@wardby/cli 0.4.1 → 0.5.1

package/dist/quickstart/index.js

@@ -6,9 +6,12 @@ import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 import { createInterface } from "node:readline/promises";
 import { composeProjectName, defaultModel, ensureWardbyIgnored, generatedSecret, providerKeyName, quickstartPaths, readQuickstartEnv, readQuickstartState, resolveProjectDir, writeQuickstartEnv, writeQuickstartState, } from "./config.js";
+import { codingStep, quickstartComposeFiles } from "./coding.js";
+import { prismaCatalogImages, prismaLocalAgents, prismaSeedCodingAgents } from "./coding-db.js";
+import { codingDoctorLines } from "./coding-doctor.js";
+import { parseStarterChoice } from "./starter-services.js";
 import { FETCH_NOTICE, migrateFailureReason, prismaMigrateInvocation, REGISTRY_FAILURE_MESSAGE, runPrismaMigrateInvocation, } from "./migrate.js";
 const packageRoot = fileURLToPath(new URL("../../", import.meta.url));
-const composeFile = join(packageRoot, "deploy/local/docker-compose.yml");
 const wardbyBin = join(packageRoot, "bin/wardby.js");
 const packageJson = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8"));
 const DEMO_AGENT = "hello-wardby";
@@ -33,17 +36,10 @@ function commandFailure(label, result) {
 function runtimeEnv(paths, values = readQuickstartEnv(paths)) {
     return { ...process.env, ...values, WARDBY_PROJECT_DIR: paths.projectDir };
 }
+/** The coding proxy's compose file joins once the coding step configured it, so ps/logs/down cover it too. */
 function composeArgs(paths, state, args) {
-    return [
-        "compose",
-        "--project-name",
-        state.composeProject,
-        "--env-file",
-        paths.envFile,
-        "--file",
-        composeFile,
-        ...args,
-    ];
+    const files = quickstartComposeFiles(packageRoot, readQuickstartEnv(paths)).flatMap((file) => ["--file", file]);
+    return ["compose", "--project-name", state.composeProject, "--env-file", paths.envFile, ...files, ...args];
 }
 function runCompose(paths, state, args, options = {}) {
     return runCommand("docker", composeArgs(paths, state, args), {
@@ -85,7 +81,7 @@ async function selectPostgresPort(firstPort = 55432) {
 }
 async function startPostgres(paths, state, config) {
     for (let attempt = 0; attempt < 10; attempt += 1) {
-        const up = runCompose(paths, state, ["up", "--detach", "--wait", "--wait-timeout", "90"]);
+        const up = runCompose(paths, state, ["up", "--detach", "--wait", "--wait-timeout", "90", "postgres"]);
         if (up.status === 0)
             return;
         const output = `${up.stderr}\n${up.stdout}`;
@@ -170,6 +166,39 @@ function parseProvider(value) {
     }
     return value;
 }
+function parseCodingProvider(value) {
+    if (value === undefined)
+        return undefined;
+    if (value !== "codex" && value !== "claude-code") {
+        throw new Error(`--coding-provider must be codex or claude-code; got "${value}".`);
+    }
+    return value;
+}
+function codingDeps(paths) {
+    return {
+        run: runCommand,
+        prompts: { line: promptLine, yesNo: promptYesNo, secret: promptSecret },
+        log: (line) => console.log(line),
+        cwd: process.cwd(),
+        env: process.env,
+        packageRoot,
+        seed: (input) => prismaSeedCodingAgents(paths, input),
+        catalogImages: (services) => prismaCatalogImages(paths, services),
+    };
+}
+async function codingSection(paths) {
+    return await codingDoctorLines(readQuickstartEnv(paths), {
+        run: runCommand,
+        listLocalAgents: async () => {
+            try {
+                return await prismaLocalAgents(paths);
+            }
+            catch {
+                return [];
+            }
+        },
+    });
+}
 function parseClient(value) {
     if (value === undefined)
         return undefined;
@@ -316,7 +345,12 @@ async function chooseClient(nonInteractive) {
 export async function quickstartCommand(args) {
     const { values } = parseArgs({
         args,
+        allowNegative: true,
         options: {
+            coding: { type: "boolean" },
+            trust: { type: "string", multiple: true },
+            "coding-provider": { type: "string" },
+            "starter-services": { type: "string" },
             provider: { type: "string" },
             model: { type: "string" },
             budget: { type: "string" },
@@ -327,6 +361,13 @@ export async function quickstartCommand(args) {
         },
     });
     const nonInteractive = values["non-interactive"] ?? false;
+    const codingOptions = {
+        nonInteractive,
+        coding: values.coding,
+        trust: values.trust ?? [],
+        provider: parseCodingProvider(values["coding-provider"]),
+        starterServices: values["starter-services"] === undefined ? undefined : parseStarterChoice(values["starter-services"]),
+    };
     const skipDemo = values["skip-demo"] ?? false;
     const budget = values.budget === undefined ? 1 : Number(values.budget);
     if (!Number.isFinite(budget) || budget <= 0)
@@ -398,6 +439,7 @@ export async function quickstartCommand(args) {
         else
             console.log(`Skipped the billed run. Start it later with: npx @wardby/cli@latest run ${DEMO_AGENT}`);
     }
+    await codingStep(paths, state, codingOptions, codingDeps(paths));
     const client = parseClient(values.client) ?? (await chooseClient(nonInteractive));
     const mcpConfigured = client !== "none" && configureMcpClients(client, paths);
     console.log("\nWardby is ready.");
@@ -481,6 +523,10 @@ export async function doctorCommand(args) {
         failed ||= !ok;
         console.log(`${ok ? "✓" : "✗"} ${name}${detail ? ` (${detail})` : ""}`);
     }
+    for (const line of await codingSection(paths)) {
+        failed ||= line.startsWith("✗");
+        console.log(line);
+    }
     if (failed)
         process.exitCode = 1;
 }
@@ -500,6 +546,9 @@ export async function statusCommand(args) {
     process.stdout.write(ps.stdout);
     const healthy = await databaseHealthy(paths);
     console.log(`database: ${healthy ? "healthy" : "unavailable"}`);
+    const coding = healthy ? await codingSection(paths) : [];
+    if (coding.length > 0)
+        console.log(["coding:", ...coding.map((line) => `  ${line}`)].join("\n"));
     if (!healthy)
         process.exitCode = 1;
 }

package/dist/quickstart/starter-services.d.ts

@@ -0,0 +1,45 @@
+import { type DeclaredService } from "../coding/services/declaration.js";
+export declare const STARTER_SERVICES_BRANCH = "wardby/quickstart-services";
+export type StarterService = "postgres" | "redis";
+export declare function starterServicesYaml(choices: readonly StarterService[]): string;
+/** `--starter-services postgres,redis|none`. */
+export declare function parseStarterChoice(value: string): StarterService[];
+/** The services a starter choice declares, as parseServiceDeclaration would read them back. */
+export declare function starterDeclaredServices(choices: readonly StarterService[]): DeclaredService[];
+/** The checked-out branch and its commit; null when HEAD is detached or the branch has no commits. */
+export declare function repoDefaultBranch(dir: string): Promise<{
+    branch: string;
+    sha: string;
+} | null>;
+export type DeclaredServicesStatus = {
+    kind: "absent";
+} | {
+    kind: "valid";
+    services: DeclaredService[];
+} | {
+    kind: "invalid";
+    reason: string;
+};
+/** The committed `.wardby/services.yaml` at `ref`, validated; `dir` must sit inside `roots`. */
+export declare function inspectDeclaredServices(dir: string, roots: readonly string[], ref: string): Promise<DeclaredServicesStatus>;
+export type StarterCommitResult = {
+    status: "created" | "replaced";
+    commit: string;
+} | {
+    status: "kept";
+    commit: string;
+} | {
+    status: "refused";
+    reason: string;
+};
+/**
+ * Commits `content` as `.wardby/services.yaml` on top of `baseSha` and points
+ * the starter branch at it. An existing branch is replaced only when
+ * `confirmReplace` says so, and only if it has not moved since it was read.
+ */
+export declare function commitStarterServices(input: {
+    dir: string;
+    baseSha: string;
+    content: string;
+    confirmReplace: (existingSha: string) => Promise<boolean>;
+}): Promise<StarterCommitResult>;

package/dist/quickstart/starter-services.js

@@ -0,0 +1,186 @@
+/**
+ * The quickstart's `.wardby/services.yaml` handling for a local repository:
+ * read the committed declaration on the default branch, or write a starter one
+ * onto its own branch with git plumbing.
+ *
+ * The write never touches the user's working tree, index, or HEAD: it builds
+ * the tree in a scratch index (GIT_INDEX_FILE in a temp dir), creates the
+ * commit with commit-tree, and moves only refs/heads/wardby/quickstart-services
+ * with a compare-and-swap update-ref. git runs through the hardened runner
+ * (GIT_* stripped, hooks/fsmonitor off, no signing), with an explicit identity
+ * so no user configuration is needed.
+ */
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { localGit, localGitWrite } from "../coding/local-git.js";
+import { LOCAL_REPO_PREFIX } from "../coding/local-repo.js";
+import { MAX_SERVICE_DECLARATION_BYTES, SERVICE_DECLARATION_PATH, ServiceDeclarationError, parseServiceDeclaration, } from "../coding/services/declaration.js";
+import { LocalRemote } from "../providers/vcs/local-remote.js";
+export const STARTER_SERVICES_BRANCH = "wardby/quickstart-services";
+const STARTER_REF = `refs/heads/${STARTER_SERVICES_BRANCH}`;
+const COMMIT_MESSAGE = "Add starter .wardby/services.yaml (wardby quickstart)";
+const IDENTITY = {
+    GIT_AUTHOR_NAME: "wardby quickstart",
+    GIT_AUTHOR_EMAIL: "quickstart@wardby.invalid",
+    GIT_COMMITTER_NAME: "wardby quickstart",
+    GIT_COMMITTER_EMAIL: "quickstart@wardby.invalid",
+};
+const OBJECT_ID = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
+/** Catalog versions (src/coding/services/builtins.ts); the catalog pins each to an image digest. */
+const STARTER_VERSIONS = { postgres: "16", redis: "7" };
+export function starterServicesYaml(choices) {
+    const lines = [
+        "# Services wardby starts next to each coding run. Each name and version must",
+        "# exist in the wardby service catalog, and the agent must allow the name",
+        "# (codingProfile.services). See docs/coding-services.md.",
+        "services:",
+        ...[...new Set(choices)].sort().map((name) => `  ${name}: "${STARTER_VERSIONS[name]}"`),
+    ];
+    return `${lines.join("\n")}\n`;
+}
+/** `--starter-services postgres,redis|none`. */
+export function parseStarterChoice(value) {
+    const names = value
+        .split(",")
+        .map((part) => part.trim().toLowerCase())
+        .filter(Boolean);
+    if (names.length === 1 && names[0] === "none")
+        return [];
+    const chosen = new Set();
+    for (const name of names) {
+        if (name !== "postgres" && name !== "redis") {
+            throw new Error(`--starter-services must list postgres, redis, or none; got "${value}".`);
+        }
+        chosen.add(name);
+    }
+    return [...chosen].sort();
+}
+/** The services a starter choice declares, as parseServiceDeclaration would read them back. */
+export function starterDeclaredServices(choices) {
+    return parseServiceDeclaration(starterServicesYaml(choices));
+}
+/** The checked-out branch and its commit; null when HEAD is detached or the branch has no commits. */
+export async function repoDefaultBranch(dir) {
+    let branch;
+    try {
+        branch = (await localGit(dir, ["symbolic-ref", "--quiet", "--short", "HEAD"], 64 * 1024)).trim();
+    }
+    catch {
+        return null;
+    }
+    if (!branch)
+        return null;
+    try {
+        const sha = (await localGit(dir, ["rev-parse", "--verify", "--quiet", "--end-of-options", `refs/heads/${branch}^{commit}`])).trim();
+        return OBJECT_ID.test(sha) ? { branch, sha } : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The committed `.wardby/services.yaml` at `ref`, validated; `dir` must sit inside `roots`. */
+export async function inspectDeclaredServices(dir, roots, ref) {
+    let text;
+    try {
+        text = await new LocalRemote({ roots: () => roots }).readRepositoryFile({
+            repository: `${LOCAL_REPO_PREFIX}${dir}`,
+            ref,
+            path: SERVICE_DECLARATION_PATH,
+            maxBytes: MAX_SERVICE_DECLARATION_BYTES,
+        });
+    }
+    catch (error) {
+        return { kind: "invalid", reason: error instanceof Error ? error.message : String(error) };
+    }
+    if (text === null)
+        return { kind: "absent" };
+    try {
+        return { kind: "valid", services: parseServiceDeclaration(text) };
+    }
+    catch (error) {
+        if (error instanceof ServiceDeclarationError)
+            return { kind: "invalid", reason: error.reason };
+        throw error;
+    }
+}
+async function currentRef(dir) {
+    try {
+        const sha = (await localGit(dir, ["rev-parse", "--verify", "--quiet", "--end-of-options", STARTER_REF])).trim();
+        return OBJECT_ID.test(sha) ? sha : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** True when any worktree of the repository (this one included) has the starter branch checked out. */
+async function branchCheckedOut(dir) {
+    const listing = await localGit(dir, ["worktree", "list", "--porcelain"]);
+    return listing.split("\n").some((line) => line.trim() === `branch ${STARTER_REF}`);
+}
+/** The starter commit on top of `baseSha`, built in a scratch index; writes objects only, never a ref. */
+async function buildStarterCommit(dir, baseSha, content) {
+    const scratch = await mkdtemp(join(tmpdir(), "wardby-quickstart-index-"));
+    try {
+        const env = { ...IDENTITY, GIT_INDEX_FILE: join(scratch, "index") };
+        await localGitWrite(dir, ["read-tree", "--end-of-options", baseSha], { env });
+        const blob = (await localGitWrite(dir, ["hash-object", "-w", "--no-filters", "--stdin"], { env, input: content })).trim();
+        if (!OBJECT_ID.test(blob))
+            throw new Error("git hash-object returned no object id");
+        await localGitWrite(dir, ["update-index", "--add", "--cacheinfo", `100644,${blob},${SERVICE_DECLARATION_PATH}`], {
+            env,
+        });
+        const tree = (await localGitWrite(dir, ["write-tree"], { env })).trim();
+        if (!OBJECT_ID.test(tree))
+            throw new Error("git write-tree returned no tree id");
+        const commit = (await localGitWrite(dir, ["commit-tree", "--no-gpg-sign", "-p", baseSha, "-m", COMMIT_MESSAGE, tree], { env })).trim();
+        if (!OBJECT_ID.test(commit))
+            throw new Error("git commit-tree returned no commit id");
+        return commit;
+    }
+    finally {
+        await rm(scratch, { recursive: true, force: true });
+    }
+}
+/**
+ * Commits `content` as `.wardby/services.yaml` on top of `baseSha` and points
+ * the starter branch at it. An existing branch is replaced only when
+ * `confirmReplace` says so, and only if it has not moved since it was read.
+ */
+export async function commitStarterServices(input) {
+    const { dir, baseSha, content } = input;
+    if (!OBJECT_ID.test(baseSha))
+        return { status: "refused", reason: "the base commit id is not valid" };
+    // Moving a checked-out branch would change that worktree's HEAD commit under it.
+    if (await branchCheckedOut(dir)) {
+        return { status: "refused", reason: `${STARTER_SERVICES_BRANCH} is checked out; switch away from it first` };
+    }
+    const existing = await currentRef(dir);
+    if (existing && !(await input.confirmReplace(existing)))
+        return { status: "kept", commit: existing };
+    let commit;
+    try {
+        commit = await buildStarterCommit(dir, baseSha, content);
+    }
+    catch (error) {
+        const detail = (error.stderr || error.message).trim().split("\n")[0];
+        return { status: "refused", reason: `git could not build the starter commit: ${detail}` };
+    }
+    // Re-checked right before the move: a checkout since the first check would otherwise be updated under it.
+    if (await branchCheckedOut(dir)) {
+        return { status: "refused", reason: `${STARTER_SERVICES_BRANCH} is checked out; switch away from it first` };
+    }
+    const expected = existing ?? "0".repeat(baseSha.length);
+    try {
+        await localGitWrite(dir, ["update-ref", "--no-deref", "-m", "wardby quickstart", STARTER_REF, commit, expected], {
+            env: IDENTITY,
+        });
+    }
+    catch {
+        return {
+            status: "refused",
+            reason: `${STARTER_SERVICES_BRANCH} changed while quickstart was writing it (or a conflicting ref exists); left as is`,
+        };
+    }
+    return { status: existing ? "replaced" : "created", commit };
+}

package/dist/quickstart-images.json

@@ -0,0 +1 @@
+{"runtime":"ghcr.io/wardby/wardby/wardby-runtime@sha256:1b6646eccf13dbe534257f641b757cd11a127ef54741cf7b7a0a56fc53de60da","worker":"ghcr.io/wardby/wardby/wardby-coding-worker@sha256:0a9d4a8f737b4b2badde4dfad5646db3cb26ead4f3783ee0c13819daf0f44b1a","claudeWorker":"ghcr.io/wardby/wardby/wardby-claude-coding-worker@sha256:36fdf3b28d60a332b170ec5bd52d7158d11cab70562d7cadffe2fa286ccff974","claudeToolRunner":"ghcr.io/wardby/wardby/wardby-claude-tool-runner@sha256:68c276dce5341bf5e8dd3723ae8ad45ae01c81065a99ee2c5ca9847ce1afe0d7"}

package/dist/serve.js

@@ -20,6 +20,7 @@ import { loadCodingConcurrencyConfig, loadMcpConfig } from "./config/providers.j
 import { drainCodingQueue } from "./core/coding-queue.js";
 import { prisma } from "./core/db.js";
 import { startReconciler } from "./core/reconciler.js";
+import { createRepoAccessGate } from "./core/repo-access.js";
 import { startScheduler } from "./core/scheduler.js";
 import { buildMcpProviders, startMcp } from "./mcp/index.js";
 export async function startServe(options = {}) {
@@ -33,10 +34,22 @@ export async function startServe(options = {}) {
     const concurrency = loadCodingConcurrencyConfig();
     const providers = options.providers ?? buildMcpProviders().providers;
     const mcp = await startMcp({ providers, schedulerAttached: true });
+    const reviewHosts = providers.reviewHosts;
     const reconciler = startReconciler({
         executor: providers.executor,
-        reviewHosts: providers.reviewHosts,
+        reviewHosts,
         issueTrackers: providers.issueTrackers,
+        ...(reviewHosts
+            ? {
+                deferredReviews: {
+                    db: prisma,
+                    executor: providers.executor,
+                    hosts: reviewHosts,
+                    repoAccess: providers.repoAccess ?? createRepoAccessGate({ db: prisma, hosts: reviewHosts }),
+                    ...(providers.issueTrackers ? { issueTrackers: providers.issueTrackers } : {}),
+                },
+            }
+            : {}),
     });
     const selfDefects = { db: prisma, issueTrackers: providers.issueTrackers };
     const scheduler = startScheduler({