@sudoji/cli 0.1.0

package/dist/chunk-RWRJASDG.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+
+export {
+  __require,
+  __esm,
+  __commonJS
+};

package/dist/index.js

@@ -0,0 +1,493 @@
+#!/usr/bin/env node
+import "./chunk-RWRJASDG.js";
+
+// src/index.ts
+import { Command as Command7 } from "commander";
+
+// src/commands/login.ts
+import { Command } from "commander";
+import { createInterface } from "readline/promises";
+import { stdin, stdout } from "process";
+import { isSudojiKey } from "@sudoji/core";
+
+// src/auth/credentials.ts
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from "fs";
+import { join, dirname } from "path";
+import { homedir } from "os";
+var SERVICE = "sudoji";
+async function tryKeytar() {
+  if (process.env["SUDOJI_NO_KEYCHAIN"]) return null;
+  try {
+    const k = await import("./keytar-2QOTTVWZ.js");
+    const mod = "default" in k ? k.default : k;
+    return mod ?? null;
+  } catch {
+    return null;
+  }
+}
+function sudojiDir() {
+  return process.env["SUDOJI_HOME"] ?? join(homedir(), ".sudoji");
+}
+function filePath(profile) {
+  const suffix = profile === "default" ? "" : `.${profile}`;
+  return join(sudojiDir(), `credentials${suffix}`);
+}
+function ensureDir(path) {
+  mkdirSync(dirname(path), { recursive: true });
+}
+function readFile(path) {
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeFile(path, creds) {
+  ensureDir(path);
+  writeFileSync(path, JSON.stringify(creds), { mode: 384 });
+  chmodSync(path, 384);
+}
+async function store(creds, profile = "default") {
+  const keytar = await tryKeytar();
+  if (keytar) {
+    await keytar.setPassword(SERVICE, profile, JSON.stringify(creds));
+    return;
+  }
+  writeFile(filePath(profile), creds);
+}
+async function load(profile = "default") {
+  const keytar = await tryKeytar();
+  if (keytar) {
+    const raw = await keytar.getPassword(SERVICE, profile);
+    if (!raw) return null;
+    try {
+      return JSON.parse(raw);
+    } catch {
+      return null;
+    }
+  }
+  return readFile(filePath(profile));
+}
+async function clear(profile = "default") {
+  const keytar = await tryKeytar();
+  if (keytar) {
+    await keytar.deletePassword(SERVICE, profile);
+    return;
+  }
+  const path = filePath(profile);
+  if (existsSync(path)) {
+    writeFileSync(path, "{}", { mode: 384 });
+  }
+}
+
+// src/commands/login.ts
+function loginCommand() {
+  return new Command("login").description("Authenticate the Sudoji CLI with an API key").option("--paste <key>", "Accept a key directly \u2014 useful for CI and scripting").option("--profile <name>", "Credentials profile to store the key under", "default").action(async (opts) => {
+    let key;
+    if (opts.paste) {
+      key = opts.paste.trim();
+    } else {
+      console.log("1. Open https://sudoji.io/dashboard/settings");
+      console.log("2. Create a new API key (read scope is enough for `sudoji ask`)");
+      console.log("3. Paste the key below:");
+      const rl = createInterface({ input: stdin, output: stdout });
+      key = (await rl.question("\nAPI key: ")).trim();
+      rl.close();
+    }
+    if (!isSudojiKey(key)) {
+      console.error('Invalid key \u2014 keys start with "sudoji_sk_" and are at least 26 characters.');
+      process.exit(1);
+    }
+    await store(key, opts.profile);
+    console.log(`
+Logged in. Key stored for profile "${opts.profile}".`);
+    console.log("Run:  sudoji doctor  to verify the connection.");
+  });
+}
+
+// src/commands/logout.ts
+import { Command as Command2 } from "commander";
+function logoutCommand() {
+  return new Command2("logout").description("Remove stored credentials for a profile").option("--profile <name>", "Credentials profile to clear", "default").action(async (opts) => {
+    await clear(opts.profile);
+    console.log(`Credentials cleared for profile "${opts.profile}".`);
+  });
+}
+
+// src/commands/doctor.ts
+import { Command as Command3 } from "commander";
+import { isSudojiKey as isSudojiKey2, redact } from "@sudoji/core";
+
+// src/config/load.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
+import { homedir as homedir2 } from "os";
+import { SettingsSchema, LOCKABLE_FIELDS } from "@sudoji/core";
+function tryReadJson(path) {
+  if (!existsSync2(path)) return {};
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function deepMerge(base, over) {
+  const result = { ...base };
+  for (const [k, v] of Object.entries(over)) {
+    const b = base[k];
+    if (typeof v === "object" && v !== null && !Array.isArray(v) && typeof b === "object" && b !== null && !Array.isArray(b)) {
+      result[k] = deepMerge(b, v);
+    } else {
+      result[k] = v;
+    }
+  }
+  return result;
+}
+function getAt(obj, path) {
+  let cur = obj;
+  for (const key of path) {
+    if (typeof cur !== "object" || cur === null) return void 0;
+    cur = cur[key];
+  }
+  return cur;
+}
+function setAt(obj, path, value) {
+  const [head, ...rest] = path;
+  if (head === void 0) return obj;
+  if (rest.length === 0) return { ...obj, [head]: value };
+  const child = obj[head] ?? {};
+  return { ...obj, [head]: setAt(child, rest, value) };
+}
+function enforceOrgLock(merged, org) {
+  let result = merged;
+  const orgDeny = getAt(org, ["permissions", "deny"]) ?? [];
+  if (orgDeny.length > 0) {
+    const currentDeny = getAt(result, ["permissions", "deny"]) ?? [];
+    result = setAt(result, ["permissions", "deny"], [.../* @__PURE__ */ new Set([...orgDeny, ...currentDeny])]);
+  }
+  for (const field of LOCKABLE_FIELDS) {
+    if (field === "permissions.deny") continue;
+    const parts = field.split(".");
+    const orgVal = getAt(org, parts);
+    if (orgVal !== void 0) {
+      result = setAt(result, parts, orgVal);
+    }
+  }
+  return result;
+}
+function loadSettings(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  const orgPath = opts.orgPath ?? "/etc/sudoji/managed.json";
+  const userPath = opts.userPath ?? join2(homedir2(), ".sudoji", "settings.json");
+  const org = tryReadJson(orgPath);
+  const user = tryReadJson(userPath);
+  const project = tryReadJson(join2(cwd, ".sudoji", "settings.json"));
+  const projectLocal = tryReadJson(join2(cwd, ".sudoji", "settings.local.json"));
+  let merged = deepMerge(org, user);
+  merged = deepMerge(merged, project);
+  merged = deepMerge(merged, projectLocal);
+  merged = enforceOrgLock(merged, org);
+  return SettingsSchema.parse(merged);
+}
+
+// src/commands/doctor.ts
+function doctorCommand() {
+  return new Command3("doctor").description("Verify auth, connectivity, settings, and redaction").option("--profile <name>", "Credentials profile to check", "default").option("--server <url>", "Override API base URL for this check").action(async (opts) => {
+    const checks = [];
+    const key = await load(opts.profile);
+    const keyOk = key !== null && isSudojiKey2(key);
+    checks.push({
+      label: "API key stored",
+      ok: keyOk,
+      detail: keyOk ? `${key.slice(0, 18)}\u2026` : `no key for profile "${opts.profile}" \u2014 run: sudoji login`
+    });
+    let settings = null;
+    try {
+      settings = loadSettings();
+      checks.push({ label: "Settings loaded", ok: true, detail: `apiBaseUrl: ${settings.apiBaseUrl}` });
+    } catch (err) {
+      checks.push({ label: "Settings loaded", ok: false, detail: String(err) });
+    }
+    const baseUrl = opts.server ?? settings?.apiBaseUrl ?? "https://api.sudoji.io";
+    try {
+      const res = await fetch(`${baseUrl}/healthz`, { signal: AbortSignal.timeout(5e3) });
+      checks.push({
+        label: "API reachable",
+        ok: res.ok,
+        detail: `${baseUrl}/healthz \u2192 HTTP ${res.status}`
+      });
+    } catch (err) {
+      checks.push({
+        label: "API reachable",
+        ok: false,
+        detail: `${baseUrl}/healthz \u2014 ${err instanceof Error ? err.message : err}`
+      });
+    }
+    const testInput = "password=super$ecret TOKEN=abc123 STRIPE_KEY=sk_live_xxx";
+    const testRedacted = redact(testInput);
+    const redactionWorking = !testRedacted.includes("super$ecret") && !testRedacted.includes("abc123");
+    checks.push({
+      label: "Redaction active",
+      ok: redactionWorking,
+      detail: `"${testInput.slice(0, 20)}\u2026" \u2192 "${testRedacted.slice(0, 30)}\u2026"`
+    });
+    const ok = (c) => c.ok ? "\u2713" : "\u2717";
+    for (const c of checks) {
+      console.log(`  ${ok(c)}  ${c.label}${c.detail ? `
+       ${c.detail}` : ""}`);
+    }
+    const allOk = checks.every((c) => c.ok);
+    if (allOk) {
+      console.log("\nAll checks passed.");
+    } else {
+      console.log("\nSome checks failed \u2014 see above.");
+      process.exit(1);
+    }
+  });
+}
+
+// src/commands/ask.ts
+import { Command as Command4 } from "commander";
+
+// src/context/gather.ts
+import { execSync } from "child_process";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { join as join3 } from "path";
+import os from "os";
+import { redact as redact2 } from "@sudoji/core";
+function tryExec(cmd, cwd, timeout = 4e3) {
+  try {
+    return execSync(cmd, { encoding: "utf8", cwd, timeout }).trim();
+  } catch {
+    return void 0;
+  }
+}
+function gatherContext(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  const maxLogLines = opts.maxLogLines ?? 200;
+  const maxFileBytes = opts.maxFileBytes ?? 8192;
+  const versions = { node: process.version };
+  const npmVer = tryExec("npm --version");
+  if (npmVer) versions["npm"] = npmVer;
+  let git;
+  const branch = tryExec("git branch --show-current", cwd);
+  const status = tryExec("git status --short", cwd);
+  if (branch !== void 0 || status !== void 0) {
+    git = redact2(`branch: ${branch ?? "unknown"}
+${status ?? ""}`);
+  }
+  const files = {};
+  const pkgPath = join3(cwd, "package.json");
+  if (existsSync3(pkgPath)) {
+    try {
+      const raw = readFileSync3(pkgPath, "utf8").slice(0, maxFileBytes);
+      files["package.json"] = redact2(raw);
+    } catch {
+    }
+  }
+  const lastStderr = process.env["SUDOJI_LAST_STDERR"];
+  const lastExitEnv = process.env["SUDOJI_LAST_EXIT"];
+  let logs;
+  if (lastStderr) {
+    const trimmed = lastStderr.split("\n").slice(-maxLogLines).join("\n");
+    logs = redact2(trimmed);
+  }
+  return {
+    cwd,
+    os: `${os.platform()} ${os.release()} (${os.arch()})`,
+    shell: process.env["SHELL"],
+    versions,
+    git,
+    lastExitCode: lastExitEnv ? parseInt(lastExitEnv, 10) : void 0,
+    logs: logs || void 0,
+    files: Object.keys(files).length > 0 ? files : void 0
+  };
+}
+
+// src/client.ts
+async function* readSSELines(res) {
+  const reader = res.body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    buffer += decoder.decode(value, { stream: true });
+    const parts = buffer.split("\n\n");
+    buffer = parts.pop() ?? "";
+    for (const part of parts) {
+      for (const line of part.split("\n")) {
+        if (line.startsWith("data: ")) {
+          yield line.slice(6);
+        }
+      }
+    }
+  }
+  for (const line of buffer.split("\n")) {
+    if (line.startsWith("data: ")) yield line.slice(6);
+  }
+}
+async function* streamAgent(baseUrl, request, token) {
+  let res;
+  try {
+    res = await fetch(`${baseUrl}/v1/agent`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`
+      },
+      body: JSON.stringify(request)
+    });
+  } catch (err) {
+    throw new Error(
+      `Cannot reach ${baseUrl} \u2014 is the agent service running?
+${err instanceof Error ? err.message : err}`
+    );
+  }
+  if (!res.ok) {
+    const body = await res.json().catch(() => ({ error: res.statusText }));
+    throw new Error(`Agent API ${res.status}: ${body.error ?? res.statusText}`);
+  }
+  for await (const data of readSSELines(res)) {
+    if (!data.trim()) continue;
+    try {
+      yield JSON.parse(data);
+    } catch {
+    }
+  }
+}
+
+// src/commands/ask.ts
+function askCommand() {
+  return new Command4("ask").description("Ask Sudoji Agent a question about your server").argument("[question...]", "Question to ask (reads from stdin if omitted)").option("--no-context", "Skip automatic context gathering").option("--mode <mode>", "Agent mode: diagnose | suggest | fix", "diagnose").option("--max-steps <n>", "Maximum agent steps", "20").option("--server <url>", "Override API base URL").option("--profile <name>", "Credentials profile", "default").option("--json", "Emit events as newline-delimited JSON instead of plain text").action(async (questionParts, opts) => {
+    const question = questionParts.join(" ").trim();
+    if (!question) {
+      console.error('Usage: sudoji ask "why is nginx not starting?"');
+      process.exit(1);
+    }
+    const key = await load(opts.profile);
+    if (!key) {
+      console.error("Not logged in. Run:  sudoji login");
+      process.exit(1);
+    }
+    const settings = loadSettings();
+    const baseUrl = opts.server ?? settings.apiBaseUrl;
+    const context = opts.context ? gatherContext({ maxLogLines: settings.context.maxLogLines, maxFileBytes: settings.context.maxFileBytes }) : { cwd: process.cwd(), os: process.platform };
+    const stream = streamAgent(
+      baseUrl,
+      {
+        message: question,
+        mode: opts.mode,
+        context,
+        maxSteps: Math.min(parseInt(opts.maxSteps, 10), 50)
+      },
+      key
+    );
+    if (!opts.json) process.stdout.write("\n");
+    for await (const event of stream) {
+      if (opts.json) {
+        console.log(JSON.stringify(event));
+        continue;
+      }
+      if (event.type === "text-delta") process.stdout.write(event.text);
+      if (event.type === "final") process.stdout.write("\n");
+      if (event.type === "error") {
+        console.error(`
+[${event.code}] ${event.message}`);
+        process.exit(1);
+      }
+    }
+  });
+}
+
+// src/commands/logs.ts
+import { Command as Command5 } from "commander";
+import { execSync as execSync2 } from "child_process";
+import { redact as redact3 } from "@sudoji/core";
+function fetchLogs(opts) {
+  const n = parseInt(opts.tail, 10);
+  switch (opts.source) {
+    case "pm2": {
+      const unit = opts.unit ?? "all";
+      return execSync2(`pm2 logs ${unit} --nostream --lines ${n}`, { encoding: "utf8", timeout: 1e4 });
+    }
+    case "systemd": {
+      const unit = opts.unit ? `-u ${opts.unit}` : "";
+      const window = opts.since ? `--since "${opts.since}"` : `-n ${n}`;
+      return execSync2(`journalctl ${unit} ${window} --no-pager --output=short`, { encoding: "utf8", timeout: 1e4 });
+    }
+    case "file": {
+      if (!opts.file) throw new Error("--file <path> is required when --source=file");
+      return execSync2(`tail -n ${n} "${opts.file}"`, { encoding: "utf8", timeout: 5e3 });
+    }
+    default:
+      throw new Error(`Unknown source "${opts.source}". Use pm2 | systemd | file.`);
+  }
+}
+function logsCommand() {
+  return new Command5("logs").description("Fetch and analyse logs from pm2, systemd, or a file").option("--source <type>", "Log source: pm2 | systemd | file", "systemd").option("--unit <name>", "pm2 app name or systemd unit (e.g. nginx)").option("--tail <n>", "Lines to fetch", "100").option("--since <time>", 'Time expression, e.g. "2 hours ago" (systemd only)').option("--file <path>", "Path to a log file (--source=file)").option("--ask <question>", "Question to ask about the logs", "Analyse these logs and identify any errors, warnings, or anomalies.").option("--server <url>", "Override API base URL").option("--profile <name>", "Credentials profile", "default").action(async (opts) => {
+    let raw;
+    try {
+      raw = fetchLogs(opts);
+    } catch (err) {
+      console.error(`Failed to fetch logs: ${err instanceof Error ? err.message : err}`);
+      process.exit(1);
+    }
+    const redacted = redact3(raw);
+    const message = `${opts.ask}
+
+<logs source="${opts.source}">
+${redacted}
+</logs>`;
+    const key = await load(opts.profile);
+    if (!key) {
+      console.error("Not logged in. Run:  sudoji login");
+      process.exit(1);
+    }
+    const settings = loadSettings();
+    const baseUrl = opts.server ?? settings.apiBaseUrl;
+    const context = gatherContext();
+    context.logs = redacted;
+    const stream = streamAgent(baseUrl, { message, mode: "diagnose", context, maxSteps: 10 }, key);
+    process.stdout.write("\n");
+    for await (const event of stream) {
+      if (event.type === "text-delta") process.stdout.write(event.text);
+      if (event.type === "final") process.stdout.write("\n");
+      if (event.type === "error") {
+        console.error(`
+Error: ${event.message}`);
+        process.exit(1);
+      }
+    }
+  });
+}
+
+// src/commands/keys.ts
+import { Command as Command6 } from "commander";
+function keysCommand() {
+  const keys = new Command6("keys").description("Manage Sudoji Agent API keys");
+  keys.command("list").description("List your API keys (opens the dashboard)").action(() => {
+    console.log("Open https://sudoji.io/dashboard/settings to manage your API keys.");
+    console.log("Key management via the CLI is available in a future release.");
+  });
+  keys.command("create").description("Create a new API key (opens the dashboard)").action(() => {
+    console.log("Open https://sudoji.io/dashboard/settings to create an API key.");
+    console.log("Paste the key with:  sudoji login --paste <key>");
+  });
+  keys.command("revoke <id>").description("Revoke an API key (opens the dashboard)").action(() => {
+    console.log("Open https://sudoji.io/dashboard/settings to revoke a key.");
+  });
+  return keys;
+}
+
+// src/index.ts
+var program = new Command7().name("sudoji").description("Sudoji Agent \u2014 AI-powered IT operations for Linux servers").version("0.1.0", "--version", "print version and exit");
+program.addCommand(loginCommand());
+program.addCommand(logoutCommand());
+program.addCommand(doctorCommand());
+program.addCommand(askCommand());
+program.addCommand(logsCommand());
+program.addCommand(keysCommand());
+program.parse(process.argv);

package/dist/keytar-2QOTTVWZ.js

@@ -0,0 +1,65 @@
+#!/usr/bin/env node
+import {
+  __commonJS,
+  __esm,
+  __require
+} from "./chunk-RWRJASDG.js";
+
+// ../../node_modules/keytar/build/Release/keytar.node
+var keytar_default;
+var init_keytar = __esm({
+  "../../node_modules/keytar/build/Release/keytar.node"() {
+    keytar_default = "./keytar-VMICNFEJ.node";
+  }
+});
+
+// node-file:/home/azureuser/sudoji-agent/node_modules/keytar/build/Release/keytar.node
+var require_keytar = __commonJS({
+  "node-file:/home/azureuser/sudoji-agent/node_modules/keytar/build/Release/keytar.node"(exports, module) {
+    "use strict";
+    init_keytar();
+    try {
+      module.exports = __require(keytar_default);
+    } catch {
+    }
+  }
+});
+
+// ../../node_modules/keytar/lib/keytar.js
+var require_keytar2 = __commonJS({
+  "../../node_modules/keytar/lib/keytar.js"(exports, module) {
+    var keytar = require_keytar();
+    function checkRequired(val, name) {
+      if (!val || val.length <= 0) {
+        throw new Error(name + " is required.");
+      }
+    }
+    module.exports = {
+      getPassword: function(service, account) {
+        checkRequired(service, "Service");
+        checkRequired(account, "Account");
+        return keytar.getPassword(service, account);
+      },
+      setPassword: function(service, account, password) {
+        checkRequired(service, "Service");
+        checkRequired(account, "Account");
+        checkRequired(password, "Password");
+        return keytar.setPassword(service, account, password);
+      },
+      deletePassword: function(service, account) {
+        checkRequired(service, "Service");
+        checkRequired(account, "Account");
+        return keytar.deletePassword(service, account);
+      },
+      findPassword: function(service) {
+        checkRequired(service, "Service");
+        return keytar.findPassword(service);
+      },
+      findCredentials: function(service) {
+        checkRequired(service, "Service");
+        return keytar.findCredentials(service);
+      }
+    };
+  }
+});
+export default require_keytar2();

package/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@sudoji/cli",
+  "version": "0.1.0",
+  "description": "Sudoji installable IT agent CLI — diagnose, approve, fix on your Linux server.",
+  "type": "module",
+  "bin": {
+    "sudoji": "./dist/index.js"
+  },
+  "files": ["dist"],
+  "scripts": {
+    "build": "tsup && chmod +x dist/index.js",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@sudoji/core": "*",
+    "commander": "^12.0.0"
+  },
+  "devDependencies": {
+    "tsup": "^8.0.0",
+    "typescript": "^5.4.0",
+    "vitest": "^1.6.0"
+  },
+  "optionalDependencies": {
+    "keytar": "^7.9.0"
+  },
+  "engines": {
+    "node": ">=18"
+  }
+}