@skillcdn/console 0.1.7 → 0.1.8

package/skills/deploying-a-console/scripts/import-aws-key.mjs

@@ -0,0 +1,35 @@
+// Writes the access key of a downloaded IAM key file into a profile of the AWS CLI's own
+// credentials file, and deletes the key file. Neither value touches a command line, a message
+// or the standard output. Usage: node import-aws-key.mjs <key file> <profile>
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import process from "node:process";
+
+const [file, profile = "console"] = process.argv.slice(2);
+if (file === undefined) {
+  process.stderr.write("usage: node import-aws-key.mjs <key file> <profile>\n");
+  process.exit(2);
+}
+const [header, row] = readFileSync(file, "utf8").trim().split(/\r?\n/);
+const names = (header ?? "").split(",").map((name) => name.trim().toLowerCase());
+const values = (row ?? "").split(",").map((value) => value.trim());
+const id = values[names.findIndex((name) => name.includes("access key id"))];
+const secret = values[names.findIndex((name) => name.includes("secret access key"))];
+if (id === undefined || secret === undefined || id.length === 0 || secret.length === 0) {
+  process.stderr.write("the file does not look like a downloaded access key (.csv)\n");
+  process.exit(1);
+}
+const directory = join(homedir(), ".aws");
+mkdirSync(directory, { recursive: true });
+const credentials = join(directory, "credentials");
+const before = existsSync(credentials)
+  ? readFileSync(credentials, "utf8").replace(new RegExp(`\\[${profile}\\][^[]*`), "")
+  : "";
+writeFileSync(
+  credentials,
+  `${before.trimEnd()}\n\n[${profile}]\naws_access_key_id = ${id}\naws_secret_access_key = ${secret}\n`.trimStart(),
+  { mode: 0o600 },
+);
+unlinkSync(file);
+process.stdout.write(`profile ${profile} written; ${file} deleted\n`);

package/skills/deploying-a-console/scripts/store-secrets.mjs

@@ -0,0 +1,114 @@
+// The secrets file of a run (the shape of assets/secrets.example.json), kept outside any
+// repository, and the parameter store: values go in from standard input or from a command's
+// answer, and out into parameters, without ever passing through a command line or the output.
+//
+//   node store-secrets.mjs set <file> <NAME>                  the value is standard input
+//   node store-secrets.mjs derive <file> <NAME> <template>    {{OTHER}} in the template is replaced
+//   node store-secrets.mjs render <file> <in> <out>           a JSON file with {{NAME}} placeholders filled
+//   node store-secrets.mjs key <file> <iam user>              creates an access key for the user and stores both halves
+//   node store-secrets.mjs store <file> <prefix>              every value as a SecureString parameter <prefix>/<NAME>
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import process from "node:process";
+
+const [mode, file, ...rest] = process.argv.slice(2);
+const usage = () => {
+  process.stderr.write("usage: node store-secrets.mjs set|derive|render|key|store <file> ...\n");
+  process.exit(2);
+};
+if (mode === undefined || file === undefined) {
+  usage();
+}
+
+const read = () => (existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : {});
+const write = (data) => writeFileSync(file, `${JSON.stringify(data, null, 2)}\n`, { mode: 0o600 });
+const fill = (data, text) =>
+  text.replace(/\{\{([A-Z0-9_]+)\}\}/g, (_, name) => {
+    if (typeof data[name] !== "string") {
+      throw new Error(`${name} is not in the secrets file`);
+    }
+    return data[name];
+  });
+/** Runs the AWS CLI with a request body in a temporary file, so that nothing is on the command line. */
+const aws = (args, body) => {
+  const directory = mkdtempSync(join(tmpdir(), "console-"));
+  try {
+    const request = join(directory, "request.json");
+    writeFileSync(request, JSON.stringify(body), { mode: 0o600 });
+    return execFileSync("aws", [...args, "--cli-input-json", `file://${request}`], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "inherit"],
+    });
+  } finally {
+    rmSync(directory, { recursive: true, force: true });
+  }
+};
+
+switch (mode) {
+  case "set": {
+    const [name] = rest;
+    if (name === undefined) {
+      usage();
+    }
+    const value = readFileSync(0, "utf8").replace(/\r?\n$/, "");
+    write({ ...read(), [name]: value });
+    break;
+  }
+  case "derive": {
+    const [name, template] = rest;
+    if (name === undefined || template === undefined) {
+      usage();
+    }
+    const data = read();
+    write({ ...data, [name]: fill(data, template) });
+    break;
+  }
+  case "render": {
+    const [input, output] = rest;
+    if (input === undefined || output === undefined) {
+      usage();
+    }
+    writeFileSync(output, fill(read(), readFileSync(input, "utf8")), { mode: 0o600 });
+    break;
+  }
+  case "key": {
+    const [user] = rest;
+    if (user === undefined) {
+      usage();
+    }
+    const answer = JSON.parse(aws(["iam", "create-access-key"], { UserName: user }));
+    write({
+      ...read(),
+      S3_ACCESS_KEY_ID: answer.AccessKey.AccessKeyId,
+      S3_SECRET_ACCESS_KEY: answer.AccessKey.SecretAccessKey,
+    });
+    break;
+  }
+  case "store": {
+    const [prefix] = rest;
+    if (prefix === undefined) {
+      usage();
+    }
+    const data = read();
+    for (const [name, value] of Object.entries(data)) {
+      // The password lives inside the URL; a value the person deferred is not a parameter.
+      if (name === "_" || name === "DATABASE_PASSWORD" || value === "later") {
+        continue;
+      }
+      const tier = Buffer.byteLength(value, "utf8") > 4000 ? "Advanced" : "Standard";
+      aws(["ssm", "put-parameter"], {
+        Name: `${prefix}/${name}`,
+        Type: "SecureString",
+        Value: value,
+        Tier: tier,
+        Overwrite: true,
+      });
+      process.stdout.write(`${prefix}/${name} stored (${tier})\n`);
+    }
+    break;
+  }
+  default:
+    usage();
+}

package/skills/working-the-board/SKILL.md

@@ -1,21 +1,29 @@
 ---
 name: working-the-board
-description: "Works a task from the board of a SkillCDN Console with the console command, as the person whose token the command holds: reads the task, takes it, reports at the milestones of the work, asks on the board when a person must decide and waits for the answer, hands in what was made as a link or a file, writes down what the next agent needs on a page of the project, and finishes. Use when an agent is told to take, work or finish a task on the console, or to report, ask, hand in or write a page there; any agent with a shell where the command is signed in. To build a console or a script against the console's API, use building-a-console."
+description: "Works a task from the board of a SkillCDN Console with the console command, as the person whose token the command holds: reads the task, takes it, reports at the milestones of the work, asks on the board when a person must decide and waits for the answer, hands in what was made as a link or a file, writes down what the next agent needs on a page of the project, and finishes. Use when an agent is told to take, work or finish a task on the console, or to report, ask, hand in or write a page there; any agent with a shell where the command is signed in. To build a console or a script against the console's API, use building-a-console; to deploy a console for an organization, use deploying-a-console."
 license: MIT
 compatibility: Needs a shell with the console command on the PATH (npm install -g @skillcdn/console, Node.js 24 or newer), signed in by a person. Nothing else; the command needs no key of its own and the agent never sees a token.
 metadata:
   author: skillcdn
-  version: "1.0"
+  version: "1.1"
 skillcdn:
   translations:
     ko:
       title: 콘솔 보드에서 일하기
-      description: "SkillCDN 콘솔의 보드에 있는 작업을 console 명령으로 수행합니다. 명령에 로그인한 사람의 자격으로, 작업을 읽고 맡고, 진행의 이정표마다 보고하고, 사람이 정해야 할 일은 보드에 물어 답을 기다리고, 만든 것을 링크나 파일로 제출하고, 다음 에이전트에게 필요한 것을 프로젝트 페이지에 적고, 마칩니다. 에이전트에게 콘솔의 작업을 맡거나 끝내라고, 또는 보고·질문·제출·페이지 쓰기를 하라고 할 때 쓰세요. 콘솔이나 API 클라이언트를 만들 때는 building-a-console을 쓰세요."
+      description: "SkillCDN 콘솔의 보드에 있는 작업을 console 명령으로 수행합니다. 명령에 로그인한 사람의 자격으로, 작업을 읽고 맡고, 진행의 이정표마다 보고하고, 사람이 정해야 할 일은 보드에 물어 답을 기다리고, 만든 것을 링크나 파일로 제출하고, 다음 에이전트에게 필요한 것을 프로젝트 페이지에 적고, 마칩니다. 에이전트에게 콘솔의 작업을 맡거나 끝내라고, 또는 보고·질문·제출·페이지 쓰기를 하라고 할 때 쓰세요. 콘솔이나 API 클라이언트를 만들 때는 building-a-console을, 조직의 콘솔을 배포할 때는 deploying-a-console을 쓰세요."
 ---
 # Working a task on the board
 
 A task of the board goes in, named by its number; a run comes out: the task taken, the work reported at its milestones, a decision raised and waited for where a person had to choose, what was made handed in, what was learned written down for the next agent, and the run finished. The board is a SkillCDN Console ([architecture](/docs/architecture.md)): projects of tasks, the agents at work on them, and the decisions that wait for a person. The agent acts as the person who signed the command in, on that person's standing and no more.
 
+## How the person is involved
+
+- **Questions:** only which task, when the request names none: "Which task should I take? Its number, or say that any ready one may be." Nothing else is asked in chat: what the task leaves open is asked on the board, where its people answer.
+- **Checkpoints:** on the board, as decisions (phase 4), which a person answers from wherever they are; the reports say what was done at each milestone, and need no answer.
+- **Go-ahead:** the task's body is the go-ahead. A task that says what the agent may decide alone is followed within that; everything else that would change scope, cost or a trade-off is a decision.
+- **Changes mid-run:** a person changes the task or answers a decision on the board; the run takes it from there and says so in its next report. A report is never rewritten.
+- **Language:** reports, questions, pages and summaries are in the language the task is written in, so that the people of the board read them as they wrote.
+
 ## Requirements
 
 | Need | How | When missing |