@quickchatai/quickreview 1.1.0 → 1.3.1

package/src/onboard/steps/bringup.ts

@@ -80,13 +80,14 @@ import {
   embedderInputsCheck,
   localEmbedderEnvEntries,
 } from "./embeddings.js";
+import { CHOICE_KEYS } from "../choices.js";
 import { readEnvKey, readTomlKey, setEnvKey } from "./ingress.js";
 import { UID_CHOICE_KEY } from "./preflight.js";
 import { topologyOf } from "./topology.js";
 
 export const BRINGUP_STEP_ID = "bringup";
 /** Recorded timestamp of this step's successful bring-up. */
-export const BROUGHT_UP_CHOICE_KEY = "stack_brought_up_at";
+export const BROUGHT_UP_CHOICE_KEY = CHOICE_KEYS.broughtUpAt;
 
 /**
  * The note, in the operator's words, emitted before the pull begins.
@@ -442,7 +443,7 @@ export function bringUpStep(opts: BringUpStepOptions = {}): OnboardingStep {
         }),
       );
       const ok = checks.every((c) => c.ok);
-      if (ok) ctx.recordChoice(BROUGHT_UP_CHOICE_KEY, ctx.adapters.clock().toISOString());
+      if (ok) ctx.recordChoice(CHOICE_KEYS.broughtUpAt, ctx.adapters.clock().toISOString());
       return { ok, checks, data: { profile, up_at: ctx.adapters.clock().toISOString() } };
     },
 

package/src/onboard/steps/compose.ts

@@ -74,6 +74,9 @@ export const MEMORY_IMAGE_REPO = "ghcr.io/quickchatai/quickreview-memory";
 
 export { CONTAINER_STATE_DIR };
 export const CONTAINER_DRYRUN_DIR = `${CONTAINER_STATE_DIR}/dryrun`;
+/** The daemon's command root in the release image (`<root>/commands`, with the
+ * root-sealed `operator/` under it and the result files in `results/`). */
+export const CONTAINER_COMMANDS_DIR = "/opt/qcr/commands";
 
 /** `<sandbox root>` — the engine's contract is stateDir = `<root>/state`. */
 export function rootOf(adapters: OnboardAdapters): string {
@@ -157,6 +160,12 @@ export function daemonExecArgs(root: string, argv: readonly string[]): string[]
   return composeArgs(root, ["exec", "-T", DAEMON_SERVICE, ...argv]);
 }
 
+/** The same exec as uid 0 — the operator seal on `commands/operator/`, which
+ * the daemon's own uid (every session's) can read but not write. */
+export function daemonRootExecArgs(root: string, argv: readonly string[]): string[] {
+  return composeArgs(root, ["exec", "-T", "-u", "0", DAEMON_SERVICE, ...argv]);
+}
+
 export async function daemonExec(
   runner: ProcessRunner,
   root: string,
@@ -172,9 +181,31 @@ export interface PsReport {
   detail: string;
 }
 
+/** docker-compose.yml's `name:` — the project label on its containers. */
+export const COMPOSE_PROJECT = "quickreview";
+
+/** `docker ps` over the compose project label, one compose-ps-shaped JSON row
+ * per running container: asks Docker without reading the compose file. */
+export function projectPsArgs(): string[] {
+  return [
+    "ps",
+    "--filter",
+    `label=com.docker.compose.project=${COMPOSE_PROJECT}`,
+    "--format",
+    '{"Service":"{{.Label "com.docker.compose.service"}}","State":"{{.State}}"}',
+  ];
+}
+
 export async function composePs(runner: ProcessRunner, root: string): Promise<PsReport> {
   const ps = await runner.run("docker", composeArgs(root, ["ps", "--format", "json"]));
   if (ps.code !== 0) {
+    // `docker compose ps` interpolates the compose file first, and before the
+    // bring-up has written the project .env (QCR_SECRETS_DIR and the rest) it
+    // refuses to run at all. That is a question about the file, not the
+    // stack: Docker itself still answers which of the project's containers
+    // run. Only when Docker cannot answer either is the state unknown.
+    const plain = await runner.run("docker", projectPsArgs());
+    if (plain.code === 0) return { ok: true, rows: parseComposePs(plain.stdout), detail: "" };
     return {
       ok: false,
       rows: [],

package/src/onboard/steps/configfill.ts

@@ -63,6 +63,7 @@ import {
   type ChoiceName,
   botLoginFor,
   ingressChoiceOf,
+  userAuthRecorded,
   type IngressChoice,
 } from "../choices.js";
 import {
@@ -76,8 +77,8 @@ import {
 } from "../engine.js";
 import { deliverConfigChange, configDeliveryChecks } from "./configdelivery.js";
 import type { TransportOptions } from "./transport.js";
-import { BARE_HOSTNAME_RE, readTomlKey, secretsDirFor } from "./ingress.js";
-import { SSH_ALIAS_RE } from "./topology.js";
+import { BARE_HOSTNAME_RE, CONTAINER_STATE_DIR, readTomlKey, secretsDirFor } from "./ingress.js";
+import { SSH_ALIAS_RE, topologyOf, type Topology } from "./topology.js";
 
 export const CONFIG_FILL_STEP_ID = "config_fill";
 
@@ -120,9 +121,12 @@ function escapeRe(s: string): string {
  * marker in place — the EXPLANATION after it is the part worth keeping. */
 export function rewriteFillMarker(comment: string): string {
   if (!/←\s*FILL/.test(comment)) return comment;
-  return comment.replace(/←\s*FILL(\s*\(\d+\))?\s*:?\s*/, "filled by qcr onboard: ");
+  return comment.replace(/←\s*FILL(\s*\(\d+\))?\s*:?\s*/, "filled by qcr: ");
 }
 
+/** A line without the CR of its CRLF ending. */
+const bare = (line: string): string => line.replace(/\r$/, "");
+
 function sectionAt(lines: string[]): string[] {
   const out: string[] = [];
   let cur = "";
@@ -134,10 +138,12 @@ function sectionAt(lines: string[]): string[] {
       if (splitTail(continuation) !== null) continuation = null;
       continue;
     }
-    const m = HEADER_RE.exec(line);
+    const m = HEADER_RE.exec(bare(line));
     if (m) cur = m[1]!.trim();
     out.push(cur);
-    const assignment = /^\s*(?:"(?:[^"\\]|\\.)*"|'[^']*'|[A-Za-z0-9_-]+)\s*=\s*(.*)$/.exec(line);
+    const assignment = /^\s*(?:"(?:[^"\\]|\\.)*"|'[^']*'|[A-Za-z0-9_-]+)\s*=\s*(.*)$/.exec(
+      bare(line),
+    );
     if (assignment && splitTail(assignment[1]!) === null) continuation = assignment[1]!;
   }
   return out;
@@ -148,9 +154,18 @@ function sectionAt(lines: string[]): string[] {
  * key order. An existing assignment has only its VALUE replaced (its trailing
  * comment survives, with a spent `← FILL` marker rewritten); a commented-out
  * assignment is uncommented in place; a key absent from its section is appended
- * to the end of that section; a missing section is appended at EOF.
+ * to the end of that section; a missing section is appended at EOF. Line
+ * endings survive too: a CRLF file is patched as LF and given its CRs back, so
+ * an edited or added line ends the way every other line does, and in a file of
+ * mixed endings the edited line keeps its own.
  */
 export function patchToml(text: string, edits: readonly TomlEdit[]): string {
+  if (text.includes("\r\n") && !/(^|[^\r])\n/.test(text))
+    return patchLines(text.replace(/\r\n/g, "\n"), edits).replace(/\n/g, "\r\n");
+  return patchLines(text, edits);
+}
+
+function patchLines(text: string, edits: readonly TomlEdit[]): string {
   const lines = text.split("\n");
   for (const edit of edits) {
     const sections = sectionAt(lines);
@@ -161,7 +176,7 @@ export function patchToml(text: string, edits: readonly TomlEdit[]): string {
     for (const re of [live, commented]) {
       for (let i = 0; i < lines.length && !applied; i++) {
         if (sections[i] !== edit.section) continue;
-        const m = re.exec(lines[i]!);
+        const m = re.exec(bare(lines[i]!));
         if (!m) continue;
         try {
           if (!Object.hasOwn(parseToml(`${m[2]} = 0`), edit.key)) continue;
@@ -170,11 +185,13 @@ export function patchToml(text: string, edits: readonly TomlEdit[]): string {
         }
         let end = i;
         let tail = m[4]!;
-        while (splitTail(tail) === null && end + 1 < lines.length) tail += "\n" + lines[++end]!;
+        while (splitTail(tail) === null && end + 1 < lines.length)
+          tail += "\n" + bare(lines[++end]!);
         const parts = splitTail(tail);
         if (!parts) throw new Error(`cannot patch unterminated TOML assignment ${edit.key}`);
         const comment = parts.comment ? `${parts.gap}${rewriteFillMarker(parts.comment)}` : "";
-        lines.splice(i, end - i + 1, `${m[1]}${m[2]}${m[3]}${edit.value}${comment}`);
+        const cr = lines[end]!.endsWith("\r") ? "\r" : "";
+        lines.splice(i, end - i + 1, `${m[1]}${m[2]}${m[3]}${edit.value}${comment}${cr}`);
         applied = true;
       }
       if (applied) break;
@@ -228,9 +245,17 @@ export interface FillFacts {
   secrets_dir: string;
   topology: string;
   ingress: string;
+  /** The GitHub route the github_account step recorded ("user" | "app"), ""
+   * while unanswered — which is the App route's interview. */
+  github_auth?: string;
+  /** The person's own login on the "user" route (`GET /user`). */
+  account_login?: string;
 }
 
-export type AnswerKey = Exclude<keyof FillFacts, "secrets_dir" | "topology" | "ingress">;
+export type AnswerKey = Exclude<
+  keyof FillFacts,
+  "secrets_dir" | "topology" | "ingress" | "github_auth" | "account_login"
+>;
 
 export interface Question {
   id: AnswerKey;
@@ -282,7 +307,9 @@ export const QUESTIONS: readonly Question[] = [
       "clone directory, backfill identity — is derived from this one answer.",
     prompt: 'Which repository should the reviewer watch? ("owner/name")',
     optional: false,
-    from: [CHOICE_KEYS.repo],
+    // On the own-account route the github_account step already asked, from
+    // the repos the person's account reaches.
+    from: [CHOICE_KEYS.accountRepo, CHOICE_KEYS.repo],
     read: (cfg) => cfg.github.repo,
     validate: (v) =>
       REPO_SLUG_RE.test(v)
@@ -298,8 +325,10 @@ export const QUESTIONS: readonly Question[] = [
       "The companion — the local pi that sits beside the TUI — reads the code a review is about. Your checkout is " +
       "mounted READ-ONLY into its container: it can read every file and change none of them. A missing checkout only " +
       "makes the companion less informed; it never breaks the reviewer.",
-    prompt: "Where is your local checkout of that repository?",
-    optional: false,
+    prompt:
+      "Where is your local checkout of that repository? (Enter if there is none here — the companion starts without it)",
+    // A fresh box has no checkout, and the daemon clones the repository itself.
+    optional: true,
     from: [CHOICE_KEYS.repoDir],
     read: (cfg) => cfg.companion.reviewed_repo_dir,
     validate: (v) => {
@@ -325,6 +354,8 @@ export const QUESTIONS: readonly Question[] = [
     prompt: "What is your GitHub App's slug?",
     optional: false,
     from: [CHOICE_KEYS.appSlug],
+    // No App exists on the own-account route: `[github] app_slug` stays "".
+    asked: (choices) => !userAuthRecorded(choices),
     read: (cfg) => cfg.github.app_slug,
     validate: (v) =>
       SLUG_RE.test(v)
@@ -390,7 +421,7 @@ export const QUESTIONS: readonly Question[] = [
       "It is never used to authenticate anything — the App credential is the only identity that acts.",
     prompt: "What is your GitHub login? (Enter to skip)",
     optional: true,
-    from: [CHOICE_KEYS.ownerLogin],
+    from: [CHOICE_KEYS.accountLogin, CHOICE_KEYS.ownerLogin],
     read: (cfg) => cfg.owner.github_login,
     validate: validateGithubLogin,
   },
@@ -493,27 +524,51 @@ export interface Derivable {
   holds(cfg: Config, facts: FillFacts): string | null;
 }
 
-/** The TUI transport a recorded topology implies; null while it is unrecorded. */
-function tuiTargetFor(topology: string): "local" | "ssh" | null {
-  return topology === "local" ? "local" : topology === "vm" ? "ssh" : null;
+/** The topology a fill is for: the recorded one, and "local" while none is
+ * recorded — `topologyOf`'s reading, the one every other step uses. */
+function fillTopology(topology: string): Topology {
+  return topologyOf({ [CHOICE_KEYS.topology]: topology });
+}
+
+/** The TUI transport a topology implies (an unrecorded one is local). */
+function tuiTargetFor(topology: string): "local" | "ssh" {
+  return fillTopology(topology) === "vm" ? "ssh" : "local";
 }
 
+/** The release image's state dir inside the compose daemon container (the
+ * `qcr-state` volume), where the local TUI reads status.json. */
+const LOCAL_TUI_STATE_DIR = CONTAINER_STATE_DIR;
+
 export const DERIVABLES: readonly Derivable[] = [
   {
     id: "bot_login",
     path: "[github] bot_login",
     explain:
-      "the bot login is the App slug plus the [bot] suffix — asking for it twice is how the two drift apart",
-    write: (f) => ({
-      section: "github",
-      key: "bot_login",
-      value: tomlString(botLoginFor(f.app_slug)),
-    }),
+      "the bot login is the App slug plus the [bot] suffix — asking for it twice is how the two drift apart. On your own " +
+      "GitHub account it is your login: the reviews are posted as you",
+    write: (f) =>
+      f.github_auth === "user"
+        ? f.account_login
+          ? { section: "github", key: "bot_login", value: tomlString(f.account_login) }
+          : null
+        : {
+            section: "github",
+            key: "bot_login",
+            value: tomlString(botLoginFor(f.app_slug)),
+          },
     stable: true,
-    holds: (cfg) =>
-      cfg.github.bot_login === botLoginFor(cfg.github.app_slug)
+    holds: (cfg, f) => {
+      if (f.github_auth === "user") {
+        if (!cfg.github.bot_login.trim())
+          return "[github] bot_login is empty — on your own account it is your GitHub login; run the github_account step";
+        return f.account_login && cfg.github.bot_login !== f.account_login
+          ? `[github] bot_login is "${cfg.github.bot_login}" but your account is "${f.account_login}" — run the github_account step again`
+          : null;
+      }
+      return cfg.github.bot_login === botLoginFor(cfg.github.app_slug)
         ? null
-        : `[github] bot_login is "${cfg.github.bot_login}" but the App slug "${cfg.github.app_slug}" implies "${botLoginFor(cfg.github.app_slug)}"`,
+        : `[github] bot_login is "${cfg.github.bot_login}" but the App slug "${cfg.github.app_slug}" implies "${botLoginFor(cfg.github.app_slug)}"`;
+    },
   },
   {
     id: "clone_dir",
@@ -547,7 +602,7 @@ export const DERIVABLES: readonly Derivable[] = [
     holds: (cfg) =>
       cfg.github.secrets_dir.trim()
         ? null
-        : "[github] secrets_dir is empty — the App credential has nowhere to live",
+        : "[github] secrets_dir is empty — the GitHub credential has nowhere to live",
   },
   {
     id: "review_team",
@@ -588,10 +643,12 @@ export const DERIVABLES: readonly Derivable[] = [
       "the history importer's identity and labels cascade off [github] — never a second copy to keep in sync",
     write: () => null,
     stable: true,
-    holds: (cfg) => {
+    holds: (cfg, f) => {
       if (cfg.backfill.bot_login !== cfg.github.bot_login)
         return "[backfill] bot_login no longer follows [github] bot_login";
-      if (cfg.backfill.bot_actor !== cfg.github.app_slug)
+      // The actor is the App slug; the own-account route has no App, and the
+      // loader decides what stands in for it there.
+      if (f.github_auth !== "user" && cfg.backfill.bot_actor !== cfg.github.app_slug)
         return "[backfill] bot_actor no longer follows [github] app_slug";
       if (cfg.backfill.trigger_label !== cfg.github.trigger_label)
         return "[backfill] trigger_label no longer follows [github] trigger_label";
@@ -615,15 +672,12 @@ export const DERIVABLES: readonly Derivable[] = [
     path: "[tui] target",
     explain:
       'follows the recorded topology: "local" when the daemon runs on this machine (the TUI talks to local Docker), "ssh" on the VM route',
-    write: (f) => {
-      const target = tuiTargetFor(f.topology);
-      return target ? { section: "tui", key: "target", value: tomlString(target) } : null;
-    },
+    write: (f) => ({ section: "tui", key: "target", value: tomlString(tuiTargetFor(f.topology)) }),
     stable: true,
     holds: (cfg, f) => {
       const want = tuiTargetFor(f.topology);
-      return want && cfg.tui.target !== want
-        ? `[tui] target = "${cfg.tui.target}", but the recorded topology is ${f.topology} — the TUI would ` +
+      return cfg.tui.target !== want
+        ? `[tui] target = "${cfg.tui.target}", but the topology is ${f.topology || "local (none recorded)"} — the TUI would ` +
             `${want === "local" ? "look for the daemon over ssh" : "look for the daemon in local Docker"}. ` +
             `Fix: run this step again (it writes target = "${want}")`
         : null;
@@ -635,7 +689,8 @@ export const DERIVABLES: readonly Derivable[] = [
     explain:
       "the bundled local Compose project runs service daemon as quickreview-daemon-1; preserve an operator's custom container",
     write: (f, fresh, existing) =>
-      f.topology === "local" && (fresh || existing?.tui.container === TUI_DEFAULTS.container)
+      fillTopology(f.topology) === "local" &&
+      (fresh || existing?.tui.container === TUI_DEFAULTS.container)
         ? { section: "tui", key: "container", value: tomlString("quickreview-daemon-1") }
         : null,
     stable: false,
@@ -647,12 +702,41 @@ export const DERIVABLES: readonly Derivable[] = [
     explain:
       "the bundled local Compose project runs the memory sidecar as quickreview-memory-1, where the memory forward must relay; preserve an operator's custom container",
     write: (f, fresh, existing) =>
-      f.topology === "local" && (fresh || (existing?.tui.memory_container ?? "") === "")
+      fillTopology(f.topology) === "local" &&
+      (fresh || (existing?.tui.memory_container ?? "") === "")
         ? { section: "tui", key: "memory_container", value: tomlString("quickreview-memory-1") }
         : null,
     stable: false,
     holds: () => null,
   },
+  {
+    id: "tui_remote_state_dir",
+    path: "[tui] remote_state_dir",
+    explain:
+      `on this machine the TUI reads status.json inside the daemon container, where the release image keeps its state (${LOCAL_TUI_STATE_DIR}, ` +
+      "the compose state volume) — the shipped default is the VM host's path; preserve an operator's custom path",
+    write: (f, fresh, existing) =>
+      fillTopology(f.topology) === "local" &&
+      (fresh || existing?.tui.remote_state_dir === TUI_DEFAULTS.remote_state_dir)
+        ? { section: "tui", key: "remote_state_dir", value: tomlString(LOCAL_TUI_STATE_DIR) }
+        : null,
+    stable: false,
+    holds: () => null,
+  },
+  {
+    id: "tui_sudo_docker",
+    path: "[tui] sudo_docker",
+    explain:
+      "off on this machine: the wizard's own bring-up drives docker without sudo, so the TUI does too (a sudo password " +
+      "prompt behind the TUI's screen can only fail); on the VM route sudo stays the shipped default",
+    write: (f, fresh, existing) =>
+      fillTopology(f.topology) === "local" &&
+      (fresh || existing?.tui.sudo_docker === TUI_DEFAULTS.sudo_docker)
+        ? { section: "tui", key: "sudo_docker", value: "false" }
+        : null,
+    stable: false,
+    holds: () => null,
+  },
   {
     id: "tui_ssh_host",
     path: "[tui] ssh_host",
@@ -729,6 +813,9 @@ export const DEFAULT_SECRETS_DIR = "";
  * Read from ITS artefacts (the `deploy_shape` marker it writes) so this step
  * reports the same required set without duplicating the wizard's validators. */
 export const REQUIRED_SECRETS: readonly string[] = ["app_id", "app.pem", "webhook_secret"];
+/** The own-account route's one secret: the person's token, written by
+ * `qcr github-token sync` (the github_account step runs it). */
+export const USER_ROUTE_SECRETS: readonly string[] = ["github_token"];
 export const TUNNEL_SHAPE_SECRET = "tunnel_token";
 
 /** Unlike `readTextOrNull`, only ABSENCE is null: a file that exists and
@@ -918,6 +1005,8 @@ export async function collectAnswers(
       DEFAULT_SECRETS_DIR,
     topology: str(choices, CHOICE_KEYS.topology),
     ingress: str(choices, CHOICE_KEYS.ingress),
+    github_auth: str(choices, CHOICE_KEYS.githubAuth),
+    account_login: str(choices, CHOICE_KEYS.accountLogin),
   };
   return { facts, missing, rejected, asked, ignored };
 }
@@ -992,7 +1081,17 @@ export function changedEdits(text: string, edits: readonly TomlEdit[]): TomlEdit
 }
 
 /** What the secrets dir holds, at the one resolution every step uses. */
-function secretsReport(dir: string): CheckResult {
+function secretsReport(dir: string, userRoute: boolean): CheckResult {
+  if (userRoute) {
+    const missing = USER_ROUTE_SECRETS.filter((f) => !existsSync(join(dir, f)));
+    return {
+      name: "secrets",
+      ok: true,
+      detail: missing.length
+        ? `${dir}: still missing ${missing.join(", ")} — the github_account step writes it from your GitHub sign-in (no App secrets on this route)`
+        : `${dir}: your GitHub token is present — the own-account route needs no App secrets`,
+    };
+  }
   if (!existsSync(dir)) {
     return {
       name: "secrets",
@@ -1221,11 +1320,14 @@ export function configFillStep(opts: { transport?: TransportOptions } = {}): Onb
         ok: true,
         detail:
           `topology ${facts.topology || "(unrecorded — filled for a daemon on this machine, so [tui] ssh_host stays empty)"}, ` +
-          `ingress ${facts.ingress || "(unrecorded — filled for an ingress that assigns its own hostname, so [server] hostname stays empty)"}` +
+          `ingress ${facts.ingress || "(unrecorded — filled for an ingress that assigns its own hostname, so [server] hostname stays empty)"}, ` +
+          `github ${facts.github_auth === "user" ? "own account (no App questions, no App secrets)" : "App"}` +
           `${str(ctx.choices, CHOICE_KEYS.authRoute) ? `, auth route ${str(ctx.choices, CHOICE_KEYS.authRoute)}` : ""}`,
       });
       // Read after the write, so the dir is the one the written config names.
-      checks.push(secretsReport(secretsDirFor(ctx.adapters, ctx.choices)));
+      checks.push(
+        secretsReport(secretsDirFor(ctx.adapters, ctx.choices), userAuthRecorded(ctx.choices)),
+      );
 
       const ok = checks.every((c) => c.ok);
       if (ok) recordChoices(ctx, facts, configPath, parsed);
@@ -1320,6 +1422,8 @@ export function configFillStep(opts: { transport?: TransportOptions } = {}): Onb
         secrets_dir: cfg.github.secrets_dir,
         topology: str(ctx.choices, CHOICE_KEYS.topology),
         ingress: str(ctx.choices, CHOICE_KEYS.ingress),
+        github_auth: str(ctx.choices, CHOICE_KEYS.githubAuth),
+        account_login: str(ctx.choices, CHOICE_KEYS.accountLogin),
       };
       for (const d of DERIVABLES) {
         if (!d.stable) continue;