@wardby/cli 0.5.2 → 0.5.3

package/dist/quickstart/images.js

@@ -7,25 +7,69 @@ function readPackageImages(packageRoot) {
         const parsed = JSON.parse(readFileSync(join(packageRoot, "dist", "quickstart-images.json"), "utf8"));
         if (typeof parsed !== "object" || parsed === null)
             return undefined;
-        const { runtime, worker, claudeWorker, claudeToolRunner } = parsed;
+        const { runtime, worker, claudeWorker, claudeToolRunner, workerNodePython, claudeToolRunnerNodePython, driver } = parsed;
         if (typeof runtime !== "string" || typeof worker !== "string")
             return undefined;
         // An image is never resolved by tag: a tag can be repointed after release.
         if (!DIGEST_REF.test(runtime) || !DIGEST_REF.test(worker))
             return undefined;
         // The Claude Code images are optional, but both or neither, and pinned when present.
-        if (claudeWorker === undefined && claudeToolRunner === undefined)
-            return { runtime, worker };
-        if (typeof claudeWorker !== "string" || typeof claudeToolRunner !== "string")
-            return undefined;
-        if (!DIGEST_REF.test(claudeWorker) || !DIGEST_REF.test(claudeToolRunner))
-            return undefined;
-        return { runtime, worker, claudeWorker, claudeToolRunner };
+        const result = { runtime, worker };
+        if (claudeWorker !== undefined || claudeToolRunner !== undefined) {
+            if (typeof claudeWorker !== "string" || typeof claudeToolRunner !== "string")
+                return undefined;
+            if (!DIGEST_REF.test(claudeWorker) || !DIGEST_REF.test(claudeToolRunner))
+                return undefined;
+            result.claudeWorker = claudeWorker;
+            result.claudeToolRunner = claudeToolRunner;
+        }
+        // The Node + Python images are each optional on their own (an older release has neither).
+        if (workerNodePython !== undefined) {
+            if (typeof workerNodePython !== "string" || !DIGEST_REF.test(workerNodePython))
+                return undefined;
+            result.workerNodePython = workerNodePython;
+        }
+        if (claudeToolRunnerNodePython !== undefined) {
+            if (typeof claudeToolRunnerNodePython !== "string" || !DIGEST_REF.test(claudeToolRunnerNodePython)) {
+                return undefined;
+            }
+            result.claudeToolRunnerNodePython = claudeToolRunnerNodePython;
+        }
+        // The driver is optional (an older release has none), and pinned when present.
+        if (driver !== undefined) {
+            if (typeof driver !== "string" || !DIGEST_REF.test(driver))
+                return undefined;
+            result.driver = driver;
+        }
+        return result;
     }
     catch {
         return undefined;
     }
 }
+/** The digest-pinned image a worker Dockerfile's first FROM line names; undefined when it is not pinned. */
+export function driverFromDockerfile(text) {
+    const image = /^FROM\s+(\S+)/im.exec(text)?.[1];
+    return image && /^[a-z0-9][a-z0-9._/:-]*@sha256:[0-9a-f]{64}$/.test(image) ? image : undefined;
+}
+function hasSource(packageRoot) {
+    return (existsSync(join(packageRoot, "deploy", "Dockerfile")) &&
+        existsSync(join(packageRoot, "src", "coding-worker", "Dockerfile")));
+}
+function sourceDriver(packageRoot) {
+    try {
+        return driverFromDockerfile(readFileSync(join(packageRoot, "src", "coding-worker", "Dockerfile"), "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** `wardby doctor`'s line naming the base image for your own worker images; undefined when it is not known. */
+export function baseImageLine(resolved) {
+    if ("unavailable" in resolved || !resolved.driver)
+        return undefined;
+    return `Base image for your own worker images: ${resolved.driver}`;
+}
 /**
  * Where the coding step gets its runtime and worker images: explicit env
  * overrides, the digest-pinned refs written at release time, or a local build
@@ -40,20 +84,38 @@ export function resolveQuickstartImages(opts) {
     const workerImage = imageVariable(env.CODING_WORKER_IMAGE);
     const claudeWorker = imageVariable(env.CODING_CLAUDE_WORKER_IMAGE);
     const claudeToolRunner = imageVariable(env.CODING_CLAUDE_TOOL_RUNNER_IMAGE);
+    const workerNodePython = imageVariable(env.CODING_WORKER_IMAGE_NODE_PYTHON_3_12);
+    const claudeToolRunnerNodePython = imageVariable(env.CODING_CLAUDE_TOOL_RUNNER_IMAGE_NODE_PYTHON_3_12);
+    // Each Node + Python image is independent: an env override beats the package or local build.
+    const envNodePython = {
+        ...(workerNodePython ? { workerNodePython } : {}),
+        ...(claudeToolRunnerNodePython ? { claudeToolRunnerNodePython } : {}),
+    };
     const envClaude = claudeWorker && claudeToolRunner ? { claudeWorker, claudeToolRunner } : {};
     if (runtimeImage && workerImage) {
-        return { runtime: runtimeImage, worker: workerImage, ...envClaude, source: "env" };
+        const driver = readPackageImages(packageRoot)?.driver ?? (hasSource(packageRoot) ? sourceDriver(packageRoot) : undefined);
+        return {
+            runtime: runtimeImage,
+            worker: workerImage,
+            ...envClaude,
+            ...envNodePython,
+            ...(driver ? { driver } : {}),
+            source: "env",
+        };
     }
     const pinned = readPackageImages(packageRoot);
     if (pinned)
-        return { ...pinned, ...envClaude, source: "package" };
-    if (existsSync(join(packageRoot, "deploy", "Dockerfile")) &&
-        existsSync(join(packageRoot, "src", "coding-worker", "Dockerfile"))) {
+        return { ...pinned, ...envClaude, ...envNodePython, source: "package" };
+    if (hasSource(packageRoot)) {
+        const driver = sourceDriver(packageRoot);
         return {
             runtime: "wardby-runtime:local",
             worker: "wardby-coding-worker:local",
             claudeWorker: "wardby-claude-coding-worker:local",
             claudeToolRunner: "wardby-claude-tool-runner:local",
+            workerNodePython: "wardby-coding-worker-node-python:local",
+            claudeToolRunnerNodePython: "wardby-claude-tool-runner-node-python:local",
+            ...(driver ? { driver } : {}),
             source: "build",
         };
     }

package/dist/quickstart/index.d.ts

@@ -5,8 +5,6 @@
  */
 export declare function mcpAddArgs(client: "codex" | "claude", projectDir: string, packageSpec: string): string[];
 export declare function quickstartCommand(args: string[]): Promise<void>;
-/** The closing "build your first agent" hint; the assistant prompts only make sense once an MCP client is configured. */
-export declare function nextStepLines(mcpConfigured: boolean): string[];
 export declare function doctorCommand(args: string[]): Promise<void>;
 export declare function statusCommand(args: string[]): Promise<void>;
 export declare function logsCommand(args: string[]): Promise<void>;

package/dist/quickstart/index.js

@@ -9,6 +9,8 @@ import { composeProjectName, defaultModel, ensureWardbyIgnored, generatedSecret,
 import { codingStep, quickstartComposeFiles } from "./coding.js";
 import { prismaCatalogImages, prismaLocalAgents, prismaSeedCodingAgents } from "./coding-db.js";
 import { codingDoctorLines } from "./coding-doctor.js";
+import { baseImageLine, resolveQuickstartImages } from "./images.js";
+import { scenarioMenuLines } from "./scenarios.js";
 import { parseStarterChoice } from "./starter-services.js";
 import { FETCH_NOTICE, migrateFailureReason, prismaMigrateInvocation, REGISTRY_FAILURE_MESSAGE, runPrismaMigrateInvocation, } from "./migrate.js";
 const packageRoot = fileURLToPath(new URL("../../", import.meta.url));
@@ -351,6 +353,7 @@ export async function quickstartCommand(args) {
             trust: { type: "string", multiple: true },
             "coding-provider": { type: "string" },
             "starter-services": { type: "string" },
+            "allow-repo-packages": { type: "boolean" },
             provider: { type: "string" },
             model: { type: "string" },
             budget: { type: "string" },
@@ -367,6 +370,7 @@ export async function quickstartCommand(args) {
         trust: values.trust ?? [],
         provider: parseCodingProvider(values["coding-provider"]),
         starterServices: values["starter-services"] === undefined ? undefined : parseStarterChoice(values["starter-services"]),
+        allowRepoPackages: values["allow-repo-packages"],
     };
     const skipDemo = values["skip-demo"] ?? false;
     const budget = values.budget === undefined ? 1 : Number(values.budget);
@@ -439,28 +443,17 @@ export async function quickstartCommand(args) {
         else
             console.log(`Skipped the billed run. Start it later with: npx @wardby/cli@latest run ${DEMO_AGENT}`);
     }
-    await codingStep(paths, state, codingOptions, codingDeps(paths));
+    const coding = await codingStep(paths, state, codingOptions, codingDeps(paths));
+    const codingRan = coding?.seed !== undefined && coding.seed.builder.status !== "skipped" && coding.seed.reviewer.status !== "skipped";
     const client = parseClient(values.client) ?? (await chooseClient(nonInteractive));
     const mcpConfigured = client !== "none" && configureMcpClients(client, paths);
     console.log("\nWardby is ready.");
     console.log("  npx @wardby/cli@latest status");
     console.log("  npx @wardby/cli@latest doctor");
     console.log("  npx @wardby/cli@latest down");
-    for (const line of nextStepLines(mcpConfigured))
+    for (const line of scenarioMenuLines({ codingRan, mcpConfigured }))
         console.log(line);
 }
-/** The closing "build your first agent" hint; the assistant prompts only make sense once an MCP client is configured. */
-export function nextStepLines(mcpConfigured) {
-    const guide = "the guide: npx @wardby/cli@latest help open agent-recipes";
-    const lines = ["", "Next: build your first agent."];
-    if (mcpConfigured) {
-        lines.push("Ask your assistant one of:", '  "Set up the Wardby architecture keeper for this repository"', '  "Set up a Wardby builder for this repository"', `Or read ${guide}`);
-    }
-    else {
-        lines.push(`Read ${guide}`);
-    }
-    return lines;
-}
 async function databaseHealthy(paths) {
     const env = readQuickstartEnv(paths);
     if (!env.DATABASE_URL)
@@ -527,6 +520,9 @@ export async function doctorCommand(args) {
         failed ||= line.startsWith("✗");
         console.log(line);
     }
+    const base = baseImageLine(resolveQuickstartImages({ env: runtimeEnv(paths), packageRoot }));
+    if (base)
+        console.log(base);
     if (failed)
         process.exitCode = 1;
 }

package/dist/quickstart/manifests.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Pure readers for a repository's declared dependencies, used by the
+ * quickstart to offer them as local-builder's package allowlist:
+ * `pyproject.toml`, `requirements*.txt` and `package.json`. Each returns bare
+ * top-level names as written (a Python requirement keeps the extras it names,
+ * also as written: `psycopg[binary]`); repo-packages.ts validates, normalizes,
+ * de-duplicates and caps them.
+ *
+ * pyproject.toml is read by a deliberately narrow TOML scanner (no new
+ * dependency): it understands tables, arrays of tables, dotted and quoted
+ * keys, all four string forms, arrays and inline tables, and treats every
+ * other scalar (numbers, booleans, dates) as opaque. Anything it cannot scan
+ * throws, and the caller skips the file with a warning.
+ */
+/**
+ * The project name of a PEP 508 requirement ("requests[socks]>=2; python_version<'4'"),
+ * or null for anything that is not a plain registry requirement: a direct URL
+ * reference (`name @ url`), a path, a URL, or an archive file.
+ */
+export declare function requirementName(spec: string): string | null;
+/**
+ * A PEP 508 requirement's name with the extras it names, as written
+ * ("psycopg[binary]" from "psycopg[binary]>=3.2"), or just the name when it
+ * names none; null when requirementName is. The extras are not validated here.
+ */
+export declare function requirementSpec(spec: string): string | null;
+/** Names from a pip requirements file; options (`-r`, `-c`, `-e`, `--…`), URLs and paths are skipped. */
+export declare function requirementsNames(text: string): string[];
+/**
+ * Names from package.json's dependencies, devDependencies and
+ * optionalDependencies (peer dependencies are the consumer's to install).
+ * An `npm:` alias names the real package; file, link, workspace, git, GitHub
+ * and URL specs are not registry packages and are skipped.
+ */
+export declare function packageJsonNames(text: string): string[];
+/** package.json's own `name`, when it is a string: the quickstart never offers
+ *  the repository's own package for its allowlist (dependency confusion). */
+export declare function packageJsonOwnNames(text: string): string[];
+/**
+ * Names from pyproject.toml: `[project] dependencies`, every
+ * `[project.optional-dependencies]` group, `[tool.poetry.dependencies]`
+ * (except python), `[tool.poetry.group.*.dependencies]` and the legacy
+ * `[tool.poetry.dev-dependencies]`, plus the packages pip needs to build the
+ * project: `[build-system] requires`, or setuptools and wheel when the file has
+ * no `[build-system]` table. Throws when the file cannot be scanned or
+ * one of those keys has an unexpected shape.
+ */
+export declare function pyprojectNames(text: string): string[];
+/**
+ * The project's own names in pyproject.toml (`[project].name` and
+ * `[tool.poetry].name`), as written: the quickstart never offers the
+ * repository's own project for its allowlist (dependency confusion), even when
+ * an optional-dependency group refers back to it with extras. Throws when the
+ * file cannot be scanned.
+ */
+export declare function pyprojectOwnNames(text: string): string[];