@quickchatai/quickreview 0.0.0-stage → 1.2.0

package/dist/src/onboard/steps/appslug.js

@@ -0,0 +1,214 @@
+// App-slug reconciliation — the one defect in the onboarding order that
+// nothing else catches.
+//
+// The problem: config_fill (order 35) runs before the App exists, because the
+// App step reads the reviewed repo config_fill records. So config_fill asks the
+// operator for the App slug up front and derives `[github] bot_login` from it
+// (`<slug>[bot]`). The App's real slug is only known
+// after creation: GitHub suffixes the name for global uniqueness, and the
+// operator can edit it on GitHub's own creation page — and can rename the App
+// at any time afterwards, which moves the slug again.
+//
+// Why it matters: `bot_login` is how the daemon recognises its own
+// reviews and comments. Get it wrong and posting-guard ① reads the bot's own
+// review as a non-author human approval, the ping-pong path mistakes its own
+// comments for the author's, and the backfill identity (which cascades off
+// [github]) imports someone else's history. Nothing else in the system checks
+// it: every one of those paths is happy with a login that simply never matches.
+//
+// The fix: after the App exists, ask the App itself (`GET /app` with the App
+// JWT — the App's own identity, no installation token, no personal credential)
+// and reconcile the answer against config.toml, correcting `[github] app_slug`
+// and `[github] bot_login` when they disagree. The live answer wins over both
+// the file and the checklist's recorded choice: a rename after creation is
+// exactly the case a record cannot see.
+//
+// This runs (order 65) before bring-up (order 70) because the daemon reads
+// config.toml once, at boot — and if the stack is somehow already running when a correction
+// lands, the step restarts it rather than leaving a live daemon on a stale
+// login.
+//
+// The dry-run flag is out of reach here as it is in config_fill (AGENTS.md
+// invariant 6): every edit this step makes goes through `assertNoDryRunEdit`, which
+// refuses an edit naming `dry_run` however it is spelled. The only onboarding
+// step that writes that flag is golive.ts, and only on an explicit
+// confirmation after a completed proof.
+import { mintAppJwt } from "@quickchatai/pi-quickreview/src/githubAuth.js";
+import { configPath, readConfigText, secretsDirFor, writeAtomic, } from "./compose.js";
+import { deliverConfigChange } from "./configdelivery.js";
+import { assertNoDryRunEdit, changedEdits, patchToml, tomlString, } from "./configfill.js";
+import { CHOICE_KEYS, botLoginFor, userAuthRecorded } from "../choices.js";
+import { api, readCredentials } from "./githubapp.js";
+export const APP_SLUG_STEP_ID = "app_slug_reconcile";
+/** Step data: a correction is on disk that the daemon has not been restarted onto. */
+const RESTART_OWED_KEY = "restart_owed";
+export { botLoginFor };
+/**
+ * The edits that make config.toml agree with the App's real slug. Empty when
+ * the file already agrees — which is what makes a re-run a no-op rather than a
+ * rewrite. Never returns an edit naming `dry_run` (asserted, not assumed).
+ */
+export function slugEdits(configText, slug) {
+    const wanted = [
+        { section: "github", key: "app_slug", value: tomlString(slug) },
+        { section: "github", key: "bot_login", value: tomlString(botLoginFor(slug)) },
+    ];
+    assertNoDryRunEdit(wanted);
+    return changedEdits(configText, wanted);
+}
+/** `GET /app` with the App's own JWT: the App's identity, from the App. */
+async function liveIdentity(ctx, apiBase, secretsDir) {
+    const creds = readCredentials(secretsDir);
+    if (!creds.complete) {
+        return {
+            ok: false,
+            slug: "",
+            detail: `${creds.problems.join("; ")} — Fix: run the github_app step; it writes app_id, app.pem and webhook_secret into ${secretsDir}`,
+        };
+    }
+    const jwt = mintAppJwt(creds.appId, creds.pem, () => ctx.adapters.clock().getTime());
+    const { status, body, text } = await api(ctx.adapters.fetch, `${apiBase}/app`, {
+        headers: { authorization: `Bearer ${jwt}` },
+    });
+    if (status === 0) {
+        return {
+            ok: false,
+            slug: "",
+            detail: `could not reach GitHub to ask the App who it is (${text}) — Fix: check this machine's network, then run this step again`,
+        };
+    }
+    if (status !== 200) {
+        const message = body?.message;
+        const said = typeof message === "string" && message.trim() !== ""
+            ? ` ("${message.trim().slice(0, 200)}")`
+            : "";
+        const credentialStatus = status === 401 || status === 403 || status === 404;
+        return {
+            ok: false,
+            slug: "",
+            detail: credentialStatus
+                ? `GET /app answered HTTP ${status}${said} — Fix: the App id and private key in ${secretsDir} must belong to the same App; ` +
+                    "re-run the github_app step to re-create or re-verify them"
+                : `GET /app answered HTTP ${status}${said} — Fix: this is GitHub's own answer, not a credential problem; run this step again in a moment`,
+        };
+    }
+    const slug = body?.slug;
+    if (typeof slug !== "string" || slug.trim() === "") {
+        return {
+            ok: false,
+            slug: "",
+            detail: "GitHub answered without a slug for this App — Fix: run this step again; if it repeats, re-run the github_app step",
+        };
+    }
+    return { ok: true, slug: slug.trim(), detail: "" };
+}
+export function appSlugStep(opts = {}) {
+    const apiBase = opts.apiBase ?? "https://api.github.com";
+    async function reconcile(ctx, write) {
+        const secretsDir = opts.secretsDir ?? secretsDirFor(ctx.adapters, ctx.choices, opts.env ?? process.env);
+        const checks = [];
+        const identity = await liveIdentity(ctx, apiBase, secretsDir);
+        if (!identity.ok) {
+            checks.push({ name: "app-identity", ok: false, detail: identity.detail });
+            return { ok: false, checks };
+        }
+        const recorded = typeof ctx.choices[CHOICE_KEYS.appSlug] === "string"
+            ? ctx.choices[CHOICE_KEYS.appSlug]
+            : "";
+        checks.push({
+            name: "app-identity",
+            ok: true,
+            detail: `GitHub says this App's slug is "${identity.slug}"` +
+                (recorded && recorded !== identity.slug
+                    ? ` — the wizard had recorded "${recorded}", so the App was renamed or uniqueness-suffixed after creation; GitHub wins`
+                    : ""),
+        });
+        const configText = readConfigText(ctx.adapters);
+        if (configText === null) {
+            checks.push({
+                name: "config",
+                ok: false,
+                detail: `${configPath(ctx.adapters)} does not exist — Fix: run the config_fill step first; it creates the file this step corrects`,
+            });
+            return { ok: false, checks };
+        }
+        const edits = slugEdits(configText, identity.slug);
+        if (edits.length === 0) {
+            checks.push({
+                name: "config",
+                ok: true,
+                detail: `[github] app_slug = "${identity.slug}" and bot_login = "${botLoginFor(identity.slug)}" already match the App — nothing rewritten`,
+            });
+        }
+        else if (!write) {
+            checks.push({
+                name: "config",
+                ok: false,
+                detail: `config.toml disagrees with the App: ${edits.map((e) => `[${e.section}] ${e.key}`).join(", ")} — Fix: run the ` +
+                    `${APP_SLUG_STEP_ID} step, which corrects both to "${identity.slug}" / "${botLoginFor(identity.slug)}"`,
+            });
+            return { ok: false, checks };
+        }
+        else {
+            writeAtomic(configPath(ctx.adapters), patchToml(configText, edits));
+            checks.push({
+                name: "config",
+                ok: true,
+                detail: `corrected ${edits.map((e) => `[${e.section}] ${e.key}`).join(", ")} to match the App: app_slug = "${identity.slug}", ` +
+                    `bot_login = "${botLoginFor(identity.slug)}". bot_login is how the daemon recognises its OWN reviews — a wrong one is ` +
+                    "invisible until the reviewer mistakes itself for a human",
+            });
+        }
+        ctx.recordChoice(CHOICE_KEYS.appSlug, identity.slug);
+        ctx.recordChoice(CHOICE_KEYS.botLogin, botLoginFor(identity.slug));
+        // A correction only reaches a running daemon through a restart: the config
+        // loader runs once, at boot. The file is corrected before the restart, so
+        // a restart that fails leaves a file that already agrees — the owed
+        // restart is kept in the step's data and paid by the next run, never
+        // forgotten because the edits came back empty.
+        let restartOwed = edits.length > 0 || ctx.data[RESTART_OWED_KEY] === true;
+        if (write && restartOwed) {
+            const delivery = await deliverConfigChange(ctx, opts.stream ? { stream: opts.stream } : {}, restartOwed, APP_SLUG_STEP_ID);
+            checks.push(...delivery.checks);
+            restartOwed = delivery.restartOwed;
+        }
+        else if (restartOwed) {
+            checks.push({
+                name: "daemon-restart",
+                ok: false,
+                detail: "the corrected bot_login is on disk but the daemon was never restarted onto it, so a running daemon still holds " +
+                    `the old login — Fix: run the ${APP_SLUG_STEP_ID} step; it restarts the daemon`,
+            });
+        }
+        return {
+            ok: checks.every((c) => c.ok),
+            checks,
+            data: {
+                slug: identity.slug,
+                bot_login: botLoginFor(identity.slug),
+                corrected: edits.length > 0,
+                [RESTART_OWED_KEY]: restartOwed,
+            },
+        };
+    }
+    return {
+        id: APP_SLUG_STEP_ID,
+        title: "Reconcile the App's real slug into your config",
+        explain: "Your GitHub App's slug is only settled once the App exists — GitHub makes the name globally unique and you can edit it " +
+            "on GitHub's own page. The config was filled before that, and the login your reviews appear under is derived from the " +
+            "slug, so this step asks the App itself who it is and corrects [github] app_slug and bot_login to match. It matters more " +
+            "than it looks: bot_login is how the reviewer recognises its own reviews and comments, and a wrong one fails silently.",
+        order: 65,
+        // There is no App slug on the own-account route: `[github] app_slug` is ""
+        // and bot_login is the person's login (the github_account step writes both).
+        enabled: (choices) => !userAuthRecorded(choices),
+        async run(ctx) {
+            return reconcile(ctx, true);
+        },
+        async verify(ctx) {
+            // verify never writes: a disagreement is red here and fixed by a run.
+            return reconcile(ctx, false);
+        },
+    };
+}
+//# sourceMappingURL=appslug.js.map

package/dist/src/onboard/steps/appslug.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appslug.js","sourceRoot":"","sources":["../../../../src/onboard/steps/appslug.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,wBAAwB;AACxB,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,qDAAqD;AACrD,0EAA0E;AAC1E,8EAA8E;AAC9E,sDAAsD;AACtD,EAAE;AACF,mEAAmE;AACnE,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,gFAAgF;AAChF,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,2EAA2E;AAC3E,wCAAwC;AACxC,EAAE;AACF,2EAA2E;AAC3E,4FAA4F;AAC5F,2EAA2E;AAC3E,SAAS;AACT,EAAE;AACF,2EAA2E;AAC3E,oFAAoF;AACpF,8EAA8E;AAC9E,mEAAmE;AACnE,wCAAwC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,+CAA+C,CAAC;AAE3E,OAAO,EACL,UAAU,EACV,cAAc,EACd,aAAa,EACb,WAAW,GAEZ,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,UAAU,GAEX,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAErD,sFAAsF;AACtF,MAAM,gBAAgB,GAAG,cAAc,CAAC;AASxC,OAAO,EAAE,WAAW,EAAE,CAAC;AAEvB;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,UAAkB,EAAE,IAAY;IACxD,MAAM,MAAM,GAAe;QACzB,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE;QAC/D,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE;KAC9E,CAAC;IACF,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,OAAO,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC;AAQD,2EAA2E;AAC3E,KAAK,UAAU,YAAY,CACzB,GAAgB,EAChB,OAAe,EACf,UAAkB;IAElB,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,EAAE;YACR,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,sFAAsF,UAAU,EAAE;SACvI,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,KAAM,EAAE,KAAK,CAAC,GAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACvF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,OAAO,MAAM,EAAE;QAC7E,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;KAC5C,CAAC,CAAC;IACH,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,EAAE;YACR,MAAM,EAAE,oDAAoD,IAAI,iEAAiE;SAClI,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,OAAO,GAAI,IAAqC,EAAE,OAAO,CAAC;QAChE,MAAM,IAAI,GACR,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;YAClD,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI;YACxC,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,gBAAgB,GAAG,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,EAAE;YACR,MAAM,EAAE,gBAAgB;gBACtB,CAAC,CAAC,0BAA0B,MAAM,GAAG,IAAI,yCAAyC,UAAU,gCAAgC;oBAC1H,2DAA2D;gBAC7D,CAAC,CAAC,0BAA0B,MAAM,GAAG,IAAI,gGAAgG;SAC5I,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAI,IAAkC,EAAE,IAAI,CAAC;IACvD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,EAAE;YACR,MAAM,EACJ,mHAAmH;SACtH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAA2B,EAAE;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAC;IAEzD,KAAK,UAAU,SAAS,CAAC,GAAgB,EAAE,KAAc;QACvD,MAAM,UAAU,GACd,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;QACvF,MAAM,MAAM,GAAkB,EAAE,CAAC;QAEjC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,QAAQ,GACZ,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,QAAQ;YAClD,CAAC,CAAE,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAY;YAC9C,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,cAAc;YACpB,EAAE,EAAE,IAAI;YACR,MAAM,EACJ,mCAAmC,QAAQ,CAAC,IAAI,GAAG;gBACnD,CAAC,QAAQ,IAAI,QAAQ,KAAK,QAAQ,CAAC,IAAI;oBACrC,CAAC,CAAC,+BAA+B,QAAQ,8EAA8E;oBACvH,CAAC,CAAC,EAAE,CAAC;SACV,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,+FAA+F;aACnI,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC/B,CAAC;QAED,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,wBAAwB,QAAQ,CAAC,IAAI,sBAAsB,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,6CAA6C;aAC3I,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,EAAE,EAAE,KAAK;gBACT,MAAM,EACJ,uCAAuC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB;oBAC/G,GAAG,gBAAgB,kCAAkC,QAAQ,CAAC,IAAI,QAAQ,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG;aAC1G,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;YACpE,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,EAAE,EAAE,IAAI;gBACR,MAAM,EACJ,aAAa,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC,QAAQ,CAAC,IAAI,KAAK;oBACvH,gBAAgB,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,6EAA6E;oBACvH,0DAA0D;aAC7D,CAAC,CAAC;QACL,CAAC;QAED,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrD,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAEnE,2EAA2E;QAC3E,0EAA0E;QAC1E,oEAAoE;QACpE,qEAAqE;QACrE,+CAA+C;QAC/C,IAAI,WAAW,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC;QAC1E,IAAI,KAAK,IAAI,WAAW,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CACxC,GAAG,EACH,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAC1C,WAAW,EACX,gBAAgB,CACjB,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;YAChC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;QACrC,CAAC;aAAM,IAAI,WAAW,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,gBAAgB;gBACtB,EAAE,EAAE,KAAK;gBACT,MAAM,EACJ,iHAAiH;oBACjH,gCAAgC,gBAAgB,+BAA+B;aAClF,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,MAAM;YACN,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,SAAS,EAAE,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACrC,SAAS,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC;gBAC3B,CAAC,gBAAgB,CAAC,EAAE,WAAW;aAChC;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,gDAAgD;QACvD,OAAO,EACL,yHAAyH;YACzH,uHAAuH;YACvH,0HAA0H;YAC1H,uHAAuH;QACzH,KAAK,EAAE,EAAE;QACT,2EAA2E;QAC3E,6EAA6E;QAC7E,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC;QAChD,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,OAAO,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,sEAAsE;YACtE,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/onboard/steps/bringup.js

@@ -0,0 +1,408 @@
+// Bring-up — the moment the system stops being configuration and
+// starts being a running reviewer.
+//
+// The stack is the released images, pulled, never built: `docker compose pull`
+// fetches `ghcr.io/quickchatai/quickreview` (the daemon) and
+// `quickreview-memory` (OpenViking and its local embedder), pinned by
+// QCR_VERSION in the project `.env`, and `docker compose up -d` starts them.
+// Only the tunnel sidecar the operator chose is built, from a thin wrapper
+// over the vendor's own image. Four things this step owes the operator, and
+// each one is a design decision rather than a detail:
+//
+//   1. The uid. Preflight captured it; the containers run as it (`user:` in
+//      the compose file) so they can read the 0600 files the operator owns in
+//      the secrets mount. The engine's ProcessRunner takes no environment, and
+//      compose reads the project `.env` for exactly this kind of value — so the
+//      uid is written there (`QCR_UID`), which also means the operator's own
+//      later `docker compose up` behaves identically to the wizard's. Same
+//      reason the chosen ingress profile is written there by the ingress step;
+//      this step re-asserts it and also passes `--profile` explicitly, so what
+//      comes up is visible in the command rather than inferred from a file.
+//
+//   2. The memory endpoint. The release image carries no OpenViking: the
+//      memory engine is the `memory` service, so config.toml must say
+//      `[openviking] endpoint = "remote"` and `host = "memory"`. This step
+//      writes both when memory is on, like the other config-writing steps
+//      (never `dry_run`, in either direction).
+//
+//   3. An honest note, before the wait. The first pull downloads two images,
+//      the memory one with its embedding model inside. That is minutes on a
+//      slow link, and a wizard that goes silent reads as broken. The note is
+//      emitted before the pull starts, never after, and the test pins that
+//      ordering. Every line Docker prints is streamed as it arrives (see
+//      compose.ts's StreamRunner and why the short-command ProcessRunner
+//      cannot do this job), with an elapsed-time marker every few lines.
+//
+//   4. No Docker, no problem. The wizard can run inside the release
+//      image (`qcr onboard`), which has no docker CLI and no socket and never
+//      gets one. When this step finds no `docker compose` it starts nothing:
+//      it prints the exact commands for the host — the extraction of the
+//      compose file from the image, the `.env`, the pull and the `up` — and
+//      stays red until the stack is seen running.
+//
+// What this step does not do: verify the system works. Container state, the
+// health endpoint and webhook ping delivery are the verify_stack step's job —
+// layered, each with its own fix. Bring-up's own success bar is "the compose
+// command succeeded and the daemon container is running".
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { basename, dirname, resolve } from "node:path";
+import { githubCloneDir, parseConfig } from "../../config.js";
+import { installName } from "../../install.js";
+import { composeArgs, composeAvailable, composePs, composeFileCheck, composeTail, containerStateCheck, hostCommands, ingressOptionOf, MEMORY_SERVICE, memoryImage, memoryOn, nodeStreamRunner, pullArgs, readEnvText, readTextOrNull, releaseImage, releaseVersion, rootOf, secretsDirFor, writeAtomic, } from "./compose.js";
+import { assertNoDryRunEdit, patchToml } from "./configfill.js";
+import { declaredEmbedderOf, describeEmbedder, embedderEnvEntries, embedderInputsCheck, localEmbedderEnvEntries, } from "./embeddings.js";
+import { readEnvKey, readTomlKey, setEnvKey } from "./ingress.js";
+import { UID_CHOICE_KEY } from "./preflight.js";
+import { topologyOf } from "./topology.js";
+export const BRINGUP_STEP_ID = "bringup";
+/** Recorded timestamp of this step's successful bring-up. */
+export const BROUGHT_UP_CHOICE_KEY = "stack_brought_up_at";
+/**
+ * The note, in the operator's words, emitted before the pull begins.
+ * Exported so the test can assert both its content and its ordering.
+ */
+export const FIRST_PULL_NOTICE = [
+    "About to pull the container images and start the stack.",
+    "The FIRST pull is the slow one: it downloads the daemon image and the memory image, and the",
+    "memory image carries its embedding model, so it is the larger of the two. How long that takes",
+    "depends on your connection. That is expected, not a hang: every line Docker prints is shown",
+    "below as it arrives. Later starts reuse the layers already here and take seconds.",
+    "The images come from ghcr.io, where they are public (a private mirror needs `gh auth refresh -s read:packages`,",
+    "then `gh auth token | docker login ghcr.io -u <user> --password-stdin`). The tunnel you chose, if any,",
+    "is built from a small wrapper over the vendor's own image. Nothing is posted to GitHub by this step.",
+].join("\n");
+/** What the compose file mounts as the container's config home: the
+ * directory of the config the locator found, whatever it is — the container
+ * reads no other (there is no checkout fallback). */
+export function configMountOf(configPath) {
+    const located = resolve(configPath);
+    return { dir: dirname(located), name: basename(located) };
+}
+/** `docker compose [--profile p] up -d`, built in one place. No `--build`: the
+ * daemon and memory images are pulled (`pullArgs`); only a tunnel sidecar that
+ * is not built yet is built, and compose does that on its own. */
+export function bringUpArgs(root, profile) {
+    return composeArgs(root, composeTail(profile, ["up", "-d"]));
+}
+/** The memory sidecar's compose service name: what `[openviking] host` must say. */
+export const MEMORY_HOST = MEMORY_SERVICE;
+/**
+ * Point the daemon at the memory sidecar: `[openviking] endpoint = "remote"`
+ * and `host = "memory"`. Returns the patched text, or null when the file
+ * already says so (or memory is off). Comment-preserving, like every wizard
+ * config write, and never `dry_run` in either direction.
+ */
+export function memoryEndpointPatch(configText) {
+    if (!memoryOn(configText))
+        return null;
+    const edits = [];
+    if (readTomlKey(configText, "openviking", "endpoint") !== "remote")
+        edits.push({ section: "openviking", key: "endpoint", value: '"remote"' });
+    if (readTomlKey(configText, "openviking", "host") !== MEMORY_HOST)
+        edits.push({ section: "openviking", key: "host", value: `"${MEMORY_HOST}"` });
+    if (edits.length === 0)
+        return null;
+    assertNoDryRunEdit(edits);
+    return patchToml(configText, edits);
+}
+/** The host's own default config home and secrets dir for this install, as
+ * shell words (the install locator's answer for that account). */
+function hostPaths(configText) {
+    const home = `\${XDG_CONFIG_HOME:-$HOME/.config}/qcr/${installName()}`;
+    const configured = (readTomlKey(configText, "github", "secrets_dir") ?? "").trim();
+    return { home, secrets: configured.startsWith("/") ? configured : `${home}/secrets` };
+}
+/** The base clone's directory name the compose file mounts a volume at
+ * (`QCR_CLONE_DIR`): the config's `[github] clone_dir`, else the repo's name,
+ * as the daemon's loader resolves it (config.ts githubCloneDir). */
+export function cloneDirOfConfig(configText) {
+    return githubCloneDir({
+        clone_dir: readTomlKey(configText, "github", "clone_dir") ?? "",
+        repo: readTomlKey(configText, "github", "repo") ?? "",
+    });
+}
+/** The project `.env` lines the host commands write, for a host this process
+ * cannot see: paths are the host's own defaults, spelled with shell variables.
+ * The heredoc that writes them is quoted, so the variables land literally in
+ * the file and Docker Compose expands them when it reads it. */
+function hostEnvLines(ctx, version, uid, profile, configText, projectEnv) {
+    const { home, secrets } = hostPaths(configText);
+    const lines = [
+        `QCR_VERSION=${version}`,
+        `QCR_UID=${uid}`,
+        `COMPOSE_PROFILES=${profile}`,
+        `QCR_CONFIG_HOME=${home}`,
+        `QCR_CONFIG_NAME=${basename(ctx.adapters.paths.configPath)}`,
+        `QCR_SECRETS_DIR=${secrets}`,
+        `QCR_CLONE_DIR=${cloneDirOfConfig(configText)}`,
+    ];
+    const ngrokDomain = readEnvKey(projectEnv, "QCR_NGROK_DOMAIN");
+    if (ngrokDomain !== null && ngrokDomain !== "")
+        lines.push(`QCR_NGROK_DOMAIN=${ngrokDomain}`);
+    for (const [key, value] of embedderEnvEntries(declaredEmbedderOf(configText)))
+        lines.push(`${key}=${value}`);
+    for (const [key, value] of localEmbedderEnvEntries(configText))
+        lines.push(`${key}=${value}`);
+    return lines;
+}
+export function bringUpStep(opts = {}) {
+    const stream = opts.stream ?? nodeStreamRunner;
+    const progressEvery = opts.progressEvery ?? 25;
+    function log(ctx, line) {
+        ctx.adapters.log?.(`${BRINGUP_STEP_ID}: ${line}`);
+    }
+    /** The captured uid — preflight's recorded choice, then the live host. */
+    function uidOf(ctx) {
+        const recorded = ctx.choices[UID_CHOICE_KEY];
+        if (typeof recorded === "number" && Number.isInteger(recorded))
+            return recorded;
+        return ctx.adapters.host.uid;
+    }
+    return {
+        id: BRINGUP_STEP_ID,
+        title: "Bring the stack up",
+        explain: "Starts QuickReview: it pulls the released images (the daemon and the memory engine, pinned to one version) and brings " +
+            "up the daemon, its memory sidecar and whichever webhook tunnel you chose, running as your own user id so they can read " +
+            "your secrets. Say plainly BEFORE running it that the first pull downloads two images, the memory one with its " +
+            "embedding model inside, and takes as long as your connection needs — the output is streamed line by line so the wait " +
+            "is visible rather than silent. Later starts are seconds. Where this wizard runs inside the image there is no Docker to " +
+            "drive, so the step prints the exact commands to run on your host instead, and you run them there.",
+        order: 70,
+        // The compose stack is the laptop route. The VM-over-ssh route brings the
+        // same system up through the existing Ansible flow and registers
+        // its own steps; this one stays out of its way.
+        enabled: (choices) => topologyOf(choices) === "local",
+        async run(ctx) {
+            const root = rootOf(ctx.adapters);
+            const checks = [];
+            const hasDocker = await composeAvailable(ctx.adapters.runner);
+            const version = releaseVersion(root);
+            if (version === "") {
+                checks.push({
+                    name: "version",
+                    ok: false,
+                    detail: "no release version to run: QCR_VERSION is not in the project .env and this wizard has no package version — " +
+                        "Fix: set QCR_VERSION in .env to the release you want (the image tag; there is no floating `latest`), then run this step again",
+                });
+                return { ok: false, checks };
+            }
+            if (hasDocker) {
+                checks.push(composeFileCheck(root, version));
+                if (!checks[0].ok)
+                    return { ok: false, checks };
+            }
+            const uid = uidOf(ctx);
+            if (uid === null) {
+                checks.push({
+                    name: "uid",
+                    ok: false,
+                    detail: "no user id was captured, so the containers cannot be matched to the files you own — Fix: run the preflight step " +
+                        "(on Windows, run the wizard inside WSL2, which is the supported route)",
+                });
+                return { ok: false, checks };
+            }
+            if (!existsSync(ctx.adapters.paths.configPath)) {
+                checks.push({
+                    name: "config",
+                    ok: false,
+                    detail: "config.toml does not exist yet — Fix: run the config_fill step; the daemon reads that file at boot",
+                });
+                return { ok: false, checks };
+            }
+            // The two host dirs the compose file bind-mounts from .env values.
+            // Compose interpolates `$VAR` in an unquoted .env value, so a path
+            // carrying a `$` would mount a different directory than this one
+            // (`/srv/$TEAM` → `/srv/` with TEAM unset) — refused before anything
+            // is created or written.
+            const mount = configMountOf(ctx.adapters.paths.configPath);
+            const secretsDir = secretsDirFor(ctx.adapters, ctx.choices);
+            const uninterpolable = [mount.dir, mount.name, secretsDir].filter((p) => /[$\n]|\s#/.test(p));
+            if (uninterpolable.length > 0) {
+                checks.push({
+                    name: "mount-paths",
+                    ok: false,
+                    detail: `${uninterpolable.join(", ")} cannot be passed to Docker Compose through .env: Compose expands \`$\` and treats whitespace followed by # as a comment, ` +
+                        "so it would mount a different directory than the one you chose — Fix: move it to a path without `$`, newlines or whitespace followed by # " +
+                        "(the config's [github] secrets_dir, or where QCR_CONFIG points) and run this step again",
+                });
+                return { ok: false, checks };
+            }
+            // The memory sidecar replaces the in-container OpenViking: the daemon
+            // must be told to probe it instead of supervising its own.
+            let configText = readFileSync(ctx.adapters.paths.configPath, "utf8");
+            const patched = memoryEndpointPatch(configText);
+            if (patched !== null) {
+                try {
+                    parseConfig(patched);
+                }
+                catch (err) {
+                    checks.push({
+                        name: "memory-endpoint",
+                        ok: false,
+                        detail: `[openviking] endpoint = "remote" / host = "${MEMORY_HOST}" would not load in ${ctx.adapters.paths.configPath}: ${String(err)} — nothing was written`,
+                    });
+                    return { ok: false, checks };
+                }
+                writeAtomic(ctx.adapters.paths.configPath, patched);
+                configText = patched;
+                checks.push({
+                    name: "memory-endpoint",
+                    ok: true,
+                    detail: `[openviking] endpoint = "remote" and host = "${MEMORY_HOST}" written to ${ctx.adapters.paths.configPath} — the daemon probes the memory sidecar this stack runs`,
+                });
+            }
+            const option = ingressOptionOf(ctx.choices);
+            const envText = readEnvText(root);
+            const profile = option ? option.profile : (readEnvKey(envText, "COMPOSE_PROFILES") ?? "");
+            if (!hasDocker) {
+                // No Docker here, so nothing is started from here. The commands
+                // for the host, exactly, and a red step until the stack is seen up.
+                const paths = hostPaths(configText);
+                const commands = hostCommands({
+                    version,
+                    projectDir: "~/qcr-bot",
+                    env: hostEnvLines(ctx, version, uid, profile, configText, envText),
+                    dirs: [`"${paths.home}"`, `"${paths.secrets}"`],
+                    notes: [
+                        `# Put ${basename(ctx.adapters.paths.configPath)} in ${paths.home} and your secrets in ${paths.secrets}:`,
+                        "# the config this wizard filled in is " +
+                            `${ctx.adapters.paths.configPath} where the wizard runs, with [openviking] endpoint = "remote" and host = "${MEMORY_HOST}".`,
+                    ],
+                    profile,
+                });
+                for (const line of commands)
+                    log(ctx, line);
+                checks.push({
+                    name: "host-commands",
+                    ok: false,
+                    detail: "there is no `docker compose` where this wizard runs (inside the qcr image there never is: no docker CLI, no socket), " +
+                        `so nothing was started. Run these on the host, in order — the images are ${releaseImage(version)} and ${memoryImage(version)}; ` +
+                        `the paths in the .env are the install's default config home, so edit those two lines if yours is elsewhere:\n${commands.join("\n")}\n` +
+                        "Then run this step again to confirm the stack is up.",
+                });
+                return { ok: false, checks };
+            }
+            // The project .env: the pin and the uid for the containers, and the
+            // ingress profile the ingress step chose (re-asserted here so a
+            // hand-edited .env cannot silently bring up a different shape than the
+            // checklist recorded).
+            let next = setEnvKey(envText, "QCR_VERSION", version);
+            next = setEnvKey(next, "QCR_UID", String(uid));
+            next = setEnvKey(next, "COMPOSE_PROFILES", profile);
+            // The embedder config.toml declares, carried into the .env the
+            // compose file passes to the memory container — the one place the boot
+            // reads it from on this route. config.toml is the truth; this is its
+            // mirror, re-asserted on every bring-up so the two cannot drift apart.
+            const embedder = declaredEmbedderOf(configText);
+            for (const [key, value] of embedderEnvEntries(embedder))
+                next = setEnvKey(next, key, value);
+            // And the local embedder's port and threads — the daemon
+            // reads them from config.toml, the boot renders ov.conf from these.
+            for (const [key, value] of localEmbedderEnvEntries(configText))
+                next = setEnvKey(next, key, value);
+            // The directory the compose file mounts read-only as the
+            // containers' config home — the one holding the config the install
+            // locator found — the only config they read. Created here so
+            // Docker never creates it, owned by root.
+            mkdirSync(mount.dir, { recursive: true, mode: 0o700 });
+            next = setEnvKey(next, "QCR_CONFIG_HOME", mount.dir);
+            next = setEnvKey(next, "QCR_CONFIG_NAME", mount.name);
+            // The secrets dir the compose file mounts read-only at
+            // /opt/quickreview/secrets — the install locator's answer, the same one
+            // the daemon's loader reaches. Created here for the same reason as the
+            // config home: never by Docker, as root.
+            mkdirSync(secretsDir, { recursive: true, mode: 0o700 });
+            next = setEnvKey(next, "QCR_SECRETS_DIR", secretsDir);
+            // The base clone's directory: the compose file mounts the daemon's
+            // base-clone volume at /opt/qcr/<it>, where the daemon looks for it.
+            next = setEnvKey(next, "QCR_CLONE_DIR", cloneDirOfConfig(configText));
+            if (next !== envText)
+                writeAtomic(`${root}/.env`, next);
+            checks.push({
+                name: "pull-inputs",
+                ok: true,
+                detail: `.env: QCR_VERSION=${version} (${releaseImage(version)} and ${memoryImage(version)}), ` +
+                    `QCR_UID=${uid} (the containers' user, so they can read the files you own), ` +
+                    `COMPOSE_PROFILES=${profile === "" ? "(empty — daemon only, the polling shape)" : profile}` +
+                    `${option ? ` for the ${option.id} ingress you chose` : profile === "" ? " (no ingress shape recorded — bringing up the daemon alone)" : " (no ingress shape recorded — keeping the profile already in .env)"}` +
+                    `, and the memory embedder ${describeEmbedder(embedder)} from config.toml${embedder.provider === "local" ? " (local: no memory text leaves this machine)" : ""}`,
+            });
+            // The note goes out before the long wait, never after it.
+            for (const line of FIRST_PULL_NOTICE.split("\n"))
+                log(ctx, line);
+            checks.push({ name: "first-pull", ok: true, detail: FIRST_PULL_NOTICE });
+            const started = ctx.adapters.clock().getTime();
+            let lines = 0;
+            const onLine = (line) => {
+                lines += 1;
+                log(ctx, line);
+                if (lines % progressEvery === 0) {
+                    const mins = Math.round((ctx.adapters.clock().getTime() - started) / 60_000);
+                    log(ctx, `… still working — ${lines} lines of Docker output, ${mins} minute${mins === 1 ? "" : "s"} elapsed. This is normal.`);
+                }
+            };
+            const pull = await stream.run("docker", pullArgs(root, profile), onLine);
+            if (pull.code !== 0) {
+                checks.push({
+                    name: "compose-pull",
+                    ok: false,
+                    detail: `\`docker compose pull\` exited ${pull.code}. Last output:\n${tail(pull.stderr || pull.stdout)}\n` +
+                        "Fix: the message above is Docker's own. The usual causes: " +
+                        `no release tagged ${version} (QCR_VERSION in .env), no disk space (\`docker system df\`, then \`docker system prune\`), ` +
+                        "or a network failure mid-download — all safe to retry by running this step again, which resumes from the layers already here.",
+                });
+                return { ok: false, checks };
+            }
+            const result = await stream.run("docker", bringUpArgs(root, profile), onLine);
+            if (result.code !== 0) {
+                checks.push({
+                    name: "compose-up",
+                    ok: false,
+                    detail: `\`docker compose up -d\` exited ${result.code}. Last output:\n${tail(result.stderr || result.stdout)}\n` +
+                        "Fix: the message above is Docker's own. Safe to retry by running this step again.",
+                });
+                return { ok: false, checks };
+            }
+            const elapsedMin = Math.round((ctx.adapters.clock().getTime() - started) / 60_000);
+            checks.push({
+                name: "compose-up",
+                ok: true,
+                detail: `the stack was pulled and started in ${elapsedMin} minute${elapsedMin === 1 ? "" : "s"} (${lines} lines of Docker output)`,
+            });
+            checks.push(...containerStateCheck(await composePs(ctx.adapters.runner, root), option, {
+                memory: memoryOn(configText),
+            }));
+            const ok = checks.every((c) => c.ok);
+            if (ok)
+                ctx.recordChoice(BROUGHT_UP_CHOICE_KEY, ctx.adapters.clock().toISOString());
+            return { ok, checks, data: { profile, up_at: ctx.adapters.clock().toISOString() } };
+        },
+        async verify(ctx) {
+            // Re-running as verification never pulls or starts anything: it asks
+            // what is running.
+            const root = rootOf(ctx.adapters);
+            const text = readTextOrNull(ctx.adapters.paths.configPath);
+            const checks = containerStateCheck(await composePs(ctx.adapters.runner, root), ingressOptionOf(ctx.choices), { memory: text === null || memoryOn(text) });
+            if (text === null)
+                return {
+                    ok: false,
+                    checks: [
+                        ...checks,
+                        {
+                            name: "embedder",
+                            ok: false,
+                            detail: "config.toml is unreadable — embedder inputs are unknown; restore it before verifying bring-up",
+                        },
+                    ],
+                };
+            checks.push(embedderInputsCheck(text, readEnvText(root)));
+            return { ok: checks.every((c) => c.ok), checks };
+        },
+    };
+}
+/** The last few lines of a failed command, which is the part that says why. */
+function tail(text, lines = 12) {
+    const rows = text.trimEnd().split("\n");
+    return rows.slice(Math.max(0, rows.length - lines)).join("\n");
+}
+//# sourceMappingURL=bringup.js.map