@stratusagent/cli 0.11.5 → 0.11.7

package/dist/commands/setup.js

@@ -4,7 +4,7 @@ import { preflightPlugin, readPluginManifest, PluginConfigError, PluginManifestE
 import { DEFAULT_ANTHROPIC_MODEL } from '@stratusagent/provider-anthropic';
 import { DEFAULT_CODEX_MODEL } from '@stratusagent/provider-codex';
 import { formatSoul, parseSoul } from '@stratusagent/agents';
-import { claimSoulFile, collectAvailableModels as collectModels, credentialsPath, defaultApiKeyEnvName, DEFAULT_ANTHROPIC_BASE_URL, DEFAULT_OPENAI_BASE_URL, DEFAULT_OPENAI_MODEL, DEFAULT_STRATUS_AGENT, globalConfigPath, loadChannelCredentials, loadCredentials, loadRosterSouls, loadSoulFile, isRegisteredProviderName, readNonEmptyString, registeredProviderNameOf, readProcessEnv, readWorkingDirectory, resolveAgentApprovals, DEFAULT_CONFIG_FILENAME, loadConfigFile, saveChannelCredentials, saveConfigFile, saveCredentials, CREDENTIAL_PROVIDER_NAMES, verifyProviderKey, } from '@stratusagent/state';
+import { claimSoulFile, collectAvailableModels as collectModels, credentialsPath, defaultApiKeyEnvName, DEFAULT_ANTHROPIC_BASE_URL, DEFAULT_OPENAI_BASE_URL, DEFAULT_OPENAI_MODEL, DEFAULT_STRATUS_AGENT, globalConfigPath, loadChannelCredentials, loadChannelTransportSecrets, loadCredentials, loadRosterSouls, loadSoulFile, isRegisteredProviderName, languageFor, readNonEmptyString, registeredProviderNameOf, readProcessEnv, readWorkingDirectory, resolveAgentApprovals, DEFAULT_CONFIG_FILENAME, loadConfigFile, saveChannelCredentials, saveChannelTransportSecrets, removeChannelTransportSecrets, CREDENTIAL_NAME_PATTERN, saveConfigFile, saveCredentials, CREDENTIAL_PROVIDER_NAMES, verifyProviderKey, } from '@stratusagent/state';
 import { installService, readServiceStatus, servicePlatform, serviceUnitPath, uninstallService, } from "../service.js";
 import { classifyApprovalReach, unattendedReachParts } from "../approvals.js";
 import { serviceEnvFor } from "../daemon.js";
@@ -97,6 +97,7 @@ export const runSetup = async (command, streams, env = {}) => {
         ...(existing.vision !== undefined ? { vision: existing.vision } : {}),
         ...(existing.promptCache !== undefined ? { promptCache: existing.promptCache } : {}),
         ...(existing.promptCacheTtl !== undefined ? { promptCacheTtl: existing.promptCacheTtl } : {}),
+        ...(existing.language !== undefined ? { language: existing.language } : {}),
         ...(existing.plugins !== undefined ? { plugins: existing.plugins } : {}),
         ...(existing.approvals !== undefined ? { approvals: existing.approvals } : {}),
         ...(existing.api !== undefined ? { api: existing.api } : {}),
@@ -116,6 +117,8 @@ export const runSetup = async (command, streams, env = {}) => {
         credentialsDirty: false,
         channels: await loadChannelCredentials(env),
         channelsDirty: false,
+        pluginChannelSecrets: {},
+        pluginChannelEdits: [],
         // On by default: setup's whole promise is that you finish it and the
         // agents are working. An always-on runtime you have to remember to
         // start is not always-on, and every Slack app configured here stays
@@ -221,12 +224,12 @@ export const runSetup = async (command, streams, env = {}) => {
         }
         return state.soulPath;
     };
-    const channelsSummary = () => {
+    const channelsSummary = (pluginKinds) => {
         const connected = Object.keys(state.channels.slack ?? {}).length;
-        if (connected === 0) {
-            return 'Slack: not connected';
-        }
-        return `Slack: ${connected} agent${connected === 1 ? '' : 's'} connected`;
+        const slack = connected === 0
+            ? 'Slack: not connected'
+            : `Slack: ${connected} agent${connected === 1 ? '' : 's'} connected`;
+        return pluginKinds.length === 0 ? slack : `${slack}; also ${pluginKinds.join(', ')}`;
     };
     const storeCredential = (provider, credential) => {
         state.credentials[provider] = credential;
@@ -705,7 +708,15 @@ export const runSetup = async (command, streams, env = {}) => {
             ...(codexSubscription ? { codexSubscription: true } : {}),
         };
     };
+    // The language the saved config would run in, soul over config, carried
+    // onto whichever variant the test run builds: it is part of what the
+    // quick hello is there to exercise.
     const buildTestRuntime = async () => {
+        const runtime = await buildTestRuntimeVariant();
+        const language = runtime ? languageFor(runtime.soul, state) : undefined;
+        return runtime && language !== undefined ? { ...runtime, language } : runtime;
+    };
+    const buildTestRuntimeVariant = async () => {
         let soul;
         if (state.soulPath) {
             try {
@@ -822,27 +833,31 @@ export const runSetup = async (command, streams, env = {}) => {
         writeLine(streams.stdout);
         writeLine(streams.stdout, `Create a Slack app for ${agentName}:`);
         writeLine(streams.stdout, '  1. Open https://api.slack.com/apps → Create New App → From a manifest');
-        writeLine(streams.stdout, '  2. Pick your workspace, then paste this manifest:');
+        writeLine(streams.stdout, '  2. Pick your workspace → Next, then paste this manifest:');
         writeLine(streams.stdout);
         for (const line of slackAppManifest(agentName).split('\n')) {
             writeLine(streams.stdout, `    ${line}`);
         }
         writeLine(streams.stdout);
-        writeLine(streams.stdout, '  3. Create the app, then Basic Information → App-Level Tokens →');
-        writeLine(streams.stdout, '     Generate a token with the connections:write scope (xapp-…)');
-        writeLine(streams.stdout, '  4. Install App → copy the Bot User OAuth Token (xoxb-…)');
+        // The app-level token is the step people got lost on: it lives on
+        // Basic Information rather than OAuth & Permissions, where the other
+        // token is, and needs a scope added in the dialog that generates it.
+        writeLine(streams.stdout, '  3. Click Next, then Create. You land on Basic Information — scroll down to');
+        writeLine(streams.stdout, '     App-Level Tokens and click Generate Token and Scopes (scope: connections:write)');
+        writeLine(streams.stdout, '  4. Sidebar → Install App → Install to your workspace → Allow, then copy');
+        writeLine(streams.stdout, '     the Bot User OAuth Token — it starts with xoxb-');
         writeLine(streams.stdout, `  5. Basic Information → Display Information → upload ${agentName}'s avatar`);
         writeLine(streams.stdout);
-        const appToken = await prompter.askSecret('Paste the app-level token (xapp-…, Enter to cancel; input is hidden): ');
+        const appToken = await prompter.askSecret('Paste the app-level token from step 3 (xapp-…, Enter to cancel; input is hidden): ');
         if (!appToken) {
             writeLine(streams.stdout, 'Cancelled — nothing was saved.');
             return;
         }
         if (!appToken.startsWith('xapp-')) {
-            writeLine(streams.stdout, '✗ That does not look like an app-level token (they start with xapp-). Nothing was saved.');
+            writeLine(streams.stdout, '✗ That does not look like an app-level token (they start with xapp-, and live under Basic Information → App-Level Tokens, not OAuth & Permissions). Nothing was saved.');
             return;
         }
-        const botToken = await prompter.askSecret('Paste the bot user OAuth token (xoxb-…, Enter to cancel; input is hidden): ');
+        const botToken = await prompter.askSecret('Paste the Bot User OAuth Token from step 4 (xoxb-…, Enter to cancel; input is hidden): ');
         if (!botToken) {
             writeLine(streams.stdout, 'Cancelled — nothing was saved.');
             return;
@@ -860,7 +875,7 @@ export const runSetup = async (command, streams, env = {}) => {
         }
         const app = await verifySlackAppToken(appToken, fetchImpl);
         if (app.status === 'rejected') {
-            writeLine(streams.stdout, `✗ Slack rejected the app-level token (${app.detail}). Nothing was saved — check it has the connections:write scope.`);
+            writeLine(streams.stdout, `✗ Slack rejected the app-level token (${app.detail}). Nothing was saved — generate a new one under Basic Information → App-Level Tokens with the connections:write scope.`);
             return;
         }
         const slack = { ...(state.channels.slack ?? {}) };
@@ -1162,6 +1177,7 @@ export const runSetup = async (command, streams, env = {}) => {
                 // The qualified form the loader stages them under, which is what a
                 // `skills:` entry has to match.
                 skills: manifest.contributes.skills.map((skill) => `${manifest.packageName}:${skill.id}`),
+                channels: manifest.contributes.channels.map((channel) => channel.name),
             };
         }
         catch {
@@ -1932,7 +1948,159 @@ export const runSetup = async (command, streams, env = {}) => {
             state.approvals = { ...(state.approvals ?? {}), mode: 'remote', agents };
         }
     };
+    /**
+     * The channel kinds the enabled plugins declare, Slack's own aside, each
+     * with the config key of every plugin declaring it — from manifests,
+     * never by loading a package, as the Plugins row reads them. Every one,
+     * not the first: two plugins may carry the same kind for different agents
+     * (channels key on agent and kind), and an agent bound by the second one's
+     * config is as bound as one bound by the first's.
+     */
+    const pluginChannelKinds = async () => {
+        const kinds = [];
+        for (const name of pluginPackages()) {
+            if (!pluginEnabled(name)) {
+                continue;
+            }
+            for (const kind of (await pluginContributions(name))?.channels ?? []) {
+                if (kind === 'slack') {
+                    continue;
+                }
+                const entry = kinds.find((candidate) => candidate.kind === kind);
+                if (entry === undefined) {
+                    kinds.push({ kind, plugins: [name] });
+                }
+                else if (!entry.plugins.includes(name)) {
+                    entry.plugins.push(name);
+                }
+            }
+        }
+        return kinds;
+    };
+    /**
+     * Slack alone, as it always was, until a plugin declares a channel: then
+     * the row asks which channel first. A setup with no channel plugin sees
+     * exactly the screens it saw before there could be one.
+     */
     const chooseChannels = async () => {
+        const kinds = await pluginChannelKinds();
+        if (kinds.length === 0) {
+            await chooseSlackChannel();
+            return;
+        }
+        while (true) {
+            const options = [
+                'Slack'.padEnd(20) + 'built in',
+                ...kinds.map(({ kind, plugins }) => kind.padEnd(20) + `from ${plugins.join(', ')}`),
+                'Back',
+            ];
+            const choice = await prompter.select('Channels', options);
+            if (choice.kind !== 'index' || choice.index === options.length - 1) {
+                return;
+            }
+            const picked = kinds[choice.index - 1];
+            if (picked === undefined) {
+                await chooseSlackChannel();
+            }
+            else {
+                await choosePluginChannel(picked.kind, picked.plugins);
+            }
+        }
+    };
+    /**
+     * One plugin channel's agents, and whether each is bound — by secrets
+     * stored under `channels.<kind>.<agentId>`, or by an entry under the
+     * plugin's own config `agents` block. Either is a binding: a channel that
+     * needs no secret (iMessage on this Mac) is bound by config alone, so a
+     * menu that knew only secrets would call it not connected.
+     *
+     * Setup stores secrets and never writes the plugin's config: which keys
+     * that block takes is the plugin's schema, which only its README states.
+     */
+    const choosePluginChannel = async (kind, plugins) => {
+        const secretsFor = async () => {
+            state.pluginChannelSecrets[kind] ??= await loadChannelTransportSecrets(env, kind);
+            return state.pluginChannelSecrets[kind];
+        };
+        while (true) {
+            const { entries: roster, loaded: rosterLoaded } = await channelRoster();
+            const stored = await secretsFor();
+            // Any plugin carrying this kind binds the agents its own block lists.
+            const inConfig = (id) => plugins.some((plugin) => {
+                const configured = state.plugins?.[plugin]?.agents;
+                return typeof configured === 'object' && configured !== null && !Array.isArray(configured) && Object.hasOwn(configured, id);
+            });
+            const options = roster.map((entry) => {
+                const id = entry.soul.agent.id;
+                const bindings = [
+                    ...(stored[id] !== undefined ? [`✓ secrets: ${Object.keys(stored[id]).sort().join(', ')}`] : []),
+                    ...(inConfig(id) ? ['✓ in its plugin config'] : []),
+                ];
+                return `${entry.soul.agent.name} (${id})`.padEnd(34) + (bindings.length > 0 ? bindings.join('; ') : '— not connected');
+            });
+            // Only against a roster that loaded, for the reason the Slack menu
+            // gives: an unreadable roster would make every binding look orphaned.
+            const orphans = rosterLoaded
+                ? Object.keys(stored).filter((id) => !roster.some((entry) => entry.soul.agent.id === id))
+                : [];
+            for (const id of orphans) {
+                options.push(`${id}`.padEnd(34) + '! secrets without a matching agent');
+            }
+            options.push('Back');
+            const blocks = plugins.map((plugin) => `plugins["${plugin}"].agents`).join(' or ');
+            const choice = await prompter.select(`Channels — ${kind} (from ${plugins.join(', ')})`, options, {
+                footnote: `Bound by secrets stored here, or by an entry under ${blocks} in your config — the plugin's README says which. Run \`${serveCommand()}\` afterwards.`,
+            });
+            if (choice.kind !== 'index' || choice.index === options.length - 1) {
+                return;
+            }
+            const agentId = choice.index < roster.length
+                ? roster[choice.index]?.soul.agent.id
+                : orphans[choice.index - roster.length];
+            if (agentId === undefined) {
+                return;
+            }
+            const actions = [
+                ...(choice.index < roster.length ? [stored[agentId] !== undefined ? 'Replace the stored secrets' : 'Store secrets'] : []),
+                ...(stored[agentId] !== undefined ? ['Remove the stored secrets'] : []),
+                'Back',
+            ];
+            const action = await prompter.select(`${agentId} on ${kind}`, actions);
+            if (action.kind !== 'index' || actions[action.index] === 'Back') {
+                continue;
+            }
+            if (actions[action.index] === 'Remove the stored secrets') {
+                delete stored[agentId];
+                state.pluginChannelEdits.push({ kind, agentId });
+                writeLine(streams.stdout, `Removed ${agentId}'s ${kind} secrets.`);
+                continue;
+            }
+            const names = (await prompter.ask(`Secret names for ${kind}, separated by spaces (its README lists them): `))
+                .split(/\s+/)
+                .filter((name) => name.length > 0);
+            if (names.length === 0) {
+                continue;
+            }
+            const bad = names.find((name, index) => !CREDENTIAL_NAME_PATTERN.test(name) || names.indexOf(name) !== index);
+            if (bad !== undefined) {
+                writeLine(streams.stderr, `${bad} is not a secret name, or is named twice. Nothing was stored.`);
+                continue;
+            }
+            const secrets = {};
+            for (const name of names) {
+                secrets[name] = await prompter.askSecret(`${name} (not echoed): `);
+            }
+            const empty = names.find((name) => (secrets[name] ?? '').length === 0);
+            if (empty !== undefined) {
+                writeLine(streams.stderr, `${empty} was empty, so nothing was stored. A binding missing a secret would never come online.`);
+                continue;
+            }
+            stored[agentId] = secrets;
+            state.pluginChannelEdits.push({ kind, agentId, secrets });
+            writeLine(streams.stdout, `Stored ${names.join(', ')} for ${agentId} on ${kind}; saved when you finish.`);
+        }
+    };
+    const chooseSlackChannel = async () => {
         while (true) {
             const { entries: roster, loaded: rosterLoaded } = await channelRoster();
             const slack = state.channels.slack ?? {};
@@ -2226,6 +2394,9 @@ export const runSetup = async (command, streams, env = {}) => {
         if (state.promptCacheTtl !== undefined) {
             config.promptCacheTtl = state.promptCacheTtl;
         }
+        if (state.language !== undefined) {
+            config.language = state.language;
+        }
         // `plugins` and `approvals` have menus above; `api`, `principals`, and
         // `slack` do not and are written back exactly as they were read. Both cases
         // land here the same way, because the menus edit this state rather
@@ -2290,6 +2461,19 @@ export const runSetup = async (command, streams, env = {}) => {
                 ? `Saved Slack tokens for ${connected} agent${connected === 1 ? '' : 's'} to ${credentialsPath(env)} — run \`${serveCommand()}\` to bring them online.`
                 : `Removed the stored Slack tokens from ${credentialsPath(env)}.`);
         }
+        if (state.pluginChannelEdits.length > 0) {
+            // In the order they were made, so a store then a remove of the same
+            // binding ends removed, as the menu last showed it.
+            for (const edit of state.pluginChannelEdits) {
+                if (edit.secrets !== undefined) {
+                    await saveChannelTransportSecrets(env, edit.kind, edit.agentId, edit.secrets);
+                }
+                else {
+                    await removeChannelTransportSecrets(env, edit.kind, edit.agentId);
+                }
+            }
+            writeLine(streams.stdout, `Saved your channel secrets to ${credentialsPath(env)} — run \`${serveCommand()}\` to bring them online.`);
+        }
         // Before the service block below, deliberately. A package installed
         // after the daemon starts is invisible to it — installing does not
         // reload a running process — so offering here is what makes the
@@ -2427,12 +2611,13 @@ export const runSetup = async (command, streams, env = {}) => {
             // corrupts every redraw after the first arrow key. Wrapping is not
             // the cosmetic cost I took it for when I let this line grow.
             const approvals = fitMenuRow((await approvalsSummary()).join('; '));
+            const channelKinds = (await pluginChannelKinds()).map((entry) => entry.kind);
             const choice = await prompter.select('', [
                 `Providers            ${providersSummary()}`,
                 `Models               ${modelsSummary()}`,
                 `Agent                ${agentSummary()}`,
                 `Plugins              ${fitMenuRow(pluginsSummary())}`,
-                `Channels             ${channelsSummary()}`,
+                `Channels             ${fitMenuRow(channelsSummary(channelKinds))}`,
                 `Approvals            ${approvals}`,
                 `Always on            ${serviceSummary()}`,
                 'Test run             say hello with the current settings',