@tiangong-ai/cli 0.0.27 → 0.0.29

package/dist/research/workspace/setup.js

@@ -7,8 +7,8 @@ import { setTimeout as sleep } from "node:timers/promises";
 import { CliError } from "../../errors.js";
 import { loadCapabilityDeclarations } from "./capabilities.js";
 import { inspectResearchContext } from "./context.js";
-import { inspectCapabilityCredentialEnvironment, setCapabilityCredentialFromEnvironment, } from "./credentials.js";
-import { configureExternalSkillProfile, configureTiangongSciCapability, doctorExternalCapabilities, EXTERNAL_SKILL_CONTEXT_PROFILE, EXTERNAL_SKILL_MEDIA_PROFILE, EXTERNAL_SKILL_PROFILE, } from "./external-skills.js";
+import { inspectCapabilityCredentialEnvironment, loadCapabilityCredentialMapForIds, reconcileCapabilityCredentialEnvironment, setCapabilityCredentialValue, } from "./credentials.js";
+import { configureExternalSkillProfile, configureTiangongSciCapability, doctorExternalCapabilities, EXTERNAL_SKILL_CONTEXT_PROFILE, EXTERNAL_SKILL_MEDIA_PROFILE, EXTERNAL_SKILL_PROFILE, reconcileSetupManagedCapabilities, } from "./external-skills.js";
 import { appendJournalEvent } from "./journal.js";
 import { configuredResearchSecrets, isSensitiveEnvironmentName, sanitizeResearchRecord, sanitizeResearchText, } from "./sanitization.js";
 import { inspectResearchSetupCatalog, RESEARCH_SETUP_CREDENTIALS, RESEARCH_SETUP_INSTALLER, RESEARCH_SETUP_SETTINGS, RESEARCH_SETUP_SKILLS, resolveSetupSkills, setupSkill, setupSource, setupTargetRoot, } from "./setup-catalog.js";
@@ -162,7 +162,7 @@ export async function createResearchSetupPlan(input) {
             globalMutation: scope === "global",
             agentSmokeCost: input.agentSmoke === true,
         },
-        mutations: setupMutations(root, targets, selected, credentialSources),
+        mutations: setupMutations(root, targets, selected),
     };
     const plan = {
         ...unsigned,
@@ -312,6 +312,12 @@ export async function applyResearchSetupPlan(planPath, options = {}) {
         state = await startSetupStep(root, state, "credential-preflight");
         await assertRequiredCredentialPreflight(plan, environment);
         state = await completeSetupStep(root, state, "credential-preflight");
+        // Persist an explicitly supplied credential before any installer or source
+        // download. A later installation failure can then resume from the immutable
+        // plan without asking the operator to expose the value again.
+        state = await startSetupStep(root, state, "credentials");
+        await configurePlanCredentials(plan, environment);
+        state = await completeSetupStep(root, state, "credentials");
         state = await startSetupStep(root, state, "installation-preflight");
         const selected = plan.selection.skillIds.map(setupSkill);
         const installInspection = await inspectSelectedInstallations(plan, selected, environment);
@@ -381,6 +387,7 @@ export async function applyResearchSetupPlan(planPath, options = {}) {
         }
         state = await startSetupStep(root, state, "capability-configuration");
         await configureSelectedCapabilities(plan, environment);
+        await reconcilePlanCredentialStores(plan);
         state = await completeSetupStep(root, state, "capability-configuration");
         state = await startSetupStep(root, state, "settings");
         await writeJsonAtomic(paths.setupConfig, {
@@ -391,9 +398,6 @@ export async function applyResearchSetupPlan(planPath, options = {}) {
             updatedAt: new Date().toISOString(),
         });
         state = await completeSetupStep(root, state, "settings");
-        state = await startSetupStep(root, state, "credentials");
-        await configurePlanCredentials(plan, environment);
-        state = await completeSetupStep(root, state, "credentials");
         await appendJournalEvent(paths.journal, "research.setup.applied", "workspace", {
             planSha256: plan.planSha256,
             selectedSkillIds: plan.selection.skillIds,
@@ -425,6 +429,7 @@ export async function applyResearchSetupPlan(planPath, options = {}) {
             runner,
             ...(options.fetcher === undefined ? {} : { fetcher: options.fetcher }),
             ...(options.sleeper === undefined ? {} : { sleeper: options.sleeper }),
+            ...(options.executor === undefined ? {} : { executor: options.executor }),
         });
         state = await updateSetupState(root, {
             ...state,
@@ -498,19 +503,7 @@ export async function inspectResearchSetupStatus(workspace, environment = proces
 }
 export async function setResearchSetupCredentialFromEnvironment(input) {
     const root = requireAbsoluteWorkspace(input.workspace);
-    const plan = await loadAndVerifyResearchSetupPlan(workspacePaths(root).setupPlan);
-    const selected = selectedCredentialDefinitions(plan);
-    const credential = selected.find((candidate) => candidate.id === input.credentialId);
-    if (!credential) {
-        throw setupError({
-            code: "RESEARCH_SETUP_CREDENTIAL_INVALID",
-            step: "credentials",
-            reason: `Credential is not declared by the selected setup plan: ${input.credentialId}.`,
-            minimumAction: "Inspect the setup catalog and selected plan credential IDs.",
-            retryCommand: `tiangong-ai research setup status --workspace ${root} --json`,
-            exitCode: 2,
-        });
-    }
+    const { credential } = await selectedSetupCredential(root, input.credentialId);
     assertEnvironmentName(input.environmentName);
     const value = input.environment[input.environmentName];
     if (typeof value !== "string" || Buffer.byteLength(value, "utf8") < credential.minimumUtf8Bytes) {
@@ -523,27 +516,85 @@ export async function setResearchSetupCredentialFromEnvironment(input) {
             exitCode: 3,
         });
     }
+    return persistResearchSetupCredential({
+        root,
+        credentialId: input.credentialId,
+        value,
+        inputMethod: "environment",
+        sourceEnvironmentName: input.environmentName,
+    });
+}
+export async function setResearchSetupCredentialValue(input) {
+    const root = requireAbsoluteWorkspace(input.workspace);
+    const { credential } = await selectedSetupCredential(root, input.credentialId);
+    if (Buffer.byteLength(input.value, "utf8") < credential.minimumUtf8Bytes) {
+        throw setupError({
+            code: "RESEARCH_SETUP_CREDENTIAL_INVALID",
+            step: "credentials",
+            reason: "Credential value is missing or does not meet the selected provider minimum.",
+            minimumAction: "Retry with secure input, stdin, or a configured owner environment variable.",
+            retryCommand: `tiangong-ai research setup credential set --id ${credential.id} --prompt --workspace ${root} --json`,
+            exitCode: 3,
+        });
+    }
+    return persistResearchSetupCredential({
+        root,
+        credentialId: input.credentialId,
+        value: input.value,
+        inputMethod: input.inputMethod,
+    });
+}
+async function selectedSetupCredential(root, credentialId) {
+    const plan = await loadAndVerifyResearchSetupPlan(workspacePaths(root).setupPlan);
+    const selected = selectedCredentialDefinitions(plan);
+    const credential = selected.find((candidate) => candidate.id === credentialId);
+    if (!credential) {
+        throw setupError({
+            code: "RESEARCH_SETUP_CREDENTIAL_INVALID",
+            step: "credentials",
+            reason: `Credential is not declared by the selected setup plan: ${credentialId}.`,
+            minimumAction: "Inspect the setup catalog and selected plan credential IDs.",
+            retryCommand: `tiangong-ai research setup status --workspace ${root} --json`,
+            exitCode: 2,
+        });
+    }
+    return { plan, selected, credential };
+}
+async function persistResearchSetupCredential(input) {
+    const { selected, credential } = await selectedSetupCredential(input.root, input.credentialId);
     if (credential.storage === "broker") {
-        const declarations = await loadCapabilityDeclarations(root);
-        await setCapabilityCredentialFromEnvironment({
-            root,
-            capabilities: declarations.capabilities,
+        const currentDeclarations = (await pathExists(workspacePaths(input.root).capabilityDeclarations))
+            ? await loadCapabilityDeclarations(input.root)
+            : { capabilities: [] };
+        await setCapabilityCredentialValue({
+            root: input.root,
+            declaredCredentialIds: [
+                ...new Set([
+                    ...currentDeclarations.capabilities.flatMap((capability) => capability.credentials.map((candidate) => candidate.id)),
+                    ...selected
+                        .filter((candidate) => candidate.storage === "broker")
+                        .map((candidate) => candidate.id),
+                ]),
+            ],
             credentialId: credential.id,
-            environmentName: input.environmentName,
-            environment: input.environment,
+            value: input.value,
+            minimumUtf8Bytes: credential.minimumUtf8Bytes,
         });
     }
     else {
-        await setAdapterCredential(root, selected, credential.id, value);
+        await setAdapterCredential(input.root, selected.filter((candidate) => candidate.storage === "adapter"), credential.id, input.value);
     }
-    await appendJournalEvent(workspacePaths(root).journal, "research.setup.credential.configured", "workspace", {
+    await appendJournalEvent(workspacePaths(input.root).journal, "research.setup.credential.configured", "workspace", {
         credentialId: credential.id,
-        sourceEnvironmentNameSha256: sha256Text(input.environmentName),
+        inputMethod: input.inputMethod,
+        ...(input.sourceEnvironmentName === undefined
+            ? {}
+            : { sourceEnvironmentNameSha256: sha256Text(input.sourceEnvironmentName) }),
         storage: credential.storage,
     });
     return {
         schemaVersion: 1,
-        workspace: root,
+        workspace: input.root,
         credentialId: credential.id,
         configured: true,
         storage: credential.storage,
@@ -693,11 +744,13 @@ export async function doctorResearchSetup(workspace, options = {}) {
         checks.push({
             id: `setting.${setting.id}`,
             category: "configuration",
-            status: configured ? "pass" : setting.required ? "fail" : "warn",
+            status: configured || !setting.required ? "pass" : "fail",
             detail: configured
                 ? "Declared non-secret setting is configured."
-                : "Setting is not configured.",
-            minimumAction: configured
+                : setting.required
+                    ? "Required setting is not configured."
+                    : "Optional setting was explicitly omitted.",
+            minimumAction: configured || !setting.required
                 ? null
                 : `Create a reviewed replacement plan with the ${setting.id} setting.`,
         });
@@ -736,13 +789,15 @@ export async function doctorResearchSetup(workspace, options = {}) {
         checks.push({
             id: `credential.${credential.id}`,
             category: "credential",
-            status: configured ? "pass" : credential.required ? "fail" : "warn",
+            status: configured || !credential.required ? "pass" : "fail",
             detail: configured
                 ? "Credential is present in an owner-only store; its value was not emitted."
-                : "Credential is not configured.",
-            minimumAction: configured
+                : credential.required
+                    ? "Required credential is not configured."
+                    : "Optional credential was explicitly omitted.",
+            minimumAction: configured || !credential.required
                 ? null
-                : `Run research setup credential set --id ${credential.id} --from-env <OWNER_ENV_NAME> --workspace ${root}.`,
+                : `Run research setup credential set --id ${credential.id} --prompt --workspace ${root}.`,
         });
     }
     await appendDependencyChecks(checks, selected, runner, root, environment);
@@ -784,15 +839,6 @@ export async function doctorResearchSetup(workspace, options = {}) {
             allowSyntheticUnstructureUpload: options.allowSyntheticUnstructureUpload === true,
         });
     }
-    else {
-        checks.push({
-            id: "live-provider-checks",
-            category: "live-check",
-            status: "warn",
-            detail: "Live provider checks were not requested.",
-            minimumAction: `Run tiangong-ai research setup doctor --live --workspace ${root} --json after reviewing quota impact.`,
-        });
-    }
     let workspaceDoctor = null;
     try {
         workspaceDoctor = await doctorResearchWorkspace(root, {
@@ -800,15 +846,23 @@ export async function doctorResearchSetup(workspace, options = {}) {
             capabilitySmoke: options.live === true,
             environment,
             capabilityFetcher: fetcher,
+            ...(options.executor === undefined ? {} : { executor: options.executor }),
         });
+        const requiredRuntimeChecks = options.agentSmoke === true || options.live === true;
+        const runtimeBlocked = workspaceDoctor.status !== "ready" && requiredRuntimeChecks;
+        const failedWorkspaceChecks = workspaceDoctor.checks
+            .filter((check) => check.status === "fail")
+            .map((check) => check.id);
         checks.push({
             id: "production-runtime",
             category: "research-runtime",
-            status: workspaceDoctor.status === "ready" ? "pass" : "warn",
+            status: workspaceDoctor.status === "ready" ? "pass" : runtimeBlocked ? "fail" : "warn",
             detail: `Workspace doctor reported ${workspaceDoctor.status}.`,
             minimumAction: workspaceDoctor.status === "ready"
                 ? null
-                : "Configure explicit production models/pricing and run the separately confirmed agent/capability smoke checks.",
+                : runtimeBlocked
+                    ? `Resolve the failed workspace doctor checks (${failedWorkspaceChecks.join(", ") || "unknown"}); an explicitly requested smoke failure blocks readiness.`
+                    : "Configure explicit production models/pricing and run the separately confirmed agent/capability smoke checks.",
         });
     }
     catch (error) {
@@ -820,6 +874,20 @@ export async function doctorResearchSetup(workspace, options = {}) {
             minimumAction: "Repair workspace runtime state, then rerun setup doctor.",
         });
     }
+    if (!options.live) {
+        const attestedCapabilitySmoke = workspaceDoctor?.checks.some((check) => check.id === "capability-live-smoke" && check.status === "pass");
+        checks.push({
+            id: "live-provider-checks",
+            category: "live-check",
+            status: attestedCapabilitySmoke ? "pass" : "warn",
+            detail: attestedCapabilitySmoke
+                ? "Reused the unexpired, runtime-bound capability smoke attestation."
+                : "Live provider checks were not requested and no reusable attestation is available.",
+            minimumAction: attestedCapabilitySmoke
+                ? null
+                : `Run tiangong-ai research setup doctor --live --workspace ${root} --json after reviewing quota impact.`,
+        });
+    }
     const readiness = checks.some((check) => check.status === "fail")
         ? "BLOCKED"
         : checks.some((check) => check.status === "warn")
@@ -1012,6 +1080,7 @@ function parseResearchSetupPlan(value) {
             typeof skill.expectedTreeSha256 !== "string" ||
             !/^[0-9a-f]{64}$/.test(skill.expectedTreeSha256) ||
             ![
+                "orchestrator",
                 "evidence-capability",
                 "input-preprocessor",
                 "acquisition-adapter",
@@ -1129,7 +1198,7 @@ function assertPlanMatchesCatalog(plan) {
     if (plan.checks.agentSmoke !== plan.confirmations.agentSmokeCost) {
         throw planCatalogDrift("agent smoke confirmation");
     }
-    const expectedMutations = setupMutations(plan.workspace.path, plan.install.targets, selected, plan.credentialSources);
+    const expectedMutations = setupMutations(plan.workspace.path, plan.install.targets, selected);
     if (canonicalJson(plan.mutations) !== canonicalJson(expectedMutations)) {
         throw planCatalogDrift("declared mutations");
     }
@@ -1668,11 +1737,9 @@ async function installSetupSkills(input) {
     }
 }
 async function configureSelectedCapabilities(plan, _environment) {
-    if (plan.selection.evidenceProfile === "none" &&
-        !plan.selection.skillIds.includes("tiangong.kb-sci-search")) {
-        return;
-    }
-    const codexRoot = plannedTargetRoot(plan, "codex");
+    const hasBraveProfile = plan.selection.evidenceProfile !== "none";
+    const hasTiangongSci = plan.selection.skillIds.includes("tiangong.kb-sci-search");
+    const codexRoot = hasBraveProfile || hasTiangongSci ? plannedTargetRoot(plan, "codex") : null;
     if (plan.selection.evidenceProfile !== "none") {
         await configureExternalSkillProfile({
             workspace: plan.workspace.path,
@@ -1680,7 +1747,7 @@ async function configureSelectedCapabilities(plan, _environment) {
             skillRoot: codexRoot,
         });
     }
-    if (plan.selection.skillIds.includes("tiangong.kb-sci-search")) {
+    if (hasTiangongSci) {
         const skill = setupSkill("tiangong.kb-sci-search");
         const source = setupSource(skill.sourceId);
         await configureTiangongSciCapability({
@@ -1700,6 +1767,47 @@ async function configureSelectedCapabilities(plan, _environment) {
                 : { region: plan.settings["tiangong.sci.region"] }),
         });
     }
+    await reconcileSetupManagedCapabilities({
+        workspace: plan.workspace.path,
+        selectedCapabilityIds: [
+            ...BRAVE_PROFILE_SKILLS[plan.selection.evidenceProfile].map(setupManagedCapabilityId),
+            ...(hasTiangongSci ? ["database.tiangong.sci-search"] : []),
+        ],
+    });
+}
+function setupManagedCapabilityId(skillId) {
+    const mapping = {
+        "brave.web-search": "method.brave.web-search",
+        "brave.news-search": "method.brave.news-search",
+        "brave.llm-context": "method.brave.llm-context",
+        "brave.images-search": "method.brave.images-search",
+        "brave.videos-search": "method.brave.videos-search",
+    };
+    const capabilityId = mapping[skillId] ?? null;
+    if (!capabilityId) {
+        throw setupError({
+            code: "RESEARCH_SETUP_CATALOG_DRIFT",
+            step: "capability-configuration",
+            reason: `Setup-managed evidence Skill has no capability mapping: ${skillId}.`,
+            minimumAction: "Use the exact CLI/catalog release and regenerate the setup plan.",
+            retryCommand: "tiangong-ai research setup catalog --json",
+            exitCode: 3,
+        });
+    }
+    return capabilityId;
+}
+async function reconcilePlanCredentialStores(plan) {
+    const declarations = await loadCapabilityDeclarations(plan.workspace.path);
+    await reconcileCapabilityCredentialEnvironment(plan.workspace.path, declarations.capabilities);
+    const adapterPath = workspacePaths(plan.workspace.path).setupAdapterEnv;
+    if (!(await pathExists(adapterPath)))
+        return;
+    const definitions = selectedCredentialDefinitions(plan).filter((credential) => credential.storage === "adapter");
+    const configured = await loadAdapterCredentials(plan.workspace.path, definitions, {
+        ignoreUndeclared: true,
+    });
+    const serialized = Object.fromEntries([...configured.entries()].sort(([left], [right]) => left.localeCompare(right)));
+    await writeTextAtomic(adapterPath, `${ADAPTER_ENV_KEY}=${JSON.stringify(serialized)}\n`, 0o600);
 }
 async function configurePlanCredentials(plan, environment) {
     for (const credential of plan.credentialSources) {
@@ -1723,22 +1831,16 @@ async function assertRequiredCredentialPreflight(plan, environment) {
     const definitions = selectedCredentialDefinitions(plan);
     let adapterCredentials = new Map();
     try {
-        adapterCredentials = await loadAdapterCredentials(plan.workspace.path, definitions);
+        adapterCredentials = await loadAdapterCredentials(plan.workspace.path, definitions, {
+            ignoreUndeclared: true,
+        });
     }
     catch (error) {
         if (error instanceof CliError)
             throw error;
     }
-    let configuredBrokerIds = new Set();
-    try {
-        const declarations = await loadCapabilityDeclarations(plan.workspace.path);
-        const status = await inspectCapabilityCredentialEnvironment(plan.workspace.path, declarations.capabilities);
-        configuredBrokerIds = new Set(status.configuredIds);
-    }
-    catch {
-        // A first apply has not configured capability declarations yet. The
-        // reviewed plan's environment mapping remains the only accepted source.
-    }
+    const brokerDefinitions = definitions.filter((definition) => definition.storage === "broker");
+    const configuredBrokerIds = new Set((await loadCapabilityCredentialMapForIds(plan.workspace.path, brokerDefinitions.map((definition) => definition.id), { ignoreUndeclared: true })).keys());
     const failures = [];
     for (const definition of definitions) {
         const planned = plan.credentialSources.find((candidate) => candidate.id === definition.id);
@@ -1749,10 +1851,7 @@ async function assertRequiredCredentialPreflight(plan, environment) {
             Buffer.byteLength(environment[planned.fromEnvironment] ?? "", "utf8") >=
                 definition.minimumUtf8Bytes;
         if ((!planned && definition.required && !stored) || (planned && !supplied && !stored)) {
-            failures.push({
-                id: definition.id,
-                environmentName: planned?.fromEnvironment ?? null,
-            });
+            failures.push({ id: definition.id });
         }
     }
     if (failures.length) {
@@ -1762,8 +1861,8 @@ async function assertRequiredCredentialPreflight(plan, environment) {
             reason: `Required or explicitly selected credentials are unavailable: ${failures
                 .map((failure) => failure.id)
                 .join(", ")}.`,
-            minimumAction: `Set the reviewed owner environment variables before any download (${failures
-                .map((failure) => `${failure.id}=${failure.environmentName ?? "<mapping-required>"}`)
+            minimumAction: `Configure each unavailable logical credential with research setup credential set --prompt, --from-stdin, or --from-env before any download (${failures
+                .map((failure) => failure.id)
                 .join(", ")}), then retry this exact step.`,
             retryCommand: `tiangong-ai research setup retry --step credential-preflight --workspace ${plan.workspace.path} --json`,
             exitCode: 3,
@@ -2211,7 +2310,7 @@ function companionArtifactError(root, reason) {
         exitCode: 3,
     });
 }
-async function loadAdapterCredentials(root, definitions) {
+async function loadAdapterCredentials(root, definitions, options = {}) {
     const path = workspacePaths(root).setupAdapterEnv;
     if (!(await pathExists(path)))
         return new Map();
@@ -2282,6 +2381,8 @@ async function loadAdapterCredentials(root, definitions) {
     const result = new Map();
     for (const [id, credentialValue] of Object.entries(value)) {
         const definition = allowed.get(id);
+        if (!definition && options.ignoreUndeclared)
+            continue;
         if (!definition ||
             typeof credentialValue !== "string" ||
             Buffer.byteLength(credentialValue, "utf8") < definition.minimumUtf8Bytes) {
@@ -2299,7 +2400,7 @@ async function loadAdapterCredentials(root, definitions) {
     return result;
 }
 async function setAdapterCredential(root, definitions, credentialId, value) {
-    const configured = await loadAdapterCredentials(root, definitions);
+    const configured = await loadAdapterCredentials(root, definitions, { ignoreUndeclared: true });
     configured.set(credentialId, value);
     const serialized = Object.fromEntries([...configured.entries()].sort(([left], [right]) => left.localeCompare(right)));
     await writeTextAtomic(workspacePaths(root).setupAdapterEnv, `${ADAPTER_ENV_KEY}=${JSON.stringify(serialized)}\n`, 0o600);
@@ -2498,7 +2599,7 @@ function validateSetupSetting(id, validation, value) {
         });
     }
 }
-function setupMutations(root, targets, selected, credentialSources) {
+function setupMutations(root, targets, selected) {
     const mutations = [
         {
             step: "workspace",
@@ -2515,27 +2616,21 @@ function setupMutations(root, targets, selected, credentialSources) {
             });
         }
     }
-    if (selected.some((skill) => skill.role === "evidence-capability")) {
-        mutations.push({
-            step: "capability-configuration",
-            target: workspacePaths(root).capabilityDeclarations,
-            reason: "Declare and lock the explicitly selected evidence capabilities.",
-        });
-    }
-    if (credentialSources.some((credential) => credential.storage === "broker")) {
-        mutations.push({
-            step: "credentials",
-            target: workspacePaths(root).env,
-            reason: "Store selected broker credentials in the owner-only workspace environment file.",
-        });
-    }
-    if (credentialSources.some((credential) => credential.storage === "adapter")) {
-        mutations.push({
-            step: "credentials",
-            target: workspacePaths(root).setupAdapterEnv,
-            reason: "Store selected companion-adapter credentials in an owner-only file.",
-        });
-    }
+    mutations.push({
+        step: "capability-configuration",
+        target: workspacePaths(root).capabilityDeclarations,
+        reason: "Reconcile and lock the explicitly selected setup-managed evidence capabilities while preserving custom declarations.",
+    });
+    mutations.push({
+        step: "credentials",
+        target: workspacePaths(root).env,
+        reason: "Reconcile selected broker credentials in the owner-only workspace environment file.",
+    });
+    mutations.push({
+        step: "credentials",
+        target: workspacePaths(root).setupAdapterEnv,
+        reason: "Reconcile selected companion-adapter credentials in an owner-only file.",
+    });
     return mutations.sort((left, right) => `${left.step}\0${left.target}`.localeCompare(`${right.step}\0${right.target}`));
 }
 function setupLockPayload(planSha256) {