@misterhuydo/sentinel 1.0.76 → 1.0.82

package/lib/init.js

@@ -1,319 +1,356 @@
-'use strict';
-
-const fs = require('fs-extra');
-const path = require('path');
-const os = require('os');
-const { execSync, spawnSync } = require('child_process');
-const prompts = require('prompts');
-const chalk = require('chalk');
-const { generateProjectScripts, generateWorkspaceScripts, writeExampleProject } = require('./generate');
-
-const ok   = msg => console.log(chalk.green('  ✔'), msg);
-const info = msg => console.log(chalk.cyan('  →'), msg);
-const warn = msg => console.log(chalk.yellow('  ⚠'), msg);
-const step = msg => console.log('\n' + chalk.bold.white(msg));
-
-module.exports = async function init() {
-  // Pre-read existing workspace config so prompts can show current values
-  const defaultWorkspace = path.join(os.homedir(), 'sentinel');
-  const existing = readExistingConfig(defaultWorkspace);
-  if (Object.keys(existing).length) {
-    console.log(chalk.cyan('\n  → Existing workspace config found — showing current values as defaults\n'));
-  }
-
-  // ── Prompts ─────────────────────────────────────────────────────────────────
-  const answers = await prompts([
-    {
-      type: 'text',
-      name: 'workspace',
-      message: 'Workspace directory (each project lives here as a subdirectory)',
-      initial: path.join(os.homedir(), 'sentinel'),
-      format: v => v.replace(/^~/, os.homedir()),
-    },
-    {
-      type: 'select',
-      name: 'authMode',
-      message: 'How will Claude Code authenticate?',
-      choices: [
-        { title: 'API key  (Anthropic API account — recommended for servers)', value: 'apikey' },
-        { title: 'Claude Pro / OAuth  (will give you a URL to open in any browser)', value: 'oauth' },
-        { title: 'Skip  (I will configure this later)', value: 'skip' },
-      ],
-    },
-    {
-      type: prev => prev === 'apikey' ? 'password' : null,
-      name: 'anthropicKey',
-      message: 'Anthropic API key (sk-ant-...)',
-      validate: v => v.startsWith('sk-ant-') ? true : 'Key should start with sk-ant-',
-    },
-    {
-      type: 'confirm',
-      name: 'example',
-      message: 'Create an example project to show how to configure?',
-      initial: true,
-    },
-    {
-      type: 'confirm',
-      name: 'systemd',
-      message: 'Set up systemd service for auto-start on reboot?',
-      initial: process.platform === 'linux',
-    },
-    {
-      type: 'text',
-      name: 'smtpUser',
-      message: 'SMTP sender address',
-      initial: existing.SMTP_USER || 'sentinel@yourdomain.com',
-    },
-    {
-      type: prev => prev ? 'password' : null,
-      name: 'smtpPassword',
-      message: existing.SMTP_PASSWORD ? 'SMTP password / app password  (press Enter to keep current)' : 'SMTP password / app password',
-    },
-    {
-      type: prev => prev ? 'text' : null,
-      name: 'smtpHost',
-      message: 'SMTP host',
-      initial: existing.SMTP_HOST || 'smtp.gmail.com',
-    },
-    {
-      type: 'confirm',
-      name: 'setupSlack',
-      message: 'Set up Slack Bot (Sentinel Boss — conversational AI interface)?',
-      initial: !!(existing.SLACK_BOT_TOKEN),
-    },
-    {
-      type: prev => prev ? 'password' : null,
-      name: 'slackBotToken',
-      message: existing.SLACK_BOT_TOKEN ? 'Slack Bot Token  (press Enter to keep current)' : 'Slack Bot Token  (xoxb-...)',
-      validate: v => !v || v.startsWith('xoxb-') ? true : 'Should start with xoxb-',
-    },
-    {
-      type: (_, { setupSlack }) => setupSlack ? 'password' : null,
-      name: 'slackAppToken',
-      message: existing.SLACK_APP_TOKEN ? 'Slack App-Level Token  (press Enter to keep current)' : 'Slack App-Level Token  (xapp-...)',
-      validate: v => !v || v.startsWith('xapp-') ? true : 'Should start with xapp-',
-    },
-  ], { onCancel: () => process.exit(0) });
-
-  const { workspace, authMode, anthropicKey, example, systemd, smtpUser, smtpPassword, smtpHost, setupSlack, slackBotToken, slackAppToken } = answers;
-  const effectiveSmtpPassword  = smtpPassword  || existing.SMTP_PASSWORD  || '';
-  const effectiveSlackBotToken = slackBotToken || existing.SLACK_BOT_TOKEN || '';
-  const effectiveSlackAppToken = slackAppToken || existing.SLACK_APP_TOKEN || '';
-  const codeDir = path.join(workspace, 'code');
-
-  // ── Python ──────────────────────────────────────────────────────────────────
-  step('Checking Python…');
-  const python = findPython();
-  if (!python) {
-    console.error(chalk.red('  ✖ python3 not found. Install it first:'));
-    console.error('      sudo apt-get install -y python3 python3-pip python3-venv');
-    process.exit(1);
-  }
-  ok(`Python: ${run(python, ['--version']).trim()}`);
-
-  // ── Copy Sentinel Python source ─────────────────────────────────────────────
-  step('Installing Sentinel code…');
-  const bundledPython = path.join(__dirname, '..', 'python');
-  if (!fs.existsSync(bundledPython)) {
-    console.error(chalk.red('  ✖ Bundled Python source not found (run npm publish from the Sentinel repo)'));
-    process.exit(1);
-  }
-  fs.ensureDirSync(codeDir);
-  fs.copySync(bundledPython, codeDir, { overwrite: true });
-  ok(`Sentinel code → ${codeDir}`);
-
-  // ── Python venv ─────────────────────────────────────────────────────────────
-  step('Setting up Python environment…');
-  const venv = path.join(codeDir, '.venv');
-  if (!fs.existsSync(venv)) {
-    info('Creating virtual environment…');
-    runLive(python, ['-m', 'venv', venv]);
-  }
-  const pip = path.join(venv, 'bin', 'pip3');
-  const pythonBin = path.join(venv, 'bin', 'python3');
-  info('Installing Python packages…');
-  runLive(pip, ['install', '--quiet', '--upgrade', 'pip']);
-  runLive(pip, ['install', '--quiet', '-r', path.join(codeDir, 'requirements.txt')]);
-  ok('Python packages installed');
-
-  // ── Node tools ──────────────────────────────────────────────────────────────
-  step('Installing Node tools…');
-  installNpmGlobal('@misterhuydo/cairn-mcp', 'cairn');
-  installNpmGlobal('@anthropic-ai/claude-code', 'claude');
-  info('Hooking Cairn MCP into Claude Code…');
-  runLive('cairn', ['install']);
-
-  // ── Claude Code auth ─────────────────────────────────────────────────────────
-  step('Claude Code authentication…');
-  if (authMode === 'apikey' && anthropicKey) {
-    ok('API key will be written to each project\'s sentinel.properties');
-  } else if (authMode === 'oauth') {
-    info('OAuth selected — start.sh will prompt for login if not yet authenticated');
-  } else {
-    info('Skipping auth — start.sh will prompt for login if needed');
-  }
-
-  // ── Slack Bot ────────────────────────────────────────────────────────────────
-  if (effectiveSlackBotToken && effectiveSlackAppToken) {
-    step('Slack Bot (Sentinel Boss)…');
-    ok('Tokens will be written to workspace sentinel.properties');
-    info('Sentinel Boss starts automatically when the project starts');
-  } else if (setupSlack) {
-    warn('Slack tokens not provided — add them to config/sentinel.properties later');
-  }
-
-  // ── Workspace structure ─────────────────────────────────────────────────────
-  step('Creating workspace…');
-  fs.ensureDirSync(workspace);
-  ok(`Workspace: ${workspace}`);
-
-  // ── Example project ─────────────────────────────────────────────────────────
-  if (example) {
-    step('Creating example project…');
-    const exampleDir = path.join(workspace, 'my-project');
-    writeExampleProject(exampleDir, codeDir, pythonBin, anthropicKey || '', { botToken: effectiveSlackBotToken, appToken: effectiveSlackAppToken });
-    ok(`Example project: ${exampleDir}`);
-  }
-
-  // ── Workspace start/stop scripts ─────────────────────────────────────────────
-  step('Generating scripts…');
-  generateWorkspaceScripts(workspace, { host: smtpHost, user: smtpUser, password: effectiveSmtpPassword }, { botToken: effectiveSlackBotToken, appToken: effectiveSlackAppToken });
-  ok(`${workspace}/startAll.sh`);
-  ok(`${workspace}/stopAll.sh`);
-
-  // ── systemd ──────────────────────────────────────────────────────────────────
-  if (systemd) {
-    step('Setting up systemd…');
-    setupSystemd(workspace);
-  }
-
-  // ── Done ─────────────────────────────────────────────────────────────────────
-  console.log('\n' + chalk.bold.green('══ Done! ══') + '\n');
-  console.log(`${chalk.bold('Next steps:')}`);
-  if (example) {
-    console.log(`
-  1. Configure your first project:
-     ${chalk.cyan(`${workspace}/my-project/config/sentinel.properties`)}
-     ${chalk.cyan(`${workspace}/my-project/config/log-configs/`)}
-     ${chalk.cyan(`${workspace}/my-project/config/repo-configs/`)}
-
-  2. Start all projects (Sentinel clones repos, indexes, and monitors automatically):
-     ${chalk.cyan(`${workspace}/startAll.sh`)}
-
-  3. Stop all projects:
-     ${chalk.cyan(`${workspace}/stopAll.sh`)}
-`);
-  }
-  if (systemd) {
-    console.log(`  Auto-start is enabled. To manage:
-     ${chalk.cyan('sudo systemctl start sentinel')}
-     ${chalk.cyan('sudo systemctl status sentinel')}
-     ${chalk.cyan('journalctl -u sentinel -f')}
-`);
-  }
-
-  console.log(`  Add another project anytime:
-     ${chalk.cyan('sentinel add <project-name>')}
-`);
-};
-
-// ── Helpers ──────────────────────────────────────────────────────────────────
-
-function readExistingConfig(workspace) {
-  const result = {};
-  _parsePropsInto(path.join(workspace, 'sentinel.properties'), result);
-  // Migrate: if Slack tokens not in workspace config, scan project configs as fallback
-  if (!result.SLACK_BOT_TOKEN || !result.SLACK_APP_TOKEN) {
-    try {
-      for (const entry of fs.readdirSync(workspace)) {
-        const p = path.join(workspace, entry, 'config', 'sentinel.properties');
-        const proj = {};
-        _parsePropsInto(p, proj);
-        if (!result.SLACK_BOT_TOKEN && proj.SLACK_BOT_TOKEN) result.SLACK_BOT_TOKEN = proj.SLACK_BOT_TOKEN;
-        if (!result.SLACK_APP_TOKEN && proj.SLACK_APP_TOKEN) result.SLACK_APP_TOKEN = proj.SLACK_APP_TOKEN;
-        if (result.SLACK_BOT_TOKEN && result.SLACK_APP_TOKEN) break;
-      }
-    } catch (_) {}
-  }
-  return result;
-}
-
-function _parsePropsInto(propsPath, result) {
-  if (!fs.existsSync(propsPath)) return;
-  try {
-    const lines = fs.readFileSync(propsPath, 'utf8').split(/\r?\n/);
-    for (const raw of lines) {
-      const line = raw.trim();
-      if (!line || line.startsWith('#')) continue;
-      const idx = line.indexOf('=');
-      if (idx === -1) continue;
-      result[line.slice(0, idx).trim()] = line.slice(idx + 1).trim();
-    }
-  } catch (_) {}
-}
-
-function findPython() {
-  for (const bin of ['python3', 'python']) {
-    try {
-      execSync(`${bin} --version`, { stdio: 'pipe' });
-      return bin;
-    } catch (_) {}
-  }
-  return null;
-}
-
-function run(bin, args) {
-  const r = spawnSync(bin, args, { encoding: 'utf8' });
-  return (r.stdout || '') + (r.stderr || '');
-}
-
-function runLive(bin, args) {
-  const r = spawnSync(bin, args, { stdio: 'inherit' });
-  if (r.status !== 0) {
-    console.error(chalk.red(`  ✖ Command failed: ${bin} ${args.join(' ')}`));
-    process.exit(1);
-  }
-}
-
-function installNpmGlobal(pkg, checkBin) {
-  try {
-    execSync(`${checkBin} --version`, { stdio: 'pipe' });
-    ok(`${pkg} already installed`);
-  } catch (_) {
-    info(`Installing ${pkg}…`);
-    runLive('npm', ['install', '-g', pkg]);
-    ok(`${pkg} installed`);
-  }
-}
-
-function setupSystemd(workspace) {
-  const user = os.userInfo().username;
-  const svc = `/etc/systemd/system/sentinel.service`;
-  const content = `[Unit]
-Description=Sentinel — Autonomous DevOps Agent
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=forking
-User=${user}
-WorkingDirectory=${workspace}
-ExecStart=${workspace}/startAll.sh
-ExecStop=${workspace}/stopAll.sh
-Restart=on-failure
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target
-`;
-  try {
-    fs.writeFileSync('/tmp/sentinel.service', content);
-    execSync(`sudo mv /tmp/sentinel.service ${svc}`);
-    execSync('sudo systemctl daemon-reload');
-    execSync('sudo systemctl enable sentinel');
-    ok('sentinel.service enabled');
-  } catch (e) {
-    warn(`Could not write systemd service (need sudo): ${e.message}`);
-    warn(`Manually create ${svc} to auto-start on reboot`);
-  }
-}
+'use strict';
+
+const fs = require('fs-extra');
+const path = require('path');
+const os = require('os');
+const { execSync, spawnSync } = require('child_process');
+const prompts = require('prompts');
+const chalk = require('chalk');
+const { generateProjectScripts, generateWorkspaceScripts, writeExampleProject } = require('./generate');
+
+const ok   = msg => console.log(chalk.green('  ✔'), msg);
+const info = msg => console.log(chalk.cyan('  →'), msg);
+const warn = msg => console.log(chalk.yellow('  ⚠'), msg);
+const step = msg => console.log('\n' + chalk.bold.white(msg));
+
+module.exports = async function init() {
+  // Pre-read existing workspace config so prompts can show current values
+  const defaultWorkspace = path.join(os.homedir(), 'sentinel');
+  const existing = readExistingConfig(defaultWorkspace);
+  if (Object.keys(existing).length) {
+    console.log(chalk.cyan('\n  → Existing workspace config found — showing current values as defaults\n'));
+  }
+
+  // ── Prompts ─────────────────────────────────────────────────────────────────
+  const answers = await prompts([
+    {
+      type: 'text',
+      name: 'workspace',
+      message: 'Workspace directory (each project lives here as a subdirectory)',
+      initial: path.join(os.homedir(), 'sentinel'),
+      format: v => v.replace(/^~/, os.homedir()),
+    },
+    {
+      type: 'select',
+      name: 'authMode',
+      message: 'How will Claude Code authenticate?',
+      choices: [
+        { title: 'API key  (Anthropic API account — recommended for servers)', value: 'apikey' },
+        { title: 'Claude Pro / OAuth  (will give you a URL to open in any browser)', value: 'oauth' },
+        { title: 'Skip  (I will configure this later)', value: 'skip' },
+      ],
+    },
+    {
+      type: prev => prev === 'apikey' ? 'password' : null,
+      name: 'anthropicKey',
+      message: 'Anthropic API key (sk-ant-...)',
+      validate: v => v.startsWith('sk-ant-') ? true : 'Key should start with sk-ant-',
+    },
+    {
+      type: 'confirm',
+      name: 'example',
+      message: 'Create an example project to show how to configure?',
+      initial: true,
+    },
+    {
+      type: 'confirm',
+      name: 'systemd',
+      message: 'Set up systemd service for auto-start on reboot?',
+      initial: process.platform === 'linux',
+    },
+    {
+      type: 'text',
+      name: 'smtpUser',
+      message: 'SMTP sender address',
+      initial: existing.SMTP_USER || 'sentinel@yourdomain.com',
+    },
+    {
+      type: prev => prev ? 'password' : null,
+      name: 'smtpPassword',
+      message: existing.SMTP_PASSWORD ? 'SMTP password / app password  (press Enter to keep current)' : 'SMTP password / app password',
+    },
+    {
+      type: prev => prev ? 'text' : null,
+      name: 'smtpHost',
+      message: 'SMTP host',
+      initial: existing.SMTP_HOST || 'smtp.gmail.com',
+    },
+    {
+      type: 'confirm',
+      name: 'setupSlack',
+      message: 'Set up Slack Bot (Sentinel Boss — conversational AI interface)?',
+      initial: !!(existing.SLACK_BOT_TOKEN),
+    },
+    {
+      type: prev => prev ? 'password' : null,
+      name: 'slackBotToken',
+      message: existing.SLACK_BOT_TOKEN ? 'Slack Bot Token  (press Enter to keep current)' : 'Slack Bot Token  (xoxb-...)',
+      validate: v => !v || v.startsWith('xoxb-') ? true : 'Should start with xoxb-',
+    },
+    {
+      type: (_, { setupSlack }) => setupSlack ? 'password' : null,
+      name: 'slackAppToken',
+      message: existing.SLACK_APP_TOKEN ? 'Slack App-Level Token  (press Enter to keep current)' : 'Slack App-Level Token  (xapp-...)',
+      validate: v => !v || v.startsWith('xapp-') ? true : 'Should start with xapp-',
+    },
+  ], { onCancel: () => process.exit(0) });
+
+  const { workspace, authMode, anthropicKey, example, systemd, smtpUser, smtpPassword, smtpHost, setupSlack, slackBotToken, slackAppToken } = answers;
+  const effectiveSmtpPassword  = smtpPassword  || existing.SMTP_PASSWORD  || '';
+  const effectiveSlackBotToken = slackBotToken || existing.SLACK_BOT_TOKEN || '';
+  const effectiveSlackAppToken = slackAppToken || existing.SLACK_APP_TOKEN || '';
+  const codeDir = path.join(workspace, 'code');
+
+  // ── Python ──────────────────────────────────────────────────────────────────
+  step('Checking Python…');
+  const python = findPython();
+  if (!python) {
+    console.error(chalk.red('  ✖ python3 not found. Install it first:'));
+    console.error('      sudo apt-get install -y python3 python3-pip python3-venv');
+    process.exit(1);
+  }
+  ok(`Python: ${run(python, ['--version']).trim()}`);
+
+  // ── Copy Sentinel Python source ─────────────────────────────────────────────
+  step('Installing Sentinel code…');
+  const bundledPython = path.join(__dirname, '..', 'python');
+  if (!fs.existsSync(bundledPython)) {
+    console.error(chalk.red('  ✖ Bundled Python source not found (run npm publish from the Sentinel repo)'));
+    process.exit(1);
+  }
+  fs.ensureDirSync(codeDir);
+  fs.copySync(bundledPython, codeDir, { overwrite: true });
+  ok(`Sentinel code → ${codeDir}`);
+
+  // ── Python venv ─────────────────────────────────────────────────────────────
+  step('Setting up Python environment…');
+  const venv = path.join(codeDir, '.venv');
+  if (!fs.existsSync(venv)) {
+    info('Creating virtual environment…');
+    runLive(python, ['-m', 'venv', venv]);
+  }
+  const pip = path.join(venv, 'bin', 'pip3');
+  const pythonBin = path.join(venv, 'bin', 'python3');
+  info('Installing Python packages…');
+  runLive(pip, ['install', '--quiet', '--upgrade', 'pip']);
+  runLive(pip, ['install', '--quiet', '-r', path.join(codeDir, 'requirements.txt')]);
+  ok('Python packages installed');
+
+  // ── Node tools ──────────────────────────────────────────────────────────────
+  step('Installing Node tools…');
+  installNpmGlobal('@misterhuydo/cairn-mcp', 'cairn');
+  installNpmGlobal('@anthropic-ai/claude-code', 'claude');
+  info('Hooking Cairn MCP into Claude Code…');
+  runLive('cairn', ['install']);
+  step('Patching Claude Code permissions…');
+  ensureClaudePermissions();
+
+  // ── Claude Code auth ─────────────────────────────────────────────────────────
+  step('Claude Code authentication…');
+  if (authMode === 'apikey' && anthropicKey) {
+    ok('API key will be written to each project\'s sentinel.properties');
+  } else if (authMode === 'oauth') {
+    info('OAuth selected — start.sh will prompt for login if not yet authenticated');
+  } else {
+    info('Skipping auth — start.sh will prompt for login if needed');
+  }
+
+  // ── Slack Bot ────────────────────────────────────────────────────────────────
+  if (effectiveSlackBotToken && effectiveSlackAppToken) {
+    step('Slack Bot (Sentinel Boss)…');
+    ok('Tokens will be written to workspace sentinel.properties');
+    info('Sentinel Boss starts automatically when the project starts');
+  } else if (setupSlack) {
+    warn('Slack tokens not provided — add them to config/sentinel.properties later');
+  }
+
+  // ── Workspace structure ─────────────────────────────────────────────────────
+  step('Creating workspace…');
+  fs.ensureDirSync(workspace);
+  ok(`Workspace: ${workspace}`);
+
+  // ── Example project ─────────────────────────────────────────────────────────
+  if (example) {
+    step('Creating example project…');
+    const exampleDir = path.join(workspace, 'my-project');
+    writeExampleProject(exampleDir, codeDir, pythonBin, anthropicKey || '', { botToken: effectiveSlackBotToken, appToken: effectiveSlackAppToken });
+    ok(`Example project: ${exampleDir}`);
+  }
+
+  // ── Workspace start/stop scripts ─────────────────────────────────────────────
+  step('Generating scripts…');
+  generateWorkspaceScripts(workspace, { host: smtpHost, user: smtpUser, password: effectiveSmtpPassword }, { botToken: effectiveSlackBotToken, appToken: effectiveSlackAppToken });
+  ok(`${workspace}/startAll.sh`);
+  ok(`${workspace}/stopAll.sh`);
+
+  // ── systemd ──────────────────────────────────────────────────────────────────
+  if (systemd) {
+    step('Setting up systemd…');
+    setupSystemd(workspace);
+  }
+
+  // ── Done ─────────────────────────────────────────────────────────────────────
+  console.log('\n' + chalk.bold.green('══ Done! ══') + '\n');
+  console.log(`${chalk.bold('Next steps:')}`);
+  if (example) {
+    console.log(`
+  1. Configure your first project:
+     ${chalk.cyan(`${workspace}/my-project/config/sentinel.properties`)}
+     ${chalk.cyan(`${workspace}/my-project/config/log-configs/`)}
+     ${chalk.cyan(`${workspace}/my-project/config/repo-configs/`)}
+
+  2. Start all projects (Sentinel clones repos, indexes, and monitors automatically):
+     ${chalk.cyan(`${workspace}/startAll.sh`)}
+
+  3. Stop all projects:
+     ${chalk.cyan(`${workspace}/stopAll.sh`)}
+`);
+  }
+  if (systemd) {
+    console.log(`  Auto-start is enabled. To manage:
+     ${chalk.cyan('sudo systemctl start sentinel')}
+     ${chalk.cyan('sudo systemctl status sentinel')}
+     ${chalk.cyan('journalctl -u sentinel -f')}
+`);
+  }
+
+  console.log(`  Add another project anytime:
+     ${chalk.cyan('sentinel add <project-name>')}
+`);
+};
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+
+function readExistingConfig(workspace) {
+  const result = {};
+  _parsePropsInto(path.join(workspace, 'sentinel.properties'), result);
+  // Migrate: if Slack tokens not in workspace config, scan project configs as fallback
+  if (!result.SLACK_BOT_TOKEN || !result.SLACK_APP_TOKEN) {
+    try {
+      for (const entry of fs.readdirSync(workspace)) {
+        const p = path.join(workspace, entry, 'config', 'sentinel.properties');
+        const proj = {};
+        _parsePropsInto(p, proj);
+        if (!result.SLACK_BOT_TOKEN && proj.SLACK_BOT_TOKEN) result.SLACK_BOT_TOKEN = proj.SLACK_BOT_TOKEN;
+        if (!result.SLACK_APP_TOKEN && proj.SLACK_APP_TOKEN) result.SLACK_APP_TOKEN = proj.SLACK_APP_TOKEN;
+        if (result.SLACK_BOT_TOKEN && result.SLACK_APP_TOKEN) break;
+      }
+    } catch (_) {}
+  }
+  return result;
+}
+
+function _parsePropsInto(propsPath, result) {
+  if (!fs.existsSync(propsPath)) return;
+  try {
+    const lines = fs.readFileSync(propsPath, 'utf8').split(/\r?\n/);
+    for (const raw of lines) {
+      const line = raw.trim();
+      if (!line || line.startsWith('#')) continue;
+      const idx = line.indexOf('=');
+      if (idx === -1) continue;
+      result[line.slice(0, idx).trim()] = line.slice(idx + 1).trim();
+    }
+  } catch (_) {}
+}
+
+function findPython() {
+  for (const bin of ['python3', 'python']) {
+    try {
+      execSync(`${bin} --version`, { stdio: 'pipe' });
+      return bin;
+    } catch (_) {}
+  }
+  return null;
+}
+
+function run(bin, args) {
+  const r = spawnSync(bin, args, { encoding: 'utf8' });
+  return (r.stdout || '') + (r.stderr || '');
+}
+
+function runLive(bin, args) {
+  const r = spawnSync(bin, args, { stdio: 'inherit' });
+  if (r.status !== 0) {
+    console.error(chalk.red(`  ✖ Command failed: ${bin} ${args.join(' ')}`));
+    process.exit(1);
+  }
+}
+
+function installNpmGlobal(pkg, checkBin) {
+  try {
+    execSync(`${checkBin} --version`, { stdio: 'pipe' });
+    ok(`${pkg} already installed`);
+  } catch (_) {
+    info(`Installing ${pkg}…`);
+    runLive('npm', ['install', '-g', pkg]);
+    ok(`${pkg} installed`);
+  }
+}
+
+function ensureClaudePermissions() {
+  const settingsPath = require('path').join(require('os').homedir(), '.claude', 'settings.json');
+  const required = ['Read(**)', 'Write(**)', 'Edit(**)', 'Bash(**)'];
+  let settings = {};
+  try {
+    if (fs.existsSync(settingsPath)) {
+      settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+    }
+  } catch (e) {
+    warn('Could not read ' + settingsPath + ': ' + e.message);
+    return;
+  }
+  if (!settings.permissions) settings.permissions = {};
+  if (!Array.isArray(settings.permissions.allow)) settings.permissions.allow = [];
+  const existing = new Set(settings.permissions.allow);
+  const added = [];
+  for (const perm of required) {
+    if (!existing.has(perm)) {
+      settings.permissions.allow.push(perm);
+      added.push(perm);
+    }
+  }
+  if (added.length === 0) {
+    ok('Claude Code permissions already configured');
+    return;
+  }
+  try {
+    fs.ensureDirSync(require('path').dirname(settingsPath));
+    fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '
+');
+    ok('Claude Code permissions patched: ' + added.join(', '));
+  } catch (e) {
+    warn('Could not write ' + settingsPath + ': ' + e.message);
+  }
+}
+function setupSystemd(workspace) {
+  const user = os.userInfo().username;
+  const svc = `/etc/systemd/system/sentinel.service`;
+  const content = `[Unit]
+Description=Sentinel — Autonomous DevOps Agent
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=forking
+User=${user}
+WorkingDirectory=${workspace}
+ExecStart=${workspace}/startAll.sh
+ExecStop=${workspace}/stopAll.sh
+Restart=on-failure
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+`;
+  try {
+    fs.writeFileSync('/tmp/sentinel.service', content);
+    execSync(`sudo mv /tmp/sentinel.service ${svc}`);
+    execSync('sudo systemctl daemon-reload');
+    execSync('sudo systemctl enable sentinel');
+    ok('sentinel.service enabled');
+  } catch (e) {
+    warn(`Could not write systemd service (need sudo): ${e.message}`);
+    warn(`Manually create ${svc} to auto-start on reboot`);
+  }
+}