@mergelight/cli 0.0.0-stage → 0.1.14

package/dist/connect-claude.js

@@ -0,0 +1,157 @@
+import { spawn } from "node:child_process";
+import { appendFileSync } from "node:fs";
+import { agentEnv } from "./providers/codex.js";
+/**
+ * Connects a Claude plan from a pull request, with no terminal.
+ *
+ * The unmodified `claude setup-token` runs in the customer's own GitHub Actions run. It makes the link, the
+ * person confirms on Claude's own page, and Claude shows them a code. They paste it on the setup page, which
+ * leaves it in their repository for this run to read. The code is useless without a secret that stays in this
+ * run, and the token it buys is saved as the repository's secret. None of it passes through Mergelight.
+ */
+const WAIT_MS = 16 * 60_000;
+const POLL_MS = 5_000;
+const LINK_WAIT_MS = 45_000;
+const TOKEN_WAIT_MS = 60_000;
+function plain(output) {
+    return output
+        .replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g, "")
+        .replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "")
+        .replace(/\x1b[=>()][0-9A-B]?/g, "");
+}
+/** The sign-in link, once all of it has arrived. Only Claude's own site counts. */
+export function parseClaudeLink(output) {
+    const found = plain(output).match(/https:\/\/claude\.(?:com|ai)\/\S+(?=\s)/)?.[0];
+    if (!found)
+        return null;
+    try {
+        const url = new URL(found);
+        return url.pathname.includes("oauth/authorize") && url.searchParams.has("code_challenge") ? found : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function parseClaudeToken(output) {
+    return plain(output).match(/\bsk-ant-oat[\w-]{20,}(?=\s)/)?.[0] ?? null;
+}
+/**
+ * The code, if this is one. `claude setup-token` only takes `code#state`, and its state is 43 characters.
+ */
+export function readPastedCode(body) {
+    const text = body.trim();
+    return /^[\w.~-]{10,500}#[\w.~-]{20,500}$/.test(text) ? text : null;
+}
+/**
+ * Starts the sign-in. It needs a terminal, so `script` gives it one, wide enough that the link and the token
+ * stay on one line. Nothing it prints is logged, because the token is in there. Null if no link appears.
+ */
+export function startClaudeSignIn(spawnImpl = spawn, wait = { link: LINK_WAIT_MS, token: TOKEN_WAIT_MS }) {
+    return new Promise((resolve) => {
+        let output = "";
+        let settled = false;
+        let onOutput = () => { };
+        let child;
+        try {
+            child = spawnImpl("script", ["-qfc", "stty cols 3000 rows 50; exec claude setup-token", "/dev/null"], { stdio: ["pipe", "pipe", "ignore"], env: { ...agentEnv(), TERM: "xterm-256color", BROWSER: "true" } });
+        }
+        catch {
+            resolve(null);
+            return;
+        }
+        const stop = () => {
+            try {
+                child.kill("SIGKILL");
+            }
+            catch {
+                // Already gone.
+            }
+        };
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            stop();
+            resolve(null);
+        }, wait.link);
+        child.on("error", () => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(null);
+        });
+        child.stdin.on?.("error", () => { });
+        const finish = (code) => new Promise((done) => {
+            output = "";
+            const giveUp = setTimeout(() => done(null), wait.token);
+            onOutput = () => {
+                const token = parseClaudeToken(output);
+                if (!token)
+                    return;
+                clearTimeout(giveUp);
+                done(token);
+            };
+            // Pasted first and confirmed a moment later, as a person would.
+            child.stdin.write(code);
+            setTimeout(() => child.stdin.write("\r"), 400);
+        }).finally(stop);
+        child.stdout.setEncoding("utf8");
+        child.stdout.on("data", (text) => {
+            output += text;
+            onOutput();
+            if (settled)
+                return;
+            const url = parseClaudeLink(output);
+            if (!url)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve({ url, finish, stop });
+        });
+    });
+}
+/**
+ * Where the setup page leaves the code: a Git reference outside branches and tags, so it shows nowhere on the
+ * pull request and notifies nobody. Only someone with write access can make one. The name comes from this
+ * sign-in's own state, so a run only ever finds the code meant for it. Null if the link has no usable state.
+ */
+export function claudeCodeRef(claudeUrl) {
+    try {
+        const state = new URL(claudeUrl).searchParams.get("state") ?? "";
+        return /^[\w-]{20,200}$/.test(state) ? `mergelight/claude-code/s${state}` : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** What's waiting at that reference, if the setup page has been there yet. */
+export async function readCodeRef(get, ref) {
+    const refs = await get(`git/matching-refs/${ref}`);
+    const found = refs.find((r) => r.ref === `refs/${ref}` && r.object.type === "blob");
+    if (!found)
+        return null;
+    const blob = await get(`git/blobs/${found.object.sha}`);
+    return Buffer.from(blob.content, "base64").toString("utf8");
+}
+/** Waits for the code. A failed read just waits for the next one, and anything that isn't a whole code doesn't count. */
+export async function waitForPastedCode(deps, timeoutMs = WAIT_MS, pollMs = POLL_MS) {
+    const now = deps.now ?? Date.now;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const end = now() + timeoutMs;
+    while (now() < end && !deps.stopped?.()) {
+        const code = readPastedCode((await deps.read().catch(() => null)) ?? "");
+        if (code)
+            return code;
+        await sleep(pollMs);
+    }
+    return null;
+}
+/** Hands the token to the rest of the job: hidden in its logs, and available to the steps that save and use it. */
+export function shareClaudeToken(token, env = process.env, print = console.log) {
+    if (!/^sk-ant-oat[\w-]+$/.test(token))
+        throw new Error("That doesn't look like a Claude token.");
+    print(`::add-mask::${token}`);
+    if (env.GITHUB_ENV)
+        appendFileSync(env.GITHUB_ENV, `MERGELIGHT_CLAUDE_TOKEN=${token}\nMERGELIGHT_PROVIDER=claude\nMERGELIGHT_CONNECT=0\n`);
+}

package/dist/connect.js

@@ -0,0 +1,319 @@
+import { spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { FAILED_MARKER, PENDING_MARKER, pendingSummaryBody, SUMMARY_MARKER } from "./publish/markdown.js";
+import { CHECK_FAILED_TITLE, readPrReviewState, writeCheck } from "./publish/publish.js";
+import { stateBlock } from "./publish/state.js";
+import { claudeCodeRef, readCodeRef, shareClaudeToken, startClaudeSignIn, waitForPastedCode } from "./connect-claude.js";
+/**
+ * Connects a repository to ChatGPT from its own pull request, with no terminal.
+ *
+ * Codex's device login runs inside the customer's own GitHub Actions run. The link and code go in
+ * a comment on their private repository, and the login stays in the runner until the Action saves
+ * it as their secret. None of it passes through Mergelight.
+ */
+/** Codex says the code lasts 15 minutes. */
+export const LOGIN_TIMEOUT_MS = 16 * 60_000;
+export const INSTALL_URL = "https://github.com/apps/mergelight-ai/installations/new";
+export const CHATGPT_SECURITY_URL = "https://chatgpt.com/settings/security";
+/**
+ * Reads the link and code from what `codex login --device-auth` prints. Only OpenAI's own link counts.
+ * Output arrives in pieces, so each one only counts once something follows it: a code cut off mid-way
+ * would be posted once and could never be corrected.
+ */
+export function parseDeviceLogin(output) {
+    const clean = output.replace(/\x1b\[[0-9;]*[A-Za-z]/g, "");
+    const url = clean.match(/https:\/\/auth\.openai\.com\/\S+(?=\s)/)?.[0];
+    const code = clean.match(/\b[A-Z0-9]{4}-[A-Z0-9]{4,}(?=\s)/)?.[0];
+    return url && code ? { url, code } : null;
+}
+/** Part of the email of the account in a Codex login, so people can see whose it is. Null if it can't be read. */
+export function connectedAccount(authJson) {
+    try {
+        const { tokens } = JSON.parse(authJson);
+        const { email } = JSON.parse(Buffer.from(tokens.id_token.split(".")[1], "base64url").toString("utf8"));
+        if (typeof email !== "string")
+            return null;
+        const [name, domain] = email.split("@");
+        return name && domain ? `${name.slice(0, 2)}***@${domain}` : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Anyone who can read the repository could have entered the code, so say whose plan it is now, where it stays visible. */
+export function connectedBody(account, secretName) {
+    const who = account ? `the ChatGPT account \`${account}\`` : "the ChatGPT account that entered the code";
+    return `🔌 Reviews on this repository now use ${who}. If that isn't yours, remove the \`${secretName}\` secret and push a commit to connect again.`;
+}
+/** The setup page reads the link and code from this hidden line, so a change to how the comment looks can't break it. */
+export function connectData(login, claudeUrl) {
+    return `<!-- mergelight:connect:v1 ${JSON.stringify({ url: login?.url ?? "", code: login?.code ?? "", claudeUrl: claudeUrl ?? null }).replace(/--/g, "\\u002d\\u002d")} -->`;
+}
+const SETUP_URL = "https://mergelight.dev/setup/";
+/** Opens the setup page on the step this pull request is waiting for. */
+export function claudeSetupLink(repo, number) {
+    return repo ? `${SETUP_URL}?repo=${repo}&pr=${number}&connect=claude` : SETUP_URL;
+}
+export function connectBody(login, runUrl, claudeUrl, setupLink = SETUP_URL) {
+    const options = [
+        ...(login ? [{ name: "ChatGPT", steps: `[Open ChatGPT](${login.url}) and enter \`${login.code}\`` }] : []),
+        ...(claudeUrl ? [{ name: "Claude", steps: `[Connect on mergelight.dev](${setupLink})` }] : []),
+    ];
+    const only = options.length === 1 ? options[0] : null;
+    const run = runUrl ? `[your own GitHub Actions run](${runUrl})` : "your own GitHub Actions run";
+    return [
+        SUMMARY_MARKER,
+        PENDING_MARKER,
+        connectData(login, claudeUrl),
+        `### 🔌 Connect ${only?.name ?? "your AI"} to start reviews`,
+        "",
+        ...(only ? [`${only.steps}. The review then starts by itself.`] : ["Pick one, and the review starts by itself.", "", ...options.map((o) => `- **${o.name}:** ${o.steps}`)]),
+        "",
+        "<details><summary>Something not working?</summary>",
+        "",
+        "- **The link or code ran out:** they last 15 minutes. Push a new commit to get new ones.",
+        ...(login ? [`- **OpenAI refuses the code:** turn on "Enable device code sign-in" in your [ChatGPT security settings](${CHATGPT_SECURITY_URL}), or ask your workspace admin to.`] : []),
+        "",
+        "</details>",
+        "",
+        `<sub>Reviews use the plan of whoever connects it, so only do this if you're setting up this repository. This comes from ${run}. The login is saved as this repository's secret and never reaches Mergelight.</sub>`,
+    ].join("\n");
+}
+export function installAppBody() {
+    return [
+        SUMMARY_MARKER,
+        PENDING_MARKER,
+        "### 🔌 One step left: install the Mergelight AI app",
+        "",
+        `[Install it on this repository](${INSTALL_URL}), or approve its updated permissions if it's already installed, then push a new commit. The app saves your ChatGPT login, so you only connect once.`,
+    ].join("\n");
+}
+export function connectFailedBody(reason, claudeOffered = false) {
+    return [
+        SUMMARY_MARKER,
+        FAILED_MARKER,
+        claudeOffered ? "### ⚠️ Mergelight couldn't connect your AI" : "### ⚠️ Mergelight couldn't connect to ChatGPT",
+        "",
+        reason,
+        "",
+        claudeOffered ? "Push a new commit to get a new link and code. You can also use an API key instead: https://mergelight.dev/setup" : "Push a new commit to try again. You can also use an OpenAI API key instead: https://mergelight.dev/setup",
+    ].join("\n");
+}
+export async function connect(deps) {
+    let output = "";
+    let shown = false;
+    let notPosted = false;
+    let showing = Promise.resolve();
+    // First, so its link is in the comment that shows the ChatGPT code.
+    const claude = deps.startClaude ? await deps.startClaude().catch(() => null) : null;
+    const show = (login) => {
+        shown = true;
+        // Nobody can finish a login whose code never reached the pull request, so don't wait for it.
+        showing = deps.showCode(login, claude?.url).catch(() => {
+            notPosted = true;
+            deps.stopLogin();
+            claude?.stop();
+        });
+    };
+    const codexLogin = deps.startLogin((text) => {
+        output += text;
+        if (shown)
+            return;
+        const login = parseDeviceLogin(output);
+        if (login)
+            show(login);
+    });
+    const claudeWait = claude ? claude.wait().catch(() => false) : Promise.resolve(false);
+    const winner = await new Promise((resolve, reject) => {
+        let code = null;
+        let claudeOver = !claude;
+        codexLogin.then((exit) => {
+            code = exit;
+            if (exit === 0)
+                resolve("chatgpt");
+            else if (claudeOver || notPosted)
+                resolve(exit);
+            // ChatGPT's device sign-in can be switched off. Claude's link still has to reach the pull request.
+            else if (!shown)
+                show(null);
+        }, reject);
+        claudeWait.then((ok) => {
+            claudeOver = true;
+            if (ok)
+                resolve("claude");
+            else if (code !== null)
+                resolve(code);
+        });
+    });
+    await showing;
+    if (winner === "claude")
+        deps.stopLogin();
+    else
+        claude?.stop();
+    if (notPosted) {
+        await deps.failed("Mergelight couldn't post the login code on this pull request, because GitHub refused or didn't answer.");
+        return 1;
+    }
+    if (winner === "chatgpt" || winner === "claude") {
+        await deps.connected(winner);
+        return 0;
+    }
+    await deps.failed(claude
+        ? "The ChatGPT code and the Claude link both ran out before anyone finished signing in."
+        : shown
+            ? `The code ran out, or OpenAI refused it. Check that "Enable device code sign-in" is on in your [ChatGPT security settings](${CHATGPT_SECURITY_URL}).`
+            : `Codex couldn't start a device login. "Enable device code sign-in" may be off in your [ChatGPT security settings](${CHATGPT_SECURITY_URL}), or for your workspace.`);
+    return 1;
+}
+/** Tells the pull request the app has to be installed first. There's nowhere to save a login without it. */
+export async function askForApp(api, number, headSha) {
+    await upsertSummary(api, number, installAppBody());
+    await writeCheck(api, null, headSha, {
+        status: "completed",
+        conclusion: "neutral",
+        completed_at: new Date().toISOString(),
+        output: { title: "Install the Mergelight AI app", summary: `Install it, then push a new commit: ${INSTALL_URL}` },
+    });
+}
+/** The summary holds what earlier rounds found, so a login prompt on a reviewed pull request has to keep that. */
+async function upsertSummary(api, number, body) {
+    const { summary } = await readPrReviewState(api, number);
+    if (summary)
+        await api.write("PATCH", `issues/comments/${summary.id}`, { body: withState(body, summary.body) });
+    else
+        await api.write("POST", `issues/${number}/comments`, { body });
+}
+export function withState(body, previous) {
+    const state = stateBlock(previous);
+    return state ? `${body}\n${state}` : body;
+}
+/** The real thing: Codex on this runner, and the pull request as the place to show the code. */
+/** A repository set up before Claude support doesn't pass the login on, so connecting it would only ask again next time. */
+async function workflowHasClaude(api, env) {
+    const [, path, ref] = (env.GITHUB_WORKFLOW_REF ?? "").match(/^[^/]+\/[^/]+\/(.+?)@(.+)$/) ?? [];
+    if (!path || !ref)
+        return false;
+    return api
+        .get(`contents/${path}?ref=${encodeURIComponent(env.GITHUB_SHA ?? ref)}`)
+        .then((f) => Buffer.from(f.content, "base64").toString("utf8").includes("claude-code-oauth-token"), () => false);
+}
+export function githubConnect(api, number, headSha, log, env = process.env) {
+    const runUrl = env.GITHUB_RUN_ID ? `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}` : undefined;
+    let checkId = null;
+    let running = null;
+    let claudeOffered = false;
+    /**
+     * The app's token dies if the app is removed during the login, which can wait 15 minutes. The comment
+     * still has to change, or it keeps offering a dead code, and the workflow's own token can do that.
+     */
+    const updateSummary = async (body) => {
+        try {
+            await upsertSummary(api, number, body);
+        }
+        catch (err) {
+            const fallback = env.GITHUB_WORKFLOW_TOKEN;
+            if (!fallback || fallback === env.GH_TOKEN || !/Bad credentials|HTTP 401/i.test(err instanceof Error ? err.message : String(err)))
+                throw err;
+            log("GitHub refused the app's token, so this updates the comment with the workflow's token.");
+            env.GH_TOKEN = fallback;
+            await upsertSummary(api, number, body);
+        }
+    };
+    const finish = (title, summary) => writeCheck(api, checkId, headSha, { status: "completed", conclusion: "neutral", completed_at: new Date().toISOString(), output: { title, summary } }, log);
+    return {
+        stopLogin: () => running?.kill("SIGTERM"),
+        startClaude: async () => {
+            if (!(await workflowHasClaude(api, env)))
+                return null;
+            const signIn = await startClaudeSignIn();
+            if (!signIn) {
+                log("Claude's sign-in didn't start, so only ChatGPT is offered.");
+                return null;
+            }
+            const ref = claudeCodeRef(signIn.url);
+            if (!ref) {
+                log("Claude's sign-in link wasn't the expected shape, so only ChatGPT is offered.");
+                signIn.stop();
+                return null;
+            }
+            claudeOffered = true;
+            let over = false;
+            return {
+                url: signIn.url,
+                stop: () => {
+                    over = true;
+                    signIn.stop();
+                },
+                wait: async () => {
+                    const code = await waitForPastedCode({ read: () => readCodeRef((path) => api.get(path), ref), stopped: () => over });
+                    if (!code)
+                        return false;
+                    const token = await signIn.finish(code);
+                    if (!token) {
+                        log("Claude didn't accept that code.");
+                        return false;
+                    }
+                    shareClaudeToken(token, env);
+                    return true;
+                },
+            };
+        },
+        startLogin: (onOutput) => new Promise((resolve, reject) => {
+            const child = spawn("codex", ["login", "--device-auth"], { stdio: ["ignore", "pipe", "pipe"] });
+            running = child;
+            const timer = setTimeout(() => child.kill("SIGTERM"), LOGIN_TIMEOUT_MS);
+            child.stdout.setEncoding("utf8").on("data", onOutput);
+            child.stderr.setEncoding("utf8").on("data", onOutput);
+            child.on("error", (err) => {
+                clearTimeout(timer);
+                reject(err);
+            });
+            child.on("close", (code) => {
+                clearTimeout(timer);
+                resolve(code ?? 1);
+            });
+        }),
+        showCode: async (login, claudeUrl) => {
+            await upsertSummary(api, number, connectBody(login, runUrl, claudeUrl, claudeSetupLink(env.GITHUB_REPOSITORY, number)));
+            log("Posted the link and code on the pull request. Waiting for the login.");
+            // The comment is what people need. A check that can't be written shouldn't end a login that can still work.
+            try {
+                const run = await writeCheck(api, null, headSha, {
+                    status: "in_progress",
+                    started_at: new Date().toISOString(),
+                    output: { title: claudeUrl ? "Waiting for you to connect your AI" : "Waiting for you to connect ChatGPT", summary: "Follow the steps in the pull request's Mergelight comment." },
+                }, log);
+                checkId = run?.id ?? null;
+            }
+            catch (err) {
+                log(`Couldn't show the waiting check: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        },
+        connected: async (via = "chatgpt") => {
+            await updateSummary(pendingSummaryBody());
+            if (via === "claude") {
+                await api.write("POST", `issues/${number}/comments`, { body: "🔌 Reviews on this repository now use the Claude plan that confirmed the sign-in. If that isn't yours, remove the `CLAUDE_CODE_OAUTH_TOKEN` secret and push a commit to connect again." });
+                await finish("Connected to Claude", "Starting the review.");
+                log("Connected to Claude.");
+                return;
+            }
+            let auth = "";
+            try {
+                auth = readFileSync(join(env.CODEX_HOME ?? "", "auth.json"), "utf8");
+            }
+            catch {
+                // Without the file the note just doesn't name the account.
+            }
+            await api.write("POST", `issues/${number}/comments`, { body: connectedBody(connectedAccount(auth), env.SECRET_NAME || "CODEX_AUTH_JSON") });
+            await finish("Connected to ChatGPT", "Starting the review.");
+            log("Connected to ChatGPT.");
+        },
+        failed: async (reason) => {
+            // One failed write mustn't stop the other. Only the app that made a check can finish it.
+            await updateSummary(connectFailedBody(reason, claudeOffered)).catch((err) => log(`Couldn't update the comment: ${err instanceof Error ? err.message : String(err)}`));
+            await finish(CHECK_FAILED_TITLE, reason).catch((err) => log(`Couldn't finish the check: ${err instanceof Error ? err.message : String(err)}`));
+            log(reason);
+        },
+    };
+}

package/dist/github.js

@@ -0,0 +1,65 @@
+import { CommandError, runOk } from "./run.js";
+/**
+ * Accepts a pull request URL, owner/repo#123, or a bare number together with
+ * a default repository ("owner/repo").
+ */
+export function parsePrRef(ref, defaultRepo) {
+    const url = ref.match(/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)/);
+    if (url)
+        return { owner: url[1], repo: url[2], number: Number(url[3]) };
+    const short = ref.match(/^([\w.-]+)\/([\w.-]+)#(\d+)$/);
+    if (short)
+        return { owner: short[1], repo: short[2], number: Number(short[3]) };
+    const bare = ref.match(/^#?(\d+)$/);
+    if (bare && defaultRepo) {
+        const [owner, repo] = defaultRepo.split("/");
+        if (owner && repo)
+            return { owner, repo, number: Number(bare[1]) };
+    }
+    if (bare) {
+        throw new Error(`"${ref}" is only a number. Pass --repo owner/name, or run this inside a clone of the repository.`);
+    }
+    throw new Error(`Could not read "${ref}" as a pull request. Use a URL, owner/repo#123, or a number with --repo.`);
+}
+/** The repository of the current directory, if gh can tell. */
+export async function currentRepo() {
+    try {
+        const { stdout } = await runOk("gh", ["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"]);
+        return stdout.trim() || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** gh api, retried a few times when GitHub answers with a 5xx or the network drops. */
+async function ghApi(path) {
+    for (let attempt = 1;; attempt++) {
+        try {
+            return (await runOk("gh", ["api", path])).stdout;
+        }
+        catch (err) {
+            const transient = err instanceof CommandError && /HTTP 5\d\d|timeout|connection reset|EOF/i.test(err.message);
+            if (!transient || attempt === 4)
+                throw err;
+            await new Promise((r) => setTimeout(r, 2000 * attempt));
+        }
+    }
+}
+export async function fetchPullRequest(ref) {
+    const pull = JSON.parse(await ghApi(`repos/${ref.owner}/${ref.repo}/pulls/${ref.number}`));
+    return {
+        owner: ref.owner,
+        repo: ref.repo,
+        number: pull.number,
+        title: pull.title,
+        body: pull.body ?? "",
+        url: pull.html_url,
+        author: pull.user?.login ?? "unknown",
+        baseRef: pull.base.ref,
+        baseSha: pull.base.sha,
+        headSha: pull.head.sha,
+        additions: pull.additions,
+        deletions: pull.deletions,
+        changedFiles: pull.changed_files,
+    };
+}

package/dist/init.js

@@ -0,0 +1,92 @@
+import { cpSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { run } from "./run.js";
+const DOCS = "https://github.com/mergelightai/mergelight/blob/main/docs/agents.md";
+/** The name on npm. Plain "mergelight" was refused there for being too close to an older package. */
+const PACKAGE = "@mergelight/cli";
+/** An installed copy starts through npx, so it keeps working when the package moves. A clone runs its own file. */
+export function serverCommand(cliPath) {
+    return /[\\/]node_modules[\\/]@mergelight[\\/]cli[\\/]/.test(cliPath) ? { command: "npx", args: ["-y", PACKAGE, "mcp"] } : { command: "node", args: [cliPath, "mcp"] };
+}
+async function has(deps, cmd) {
+    try {
+        return (await deps.run(cmd, ["--version"])).code === 0;
+    }
+    catch {
+        return false;
+    }
+}
+function addSkill(deps, skills) {
+    mkdirSync(skills, { recursive: true });
+    cpSync(deps.skillDir, join(skills, "mergelight"), { recursive: true });
+}
+const why = (r) => (r.stderr || r.stdout).trim().split("\n").at(-1)?.slice(0, 200) ?? "no reason given";
+export async function init(deps) {
+    const server = serverCommand(deps.cliPath);
+    let added = 0;
+    if (await has(deps, "claude")) {
+        // Claude Code refuses a name that's already there, so the old entry goes first.
+        await deps.run("claude", ["mcp", "remove", "--scope", "user", "mergelight"]).catch(() => undefined);
+        const r = await deps.run("claude", ["mcp", "add", "--scope", "user", "mergelight", "--", server.command, ...server.args]);
+        if (r.code === 0) {
+            addSkill(deps, join(deps.home, ".claude", "skills"));
+            deps.log("✓ MCP server and skill added for Claude Code");
+            added++;
+        }
+        else
+            deps.log(`Claude Code: couldn't add the MCP server (${why(r)})`);
+    }
+    if (await has(deps, "codex")) {
+        const r = await deps.run("codex", ["mcp", "add", "mergelight", "--", server.command, ...server.args]);
+        if (r.code === 0) {
+            addSkill(deps, join(deps.home, ".agents", "skills"));
+            deps.log("✓ MCP server and skill added for Codex");
+            added++;
+        }
+        else
+            deps.log(`Codex: couldn't add the MCP server (${why(r)})`);
+    }
+    const cursor = join(deps.home, ".cursor");
+    if (existsSync(cursor)) {
+        const file = join(cursor, "mcp.json");
+        let config = {};
+        if (existsSync(file)) {
+            try {
+                const parsed = JSON.parse(readFileSync(file, "utf8"));
+                config = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+            }
+            catch {
+                config = null;
+            }
+        }
+        if (config) {
+            const servers = config.mcpServers && typeof config.mcpServers === "object" ? config.mcpServers : {};
+            writeFileSync(file, `${JSON.stringify({ ...config, mcpServers: { ...servers, mergelight: { type: "stdio", ...server } } }, null, 2)}\n`);
+            addSkill(deps, join(cursor, "skills"));
+            deps.log("✓ MCP server and skill added for Cursor");
+            added++;
+        }
+        else
+            deps.log(`Cursor: ${file} isn't valid JSON, so it's left as it is. To add Mergelight by hand, see ${DOCS}`);
+    }
+    if (!added) {
+        deps.log(`No coding agent was set up. Mergelight looks for Claude Code, Codex and Cursor. To add it by hand, see ${DOCS}`);
+        return 1;
+    }
+    if (!(await has(deps, "gh")))
+        deps.log("The server reads pull requests with the GitHub CLI. Install it from https://cli.github.com and run: gh auth login");
+    deps.log('Now ask your agent: "Handle the Mergelight findings on this PR."');
+    return 0;
+}
+export function realInitDeps() {
+    const here = dirname(fileURLToPath(import.meta.url));
+    return {
+        home: homedir(),
+        cliPath: join(here, "cli.js"),
+        skillDir: join(here, "..", "skills", "mergelight"),
+        run: (cmd, args) => run(cmd, args, { timeoutMs: 60_000 }),
+        log: (line) => console.log(line),
+    };
+}