@quickchatai/quickreview 0.0.0-stage → 1.1.0

package/dist/src/onboard/engine.js

@@ -0,0 +1,344 @@
+// OnboardingEngine — the seam of the onboarding wizard: a checklist state
+// machine plus deterministic step implementations behind injected adapters.
+// pi is a thin driver over this engine (extensions/onboarding.ts registers one
+// tool per step); the engine
+// itself is fully drivable from tests and from a non-LLM fallback entry, and
+// nothing in here touches the network, Docker, or a real pi except through
+// the adapters.
+//
+// Resumability contract:
+//   - checklist state persists to state/onboarding/checklist.json after every
+//     step, tmp+rename atomic (the verdicts.ts convention);
+//   - startup reconciles claimed state against reality: a step claimed done is
+//     re-verified with its verify(), never trusted from the file alone;
+//   - a fully-done checklist re-runs as verify-only (the wizard doubles as a
+//     diagnostic);
+//   - a corrupt/unreadable checklist degrades to a fresh one (the resume
+//     re-verifies everything anyway) — never a crash.
+//
+// The finish path writes the first-run marker state/companion/first-run.json
+// ({"completed_at": "<iso>"}) exactly once — the contract the companion's
+// first-run greeting consumes. Keep the path and shape stable.
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+export function failures(checks) {
+    return checks.filter((c) => !c.ok).map((c) => `${c.name}: ${c.detail}`);
+}
+// ---- checklist file ---------------------------------------------------------
+export const CHECKLIST_VERSION = 1;
+export function checklistPath(stateDir) {
+    return join(stateDir, "onboarding", "checklist.json");
+}
+/** The first-run contract path: the companion's first-run greeting keys off this
+ * file. Written once, by finish(), shape {"completed_at": "<iso>"}. */
+export function firstRunMarkerPath(stateDir) {
+    return join(stateDir, "companion", "first-run.json");
+}
+function isPlainObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** Read the checklist; null when absent or unreadable (both mean "fresh"). */
+export function readChecklist(stateDir) {
+    const path = checklistPath(stateDir);
+    if (!existsSync(path))
+        return null;
+    try {
+        const raw = JSON.parse(readFileSync(path, "utf8"));
+        if (typeof raw !== "object" || raw === null)
+            return null;
+        const file = raw;
+        // Every field the engine dereferences is checked here: a file that parses
+        // but lacks one (hand-edited, foreign) would otherwise throw out of a
+        // step predicate or record() on every call — a wedge, not a fresh start.
+        if (typeof file.version !== "number")
+            return null;
+        if (!isPlainObject(file.choices))
+            return null;
+        if (file.completed_at !== null && typeof file.completed_at !== "string")
+            return null;
+        if (!isPlainObject(file.steps))
+            return null;
+        for (const rec of Object.values(file.steps)) {
+            if (!isPlainObject(rec) || !isPlainObject(rec.data))
+                return null;
+        }
+        return file;
+    }
+    catch {
+        return null;
+    }
+}
+/** Does the checklist file say onboarding finished? The CLI's post-exit
+ * handoff reads exactly this (the finish tool only sets it after a full green
+ * re-verification, so "the file says so" is a verified claim). */
+export function checklistComplete(stateDir) {
+    const file = readChecklist(stateDir);
+    return file !== null && completeNow(file);
+}
+/** Is onboarding complete NOW: finished once, and not reopened since. The one
+ * reading of the two fields, for the file on disk and the engine's copy. */
+function completeNow(file) {
+    return typeof file.completed_at === "string" && !file.reopened_at;
+}
+/** `<sandbox root>` — the parent of `paths.stateDir`, by the adapters'
+ * contract (stateDir = `<sandbox root>/state`). The one place that says so. */
+export function sandboxRoot(paths) {
+    return resolve(paths.stateDir, "..");
+}
+/** tmp+rename atomic write — the one writer every onboarding file write goes
+ * through (the checklist, config.toml, .env, the inventory): a reader, the
+ * daemon's own loader one bind mount away included, never sees a half-written
+ * file, and an interrupted write leaves the previous file whole. */
+export function writeAtomic(path, content) {
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = join(dirname(path), `.${basename(path)}.onboard.tmp`);
+    writeFileSync(tmp, content);
+    renameSync(tmp, path);
+}
+/** A file's text, or null when it cannot be read for any reason. For a read
+ * where only ABSENCE may be null, read it yourself. */
+export function readTextOrNull(path) {
+    try {
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+export class OnboardingEngine {
+    adapters;
+    registry;
+    checklist;
+    constructor(steps, adapters) {
+        this.adapters = adapters;
+        this.registry = [...steps].sort((a, b) => a.order - b.order);
+        const loaded = readChecklist(adapters.paths.stateDir);
+        if (loaded === null && existsSync(checklistPath(adapters.paths.stateDir))) {
+            adapters.log?.("onboarding: checklist file unreadable — starting fresh (recorded choices and step progress were reset)");
+        }
+        this.checklist = loaded ?? this.fresh();
+    }
+    fresh() {
+        const now = this.adapters.clock().toISOString();
+        return {
+            version: CHECKLIST_VERSION,
+            created_at: now,
+            updated_at: now,
+            completed_at: null,
+            choices: {},
+            steps: {},
+        };
+    }
+    save() {
+        this.checklist.updated_at = this.adapters.clock().toISOString();
+        writeAtomic(checklistPath(this.adapters.paths.stateDir), `${JSON.stringify(this.checklist, null, 2)}\n`);
+    }
+    record(id) {
+        const existing = this.checklist.steps[id];
+        if (existing)
+            return existing;
+        const created = {
+            status: "pending",
+            completed_at: null,
+            verified_at: null,
+            note: null,
+            data: {},
+        };
+        this.checklist.steps[id] = created;
+        return created;
+    }
+    ctxFor(id, input = {}) {
+        return {
+            adapters: this.adapters,
+            input,
+            choices: this.checklist.choices,
+            data: this.record(id).data,
+            recordChoice: (key, value) => {
+                this.checklist.choices[key] = value;
+            },
+        };
+    }
+    /** The registered steps, in order (the pi tools register off this). */
+    stepDefs() {
+        return this.registry;
+    }
+    enabled(step) {
+        return step.enabled ? step.enabled(this.checklist.choices) : true;
+    }
+    choices() {
+        return this.checklist.choices;
+    }
+    isComplete() {
+        return completeNow(this.checklist);
+    }
+    /** A completed checklist no longer verifies: withdraw the current-completion
+     * claim (the post-exit handoff reads it) without touching the history. */
+    reopen() {
+        if (this.checklist.completed_at === null || this.checklist.reopened_at)
+            return;
+        this.checklist.reopened_at = this.adapters.clock().toISOString();
+    }
+    list() {
+        return this.registry.map((step) => {
+            const rec = this.checklist.steps[step.id];
+            return {
+                id: step.id,
+                title: step.title,
+                explain: step.explain,
+                status: this.enabled(step) ? (rec?.status ?? "pending") : "disabled",
+                note: rec?.note ?? null,
+            };
+        });
+    }
+    /**
+     * Resume: re-verify every enabled claimed-done step against reality. A step
+     * whose verify() fails is demoted to pending with the failures in its note —
+     * the file's claim is never trusted alone. A fully-done checklist therefore
+     * re-runs as verify-only. Persists once at the end.
+     */
+    async reconcile() {
+        const report = { verified: [], demoted: [] };
+        for (const step of this.registry) {
+            if (!this.enabled(step))
+                continue;
+            const rec = this.checklist.steps[step.id];
+            if (!rec || rec.status !== "done") {
+                this.reopen();
+                continue;
+            }
+            const outcome = await this.safeVerify(step);
+            if (outcome.ok) {
+                rec.verified_at = this.adapters.clock().toISOString();
+                report.verified.push(step.id);
+            }
+            else {
+                const fails = failures(outcome.checks);
+                rec.status = "pending";
+                rec.note = `re-verification failed: ${fails.join("; ") || "unknown"}`;
+                this.reopen();
+                report.demoted.push({ id: step.id, failures: fails });
+            }
+        }
+        this.save();
+        return report;
+    }
+    /** Run one step, optionally with the operator's answer (`input`, the pi
+     * tool's params). Unknown/disabled ids are refusals-as-answers, never
+     * throws (the caller is an LLM tool belt). Persists after the step. */
+    async runStep(id, input = {}) {
+        const step = this.registry.find((s) => s.id === id);
+        if (!step) {
+            return {
+                id,
+                ok: false,
+                checks: [],
+                failures: [`unknown step "${id}" — known: ${this.registry.map((s) => s.id).join(", ")}`],
+            };
+        }
+        if (!this.enabled(step)) {
+            return {
+                id,
+                ok: false,
+                checks: [],
+                failures: [`step "${id}" is disabled by the recorded choices`],
+            };
+        }
+        const rec = this.record(id);
+        rec.status = "pending";
+        this.reopen();
+        this.save();
+        let report;
+        try {
+            report = await step.run(this.ctxFor(id, input));
+        }
+        catch (err) {
+            report = {
+                ok: false,
+                checks: [{ name: id, ok: false, detail: `step threw: ${String(err)}` }],
+            };
+        }
+        if (report.data)
+            rec.data = { ...rec.data, ...report.data };
+        if (report.ok) {
+            rec.status = "done";
+            rec.completed_at = this.adapters.clock().toISOString();
+            rec.verified_at = null;
+            rec.note = null;
+            // A run acts on the installation (choices, config, deploys) after the
+            // full verification that backed the completion claim: only the next
+            // green finish() may make that claim again.
+            this.reopen();
+        }
+        else {
+            rec.status = "pending";
+            rec.note = `last run failed: ${failures(report.checks).join("; ") || "unknown"}`;
+            this.reopen();
+        }
+        this.save();
+        return { id, ok: report.ok, checks: report.checks, failures: failures(report.checks) };
+    }
+    async safeVerify(step) {
+        try {
+            return await step.verify(this.ctxFor(step.id));
+        }
+        catch (err) {
+            return {
+                ok: false,
+                checks: [{ name: step.id, ok: false, detail: `verify threw: ${String(err)}` }],
+            };
+        }
+    }
+    /**
+     * Verify every enabled step — done or not. A pending step whose verify()
+     * holds is promoted to done (its outcome exists in reality, which is the
+     * only truth the checklist mirrors); a done step whose verify() fails
+     * reports red here (finish refuses) but demotion is reconcile()'s job.
+     */
+    async verifyAll() {
+        const results = [];
+        for (const step of this.registry) {
+            if (!this.enabled(step))
+                continue;
+            const outcome = await this.safeVerify(step);
+            const rec = this.record(step.id);
+            if (outcome.ok) {
+                rec.verified_at = this.adapters.clock().toISOString();
+                if (rec.status !== "done") {
+                    rec.status = "done";
+                    rec.completed_at = rec.completed_at ?? rec.verified_at;
+                    rec.note = "verified green without a recorded run";
+                }
+            }
+            results.push({ id: step.id, ok: outcome.ok, failures: failures(outcome.checks) });
+        }
+        this.save();
+        return { ok: results.every((r) => r.ok), results };
+    }
+    /**
+     * The finish tool's engine half: re-run the full verification checklist.
+     * Anything red ⇒ refuse with the failures (the caller returns them as the
+     * tool result and does not exit). All green ⇒ mark the checklist complete
+     * and write the first-run marker — once: a marker already on disk is left
+     * untouched, so the completed_at the companion greets on never moves.
+     */
+    async finish() {
+        const all = await this.verifyAll();
+        if (!all.ok) {
+            this.reopen();
+            this.save();
+            return { ok: false, results: all.results };
+        }
+        const completedAt = this.checklist.completed_at ?? this.adapters.clock().toISOString();
+        this.checklist.completed_at = completedAt;
+        this.checklist.reopened_at = null;
+        this.save();
+        const marker = firstRunMarkerPath(this.adapters.paths.stateDir);
+        let markerWritten = false;
+        if (!existsSync(marker)) {
+            writeAtomic(marker, `${JSON.stringify({ completed_at: completedAt })}\n`);
+            markerWritten = true;
+        }
+        return { ok: true, completed_at: completedAt, marker_written: markerWritten };
+    }
+}
+//# sourceMappingURL=engine.js.map

package/dist/src/onboard/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../../src/onboard/engine.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,4EAA4E;AAC5E,+EAA+E;AAC/E,6BAA6B;AAC7B,6EAA6E;AAC7E,2EAA2E;AAC3E,gBAAgB;AAChB,EAAE;AACF,yBAAyB;AACzB,8EAA8E;AAC9E,4DAA4D;AAC5D,+EAA+E;AAC/E,wEAAwE;AACxE,6EAA6E;AAC7E,mBAAmB;AACnB,yEAAyE;AACzE,sDAAsD;AACtD,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,+DAA+D;AAC/D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAoG7D,MAAM,UAAU,QAAQ,CAAC,MAA8B;IACrD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,gFAAgF;AAEhF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AA6BnC,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;AACxD,CAAC;AAED;uEACuE;AACvE,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,OAAO,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;QAC9D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,IAAI,GAAG,GAAoB,CAAC;QAClC,0EAA0E;QAC1E,sEAAsE;QACtE,yEAAyE;QACzE,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACrF,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QACnE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;kEAEkE;AAClE,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,IAAI,KAAK,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;4EAC4E;AAC5E,SAAS,WAAW,CAAC,IAAyD;IAC5E,OAAO,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;AACpE,CAAC;AAED;+EAC+E;AAC/E,MAAM,UAAU,WAAW,CAAC,KAAoC;IAC9D,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC;AAED;;;oEAGoE;AACpE,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,OAAe;IACvD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAClE,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5B,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;uDACuD;AACvD,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAmCD,MAAM,OAAO,gBAAgB;IAMR;IALF,QAAQ,CAAmB;IACpC,SAAS,CAAgB;IAEjC,YACE,KAAuB,EACN,QAAyB;QAAzB,aAAQ,GAAR,QAAQ,CAAiB;QAE1C,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,MAAM,KAAK,IAAI,IAAI,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC1E,QAAQ,CAAC,GAAG,EAAE,CACZ,wGAAwG,CACzG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;IAC1C,CAAC;IAEO,KAAK;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;QAChD,OAAO;YACL,OAAO,EAAE,iBAAiB;YAC1B,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,GAAG;YACf,YAAY,EAAE,IAAI;YAClB,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,EAAE;SACV,CAAC;IACJ,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;QAChE,WAAW,CACT,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAC3C,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC/C,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,EAAU;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,OAAO,GAAe;YAC1B,MAAM,EAAE,SAAS;YACjB,YAAY,EAAE,IAAI;YAClB,WAAW,EAAE,IAAI;YACjB,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,EAAE;SACT,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC;QACnC,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,MAAM,CAAC,EAAU,EAAE,QAAiC,EAAE;QAC5D,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK;YACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;YAC/B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI;YAC1B,YAAY,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBAC3B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACtC,CAAC;SACF,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,QAAQ;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,OAAO,CAAC,IAAoB;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;IAChC,CAAC;IAED,UAAU;QACR,OAAO,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAED;8EAC0E;IAClE,MAAM;QACZ,IAAI,IAAI,CAAC,SAAS,CAAC,YAAY,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW;YAAE,OAAO;QAC/E,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;IACnE,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1C,OAAO;gBACL,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU;gBACpE,IAAI,EAAE,GAAG,EAAE,IAAI,IAAI,IAAI;aACxB,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAoB,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC9D,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,SAAS;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAClC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACd,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;gBACf,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;gBACtD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACvC,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;gBACvB,GAAG,CAAC,IAAI,GAAG,2BAA2B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC;gBACtE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACd,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;2EAEuE;IACvE,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,QAAiC,EAAE;QAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,EAAE;gBACF,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,CAAC,iBAAiB,EAAE,cAAc,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;aACzF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO;gBACL,EAAE;gBACF,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,CAAC,SAAS,EAAE,uCAAuC,CAAC;aAC/D,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5B,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;QACvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,MAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG;gBACP,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;aACxE,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI;YAAE,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5D,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;YACpB,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;YACvD,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC;YACvB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAChB,sEAAsE;YACtE,oEAAoE;YACpE,4CAA4C;YAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;YACvB,GAAG,CAAC,IAAI,GAAG,oBAAoB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC;YACjF,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IACzF,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAoB;QAC3C,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;aAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,OAAO,GAA+B,EAAE,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,SAAS;YAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;gBACf,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;gBACtD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC1B,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;oBACpB,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,WAAW,CAAC;oBACvD,GAAG,CAAC,IAAI,GAAG,uCAAuC,CAAC;gBACrD,CAAC;YACH,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAC7C,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;QACvF,IAAI,CAAC,SAAS,CAAC,YAAY,GAAG,WAAW,CAAC;QAC1C,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,IAAI,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChE,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACxB,WAAW,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;YAC1E,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;IAChF,CAAC;CACF"}

package/dist/src/onboard/launch.js

@@ -0,0 +1,83 @@
+// `qcr onboard` mechanics: launch pi at the pinned version via npx
+// (pi stays a non-dependency — this works from a bare clone with only Node and
+// the checkout), hand it the onboarding system prompt + exactly one onboarding
+// extension + a restricted built-in tool set, and on exit either exec the TUI
+// (checklist complete) or say how to resume.
+//
+// Everything effectful is injected (spawn, completion read, log), so tests
+// drive the whole flow with fakes; src/cli.ts cmdOnboard is the one real
+// assembly.
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+/** The pin from package.json's "qcrPi" block — the mirror that exists on a bare
+ * public clone, where config.toml does not (the wizard writes it later).
+ * config.toml [pi] stays the preferred source when it loads (cmdOnboard tries
+ * it first); both mirror the same pinned version by rule 7's discipline. */
+export function piPinFromPackageJson(root, readFile = (p) => readFileSync(p, "utf8")) {
+    try {
+        const pkg = JSON.parse(readFile(join(root, "package.json")));
+        const pi = pkg.qcrPi;
+        if (pi && typeof pi.package === "string" && typeof pi.version === "string") {
+            return { package: pi.package, version: pi.version };
+        }
+    }
+    catch {
+        // fall through — the caller reports the missing pin
+    }
+    return null;
+}
+/** Dedicated onboarding session store — never the reviewer/companion dirs, so
+ * onboarding cannot pollute (or be polluted by) any other pi session store. */
+export function onboardingSessionDir(root) {
+    return join(root, "state", "onboarding", "pi-sessions");
+}
+/**
+ * The full npx argv for the onboarding pi session.
+ *
+ * `--approve` is the same never-block-on-input rule as buildPiCommand
+ * (src/sessions.ts) and the companion's piArgv: the wizard must never stall
+ * on pi's interactive "Trust project folder?" modal.
+ *
+ * VERIFY-ON-PIN: `--no-extensions`, `--no-skills`, `--no-context-files`,
+ * `-e <path>` and `--tools <list>` against the pinned pi version's --help —
+ * the intent (no ambient extensions, exactly one onboarding extension, a
+ * read-only built-in belt) is the design decision; the exact flag spellings
+ * are unverified statically and belong to the named onboarding smoke step.
+ */
+export function onboardingPiArgv(pin, root) {
+    return [
+        "npx",
+        "-y",
+        `${pin.package}@${pin.version}`,
+        "--approve",
+        "--no-extensions",
+        "--no-skills",
+        "--no-context-files",
+        "-e",
+        join(root, "extensions", "cli", "onboarding.ts"),
+        "--system-prompt",
+        join(root, "prompts", "onboarding.md"),
+        "--tools",
+        "read,ls,grep",
+        "--session-dir",
+        onboardingSessionDir(root),
+    ];
+}
+/**
+ * Run the onboarding session and handle the handoff:
+ *   - checklist complete after pi exits ⇒ open the TUI (same stdio);
+ *   - otherwise print how to resume — `qcr onboard` again re-verifies
+ *     completed steps and continues at the first unfinished one.
+ */
+export async function runOnboard(deps) {
+    const argv = onboardingPiArgv(deps.pin, deps.root);
+    deps.log(`onboarding: launching pi ${deps.pin.package}@${deps.pin.version} via npx (first run downloads it — give it a moment)`);
+    const code = await deps.spawn(argv[0], argv.slice(1));
+    if (deps.isComplete()) {
+        deps.log("onboarding: checklist verified complete — opening the TUI.");
+        return deps.spawn(deps.nodeBin ?? process.execPath, [deps.cliPath, "tui"]);
+    }
+    deps.log("onboarding: not finished yet. Run `qcr onboard` again to resume — completed steps are re-verified, not repeated.");
+    return code;
+}
+//# sourceMappingURL=launch.js.map

package/dist/src/onboard/launch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch.js","sourceRoot":"","sources":["../../../src/onboard/launch.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,6CAA6C;AAC7C,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,YAAY;AACZ,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAOjC;;;4EAG4E;AAC5E,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,WAAkC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC;IAEhE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAE1D,CAAC;QACF,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;QACrB,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC3E,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;+EAC+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAU,EAAE,IAAY;IACvD,OAAO;QACL,KAAK;QACL,IAAI;QACJ,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE;QAC/B,WAAW;QACX,iBAAiB;QACjB,aAAa;QACb,oBAAoB;QACpB,IAAI;QACJ,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,CAAC;QAChD,iBAAiB;QACjB,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC;QACtC,SAAS;QACT,cAAc;QACd,eAAe;QACf,oBAAoB,CAAC,IAAI,CAAC;KAC3B,CAAC;AACJ,CAAC;AAkBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAoB;IACnD,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG,CACN,4BAA4B,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,sDAAsD,CACvH,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,GAAG,CACN,kHAAkH,CACnH,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/onboard/steps/appslug.js

@@ -0,0 +1,211 @@
+// App-slug reconciliation — the one defect in the onboarding order that
+// nothing else catches.
+//
+// The problem: config_fill (order 35) runs before the App exists, because the
+// App step reads the reviewed repo config_fill records. So config_fill asks the
+// operator for the App slug up front and derives `[github] bot_login` from it
+// (`<slug>[bot]`). The App's real slug is only known
+// after creation: GitHub suffixes the name for global uniqueness, and the
+// operator can edit it on GitHub's own creation page — and can rename the App
+// at any time afterwards, which moves the slug again.
+//
+// Why it matters: `bot_login` is how the daemon recognises its own
+// reviews and comments. Get it wrong and posting-guard ① reads the bot's own
+// review as a non-author human approval, the ping-pong path mistakes its own
+// comments for the author's, and the backfill identity (which cascades off
+// [github]) imports someone else's history. Nothing else in the system checks
+// it: every one of those paths is happy with a login that simply never matches.
+//
+// The fix: after the App exists, ask the App itself (`GET /app` with the App
+// JWT — the App's own identity, no installation token, no personal credential)
+// and reconcile the answer against config.toml, correcting `[github] app_slug`
+// and `[github] bot_login` when they disagree. The live answer wins over both
+// the file and the checklist's recorded choice: a rename after creation is
+// exactly the case a record cannot see.
+//
+// This runs (order 65) before bring-up (order 70) because the daemon reads
+// config.toml once, at boot — and if the stack is somehow already running when a correction
+// lands, the step restarts it rather than leaving a live daemon on a stale
+// login.
+//
+// The dry-run flag is out of reach here as it is in config_fill (AGENTS.md
+// invariant 6): every edit this step makes goes through `assertNoDryRunEdit`, which
+// refuses an edit naming `dry_run` however it is spelled. The only onboarding
+// step that writes that flag is golive.ts, and only on an explicit
+// confirmation after a completed proof.
+import { mintAppJwt } from "@quickchatai/pi-quickreview/src/githubAuth.js";
+import { configPath, readConfigText, secretsDirFor, writeAtomic, } from "./compose.js";
+import { deliverConfigChange } from "./configdelivery.js";
+import { assertNoDryRunEdit, changedEdits, patchToml, tomlString, } from "./configfill.js";
+import { CHOICE_KEYS, botLoginFor } from "../choices.js";
+import { api, readCredentials } from "./githubapp.js";
+export const APP_SLUG_STEP_ID = "app_slug_reconcile";
+/** Step data: a correction is on disk that the daemon has not been restarted onto. */
+const RESTART_OWED_KEY = "restart_owed";
+export { botLoginFor };
+/**
+ * The edits that make config.toml agree with the App's real slug. Empty when
+ * the file already agrees — which is what makes a re-run a no-op rather than a
+ * rewrite. Never returns an edit naming `dry_run` (asserted, not assumed).
+ */
+export function slugEdits(configText, slug) {
+    const wanted = [
+        { section: "github", key: "app_slug", value: tomlString(slug) },
+        { section: "github", key: "bot_login", value: tomlString(botLoginFor(slug)) },
+    ];
+    assertNoDryRunEdit(wanted);
+    return changedEdits(configText, wanted);
+}
+/** `GET /app` with the App's own JWT: the App's identity, from the App. */
+async function liveIdentity(ctx, apiBase, secretsDir) {
+    const creds = readCredentials(secretsDir);
+    if (!creds.complete) {
+        return {
+            ok: false,
+            slug: "",
+            detail: `${creds.problems.join("; ")} — Fix: run the github_app step; it writes app_id, app.pem and webhook_secret into ${secretsDir}`,
+        };
+    }
+    const jwt = mintAppJwt(creds.appId, creds.pem, () => ctx.adapters.clock().getTime());
+    const { status, body, text } = await api(ctx.adapters.fetch, `${apiBase}/app`, {
+        headers: { authorization: `Bearer ${jwt}` },
+    });
+    if (status === 0) {
+        return {
+            ok: false,
+            slug: "",
+            detail: `could not reach GitHub to ask the App who it is (${text}) — Fix: check this machine's network, then run this step again`,
+        };
+    }
+    if (status !== 200) {
+        const message = body?.message;
+        const said = typeof message === "string" && message.trim() !== ""
+            ? ` ("${message.trim().slice(0, 200)}")`
+            : "";
+        const credentialStatus = status === 401 || status === 403 || status === 404;
+        return {
+            ok: false,
+            slug: "",
+            detail: credentialStatus
+                ? `GET /app answered HTTP ${status}${said} — Fix: the App id and private key in ${secretsDir} must belong to the same App; ` +
+                    "re-run the github_app step to re-create or re-verify them"
+                : `GET /app answered HTTP ${status}${said} — Fix: this is GitHub's own answer, not a credential problem; run this step again in a moment`,
+        };
+    }
+    const slug = body?.slug;
+    if (typeof slug !== "string" || slug.trim() === "") {
+        return {
+            ok: false,
+            slug: "",
+            detail: "GitHub answered without a slug for this App — Fix: run this step again; if it repeats, re-run the github_app step",
+        };
+    }
+    return { ok: true, slug: slug.trim(), detail: "" };
+}
+export function appSlugStep(opts = {}) {
+    const apiBase = opts.apiBase ?? "https://api.github.com";
+    async function reconcile(ctx, write) {
+        const secretsDir = opts.secretsDir ?? secretsDirFor(ctx.adapters, ctx.choices, opts.env ?? process.env);
+        const checks = [];
+        const identity = await liveIdentity(ctx, apiBase, secretsDir);
+        if (!identity.ok) {
+            checks.push({ name: "app-identity", ok: false, detail: identity.detail });
+            return { ok: false, checks };
+        }
+        const recorded = typeof ctx.choices[CHOICE_KEYS.appSlug] === "string"
+            ? ctx.choices[CHOICE_KEYS.appSlug]
+            : "";
+        checks.push({
+            name: "app-identity",
+            ok: true,
+            detail: `GitHub says this App's slug is "${identity.slug}"` +
+                (recorded && recorded !== identity.slug
+                    ? ` — the wizard had recorded "${recorded}", so the App was renamed or uniqueness-suffixed after creation; GitHub wins`
+                    : ""),
+        });
+        const configText = readConfigText(ctx.adapters);
+        if (configText === null) {
+            checks.push({
+                name: "config",
+                ok: false,
+                detail: `${configPath(ctx.adapters)} does not exist — Fix: run the config_fill step first; it creates the file this step corrects`,
+            });
+            return { ok: false, checks };
+        }
+        const edits = slugEdits(configText, identity.slug);
+        if (edits.length === 0) {
+            checks.push({
+                name: "config",
+                ok: true,
+                detail: `[github] app_slug = "${identity.slug}" and bot_login = "${botLoginFor(identity.slug)}" already match the App — nothing rewritten`,
+            });
+        }
+        else if (!write) {
+            checks.push({
+                name: "config",
+                ok: false,
+                detail: `config.toml disagrees with the App: ${edits.map((e) => `[${e.section}] ${e.key}`).join(", ")} — Fix: run the ` +
+                    `${APP_SLUG_STEP_ID} step, which corrects both to "${identity.slug}" / "${botLoginFor(identity.slug)}"`,
+            });
+            return { ok: false, checks };
+        }
+        else {
+            writeAtomic(configPath(ctx.adapters), patchToml(configText, edits));
+            checks.push({
+                name: "config",
+                ok: true,
+                detail: `corrected ${edits.map((e) => `[${e.section}] ${e.key}`).join(", ")} to match the App: app_slug = "${identity.slug}", ` +
+                    `bot_login = "${botLoginFor(identity.slug)}". bot_login is how the daemon recognises its OWN reviews — a wrong one is ` +
+                    "invisible until the reviewer mistakes itself for a human",
+            });
+        }
+        ctx.recordChoice(CHOICE_KEYS.appSlug, identity.slug);
+        ctx.recordChoice(CHOICE_KEYS.botLogin, botLoginFor(identity.slug));
+        // A correction only reaches a running daemon through a restart: the config
+        // loader runs once, at boot. The file is corrected before the restart, so
+        // a restart that fails leaves a file that already agrees — the owed
+        // restart is kept in the step's data and paid by the next run, never
+        // forgotten because the edits came back empty.
+        let restartOwed = edits.length > 0 || ctx.data[RESTART_OWED_KEY] === true;
+        if (write && restartOwed) {
+            const delivery = await deliverConfigChange(ctx, opts.stream ? { stream: opts.stream } : {}, restartOwed, APP_SLUG_STEP_ID);
+            checks.push(...delivery.checks);
+            restartOwed = delivery.restartOwed;
+        }
+        else if (restartOwed) {
+            checks.push({
+                name: "daemon-restart",
+                ok: false,
+                detail: "the corrected bot_login is on disk but the daemon was never restarted onto it, so a running daemon still holds " +
+                    `the old login — Fix: run the ${APP_SLUG_STEP_ID} step; it restarts the daemon`,
+            });
+        }
+        return {
+            ok: checks.every((c) => c.ok),
+            checks,
+            data: {
+                slug: identity.slug,
+                bot_login: botLoginFor(identity.slug),
+                corrected: edits.length > 0,
+                [RESTART_OWED_KEY]: restartOwed,
+            },
+        };
+    }
+    return {
+        id: APP_SLUG_STEP_ID,
+        title: "Reconcile the App's real slug into your config",
+        explain: "Your GitHub App's slug is only settled once the App exists — GitHub makes the name globally unique and you can edit it " +
+            "on GitHub's own page. The config was filled before that, and the login your reviews appear under is derived from the " +
+            "slug, so this step asks the App itself who it is and corrects [github] app_slug and bot_login to match. It matters more " +
+            "than it looks: bot_login is how the reviewer recognises its own reviews and comments, and a wrong one fails silently.",
+        order: 65,
+        async run(ctx) {
+            return reconcile(ctx, true);
+        },
+        async verify(ctx) {
+            // verify never writes: a disagreement is red here and fixed by a run.
+            return reconcile(ctx, false);
+        },
+    };
+}
+//# sourceMappingURL=appslug.js.map