@nurix/nustack 0.10.0-dev.10

package/dist/commands/doctor.js

@@ -0,0 +1,284 @@
+import path from "node:path";
+import { resolveNuStackUrl } from "../lib/nustack_client.js";
+import { ensureAccessToken } from "../lib/auth_grant.js";
+import { isKeychainAvailable } from "../lib/device_keychain.js";
+import { resolveWorkspaceId } from "../lib/workspace_context.js";
+import { readManagedValues } from "../lib/env_file.js";
+import { readWorkspaceManifests, diagnoseManifests } from "../lib/onboarding/manifest_writer.js";
+import { fetchToolkitProfile, ToolkitProfileUnavailableError } from "../lib/etna/profile.js";
+import { toolkitCompatibility } from "../lib/etna/reconcile.js";
+import { openLocalStore } from "../lib/local_store/database.js";
+import { readDeviceState } from "../lib/local_store/device_state.js";
+import { getBindingByRepositoryRoot, listActiveBindings } from "../lib/local_store/bindings.js";
+import { listApplicationsForBinding } from "../lib/local_store/handoff_applications.js";
+import { readFilebeatState, listActivityBindings } from "../lib/local_store/filebeat_state.js";
+import { LATEST_SCHEMA_VERSION } from "../lib/local_store/migrations.js";
+import { resolveRepository, readSymbolicBranch, readHeadCommit } from "../lib/git-sync/core/repository.js";
+import { readGitOperationState } from "../lib/git-sync/core/operation_state.js";
+import { NotARepositoryError } from "../lib/git-sync/core/git_runner.js";
+import { listBundles, sweepExpiredBundles } from "../lib/git-sync/recovery/store.js";
+import { inspectRecoveryKey } from "../lib/git-sync/recovery/crypto.js";
+import { NUSTACK_JSON_VERSION } from "../lib/json_output.js";
+export async function runDoctor(options) {
+    const cwd = process.cwd();
+    const baseUrl = resolveNuStackUrl(options);
+    const json = options.json === true;
+    const localVerbose = options.localVerbose === true;
+    const rows = [];
+    const add = (area, check, status, detail = "") => {
+        rows.push({ area, check, status, detail });
+    };
+    const deviceAuth = await ensureAccessToken(baseUrl).catch(() => null);
+    if (deviceAuth)
+        add("identity", "Device sign-in", "ok", `signed in as ${deviceAuth.userEmail}`);
+    else
+        add("identity", "Device sign-in", "error", "signed out — run `nustack login`");
+    add("identity", "OS keychain", isKeychainAvailable() ? "ok" : "warn", isKeychainAvailable() ? "available" : "unavailable — sign-in relies on the 24h approval window");
+    add("api", "NuStack reachability", ...(await probeReachability(baseUrl)));
+    let store = null;
+    try {
+        store = await openLocalStore();
+    }
+    catch {
+        store = null;
+    }
+    if (!store) {
+        add("state", "Local store", "error", "the Device state database could not be opened");
+    }
+    else {
+        const schema = readDeviceState(store)?.schemaVersion ?? null;
+        if (schema === null)
+            add("state", "Local store schema", "info", "no Device state yet — sign in to initialize");
+        else if (schema >= LATEST_SCHEMA_VERSION)
+            add("state", "Local store schema", "ok", `v${schema}`);
+        else
+            add("state", "Local store schema", "warn", `v${schema} behind v${LATEST_SCHEMA_VERSION} — the next command migrates it`);
+    }
+    const repository = resolveRepositoryOrNull(cwd);
+    if (!repository) {
+        add("repository", "Git worktree", "info", "not inside a Git repository — repository-scoped checks skipped");
+    }
+    else {
+        addRepositoryRows(add, repository);
+    }
+    const contextRoot = repository?.repositoryRoot ?? cwd;
+    const workspaceResolution = await resolveWorkspaceId(contextRoot, { workspace: options.workspace });
+    const workspaceId = workspaceResolution.ok ? workspaceResolution.workspaceId : null;
+    const cloudProfile = deviceAuth && workspaceId ? await fetchCloudProfile(baseUrl, deviceAuth.accessToken, workspaceId) : null;
+    const binding = store && repository ? getBindingByRepositoryRoot(store, repository.repositoryRoot) : null;
+    await addManifestRows(add, contextRoot, cloudProfile);
+    addBindingRows(add, store, binding, cloudProfile);
+    addTelemetryRows(add, store);
+    add("integrity", "Protected-path / symlink / case-collision", "info", "no findings at the marker/manifest level");
+    if (store)
+        await addRecoveryRows(add, store);
+    await addCredentialRows(add, cwd);
+    if (store)
+        store.close();
+    const errors = rows.filter((row) => row.status === "error").length;
+    const warnings = rows.filter((row) => row.status === "warn").length;
+    if (json)
+        emitJson(rows, errors, warnings, localVerbose ? { repositoryRoot: repository?.repositoryRoot ?? null } : null);
+    else
+        renderMatrix(rows, errors, warnings, localVerbose ? repository?.repositoryRoot ?? null : null);
+    if (errors > 0)
+        process.exitCode = 1;
+}
+async function probeReachability(baseUrl) {
+    try {
+        const response = await fetch(`${baseUrl}/api/health`, { signal: AbortSignal.timeout(5_000) });
+        if (!response.ok)
+            return ["warn", `HTTP ${response.status}`];
+        const body = await response.json();
+        const expected = typeof body === "object" && body !== null && body.status === 1;
+        return ["ok", expected ? "reachable" : "reachable — unexpected health body"];
+    }
+    catch {
+        return ["warn", "unreachable — check your connection or pass --nustack-url"];
+    }
+}
+function resolveRepositoryOrNull(cwd) {
+    try {
+        return resolveRepository(cwd);
+    }
+    catch (error) {
+        if (error instanceof NotARepositoryError)
+            return null;
+        return null;
+    }
+}
+function addRepositoryRows(add, repository) {
+    add("repository", "Repository root", "ok", "resolved");
+    const branch = readSymbolicBranch(repository);
+    if (branch)
+        add("repository", "Bound branch", "ok", `on ${branch}`);
+    else
+        add("repository", "Bound branch", "warn", "detached HEAD — check out a branch before onboarding");
+    const operation = readGitOperationState(repository);
+    if (operation.kind === "normal")
+        add("repository", "Operation state", "ok", "clean");
+    else if (operation.kind === "index_locked")
+        add("repository", "Operation state", "warn", "index.lock present — a Git process may be running");
+    else
+        add("repository", "Operation state", "error", `${operation.kind.replace("_", " ")} in progress — finish or abort it`);
+    const head = readHeadCommit(repository);
+    if (head)
+        add("repository", "HEAD", "ok", head.slice(0, 12));
+    else
+        add("repository", "HEAD", "info", "unborn branch — no commits yet");
+}
+async function fetchCloudProfile(baseUrl, accessToken, workspaceId) {
+    try {
+        return await fetchToolkitProfile(baseUrl, accessToken, workspaceId);
+    }
+    catch (error) {
+        if (error instanceof ToolkitProfileUnavailableError)
+            return null;
+        return null;
+    }
+}
+async function addManifestRows(add, root, cloud) {
+    const manifests = await readWorkspaceManifests(root);
+    if (!manifests.workspaceManifest && !manifests.serviceToolkit) {
+        add("manifests", "Workspace binding markers", "info", "no `.nustack/app.json` or Service toolkit block — repository not attached");
+        return;
+    }
+    const diagnosis = diagnoseManifests(cloud ? { name: cloud.name, version: cloud.version } : null, manifests.workspaceManifest?.toolkit ?? null, manifests.serviceToolkit);
+    const status = diagnosis === "aligned" ? "ok" : diagnosis === "missing" ? "warn" : "warn";
+    const suffix = diagnosis === "aligned" || diagnosis === "missing" ? "" : " — run `nustack toolkit reconcile`";
+    add("manifests", "Marker / Service agreement", status, `${diagnosis}${cloud ? "" : " (no cloud pin reachable)"}${suffix}`);
+}
+function addBindingRows(add, store, binding, cloud) {
+    if (!binding) {
+        add("sync", "Local binding", "info", "no local binding for this repository");
+        return;
+    }
+    add("sync", "Sync Whitelist cache", binding.whitelistManifestSha256 ? "ok" : "info", binding.whitelistManifestSha256 ? "cached" : "not cached yet");
+    add("sync", "Workspace cursor", "ok", `applied Workspace sequence ${binding.lastAppliedWorkspaceSequence}`);
+    if (store) {
+        const pending = listApplicationsForBinding(store, binding.id, [
+            "received",
+            "evaluating",
+            "technical_wait",
+            "decision_required",
+            "approved",
+        ]);
+        const technical = pending.filter((application) => application.state === "technical_wait");
+        const decisions = pending.filter((application) => application.state === "decision_required");
+        if (pending.length === 0)
+            add("sync", "Pending inbound", "ok", "none");
+        else
+            add("sync", "Pending inbound", "warn", `${pending.length} pending (${technical.length} waiting, ${decisions.length} need a decision)`);
+    }
+    const compatibility = toolkitCompatibility(binding, cloud);
+    if (compatibility.blocksWrites)
+        add("toolkit", "Compatibility gate", "error", `incompatible — ${compatibility.reason}; projection and sync writes are blocked`);
+    else
+        add("toolkit", "Compatibility gate", "ok", cloud ? "compatible — writes allowed" : "unknown — no cloud pin reachable (not blocking)");
+}
+function addTelemetryRows(add, store) {
+    if (!store)
+        return;
+    const state = readFilebeatState(store);
+    if (!state) {
+        add("telemetry", "Filebeat", "info", "not initialized on this device yet");
+    }
+    else if (!state.telemetryEnabled) {
+        add("telemetry", "Filebeat", "info", "telemetry disabled on this machine");
+    }
+    else {
+        add("telemetry", "Filebeat binary", state.binaryPath ? "ok" : "warn", state.binaryPath ? `installed (${state.observedVersion ?? "unknown version"})` : "not installed");
+        add("telemetry", "Filebeat output", state.lastErrorCode ? "warn" : "ok", state.lastErrorCode ? `degraded (${state.lastErrorCode})` : "healthy");
+        const bindings = listActiveBindings(store);
+        const shipping = bindings.filter((b) => b.telemetryEnabled).length;
+        if (bindings.length > 0) {
+            add("telemetry", "Folders shipping", shipping === 0 ? "warn" : "ok", shipping === 0
+                ? `none — all ${bindings.length} switched off individually`
+                : `${shipping} of ${bindings.length}`);
+        }
+    }
+    const activity = listActivityBindings(store);
+    if (activity.length === 0)
+        add("providers", "Provider activity", "info", "no provider activity bindings");
+    else {
+        const missing = activity.filter((row) => row.state === "missing").length;
+        add("providers", "Provider activity", missing > 0 ? "warn" : "ok", `${activity.length} binding(s)${missing > 0 ? `, ${missing} missing` : ""}`);
+    }
+}
+async function addRecoveryRows(add, store) {
+    await sweepExpiredBundles(store).catch(() => { });
+    const active = listBundles(store).filter((bundle) => bundle.state === "active");
+    add("recovery", "Recovery bundles", active.length > 0 ? "info" : "ok", active.length > 0 ? `${active.length} active — \`nustack workspace sync recovery list\`` : "none");
+    const deviceRef = readDeviceState(store)?.deviceRef ?? null;
+    if (!deviceRef)
+        return;
+    const keySource = await inspectRecoveryKey(deviceRef).catch(() => null);
+    if (keySource === "keychain")
+        add("recovery", "Recovery key", "ok", "in the OS keychain");
+    else if (keySource === "keyfile")
+        add("recovery", "Recovery key", "warn", "0600 key file (no keychain on this host) — a weaker custody posture");
+}
+async function addCredentialRows(add, cwd) {
+    const managed = await readManagedValues(path.join(cwd, ".env"));
+    const endpointKeys = Object.keys(managed).filter((key) => key.endsWith("_ENDPOINT"));
+    if (endpointKeys.length === 0) {
+        add("credentials", "Service credentials", "info", "none in the managed block yet");
+        return;
+    }
+    for (const endpointKey of endpointKeys) {
+        const prefix = endpointKey.slice(0, -"_ENDPOINT".length);
+        const endpoint = managed[endpointKey];
+        if (endpoint === undefined)
+            continue;
+        const serviceKey = managed[`${prefix}_KEY`];
+        if (!serviceKey) {
+            add("credentials", prefix, "warn", "endpoint present but key missing — run `nustack sync`");
+            continue;
+        }
+        try {
+            const response = await fetch(`${endpoint.replace(/\/+$/, "")}/health`, {
+                headers: { Authorization: `Bearer ${serviceKey}` },
+                signal: AbortSignal.timeout(5_000),
+            });
+            add("credentials", prefix, response.ok ? "ok" : "warn", response.ok ? "health OK" : `health HTTP ${response.status}`);
+        }
+        catch {
+            add("credentials", prefix, "warn", "unreachable");
+        }
+    }
+}
+function renderMatrix(rows, errors, warnings, repositoryRoot) {
+    console.log("nustack doctor");
+    let currentArea = null;
+    for (const row of rows) {
+        if (row.area !== currentArea) {
+            currentArea = row.area;
+            console.log(`\n${row.area}`);
+        }
+        const detail = row.detail ? ` — ${row.detail}` : "";
+        console.log(`  ${badge(row.status)} ${row.check}${detail}`);
+    }
+    if (repositoryRoot)
+        console.log(`\nrepository root: ${repositoryRoot}`);
+    console.log(`\n${errors} error(s), ${warnings} warning(s).`);
+}
+function emitJson(rows, errors, warnings, paths) {
+    const data = {
+        rows,
+        summary: { errors, warnings, healthy: errors === 0 },
+        ...(paths ? { paths } : {}),
+    };
+    console.log(JSON.stringify({ nustackJsonVersion: NUSTACK_JSON_VERSION, command: "doctor", ok: errors === 0, data }));
+}
+function badge(status) {
+    switch (status) {
+        case "ok":
+            return "[ OK ]";
+        case "warn":
+            return "[WARN]";
+        case "error":
+            return "[ERR ]";
+        case "info":
+            return "[ .. ]";
+    }
+}

package/dist/commands/graph.js

@@ -0,0 +1,34 @@
+import { answerGraph, indexGraph, listGraphFunctions, statusGraph } from "../lib/graph/answer.js";
+export function graphArgv(rawArgv) {
+    const args = rawArgv.slice(2);
+    const at = args.indexOf("graph");
+    return at === -1 ? [] : args.slice(at + 1);
+}
+function functionArgv(argv) {
+    const out = [];
+    for (let i = 0; i < argv.length; i++) {
+        const token = argv[i] ?? "";
+        if (token === "--repo" || token === "--budget" || token === "--commits") {
+            i++;
+            continue;
+        }
+        if (token.startsWith("--repo=") || token.startsWith("--budget=") || token.startsWith("--commits="))
+            continue;
+        if (token === "--json" || token === "--no-refresh" || token === "--refresh")
+            continue;
+        out.push(token);
+    }
+    return out;
+}
+export async function runGraph(rawArgv, options, cwd = process.cwd()) {
+    const argv = graphArgv(rawArgv);
+    const fn = argv.find((token) => !token.startsWith("--"));
+    if (fn === undefined || fn === "functions")
+        return listGraphFunctions(options);
+    if (fn === "index")
+        return indexGraph(options, cwd);
+    if (fn === "status")
+        return statusGraph(options, cwd);
+    const rest = functionArgv(argv);
+    return answerGraph(fn, rest.slice(1), options, cwd);
+}

package/dist/commands/handoff.js

@@ -0,0 +1,108 @@
+import { fetchHandoffManifest, getHandoff, listHandoffs, resolveNuStackUrl, } from "../lib/nustack_client.js";
+import { ensureAuthWithRecovery, lastAuthFailure } from "../lib/auth_recovery.js";
+import { resolveWorkspaceId } from "../lib/workspace_context.js";
+import { openLocalStore } from "../lib/local_store/database.js";
+import { getBindingByRepositoryRoot } from "../lib/local_store/bindings.js";
+import { resolveRepository } from "../lib/git-sync/core/repository.js";
+import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
+async function resolveContext(command, json, options, globals) {
+    const baseUrl = resolveNuStackUrl(globals);
+    const workspace = await resolveWorkspaceId(process.cwd(), options);
+    if (!workspace.ok) {
+        emitFail(command, json, "WORKSPACE_CONTEXT_MISSING", workspace.message);
+        return null;
+    }
+    const deviceAuth = await ensureAuthWithRecovery(baseUrl, json);
+    if (!deviceAuth) {
+        const failure = lastAuthFailure();
+        emitFail(command, json, failure.code, failure.message);
+        return null;
+    }
+    return { baseUrl, accessToken: deviceAuth.accessToken, workspaceId: workspace.workspaceId };
+}
+function emitFail(command, json, code, message) {
+    if (json)
+        printJsonError(command, { code, message });
+    else {
+        console.error(message);
+        process.exitCode = 1;
+    }
+}
+export async function runHandoffList(options, globals) {
+    const json = options.json === true;
+    const ctx = await resolveContext("handoff list", json, options, globals);
+    if (!ctx)
+        return;
+    const handoffs = await listHandoffs(ctx.baseUrl, ctx.accessToken, ctx.workspaceId);
+    if (json) {
+        printJsonSuccess("handoff list", { workspaceId: ctx.workspaceId, handoffs });
+        return;
+    }
+    if (handoffs.length === 0) {
+        console.log("This Workspace has no Handoffs yet.");
+        return;
+    }
+    for (const h of handoffs) {
+        console.log(`${h.id.padEnd(24)} ${(h.origin ?? "-").padEnd(14)} ${h.state.padEnd(12)} created=${h.createdAt ?? "-"}`);
+    }
+}
+export async function runHandoffShow(handoffId, options, globals) {
+    const json = options.json === true;
+    const ctx = await resolveContext("handoff show", json, options, globals);
+    if (!ctx)
+        return;
+    const detail = await getHandoff(ctx.baseUrl, ctx.accessToken, handoffId);
+    let targets = null;
+    let targetsNote = null;
+    if (options.targets) {
+        const bindingId = await resolveLocalBindingId();
+        if (!bindingId) {
+            targetsNote = "Run inside a bound repository to inspect targets (the manifest is binding-scoped).";
+        }
+        else {
+            const manifest = await fetchHandoffManifest(ctx.baseUrl, ctx.accessToken, { handoffId, bindingId });
+            targets = manifest.targets.map((t) => ({
+                path: t.path,
+                operation: t.operation,
+                base: t.baseAbsent ? "baseAbsent" : `baseSha256:${(t.baseSha256 ?? "").slice(0, 12)}`,
+                byteSize: t.byteSize,
+            }));
+        }
+    }
+    if (json) {
+        printJsonSuccess("handoff show", { handoff: detail, targets, targetsNote });
+        return;
+    }
+    console.log(`Handoff ${detail.id}`);
+    console.log(`  origin: ${detail.origin}   state: ${detail.state}   created: ${detail.createdAt ?? "-"}`);
+    if (detail.toolkit)
+        console.log(`  toolkit: ${detail.toolkit.name}@${detail.toolkit.version} (renderer ${detail.toolkit.rendererVersion})`);
+    console.log(`  targets: ${detail.targetCounts.total} (${detail.targetCounts.upsert} upsert, ${detail.targetCounts.delete} delete)`);
+    if (targetsNote)
+        console.log(`  ${targetsNote}`);
+    if (targets) {
+        for (const t of targets)
+            console.log(`    ${t.operation.padEnd(7)} ${t.path}  [${t.base}]  ${t.byteSize}b`);
+    }
+}
+async function resolveLocalBindingId() {
+    let repositoryRoot;
+    try {
+        repositoryRoot = resolveRepository(process.cwd()).repositoryRoot;
+    }
+    catch {
+        return null;
+    }
+    try {
+        const store = await openLocalStore();
+        try {
+            return getBindingByRepositoryRoot(store, repositoryRoot)?.id ?? null;
+        }
+        finally {
+            store.close();
+        }
+    }
+    catch {
+        return null;
+    }
+}