSshKey?.privateKeyPath ?? sshPublicKeys.find((key) => key.path === selectedSshPublicKeyPath)?.privateKeyPath ?? (selectedSshPublicKeyPath ? inferSshPrivateKeyPath(selectedSshPublicKeyPath) : "");
+      const existingSshKey = hasUsableSavedSshKey(existingSetup) ? existingSetup?.gitSshKey ?? null : null;
+      const { sshPublicKeys, createdSshKey } = existingSshKey ? {
+        sshPublicKeys: includePreferredSshKeyOption(listDiscoveredSshKeyPairs(), createSavedSshKeyOption(existingSshKey)),
+        createdSshKey: null
+      } : await prepareAgentSetupSshKeys();
+      const selectedSshPublicKeyPath = existingSshKey ? existingSshKey.publicKeyPath : sshPublicKeys[0]?.path ?? "";
+      const selectedSshPrivateKeyPath = existingSshKey?.privateKeyPath ?? sshPublicKeys.find((key) => key.path === selectedSshPublicKeyPath)?.privateKeyPath ?? (selectedSshPublicKeyPath ? inferSshPrivateKeyPath(selectedSshPublicKeyPath) : "");
       const selectedOrganizationId = existingSetup?.forgejoOrganization?.id ?? organizations[0]?.id ?? "";
       return {
         contextId: config.contextId,
@@ -6451,6 +6583,7 @@ var require_setup = __commonJS({
         sshPublicKeys,
         selectedSshPublicKeyPath,
         selectedSshPrivateKeyPath,
+        createdSshKey,
         existingSetup
       };
     }
@@ -6469,10 +6602,19 @@ var require_setup = __commonJS({
       throw new Error(`Unknown Agent API organization: ${selector}`);
     }
     function validatePreparedAgentSetupInput(prepared, input) {
+      if (Boolean(input.sshPublicKeyPath) !== Boolean(input.sshPrivateKeyPath)) {
+        throw (0, errors_1.createUserFacingError)({
+          code: "setup_ssh_key_override_pair_required",
+          summary: "SSH key override paths must be provided together.",
+          fixes: ["Pass both --ssh-public-key and --ssh-private-key, or omit both to use the selected key."]
+        });
+      }
       const organization = findAgentSetupOrganization(prepared.organizations, input.organization);
       const cloneRoot = input.cloneRoot ? resolveCloneRootPath(input.cloneRoot) : resolveCloneRootPath(prepared.cloneRoot);
-      const sshKey = loadSshPublicKey(input.sshPublicKeyPath);
-      const sshPrivateKeyPath = resolveSshPrivateKeyPath(input.sshPrivateKeyPath);
+      const sshPublicKeyPath = input.sshPublicKeyPath || prepared.selectedSshPublicKeyPath;
+      const sshPrivateKeyPathInput = input.sshPrivateKeyPath || prepared.selectedSshPrivateKeyPath;
+      const sshKey = loadSshPublicKey(sshPublicKeyPath);
+      const sshPrivateKeyPath = resolveSshPrivateKeyPath(sshPrivateKeyPathInput);
       return {
         contextId: prepared.contextId,
         organization,
@@ -7095,9 +7237,7 @@ var require_cli = __commonJS({
     function assertSetupRequiredOptions(options) {
       const missing = [
         options.contextId ? "" : "--context",
-        options.organization ? "" : "--organization",
-        options.sshPublicKeyPath ? "" : "--ssh-public-key",
-        options.sshPrivateKeyPath ? "" : "--ssh-private-key"
+        options.organization ? "" : "--organization"
       ].filter(Boolean);
       if (missing.length > 0) {
         throw (0, errors_1.createUserFacingError)({
@@ -7105,7 +7245,7 @@ var require_cli = __commonJS({
           summary: `Missing required setup option${missing.length === 1 ? "" : "s"}: ${missing.join(", ")}`,
           fixes: [
             "Run `tela agent setup --list-options --context <context-id> --json` to inspect valid values.",
-            "Pass all required flags for non-interactive setup."
+            "Pass the required context and organization flags for non-interactive setup."
           ]
         });
       }
@@ -7130,6 +7270,7 @@ var require_cli = __commonJS({
           })),
           selectedSshPublicKeyPath: preparation2.selectedSshPublicKeyPath,
           selectedSshPrivateKeyPath: preparation2.selectedSshPrivateKeyPath,
+          createdSshKey: preparation2.createdSshKey,
           existingSetup: preparation2.existingSetup
         };
         if (options.json)
@@ -7142,6 +7283,12 @@ var require_cli = __commonJS({
               { label: "Clone root", value: result2.cloneRoot }
             ])),
             (0, ui_1.section)("Organizations", result2.organizations.map((item) => `- ${item.name} (${item.id})`).join("\n")),
+            ...result2.createdSshKey ? [
+              (0, ui_1.section)("Generated SSH key", (0, ui_1.kvList)([
+                { label: "Public key", value: result2.createdSshKey.path },
+                { label: "Private key", value: result2.createdSshKey.privateKeyPath }
+              ]))
+            ] : [],
             (0, ui_1.section)("SSH keys", result2.sshPublicKeys.map((item) => `- ${item.title}: ${item.path}`).join("\n") || "<none>")
           ]));
         }
@@ -7166,6 +7313,7 @@ var require_cli = __commonJS({
           cloneRoot: validated.cloneRoot,
           sshPublicKeyPath: validated.sshKey.path,
           sshPrivateKeyPath: validated.sshPrivateKeyPath,
+          createdSshKey: preparation.createdSshKey,
           nextActions: ["Run the same setup command without `--dry-run` to provision Forgejo and save setup metadata."]
         };
         if (options.json)
@@ -7179,6 +7327,12 @@ var require_cli = __commonJS({
               { label: "SSH public key", value: result2.sshPublicKeyPath },
               { label: "SSH private key", value: result2.sshPrivateKeyPath }
             ])),
+            ...result2.createdSshKey ? [
+              (0, ui_1.section)("Generated SSH key", (0, ui_1.kvList)([
+                { label: "Public key", value: result2.createdSshKey.path },
+                { label: "Private key", value: result2.createdSshKey.privateKeyPath }
+              ]))
+            ] : [],
             (0, ui_1.nextActions)(result2.nextActions)
           ]));
         }
@@ -7196,6 +7350,7 @@ var require_cli = __commonJS({
         contextId: setup.contextId,
         setup: setup.setup,
         response: setup.response,
+        createdSshKey: preparation.createdSshKey,
         nextActions: ["Run `tela agent sync --all --dry-run --json` to inspect repository sync readiness."]
       };
       if (options.json)
@@ -7207,6 +7362,12 @@ var require_cli = __commonJS({
             { label: "Forgejo Organization", value: setup.setup.forgejoOrganization?.name ?? "<none>" },
             { label: "SSH key", value: setup.setup.gitSshKey?.title ?? "<none>" }
           ])),
+          ...result.createdSshKey ? [
+            (0, ui_1.section)("Generated SSH key", (0, ui_1.kvList)([
+              { label: "Public key", value: result.createdSshKey.path },
+              { label: "Private key", value: result.createdSshKey.privateKeyPath }
+            ]))
+          ] : [],
           (0, ui_1.nextActions)(result.nextActions)
         ]));
       }
@@ -8629,7 +8790,7 @@ function writeHelp(io) {
   writeLine(io, "  agent run [--input <name=path>...] [--mode one-shot|chat] [--input-conflict fail|overwrite|rename] [--plain] [--json] [--verbose]");
   writeLine(io, "  agent push [--message <text>|--claude|--manual] [--dry-run] [--json] [--verbose]");
   writeLine(io, "  agent feedback [--list] [--apply all|select] [--feedback-id <id>...] [--json] [--verbose]");
-  writeLine(io, "  agent setup [--list-options] [--context <context-id>] [--organization <id-or-name>] [--clone-root <path>] [--ssh-public-key <path>] [--ssh-private-key <path>] [--dry-run] [--json]");
+  writeLine(io, "  agent setup [--list-options] --context <context-id> --organization <id-or-name> [--clone-root <path>] [--ssh-public-key <path>] [--ssh-private-key <path>] [--dry-run] [--json]");
 }
 function getPackageVersion() {
   const metadata = JSON.parse((0, import_node_fs2.readFileSync)((0, import_node_path2.join)(__dirname, "..", "package.json"), "utf8"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meistrari/tela-cli",
-  "version": "0.7.47",
+  "version": "0.7.48",
   "description": "Tela command line tools for local state and agent workflows.",
   "license": "UNLICENSED",
   "repository": {

package/skills/tela-cli/references/agent.md

@@ -18,12 +18,14 @@ tela agent setup \
   --context production/foundation \
   --organization acme \
   --clone-root "$HOME/tela-agents" \
-  --ssh-public-key "$HOME/.ssh/id_ed25519.pub" \
-  --ssh-private-key "$HOME/.ssh/id_ed25519" \
   --dry-run \
   --json
 ```
 
+Setup uses an existing SSH key pair from `~/.ssh`, or creates
+`~/.ssh/tela_agent_ed25519` when no key pair exists. Pass `--ssh-public-key`
+and `--ssh-private-key` only when overriding that default selection.
+
 Complete setup by removing `--dry-run`. This provisions the Forgejo user and
 saves Agent setup metadata in the shared Tela local config.