@tiens.nguyen/gu-cli 1.0.764 → 1.0.765

package/client-expert-run.mjs

@@ -46,6 +46,9 @@ import {
   clientExpertAvailable,
   mongoInstallPlan,
   mongoDockerPlan,
+  buildMongoUri,
+  mongoShellPingCommand,
+  mongoAuthVerdict,
   MONGO_DOCKER_NAME,
 } from "./client-expert-setup.mjs";
 
@@ -299,6 +302,79 @@ export async function startMongoInDocker(ask, { platform = process.platform } =
   return false;
 }
 
+/**
+ * Does MongoDB accept THIS uri — credentials included? (task #15)
+ *
+ * Asks a mongo shell, because the shell is all that exists at this point in setup: the API
+ * package (and the mongodb driver inside it) is downloaded LATER. `mongosh` first, the legacy
+ * `mongo` shell second. When neither exists the answer is { ok: null, unverifiable: true } —
+ * honestly "cannot check", which is a different thing from "check failed": the seed step still
+ * verifies the URI for real before anything is written.
+ */
+export async function checkMongoConnection(uri) {
+  for (const shell of ["mongosh", "mongo"]) {
+    const has = await tryRun("sh", ["-c", `command -v ${shell} || true`]);
+    if (!has || !has.trim()) continue;
+    const out = await tryRun(shell, mongoShellPingCommand(uri), 12000);
+    return mongoAuthVerdict({ output: out });
+  }
+  return {
+    ok: null,
+    unverifiable: true,
+    why: "no mongo shell on this machine to check with — it will be verified for real " +
+      "when the database is seeded",
+  };
+}
+
+/**
+ * Confirm WHO the MongoDB on this machine belongs to, and collect credentials when it is not
+ * the one setup would have created (task #15).
+ *
+ * THE CASE: something is already answering on 27017 — a MongoDB the OS had before gu — and it
+ * has its OWN username/password, which we do not have admin access to. Seeding into it with
+ * the default empty credentials then fails two steps later, after a 360-package install, with
+ * a message about "a permissions or connection-string problem". The question belongs at the
+ * mongo step, where the answer is still cheap to change.
+ *
+ * Returns { uri, custom } to continue with, or { exit: true } when the user declines — the
+ * caller ends setup with the `gu clear` → `gu` hint.
+ */
+export async function askMongoCredentials(ask) {
+  const { host, port } = mongoHostPort(LOCAL_MONGO_URI);
+  console.log(dim(`  MongoDB is answering at ${host}:${port}.`));
+  console.log(dim("  If that is a MongoDB this machine already had, it may have its OWN"));
+  console.log(dim("  username and password — which setup does not know, and cannot change."));
+  const yes = await ask("  Use the default (empty username and password)? [Y/n]: ");
+  if (!String(yes ?? "").trim().toLowerCase().startsWith("n")) {
+    return { uri: LOCAL_MONGO_URI, custom: false };
+  }
+  // NO → the instance has its own credentials. Ask for them, and CHECK before any installing
+  // continues: a typo found here costs ten seconds; found at the seed step it costs the run.
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    const username = String(await ask("  MongoDB username: ") ?? "").trim();
+    const password = String(await ask("  MongoDB password: ") ?? "");
+    const uri = buildMongoUri({ username, password, host, port });
+    process.stdout.write(dim("  checking the connection…"));
+    const verdict = await checkMongoConnection(uri);
+    if (verdict.ok === true) {
+      console.log("\n  " + cyan("✓ Connection OK") + dim(" — those credentials work"));
+      return { uri, custom: true };
+    }
+    if (verdict.unverifiable) {
+      console.log("\n  " + yellow("⚠ could not verify: ") + dim(verdict.why));
+      const carryOn = await ask("  Continue with these credentials anyway? [Y/n]: ");
+      if (!String(carryOn ?? "").trim().toLowerCase().startsWith("n")) {
+        return { uri, custom: true, unverified: true };
+      }
+    } else {
+      console.log("\n  " + red("✗ Check Connection failed") + dim(` — ${verdict.why}`));
+    }
+    const again = await ask("  Re-enter the username and password? [y/N]: ");
+    if (!String(again ?? "").trim().toLowerCase().startsWith("y")) return { exit: true };
+  }
+  return { exit: true };
+}
+
 /**
  * Where the published API packages live. Overridable so a fork, a staging bucket or an
  * air-gapped mirror does not need a code change.
@@ -616,6 +692,36 @@ export async function runClientExpertSetup({ ask }) {
   }
 
   console.log("\n  " + cyan("✓ MongoDB is running") + dim(` (${mongo.how})`));
+
+  // --- whose MongoDB is it? (task #15) ---------------------------------------------------
+  // Something answering on 27017 is not necessarily a database setup can USE: an instance the
+  // OS already had may carry its own admin credentials, and seeding into it with the default
+  // empty pair fails two steps later, after the 360-package install, with a message pointing
+  // at the wrong thing. Confirm the credentials HERE, where changing the answer is cheap.
+  // A uri already in state — a resumed run — is reused silently, like every other answered
+  // question, and a URI forced via GONEXT_LOCAL_MONGO_URI is taken as deliberate.
+  let mongoUri = LOCAL_MONGO_URI;
+  if (typeof state.localMongoUri === "string" && state.localMongoUri) {
+    mongoUri = state.localMongoUri;
+    if (mongoUri !== LOCAL_MONGO_URI) {
+      console.log(dim("  using the MongoDB credentials from the previous run"));
+    }
+  } else if (!process.env.GONEXT_LOCAL_MONGO_URI) {
+    const credsChoice = await askMongoCredentials(ask);
+    if (credsChoice.exit) {
+      console.log("\n  " + dim("No working MongoDB credentials — setup stops here."));
+      console.log(dim("  To start over: `gu clear`, then `gu` again.\n"));
+      state = recordStep(state, "mongo", "interrupted", {
+        reason: "declined at the MongoDB credentials check",
+      });
+      await saveState(state);
+      return { complete: false, stoppedAt: "mongo" };
+    }
+    mongoUri = credsChoice.uri;
+    if (credsChoice.custom) {
+      state = { ...state, localMongoUri: mongoUri };
+    }
+  }
   state = recordStep(state, "mongo", "done");
   await saveState(state);
 
@@ -687,6 +793,7 @@ export async function runClientExpertSetup({ ask }) {
   try {
     creds = await seedDatabase({
       apiDir,
+      mongoUri,
       userId: state.localUserId,
       workerKey: state.localWorkerKey,
     });
@@ -713,7 +820,7 @@ export async function runClientExpertSetup({ ask }) {
   let health = await probeLocalApi(LOCAL_API_PORT);
   if (!health.ok) {
     console.log("\n  " + bold(`Starting the local API on port ${LOCAL_API_PORT}`));
-    await startLocalApi({ apiDir });
+    await startLocalApi({ apiDir, mongoUri });
     health = await waitForApi({ port: LOCAL_API_PORT });
   }
   if (!health.ok) {

package/client-expert-setup.mjs

@@ -808,3 +808,51 @@ export async function promptForLicenseToken(ask, initialToken, {
   }
   return { token: "", result: null, declined: true };
 }
+
+/* ------------------------- MongoDB credentials (task #15) ------------------------------ */
+
+/**
+ * Build a mongodb:// URI from parts, with the credentials URL-encoded.
+ *
+ * Encoding is not decoration: a password of `p@ss/word#1` pasted verbatim into a URI breaks
+ * the parse in three different ways, and the failure surfaces two steps later as "MongoDB
+ * answered a moment ago, so this is usually a permissions problem" — a message that sends the
+ * user debugging the wrong thing entirely.
+ */
+export function buildMongoUri({ username = "", password = "", host = "127.0.0.1", port = 27017 } = {}) {
+  const user = String(username ?? "").trim();
+  if (!user) return `mongodb://${host}:${port}`;
+  const pass = String(password ?? "");
+  return `mongodb://${encodeURIComponent(user)}:${encodeURIComponent(pass)}@${host}:${port}`;
+}
+
+/** The one-liner any mongo shell answers, credentialed or not. */
+export function mongoShellPingCommand(uri) {
+  return ["--quiet", String(uri), "--eval", "db.runCommand({ping:1}).ok"];
+}
+
+/**
+ * What a mongo shell's ping output means for CREDENTIALS (task #15).
+ *
+ * → { ok } true when the ping answered, false when it definitely did not,
+ *   { ok: null, unverifiable: true } when no shell exists on this machine to ask.
+ *
+ * A socket can prove a port answers; only something that speaks the wire protocol can prove a
+ * username/password pair is ACCEPTED — which is the whole question when the MongoDB on 27017
+ * is not one we installed. The shells are what is available before the API package (and its
+ * mongodb driver) is downloaded, so their absence means "cannot check", not "check failed" —
+ * and those two get different messages because they need different fixes.
+ */
+export function mongoAuthVerdict({ output } = {}) {
+  const out = String(output ?? "");
+  if (out.trim().endsWith("1")) return { ok: true, why: "" };
+  const looksLikeAuth =
+    /auth|AuthenticationFailed|SCRAM|not authorized|requires authentication/i.test(out);
+  return {
+    ok: false,
+    why: looksLikeAuth
+      ? "the database rejected those credentials"
+      : "it answered, but the ping did not succeed",
+  };
+}
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.764",
+  "version": "1.0.765",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",