bottleship 0.0.1 → 0.1.0-prototype.1

package/dist/src/boxes.js

@@ -0,0 +1,265 @@
+// Boxes that run an agent in the background. All state lives in the box under ~/.bottleship:
+// env.sh (env and secrets), run.sh/resume.sh (the agent command), prompt.txt, pid, exit, agent.log,
+// and on the device login route login.sh, login-status.sh, login (checking, pending, ok or failed) and login.log.
+import { createHash, randomBytes } from "node:crypto";
+import { fill, shq } from "../presets/providers/util.js";
+import { BsError, boxEnv, getAgent, getProvider, noIsolationAccepted, noIsolationError, unisolated } from "./config.js";
+const B = '"$HOME/.bottleship"';
+const MARK = "__BOTTLESHIP_PROMPT__";
+const tail = (s, n = 2000) => (s.length > n ? "..." + s.slice(-n) : s);
+export const goneFix = 'the box is gone. Start a new one with `bottleship new "<task>"` and tell its agent to continue on the branch the old box pushed';
+// the prompt is read from a file at run time, so one script serves every turn
+const agentScript = (template) => fill(template, { prompt: MARK }).split(shq(MARK)).join(`"$(cat ${B}/prompt.txt)"`);
+// writes files under the box's $HOME from inside a script fed on stdin, so secrets never show up in argv
+function writeFiles(files) {
+    const eof = `BOTTLESHIP_EOF_${randomBytes(8).toString("hex")}`;
+    return Object.entries(files)
+        .map(([path, content]) => {
+        const p = `"$HOME"/${shq(path)}`;
+        return `mkdir -p "$(dirname ${p})" && cat > ${p} <<'${eof}'\n${content}${content.endsWith("\n") ? "" : "\n"}${eof}`;
+    })
+        .join("\n");
+}
+// starts the agent detached; launch.sh records the exit code when it ends
+const start = (mode) => `rm -f ${B}/exit
+if [ -f ${B}/login.sh ]; then echo checking > ${B}/login.tmp && mv -f ${B}/login.tmp ${B}/login; rm -f ${B}/login.log; fi
+nohup bash ${B}/launch.sh ${mode} </dev/null >/dev/null 2>&1 &
+echo $! > ${B}/pid`;
+const RUNNING = `[ ! -f ${B}/exit ] && kill -0 "$(cat ${B}/pid 2>/dev/null)" 2>/dev/null`;
+// on the device route it logs in first when login-status.sh fails, giving up after login-timeout seconds; until a run started, a follow-up runs instead of resuming
+const LAUNCH = `B="$HOME/.bottleship"
+. "$B/env.sh"
+cd "$HOME/workspace"
+mode=$1
+# state files are replaced whole, so status never reads one half-written
+put() { echo "$2" > "$B/$1.tmp" && mv -f "$B/$1.tmp" "$B/$1"; }
+killtree() { for c in $(ps -A -o pid=,ppid= | awk -v p="$1" '$2 == p { print $1 }'); do killtree "$c"; done; kill "$1" 2>/dev/null; }
+[ -f "$B/started" ] || mode=run
+if [ -f "$B/login.sh" ]; then
+  if bash "$B/login-status.sh" >/dev/null 2>&1; then put login ok; else
+    put login pending
+    # stays in the box's process group so rm can find it; a timeout ends its whole process tree
+    bash "$B/login.sh" > "$B/login.log" 2>&1 </dev/null &
+    lp=$!
+    end=$((SECONDS + $(cat "$B/login-timeout")))
+    while kill -0 $lp 2>/dev/null && [ $SECONDS -lt $end ]; do sleep 1; done
+    if kill -0 $lp 2>/dev/null; then killtree $lp; echo "bottleship: no approval within $(cat "$B/login-timeout") seconds" >> "$B/login.log"; fi
+    wait $lp
+    rc=$?
+    if [ $rc -ne 0 ]; then put login failed; put exit $rc; exit; fi
+    put login ok
+  fi
+fi
+touch "$B/started"
+bash "$B/$mode.sh" > "$B/agent.log" 2>&1 </dev/null
+put exit $?
+`;
+// node for agents installed with npm, without sudo, if the box has none
+const NODE = `if ! command -v node >/dev/null; then
+  case "$(uname -m)" in aarch64|arm64) A=arm64;; *) A=x64;; esac
+  F=$(curl -fsSL https://nodejs.org/dist/latest-v22.x/SHASUMS256.txt | grep -o "node-v[0-9.]*-linux-$A.tar.xz" | head -1)
+  mkdir -p ${B}/node && curl -fsSL "https://nodejs.org/dist/latest-v22.x/$F" | tar -xJ -C ${B}/node --strip-components=1
+fi`;
+// gh and git both read GH_TOKEN, so pushes and PRs work with no further login
+const GIT_HELPER = `!f() { test "$1" = get && echo username=x-access-token && echo "password=$GH_TOKEN"; }; f`;
+// the box template: what every box set up at start would install, as the non-root user box; npm globals land where env.sh puts them
+const DOCKERFILE = `FROM node:22-bookworm-slim
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+RUN apt-get update && apt-get install -y --no-install-recommends git curl ca-certificates ripgrep \\
+ && mkdir -p -m 755 /etc/apt/keyrings \\
+ && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg -o /etc/apt/keyrings/githubcli-archive-keyring.gpg \\
+ && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" > /etc/apt/sources.list.d/github-cli.list \\
+ && apt-get update && apt-get install -y --no-install-recommends gh \\
+ && rm -rf /var/lib/apt/lists/*
+RUN userdel -r node && useradd -m -s /bin/bash -u 1000 box
+USER box
+WORKDIR /home/box
+ENV NPM_CONFIG_PREFIX=/home/box/.bottleship/npm PATH=/home/box/.bottleship/npm/bin:/home/box/.local/bin:$PATH
+`;
+// bakes in only this agent's install: other agents install at start, and a changed agent gets a new template
+export function templateSpec(cfg, agentName) {
+    const dockerfile = DOCKERFILE + (getAgent(cfg, agentName).install ?? []).map((line) => `RUN ${line}\n`).join("");
+    return { name: `bottleship-${createHash("sha256").update(dockerfile).digest("hex").slice(0, 8)}`, dockerfile };
+}
+// the template init recorded for this provider, if it was built from the current spec of the configured agent
+export function currentTemplate(cfg, provider) {
+    const t = cfg.templates[provider];
+    return t && t.name === templateSpec(cfg, cfg.agent).name ? t.ref : undefined;
+}
+export function parseId(cfg, handle) {
+    const i = handle.indexOf(":");
+    return i < 0 ? { provider: cfg.provider, box: handle } : { provider: handle.slice(0, i), box: handle.slice(i + 1) };
+}
+export function newBoxId(prompt) {
+    const slug = prompt.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 20).replace(/-$/, "");
+    return `bs-${slug ? slug + "-" : ""}${randomBytes(2).toString("hex")}`;
+}
+async function sh(b, script, stdin) {
+    try {
+        return await b.provider.exec(b.box, script, { stdin });
+    }
+    catch (e) {
+        throw new BsError("box_unreachable", `could not run a command in ${b.id}: ${e.message}`, `bottleship status ${b.id}`);
+    }
+}
+// a box that exists; throws box_gone if the provider says it does not
+export async function openBox(cfg, handle) {
+    const { provider: name, box } = parseId(cfg, handle);
+    const provider = await getProvider(cfg, name);
+    if (provider.status && (await provider.status(box)) === "gone")
+        throw new BsError("box_gone", `box ${handle} is gone`, goneFix);
+    return { id: `${name}:${box}`, provider, box };
+}
+// one round trip: files, node, git, clone (unless the provider made ~/workspace a checkout), install, start
+export async function setupAndStart(cfg, b, { agent: agentName, prompt, repo, dotenv = {} }) {
+    const agent = getAgent(cfg, agentName);
+    const { env, missing } = boxEnv(cfg, agentName);
+    if (missing.length)
+        throw missingSecrets(missing.map((m) => m.name));
+    const unset = (agent.unset ?? []).filter((k) => !(k in env));
+    const device = agent.login?.use === "device" ? agent.login.device : undefined;
+    if (agent.login?.use === "device" && !device)
+        throw new BsError("bad_agent", `agent ${agentName} uses the device login route but has no login.device`, `set agents.${agentName}.login.use to another route in ~/.bottleship/config.json`);
+    const envSh = [
+        ...(unset.length ? [`unset ${unset.join(" ")}`] : []),
+        'export PATH="$HOME/.bottleship/node/bin:$HOME/.bottleship/npm/bin:$HOME/.local/bin:$PATH"',
+        'export NPM_CONFIG_PREFIX="$HOME/.bottleship/npm"',
+        ...Object.entries(env).map(([k, v]) => `export ${k}=${shq(v)}`),
+    ].join("\n");
+    const files = {
+        // the agent needs these secrets, so it can read them; README says to scope them narrowly
+        ".bottleship/env.sh": envSh,
+        ".bottleship/launch.sh": LAUNCH,
+        ".bottleship/run.sh": agentScript(agent.run),
+        ".bottleship/resume.sh": agentScript(agent.resume),
+        ".bottleship/prompt.txt": prompt,
+        ...(device && {
+            ".bottleship/login.sh": device.command,
+            ".bottleship/login-status.sh": device.status,
+            ".bottleship/login-timeout": String(device.timeout ?? 900),
+            ".bottleship/agent-name": agentName,
+        }),
+        ...Object.fromEntries(Object.entries(dotenv).map(([name, content]) => [`.bottleship/dotenv/${name}`, content])),
+    };
+    const script = `set -e
+${writeFiles(files)}
+chmod 600 ${B}/env.sh
+. ${B}/env.sh
+${NODE}
+${cfg.git.name ? `git config --global user.name ${shq(cfg.git.name)}` : ""}
+${cfg.git.email ? `git config --global user.email ${shq(cfg.git.email)}` : ""}
+git config --global credential.https://github.com.helper ${shq(GIT_HELPER)}
+${repo ? `[ -e "$HOME/workspace/.git" ] || git clone --quiet ${shq(repo.url)} "$HOME/workspace"` : ""}
+mkdir -p "$HOME/workspace"
+if [ -d ${B}/dotenv ]; then cp -R ${B}/dotenv/. "$HOME/workspace/"; fi
+cd "$HOME/workspace"
+${(agent.install ?? []).join("\n")}
+${start("run")}`;
+    const r = await sh(b, "bash -s", script);
+    if (r.code !== 0)
+        throw new BsError("setup_failed", `setting up ${b.id} failed (exit ${r.code})`, "fix the cause in stderr, then try again", { stderr: tail(r.stderr), stdout: tail(r.stdout) });
+}
+export function missingSecrets(names) {
+    return new BsError("secret_missing", `no value for ${names.join(", ")}`, "ask the user to run `bottleship init` in their terminal; it asks for missing secrets with a hidden prompt. Never ask the user to paste a secret to you", { missing: names });
+}
+// source: the local checkout of the task's repo, for providers that can use it (local makes a worktree)
+export async function newBox(cfg, opts) {
+    // fails before a box exists when a secret is missing
+    if (unisolated(cfg, opts.provider) && !noIsolationAccepted(cfg, opts.provider))
+        throw noIsolationError(opts.provider);
+    const { missing } = boxEnv(cfg, opts.agent);
+    if (missing.length)
+        throw missingSecrets(missing.map((m) => m.name));
+    const provider = await getProvider(cfg, opts.provider);
+    const template = provider.template && currentTemplate(cfg, provider.name);
+    const { id: box } = await provider.create({ id: newBoxId(opts.prompt), ...(opts.source && { source: opts.source }), ...(template && { template }) });
+    const b = { id: `${provider.name}:${box}`, provider, box };
+    // a stale or missing template still works, as setup installs what the template would have held, only slower
+    if (provider.template && !template && provider.name === cfg.provider)
+        b.warning = `no current box template for ${provider.name}, so this box installs its tools at start, which is slower; run \`bottleship init\` to build one`;
+    try {
+        await setupAndStart(cfg, b, opts);
+        const s = await loginState(b, getAgent(cfg, opts.agent).login?.device?.setup);
+        if (s.agent === "waiting_for_login")
+            b.login = s.login;
+    }
+    catch (e) {
+        await provider.destroy(box).catch(() => { });
+        throw e;
+    }
+    return b;
+}
+const ANSI = /\x1b\[[0-9;?]*[A-Za-z]/g;
+// the first URL in a login's output, and a code like ABCD-12345 outside of URLs
+export function parseLogin(output, agent) {
+    const text = output.replace(ANSI, "");
+    const url = text.match(/https?:\/\/[^\s"'<>]+/)?.[0];
+    if (!url)
+        return undefined;
+    const code = text.replace(/https?:\/\/\S+/g, " ").match(/\b[A-Z0-9]{4,}-[A-Z0-9]{4,}\b/)?.[0];
+    return { url, ...(code && { code }), agent };
+}
+// the login's output (all of it, for the URL) while it is the current step, else the agent's last lines
+export async function agentState(b, lines = 40) {
+    // liveness first: once launch.sh is dead its state files are final, so a finish between the reads cannot look like "stopped"
+    const r = await sh(b, `kill -0 "$(cat ${B}/pid 2>/dev/null)" 2>/dev/null && alive=1 || alive=
+L=$(cat ${B}/login 2>/dev/null)
+if [ "$L" = failed ]; then echo "login_failed $(cat ${B}/exit 2>/dev/null || echo 1)"
+elif [ -f ${B}/exit ]; then echo "exited $(cat ${B}/exit)"
+elif [ -n "$alive" ]; then
+  case "$L" in checking|pending) echo "waiting_for_login $(cat ${B}/agent-name 2>/dev/null)";; *) echo running;; esac
+else echo stopped; fi
+case "$L" in checking|pending|failed) head -c 20000 ${B}/login.log 2>/dev/null;; *) tail -n ${lines} ${B}/agent.log 2>/dev/null;; esac
+true`);
+    const nl = r.stdout.indexOf("\n");
+    const [state, arg] = r.stdout.slice(0, nl).split(" ");
+    const out = r.stdout.slice(nl + 1);
+    const last = (s) => s.replace(ANSI, "").split("\n").slice(-lines - 1).join("\n");
+    if (state === "exited")
+        return { agent: "exited", exitCode: Number(arg), log: out };
+    if (state === "login_failed")
+        return { agent: "login_failed", exitCode: Number(arg), log: last(out) };
+    if (state === "waiting_for_login") {
+        const login = parseLogin(out, arg);
+        return { agent: "waiting_for_login", ...(login && { login }), log: last(out) };
+    }
+    return { agent: state === "running" ? "running" : "stopped", log: out };
+}
+// right after a start: on the device route, waits until the login shows its URL or is not needed; a failed login throws
+export async function loginState(b, setup, seconds = 60) {
+    const until = Date.now() + seconds * 1000;
+    let s = await agentState(b);
+    while (s.agent === "waiting_for_login" && !s.login && Date.now() < until) {
+        await new Promise((r) => setTimeout(r, 300));
+        s = await agentState(b);
+    }
+    if (s.agent === "login_failed" || (s.agent === "waiting_for_login" && !s.login))
+        throw new BsError("login_failed", `the agent's device login in ${b.id} ${s.agent === "login_failed" ? "failed" : "showed no URL within a minute"}`, `read log${setup ? `; check that the user did this once: ${setup}` : ""}`, { log: s.log });
+    return s;
+}
+const busy = (s) => s.agent === "running" || s.agent === "waiting_for_login";
+// ponytail: polls every second; fine for one waiting agent, a blocking exec in the box if many wait
+export async function waitAgent(b, seconds, lines) {
+    const until = Date.now() + seconds * 1000;
+    let s = await agentState(b, lines);
+    while (busy(s) && Date.now() < until) {
+        await new Promise((r) => setTimeout(r, 1000));
+        s = await agentState(b, lines);
+    }
+    return s;
+}
+// starts a follow-up; on the device route it returns the login the user has to approve first, if the box's login expired
+export async function ask(b, prompt) {
+    const r = await sh(b, "bash -s", `if ${RUNNING}; then echo running; exit 0; fi
+${writeFiles({ ".bottleship/prompt.txt": prompt })}
+${start("resume")}
+echo started`);
+    if (r.stdout.trim() === "running")
+        throw new BsError("agent_running", `the agent in ${b.id} is still working`, `wait for it: bottleship status ${b.id} --wait 600`);
+    if (r.stdout.trim() !== "started")
+        throw new BsError("ask_failed", `could not start the agent in ${b.id} (exit ${r.code})`, `bottleship exec ${b.id} -- cat ~/.bottleship/agent.log`, { stderr: tail(r.stderr) });
+    const s = await loginState(b);
+    return s.agent === "waiting_for_login" ? s.login : undefined;
+}
+// the env and workspace the agent sees, for exec
+export const inBox = (script) => `. ${B}/env.sh 2>/dev/null; cd "$HOME/workspace" 2>/dev/null; ${script}`;

package/dist/src/cli.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/cli.js

@@ -0,0 +1,202 @@
+// bottleship CLI. Built for agents: JSON on stdout, errors are {error, message, fix} with exit 1.
+// Only `init` on a terminal talks to a human.
+import { execFileSync } from "node:child_process";
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { parseArgs } from "node:util";
+import { ROOT } from "./paths.js";
+import { BsError, getProvider, loadConfig } from "./config.js";
+import { ask, goneFix, inBox, newBox, openBox, parseId, waitAgent, agentState } from "./boxes.js";
+import { init } from "./init.js";
+import { c, terminalUI } from "./ui.js";
+import { shq } from "../presets/providers/util.js";
+const HELP = `bottleship: run coding agents in remote sandboxes ("boxes"), like subagents. Output is JSON.
+
+  init [--yes] [--provider P] [--agent A] [--git-name N] [--git-email E]
+       [--host H]                  (ssh) the host boxes run on
+       [--i-understand-no-isolation]  (local, ssh) the user accepts agents running unsandboxed
+       [--provider custom --name N]  scaffolds ~/.bottleship/providers/N.ts for your own sandboxes
+       [--reset]                   start over: sets config.json aside as config.json.bak (on a terminal, offers to forget saved logins)
+                                   one-time setup; a human runs it in a terminal, or an agent with --yes
+  new "<task>" [--repo owner/name | --no-repo] [--provider P] [--agent A]
+                                   new box: clones the repo (default: the cwd's origin; local: a worktree), starts the agent
+  status <id> [--wait S] [--lines N]
+                                   is the agent running, its exit code and last output lines
+  ask <id> "<message>"             follow-up in the same conversation, once the agent has finished
+  exec <id> [-i] -- <cmd...>       run a command in the box's workspace; -i streams stdin/stdout
+  rm <id>                          destroy the box
+  help
+
+README: ${join(ROOT, "README.md")}`;
+const out = (obj) => void process.stdout.write(JSON.stringify(obj, null, 2) + "\n");
+const git = (cwd, ...args) => {
+    try {
+        return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    }
+    catch {
+        return "";
+    }
+};
+// owner/name or a GitHub URL becomes an https clone URL, so the GH_TOKEN helper applies; anything else is cloned as is
+function toRepo(s) {
+    const gh = s.match(/^([\w.-]+\/[\w.-]+?)(?:\.git)?$/) ?? s.match(/github\.com[:/]([^/]+\/[^/]+?)(?:\.git)?$/);
+    return gh ? { url: `https://github.com/${gh[1]}.git`, label: gh[1] } : { url: s, label: s };
+}
+// .env files at the repo root, minus templates like .env.example
+function dotenvFiles(root) {
+    const names = readdirSync(root).filter((f) => /^\.env/.test(f) && !/\.(example|sample|template)$/.test(f) && statSync(join(root, f)).isFile());
+    return Object.fromEntries(names.map((f) => [f, readFileSync(join(root, f), "utf8")]));
+}
+function args(argv, options = {}) {
+    return parseArgs({ args: argv, options, allowPositionals: true, strict: true });
+}
+const need = (v, usage) => {
+    if (!v)
+        throw new BsError("bad_request", `usage: bottleship ${usage}`, "bottleship help");
+    return v;
+};
+async function cmdNew(argv) {
+    const { values, positionals } = args(argv, { repo: { type: "string" }, "no-repo": { type: "boolean" }, provider: { type: "string" }, agent: { type: "string" } });
+    const prompt = need(positionals.join(" ").trim(), 'new "<task>" [--repo owner/name | --no-repo]');
+    const cfg = loadConfig();
+    const origin = git(process.cwd(), "remote", "get-url", "origin");
+    const here = origin ? toRepo(origin) : undefined;
+    let repo;
+    let dotenv = {};
+    // the local checkout, when the task's repo is the cwd's repo
+    let source;
+    if (values.repo)
+        repo = toRepo(values.repo);
+    else if (!values["no-repo"]) {
+        if (!here)
+            throw new BsError("no_repo", "this directory has no git origin to clone", "pass --repo owner/name, or --no-repo for an empty workspace");
+        repo = here;
+    }
+    if (repo && repo.url === here?.url) {
+        source = git(process.cwd(), "rev-parse", "--show-toplevel");
+        dotenv = dotenvFiles(source);
+    }
+    const agent = values.agent ?? cfg.agent;
+    const b = await newBox(cfg, { provider: values.provider ?? cfg.provider, agent, prompt, repo, dotenv, source });
+    return { id: b.id, provider: b.provider.name, agent, repo: repo?.label ?? null, ...(b.warning && { warning: b.warning }), ...(b.login && { login: b.login }), next: b.login ? loginNext(b.id) : `bottleship status ${b.id} --wait 600` };
+}
+const loginNext = (id) => `show the user this URL and code; the task starts once they approve. Then bottleship status ${id} --wait 600`;
+function statusNext(id, s) {
+    if (s.agent === "running")
+        return `bottleship status ${id} --wait 600`;
+    if (s.agent === "waiting_for_login")
+        return s.login ? loginNext(id) : `bottleship status ${id}`;
+    if (s.agent === "login_failed")
+        return `the agent's login failed or timed out, see log. bottleship ask ${id} "<prompt>" starts a new login; if the task never ran, send the whole task again`;
+    return `bottleship ask ${id} "<follow-up>", or bottleship rm ${id} when done`;
+}
+async function cmdStatus(argv) {
+    const { values, positionals } = args(argv, { wait: { type: "string" }, lines: { type: "string" } });
+    const id = need(positionals[0], "status <id> [--wait S]");
+    const cfg = loadConfig();
+    let b;
+    try {
+        b = await openBox(cfg, id);
+    }
+    catch (e) {
+        if (e instanceof BsError && e.code === "box_gone") {
+            const { provider, box } = parseId(cfg, id);
+            return { id: `${provider}:${box}`, box: "gone", next: goneFix };
+        }
+        throw e;
+    }
+    const lines = Number(values.lines ?? 40);
+    const s = values.wait ? await waitAgent(b, Number(values.wait), lines) : await agentState(b, lines);
+    return { id: b.id, box: "running", ...s, next: statusNext(b.id, s) };
+}
+async function cmdAsk(argv) {
+    const { positionals } = args(argv);
+    const [id, ...words] = positionals;
+    const message = need(words.join(" ").trim(), 'ask <id> "<message>"');
+    const b = await openBox(loadConfig(), need(id, 'ask <id> "<message>"'));
+    const login = await ask(b, message);
+    if (login)
+        return { id: b.id, agent: "waiting_for_login", login, next: loginNext(b.id) };
+    return { id: b.id, agent: "running", next: `bottleship status ${b.id} --wait 600` };
+}
+// one argument is a script, several are a command whose arguments are passed literally
+async function cmdExec(argv) {
+    const { values, positionals } = args(argv, { i: { type: "boolean", short: "i" } });
+    const [id, ...cmd] = positionals;
+    const usage = "exec <id> [-i] -- <cmd...>";
+    need(cmd[0], usage);
+    const script = inBox(cmd.length === 1 ? cmd[0] : cmd.map(shq).join(" "));
+    const b = await openBox(loadConfig(), need(id, usage));
+    if (!values.i) {
+        const r = await b.provider.exec(b.box, script);
+        process.stdout.write(r.stdout);
+        process.stderr.write(r.stderr);
+        process.exitCode = r.code ?? 1;
+        return;
+    }
+    if (!b.provider.openStream)
+        throw new BsError("no_stream", `provider ${b.provider.name} has no openStream()`, "use exec without -i, or add openStream to the provider");
+    const s = await b.provider.openStream(b.box, script);
+    process.stdin.pipe(s.stdin);
+    s.stdout.pipe(process.stdout);
+    s.stderr.pipe(process.stderr);
+    await new Promise((res) => s.onClose((code) => {
+        process.exitCode = code ?? 0;
+        process.stdin.unpipe(s.stdin);
+        process.stdin.destroy();
+        res();
+    }));
+}
+async function cmdRm(argv) {
+    const id = need(args(argv).positionals[0], "rm <id>");
+    const cfg = loadConfig();
+    const { provider, box } = parseId(cfg, id);
+    await (await getProvider(cfg, provider)).destroy(box);
+    return { removed: `${provider}:${box}` };
+}
+async function cmdInit(argv, ui) {
+    const { values } = args(argv, { yes: { type: "boolean", short: "y" }, provider: { type: "string" }, host: { type: "string" }, name: { type: "string" }, agent: { type: "string" }, "git-name": { type: "string" }, "git-email": { type: "string" }, "i-understand-no-isolation": { type: "boolean" }, reset: { type: "boolean" } });
+    const result = await init({ provider: values.provider, host: values.host, name: values.name, agent: values.agent, gitName: values["git-name"], gitEmail: values["git-email"], noIsolation: values["i-understand-no-isolation"], reset: values.reset }, ui);
+    if (!result.ok)
+        process.exitCode = 1;
+    return result;
+}
+async function main() {
+    const [cmd, ...argv] = process.argv.slice(2);
+    // init talks to a human on a terminal, unless told --yes
+    const ui = cmd === "init" && process.stdin.isTTY && process.stdout.isTTY && !argv.includes("--yes") && !argv.includes("-y") ? terminalUI() : undefined;
+    try {
+        switch (cmd) {
+            case "new": return out(await cmdNew(argv));
+            case "status": return out(await cmdStatus(argv));
+            case "ask": return out(await cmdAsk(argv));
+            case "exec": return await cmdExec(argv);
+            case "rm": return out(await cmdRm(argv));
+            case "init": {
+                const r = await cmdInit(argv, ui);
+                return ui ? undefined : out(r);
+            }
+            case "help":
+            case "--help":
+            case "-h":
+            case undefined:
+                return void process.stdout.write(HELP + "\n");
+            default:
+                throw new BsError("bad_request", `unknown command "${cmd}"`, "bottleship help");
+        }
+    }
+    catch (e) {
+        const err = e instanceof BsError ? e
+            : e.code?.startsWith("ERR_PARSE_ARGS") ? new BsError("bad_request", e.message, "bottleship help")
+                : new BsError("internal", e.message);
+        process.exitCode = 1;
+        if (!ui)
+            return out(err.toJSON());
+        const fix = err.code === "secret_missing" ? "run `bottleship init` again once you have the value" : err.fix;
+        ui.fail(err.message, fix);
+    }
+    finally {
+        ui?.close();
+    }
+}
+await main();

package/dist/src/config.d.ts

@@ -0,0 +1,27 @@
+import type { AgentSpec, BsErrorJSON, Config, LoadedProvider, SecretSource } from "./types.ts";
+export declare class BsError extends Error {
+    code: string;
+    fix: string | undefined;
+    extra: Record<string, unknown>;
+    constructor(code: string, message: string, fix?: string, extra?: Record<string, unknown>);
+    toJSON(): BsErrorJSON;
+}
+export declare const DEFAULTS: Config;
+export declare const unisolated: (cfg: Config, provider: string) => boolean;
+export declare const noIsolationAccepted: (cfg: Config, provider: string) => boolean;
+export declare function noIsolationError(provider: string): BsError;
+export declare function readUserConfig(): Partial<Config>;
+export declare function writeUserConfig(raw: Partial<Config>): void;
+export declare function loadConfig(raw?: Partial<Config>): Config;
+export declare function getAgent(cfg: Config, name: string): AgentSpec;
+export declare const isSource: (v: unknown) => v is SecretSource;
+export interface NamedSecret {
+    name: string;
+    source: SecretSource;
+}
+export declare function boxEnv(cfg: Config, agentName: string): {
+    env: Record<string, string>;
+    missing: NamedSecret[];
+};
+export declare function neededSecrets(cfg: Config, providerName: string, agentName: string): NamedSecret[];
+export declare function getProvider(cfg: Config, name: string): Promise<LoadedProvider>;

package/dist/src/config.js

@@ -0,0 +1,151 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+// ~/.bottleship/config.json: personal, never from a repo. Decides providers, agents,
+// the git identity, and which env vars (and secrets) every box gets.
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { isAbsolute, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { CONFIG_FILE, DIST, HOME, ROOT } from "./paths.js";
+import { readSecret } from "./secrets.js";
+import * as kit from "../presets/providers/util.js";
+// errors agents can act on: a code, a message, and the next step
+export class BsError extends Error {
+    code;
+    fix;
+    extra;
+    constructor(code, message, fix, extra = {}) {
+        super(message);
+        this.code = code;
+        this.fix = fix;
+        this.extra = extra;
+    }
+    toJSON() {
+        return { error: this.code, message: this.message, ...(this.fix ? { fix: this.fix } : {}), ...this.extra };
+    }
+}
+export const DEFAULTS = {
+    provider: "docker",
+    agent: "claude",
+    git: { name: "", email: "" },
+    // a fine-grained token for the repos the user picks; init asks for it
+    env: { GH_TOKEN: { store: "github" } },
+    providers: {
+        docker: { module: "builtin:docker" },
+        exe: { module: "builtin:exe" },
+        e2b: { module: "builtin:e2b", apiKey: { store: "e2b" } },
+        daytona: { module: "builtin:daytona", apiKey: { store: "daytona" } },
+        modal: { module: "builtin:modal", tokenId: { store: "modal-token-id" }, tokenSecret: { store: "modal-token-secret" } },
+        ssh: { module: "builtin:ssh" },
+        local: { module: "builtin:local" },
+    },
+    agents: {},
+    templates: {},
+};
+// providers whose boxes run agents unsandboxed, as the user, so the user has to accept that once in init
+export const unisolated = (cfg, provider) => ["builtin:local", "builtin:ssh"].includes(cfg.providers[provider]?.module ?? "");
+export const noIsolationAccepted = (cfg, provider) => cfg.providers[provider]?.acceptNoIsolation === true;
+export function noIsolationError(provider) {
+    return new BsError("no_isolation_unconfirmed", `the ${provider} provider runs agents with no isolation and with permission prompts off, as the user, and the user has not accepted that`, `ask the user to run \`bottleship init --provider ${provider}\` in their terminal and confirm, or pick an isolated provider (docker, e2b, daytona, modal, exe)`);
+}
+function builtinAgents() {
+    const dir = join(ROOT, "presets/agents");
+    const files = readdirSync(dir).filter((f) => f.endsWith(".json"));
+    return Object.fromEntries(files.map((f) => [f.slice(0, -5), JSON.parse(readFileSync(join(dir, f), "utf8"))]));
+}
+export function readUserConfig() {
+    return existsSync(CONFIG_FILE) ? JSON.parse(readFileSync(CONFIG_FILE, "utf8")) : {};
+}
+export function writeUserConfig(raw) {
+    mkdirSync(HOME, { recursive: true });
+    writeFileSync(CONFIG_FILE, JSON.stringify(raw, null, 2) + "\n");
+}
+// providers merge over the builtins, and each agent over its builtin; env replaces the default so entries can be dropped
+export function loadConfig(raw = readUserConfig()) {
+    return {
+        ...DEFAULTS,
+        ...raw,
+        git: { ...DEFAULTS.git, ...raw.git },
+        providers: { ...DEFAULTS.providers, ...raw.providers },
+        agents: mergeAgents(builtinAgents(), raw.agents ?? {}),
+    };
+}
+// a user entry for a builtin agent overrides its fields, and login's, so { "login": { "use": "token" } } is enough
+function mergeAgents(builtin, user) {
+    const agents = { ...builtin };
+    for (const [name, spec] of Object.entries(user)) {
+        const login = builtin[name]?.login || spec.login ? { ...builtin[name]?.login, ...spec.login } : undefined;
+        agents[name] = { ...builtin[name], ...spec, ...(login && { login }) };
+    }
+    return agents;
+}
+// the env var that logs a box's agent in on the token route; the device route logs in inside the box
+function loginEnv(cfg, agentName) {
+    const l = getAgent(cfg, agentName).login;
+    return l?.use === "token" && l.token ? { [l.token.env]: { store: l.token.store } } : {};
+}
+// the agent's env, its login token, then config env over both
+const allEnv = (cfg, agentName) => ({ ...getAgent(cfg, agentName).env, ...loginEnv(cfg, agentName), ...cfg.env });
+export function getAgent(cfg, name) {
+    const a = cfg.agents[name];
+    if (!a)
+        throw new BsError("unknown_agent", `no agent "${name}"`, `known: ${Object.keys(cfg.agents).join(", ")}. Add one under "agents" in ${CONFIG_FILE}`);
+    return a;
+}
+export const isSource = (v) => typeof v === "object" && v !== null && ["store", "command", "env"].some((k) => typeof v[k] === "string");
+// the env every box of this agent gets, read now; missing secrets are listed, not thrown
+export function boxEnv(cfg, agentName) {
+    const env = {};
+    const missing = [];
+    for (const [name, v] of Object.entries(allEnv(cfg, agentName))) {
+        if (!isSource(v))
+            env[name] = v;
+        else
+            try {
+                env[name] = readSecret(v);
+            }
+            catch {
+                missing.push({ name, source: v });
+            }
+    }
+    return { env, missing };
+}
+// every secret a box of this provider and agent needs: the provider's own API keys, the box env and the agent's login
+export function neededSecrets(cfg, providerName, agentName) {
+    const fromProvider = Object.entries(cfg.providers[providerName] ?? {}).filter(([, v]) => isSource(v)).map(([k, v]) => ({ name: `providers.${providerName}.${k}`, source: v }));
+    const fromEnv = Object.entries(allEnv(cfg, agentName)).filter(([, v]) => isSource(v)).map(([name, v]) => ({ name, source: v }));
+    return [...fromProvider, ...fromEnv];
+}
+// providers.<name> = { module, ...options }; module is "builtin:<preset>", an absolute path, or relative to HOME (.mjs or .ts)
+export async function getProvider(cfg, name) {
+    const spec = cfg.providers[name];
+    if (!spec)
+        throw new BsError("unknown_provider", `no provider "${name}"`, `known: ${Object.keys(cfg.providers).join(", ")}. Add one under "providers" in ${CONFIG_FILE}`);
+    const { module, ...options } = spec;
+    const file = module.startsWith("builtin:")
+        ? join(DIST, "presets/providers", `${module.slice("builtin:".length)}.js`)
+        : isAbsolute(module) ? module : resolve(HOME, module);
+    const bad = (msg) => new BsError("bad_provider", `provider "${name}" (${file}) ${msg}`, `fix providers.${name}.module in ${CONFIG_FILE}`);
+    if (module.startsWith("builtin:") && !existsSync(file))
+        throw new BsError("bad_provider", `${module} is not in this version of bottleship`, "update bottleship, or pick another provider with `bottleship init --provider <name>`");
+    let factory;
+    try {
+        factory = (await import(__rewriteRelativeImportExtension(pathToFileURL(file).href))).default;
+    }
+    catch (e) {
+        throw bad(`failed to load: ${e.message}`);
+    }
+    if (typeof factory !== "function")
+        throw bad("has no default export function");
+    const ctx = { name, options, secret: readSecret, log: (...a) => console.error(`[${name}]`, ...a), kit };
+    const provider = { name, ...(await factory(ctx)) };
+    for (const m of ["create", "exec", "destroy"])
+        if (typeof provider[m] !== "function")
+            throw bad(`has no ${m}()`);
+    return provider;
+}