bottleship 0.1.0-prototype.0 → 0.1.0-prototype.2

package/dist/src/boxes.js

@@ -1,15 +1,34 @@
-// Boxes that run an agent in the background. All state lives in the box under ~/.bottleship:
-// env.sh (env and secrets), run.sh/resume.sh (the agent command), prompt.txt, pid, exit, agent.log,
-// and on the device login route login.sh, login-status.sh, login (checking, pending, ok or failed) and login.log.
+// Boxes: a provider box set up as the repo's dev environment, optionally with an agent working in it.
+// All state lives in the box under ~/.bottleship: env.sh, prepare.sh, ports, stage, setup.log, app.log, app.pid,
+// and for agent boxes launch.sh, run.sh, resume.sh, prompt.txt, pid, exit, prepare.log, agent.log.
 import { createHash, randomBytes } from "node:crypto";
-import { fill, shq } from "../presets/providers/util.js";
-import { BsError, boxEnv, getAgent, getProvider, noIsolationAccepted, noIsolationError, unisolated } from "./config.js";
+import { BsError, boxEnv, getAgent, missingSecrets } from "./config.js";
+import { getProvider } from "./provider.js";
+import { fill, shq } from "./util.js";
 const B = '"$HOME/.bottleship"';
 const MARK = "__BOTTLESHIP_PROMPT__";
 const tail = (s, n = 2000) => (s.length > n ? "..." + s.slice(-n) : s);
-export const goneFix = 'the box is gone. Start a new one with `bottleship new "<task>"` and tell its agent to continue on the branch the old box pushed';
-// the prompt is read from a file at run time, so one script serves every turn
-const agentScript = (template) => fill(template, { prompt: MARK }).split(shq(MARK)).join(`"$(cat ${B}/prompt.txt)"`);
+export const goneFix = 'the box is gone. Start a new one with `bottleship agent new "<task>"` and tell its agent to continue on the branch the old box pushed';
+// the image every box starts from; the repo's .bottleship/Dockerfile lines run as root on top, then the agent installs as box
+const BASE = `FROM node:22-bookworm-slim
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+RUN apt-get update && apt-get install -y --no-install-recommends git curl ca-certificates ripgrep \\
+ && mkdir -p -m 755 /etc/apt/keyrings \\
+ && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg -o /etc/apt/keyrings/githubcli-archive-keyring.gpg \\
+ && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" > /etc/apt/sources.list.d/github-cli.list \\
+ && apt-get update && apt-get install -y --no-install-recommends gh \\
+ && rm -rf /var/lib/apt/lists/*
+RUN userdel -r node && useradd -m -s /bin/bash -u 1000 box
+ENV NPM_CONFIG_PREFIX=/home/box/.bottleship/npm PATH=/home/box/.bottleship/npm/bin:/home/box/.local/bin:$PATH
+`;
+// the box image for a repo: base, the repo's lines, the agent's install; named by its content so a change builds a new one
+// extra: lines bottleship itself adds last, e.g. the review ports, so they never invalidate the cached layers above
+export function boxImage(cfg, agentName, repoEnv, extra = "") {
+    const repo = repoEnv?.dockerfile ? `# .bottleship/Dockerfile\n${repoEnv.dockerfile.trimEnd()}\n` : "";
+    const install = (getAgent(cfg, agentName).install ?? []).map((line) => `RUN ${line}\n`).join("");
+    const dockerfile = `${BASE}${repo}USER box\nWORKDIR /home/box\n${install}${extra}`;
+    return { dockerfile, image: `bottleship-${createHash("sha256").update(dockerfile).digest("hex").slice(0, 12)}` };
+}
 // writes files under the box's $HOME from inside a script fed on stdin, so secrets never show up in argv
 function writeFiles(files) {
     const eof = `BOTTLESHIP_EOF_${randomBytes(8).toString("hex")}`;
@@ -20,246 +39,229 @@ function writeFiles(files) {
     })
         .join("\n");
 }
-// starts the agent detached; launch.sh records the exit code when it ends
-const start = (mode) => `rm -f ${B}/exit
-if [ -f ${B}/login.sh ]; then echo checking > ${B}/login.tmp && mv -f ${B}/login.tmp ${B}/login; rm -f ${B}/login.log; fi
-nohup bash ${B}/launch.sh ${mode} </dev/null >/dev/null 2>&1 &
-echo $! > ${B}/pid`;
-const RUNNING = `[ ! -f ${B}/exit ] && kill -0 "$(cat ${B}/pid 2>/dev/null)" 2>/dev/null`;
-// on the device route it logs in first when login-status.sh fails, giving up after login-timeout seconds; until a run started, a follow-up runs instead of resuming
-const LAUNCH = `B="$HOME/.bottleship"
+// gets the repo's environment going: setup.sh once, then start.sh in the background until every port listens.
+// Writes the stage it is in (setup, start, ready, failed), exits non-zero on failure; $1 is the deadline in seconds.
+const PREPARE = `B="$HOME/.bottleship"
 . "$B/env.sh"
 cd "$HOME/workspace"
-mode=$1
-# state files are replaced whole, so status never reads one half-written
+deadline=$((SECONDS + \${1:-900}))
 put() { echo "$2" > "$B/$1.tmp" && mv -f "$B/$1.tmp" "$B/$1"; }
+fail() { put stage failed; echo "$1"; exit 1; }
 killtree() { for c in $(ps -A -o pid=,ppid= | awk -v p="$1" '$2 == p { print $1 }'); do killtree "$c"; done; kill "$1" 2>/dev/null; }
-[ -f "$B/started" ] || mode=run
-if [ -f "$B/login.sh" ]; then
-  if bash "$B/login-status.sh" >/dev/null 2>&1; then put login ok; else
-    put login pending
-    # stays in the box's process group so rm can find it; a timeout ends its whole process tree
-    bash "$B/login.sh" > "$B/login.log" 2>&1 </dev/null &
-    lp=$!
-    end=$((SECONDS + $(cat "$B/login-timeout")))
-    while kill -0 $lp 2>/dev/null && [ $SECONDS -lt $end ]; do sleep 1; done
-    if kill -0 $lp 2>/dev/null; then killtree $lp; echo "bottleship: no approval within $(cat "$B/login-timeout") seconds" >> "$B/login.log"; fi
-    wait $lp
-    rc=$?
-    if [ $rc -ne 0 ]; then put login failed; put exit $rc; exit; fi
-    put login ok
-  fi
+if [ -f .bottleship/setup.sh ]; then
+  put stage setup
+  bash .bottleship/setup.sh > "$B/setup.log" 2>&1 </dev/null &
+  pid=$!
+  while kill -0 $pid 2>/dev/null; do
+    [ $SECONDS -lt $deadline ] || { killtree $pid; fail "setup.sh did not finish in time, see ~/.bottleship/setup.log"; }
+    sleep 1
+  done
+  wait $pid || fail "setup.sh failed (exit $?), see ~/.bottleship/setup.log"
+fi
+if [ -f .bottleship/start.sh ]; then
+  put stage start
+  nohup bash .bottleship/start.sh > "$B/app.log" 2>&1 </dev/null &
+  echo $! > "$B/app.pid"
+  for port in $(cat "$B/ports"); do
+    until (exec 3<>"/dev/tcp/127.0.0.1/$port") 2>/dev/null; do
+      kill -0 "$(cat "$B/app.pid")" 2>/dev/null || fail "start.sh exited before port $port was up, see ~/.bottleship/app.log"
+      [ $SECONDS -lt $deadline ] || fail "port $port was not up in time, see ~/.bottleship/app.log"
+      sleep 1
+    done
+  done
 fi
+put stage ready
+`;
+// prepares the environment once, then runs the agent; the agent runs even if preparing failed, and can see why in prepare.log
+const LAUNCH = `B="$HOME/.bottleship"
+. "$B/env.sh"
+mode=$1
+put() { echo "$2" > "$B/$1.tmp" && mv -f "$B/$1.tmp" "$B/$1"; }
+[ -f "$B/stage" ] || bash "$B/prepare.sh" > "$B/prepare.log" 2>&1
+cd "$HOME/workspace"
+[ -f "$B/started" ] || mode=run
 touch "$B/started"
 bash "$B/$mode.sh" > "$B/agent.log" 2>&1 </dev/null
 put exit $?
 `;
-// node for agents installed with npm, without sudo, if the box has none
-const NODE = `if ! command -v node >/dev/null; then
-  case "$(uname -m)" in aarch64|arm64) A=arm64;; *) A=x64;; esac
-  F=$(curl -fsSL https://nodejs.org/dist/latest-v22.x/SHASUMS256.txt | grep -o "node-v[0-9.]*-linux-$A.tar.xz" | head -1)
-  mkdir -p ${B}/node && curl -fsSL "https://nodejs.org/dist/latest-v22.x/$F" | tar -xJ -C ${B}/node --strip-components=1
-fi`;
+// starts the agent detached; launch.sh records the exit code when it ends
+const start = (mode) => `rm -f ${B}/exit
+nohup bash ${B}/launch.sh ${mode} </dev/null >/dev/null 2>&1 &
+echo $! > ${B}/pid`;
+const RUNNING = `[ ! -f ${B}/exit ] && kill -0 "$(cat ${B}/pid 2>/dev/null)" 2>/dev/null`;
+// a follow-up for the agent, read from stdin: prints running (the agent is busy, nothing changes) or started.
+// bottleship agent ask runs it, and so does the review server when the reviewer sends comments.
+const ASK = `if ${RUNNING}; then echo running; exit 0; fi
+cat > ${B}/prompt.txt
+${start("resume")}
+echo started
+`;
+// whether the agent is still running, for the review server: prints running or idle
+const STATE = `if ${RUNNING}; then echo running; else echo idle; fi
+`;
 // gh and git both read GH_TOKEN, so pushes and PRs work with no further login
 const GIT_HELPER = `!f() { test "$1" = get && echo username=x-access-token && echo "password=$GH_TOKEN"; }; f`;
-// the box template: what every box set up at start would install, as the non-root user box; npm globals land where env.sh puts them
-const DOCKERFILE = `FROM node:22-bookworm-slim
-SHELL ["/bin/bash", "-o", "pipefail", "-c"]
-RUN apt-get update && apt-get install -y --no-install-recommends git curl ca-certificates ripgrep \\
- && mkdir -p -m 755 /etc/apt/keyrings \\
- && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg -o /etc/apt/keyrings/githubcli-archive-keyring.gpg \\
- && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" > /etc/apt/sources.list.d/github-cli.list \\
- && apt-get update && apt-get install -y --no-install-recommends gh \\
- && rm -rf /var/lib/apt/lists/*
-RUN userdel -r node && useradd -m -s /bin/bash -u 1000 box
-USER box
-WORKDIR /home/box
-ENV NPM_CONFIG_PREFIX=/home/box/.bottleship/npm PATH=/home/box/.bottleship/npm/bin:/home/box/.local/bin:$PATH
-`;
-// bakes in only this agent's install: other agents install at start, and a changed agent gets a new template
-export function templateSpec(cfg, agentName) {
-    const dockerfile = DOCKERFILE + (getAgent(cfg, agentName).install ?? []).map((line) => `RUN ${line}\n`).join("");
-    return { name: `bottleship-${createHash("sha256").update(dockerfile).digest("hex").slice(0, 8)}`, dockerfile };
-}
-// the template init recorded for this provider, if it was built from the current spec of the configured agent
-export function currentTemplate(cfg, provider) {
-    const t = cfg.templates[provider];
-    return t && t.name === templateSpec(cfg, cfg.agent).name ? t.ref : undefined;
-}
+// the host of an https clone URL, e.g. a GitHub Enterprise host, so GH_TOKEN reaches it too
+const cloneHost = (url) => url.match(/^https:\/\/([^/:]+)/)?.[1]?.toLowerCase();
+// the prompt is read from a file at run time, so one script serves every turn
+const agentScript = (template) => fill(template, { prompt: MARK }).split(shq(MARK)).join(`"$(cat ${B}/prompt.txt)"`);
 export function parseId(cfg, handle) {
     const i = handle.indexOf(":");
     return i < 0 ? { provider: cfg.provider, box: handle } : { provider: handle.slice(0, i), box: handle.slice(i + 1) };
 }
-export function newBoxId(prompt) {
-    const slug = prompt.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 20).replace(/-$/, "");
+export function newBoxId(label) {
+    const slug = label.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 20).replace(/-$/, "");
     return `bs-${slug ? slug + "-" : ""}${randomBytes(2).toString("hex")}`;
 }
 async function sh(b, script, stdin) {
     try {
-        return await b.provider.exec(b.box, script, { stdin });
+        return await b.provider.exec(b.box, script, stdin);
     }
     catch (e) {
-        throw new BsError("box_unreachable", `could not run a command in ${b.id}: ${e.message}`, `bottleship status ${b.id}`);
+        throw new BsError("box_unreachable", `could not run a command in ${b.id}: ${e.message}`, `bottleship agent status ${b.id}`);
     }
 }
 // a box that exists; throws box_gone if the provider says it does not
 export async function openBox(cfg, handle) {
     const { provider: name, box } = parseId(cfg, handle);
-    const provider = await getProvider(cfg, name);
-    if (provider.status && (await provider.status(box)) === "gone")
+    const provider = getProvider(name);
+    if ((await provider.status(box)) === "gone")
         throw new BsError("box_gone", `box ${handle} is gone`, goneFix);
     return { id: `${name}:${box}`, provider, box };
 }
-// one round trip: files, node, git, clone (unless the provider made ~/workspace a checkout), install, start
-export async function setupAndStart(cfg, b, { agent: agentName, prompt, repo, dotenv = {} }) {
-    const agent = getAgent(cfg, agentName);
-    const { env, missing } = boxEnv(cfg, agentName);
-    if (missing.length)
-        throw missingSecrets(missing.map((m) => m.name));
-    const unset = (agent.unset ?? []).filter((k) => !(k in env));
-    const device = agent.login?.use === "device" ? agent.login.device : undefined;
-    if (agent.login?.use === "device" && !device)
-        throw new BsError("bad_agent", `agent ${agentName} uses the device login route but has no login.device`, `set agents.${agentName}.login.use to another route in ~/.bottleship/config.json`);
+// creates the box from the repo's image and sets up env, git and the workspace; a failure leaves no box
+export async function createBox(cfg, opts) {
+    let env = {};
+    let unset = [];
+    if (opts.agent) {
+        const r = boxEnv(cfg, opts.agent);
+        if (r.missing.length)
+            throw missingSecrets(r.missing.map((m) => m.name));
+        env = r.env;
+        unset = (getAgent(cfg, opts.agent).unset ?? []).filter((k) => !(k in env));
+    }
+    env = { ...env, ...opts.env };
+    const provider = getProvider(opts.provider);
+    const { dockerfile, image } = boxImage(cfg, opts.agent ?? cfg.agent, opts.repoEnv, opts.dockerfile);
+    const box = newBoxId(opts.label);
+    try {
+        await provider.create(box, dockerfile, image);
+    }
+    catch (e) {
+        await provider.destroy(box).catch(() => { });
+        throw new BsError("create_failed", `could not create the box: ${e.message}`, "if the image build failed, fix .bottleship/Dockerfile and try again");
+    }
+    const b = { id: `${provider.name}:${box}`, provider, box };
+    try {
+        await setup(cfg, b, opts, env, unset);
+    }
+    catch (e) {
+        await provider.destroy(box).catch(() => { });
+        throw e;
+    }
+    return b;
+}
+async function setup(cfg, b, opts, env, unset) {
     const envSh = [
         ...(unset.length ? [`unset ${unset.join(" ")}`] : []),
-        'export PATH="$HOME/.bottleship/node/bin:$HOME/.bottleship/npm/bin:$HOME/.local/bin:$PATH"',
-        'export NPM_CONFIG_PREFIX="$HOME/.bottleship/npm"',
         ...Object.entries(env).map(([k, v]) => `export ${k}=${shq(v)}`),
     ].join("\n");
+    const agent = opts.agent ? getAgent(cfg, opts.agent) : undefined;
     const files = {
         // the agent needs these secrets, so it can read them; README says to scope them narrowly
         ".bottleship/env.sh": envSh,
-        ".bottleship/launch.sh": LAUNCH,
-        ".bottleship/run.sh": agentScript(agent.run),
-        ".bottleship/resume.sh": agentScript(agent.resume),
-        ".bottleship/prompt.txt": prompt,
-        ...(device && {
-            ".bottleship/login.sh": device.command,
-            ".bottleship/login-status.sh": device.status,
-            ".bottleship/login-timeout": String(device.timeout ?? 900),
-            ".bottleship/agent-name": agentName,
-        }),
-        ...Object.fromEntries(Object.entries(dotenv).map(([name, content]) => [`.bottleship/dotenv/${name}`, content])),
+        ".bottleship/prepare.sh": PREPARE,
+        ".bottleship/ports": (opts.repoEnv?.ports ?? []).join("\n"),
+        ...(agent && { ".bottleship/launch.sh": LAUNCH, ".bottleship/run.sh": agentScript(agent.run), ".bottleship/resume.sh": agentScript(agent.resume), ".bottleship/ask.sh": ASK, ".bottleship/agent-state.sh": STATE }),
+        ...Object.fromEntries(Object.entries(opts.dotenv ?? {}).map(([name, content]) => [`.bottleship/dotenv/${name}`, content])),
     };
+    const ws = opts.workspace;
     const script = `set -e
 ${writeFiles(files)}
 chmod 600 ${B}/env.sh
-. ${B}/env.sh
-${NODE}
 ${cfg.git.name ? `git config --global user.name ${shq(cfg.git.name)}` : ""}
 ${cfg.git.email ? `git config --global user.email ${shq(cfg.git.email)}` : ""}
-git config --global credential.https://github.com.helper ${shq(GIT_HELPER)}
-${repo ? `[ -e "$HOME/workspace/.git" ] || git clone --quiet ${shq(repo.url)} "$HOME/workspace"` : ""}
+${[...new Set(["github.com", ...(ws && "clone" in ws ? [cloneHost(ws.clone.url)] : [])].filter(Boolean))].map((h) => `git config --global credential.https://${h}.helper ${shq(GIT_HELPER)}`).join("\n")}
 mkdir -p "$HOME/workspace"
-if [ -d ${B}/dotenv ]; then cp -R ${B}/dotenv/. "$HOME/workspace/"; fi
-cd "$HOME/workspace"
-${(agent.install ?? []).join("\n")}
-${start("run")}`;
+${ws && "clone" in ws ? `(. ${B}/env.sh
+  git clone --quiet ${shq(ws.clone.url)} "$HOME/workspace"
+  ${opts.pr ? `cd "$HOME/workspace"
+  git fetch --quiet origin ${shq(`pull/${opts.pr.number}/head:review/pr-${opts.pr.number}`)} ${shq(`${opts.pr.base}:review/base`)}
+  git checkout --quiet ${shq(`review/pr-${opts.pr.number}`)}
+  git branch --quiet -f review/base "$(git merge-base review/base ${shq(`review/pr-${opts.pr.number}`)})"
+  git worktree add --quiet "$HOME/base" review/base` : ""})` : ""}
+if [ -d ${B}/dotenv ]; then cp -R ${B}/dotenv/. "$HOME/workspace/"; [ -d "$HOME/base" ] && cp -R ${B}/dotenv/. "$HOME/base/"; fi
+true`;
     const r = await sh(b, "bash -s", script);
     if (r.code !== 0)
         throw new BsError("setup_failed", `setting up ${b.id} failed (exit ${r.code})`, "fix the cause in stderr, then try again", { stderr: tail(r.stderr), stdout: tail(r.stdout) });
+    if (ws && "tar" in ws)
+        await putTar(b, "workspace", ws.tar);
 }
-export function missingSecrets(names) {
-    return new BsError("secret_missing", `no value for ${names.join(", ")}`, "ask the user to run `bottleship init` in their terminal; it asks for missing secrets with a hidden prompt. Never ask the user to paste a secret to you", { missing: names });
+// unpacks a tar into a directory under the box's $HOME
+export async function putTar(b, dir, tar) {
+    // GNU tar warns about the extended headers macOS tar writes
+    const t = await sh(b, `d="$HOME"/${shq(dir)}; mkdir -p "$d"; w=; tar --version 2>/dev/null | grep -q GNU && w=--warning=no-unknown-keyword; tar -x $w -C "$d"`, tar);
+    if (t.code !== 0)
+        throw new BsError("setup_failed", `copying files into ${b.id} failed (exit ${t.code})`, "fix the cause in stderr, then try again", { stderr: tail(t.stderr) });
 }
-// source: the local checkout of the task's repo, for providers that can use it (local makes a worktree)
-export async function newBox(cfg, opts) {
-    // fails before a box exists when a secret is missing
-    if (unisolated(cfg, opts.provider) && !noIsolationAccepted(cfg, opts.provider))
-        throw noIsolationError(opts.provider);
-    const { missing } = boxEnv(cfg, opts.agent);
-    if (missing.length)
-        throw missingSecrets(missing.map((m) => m.name));
-    const provider = await getProvider(cfg, opts.provider);
-    const template = provider.template && currentTemplate(cfg, provider.name);
-    const { id: box } = await provider.create({ id: newBoxId(opts.prompt), ...(opts.source && { source: opts.source }), ...(template && { template }) });
-    const b = { id: `${provider.name}:${box}`, provider, box };
-    // a stale or missing template still works, as setup installs what the template would have held, only slower
-    if (provider.template && !template && provider.name === cfg.provider)
-        b.warning = `no current box template for ${provider.name}, so this box installs its tools at start, which is slower; run \`bottleship init\` to build one`;
-    try {
-        await setupAndStart(cfg, b, opts);
-        const s = await loginState(b, getAgent(cfg, opts.agent).login?.device?.setup);
-        if (s.agent === "waiting_for_login")
-            b.login = s.login;
-    }
-    catch (e) {
-        await provider.destroy(box).catch(() => { });
-        throw e;
-    }
-    return b;
+// writes text files under the box's $HOME, by path
+export async function putFiles(b, files) {
+    const r = await sh(b, "bash -s", `set -e\n${writeFiles(files)}`);
+    if (r.code !== 0)
+        throw new BsError("setup_failed", `writing files into ${b.id} failed (exit ${r.code})`, "fix the cause in stderr, then try again", { stderr: tail(r.stderr) });
 }
-const ANSI = /\x1b\[[0-9;?]*[A-Za-z]/g;
-// the first URL in a login's output, and a code like ABCD-12345 outside of URLs
-export function parseLogin(output, agent) {
-    const text = output.replace(ANSI, "");
-    const url = text.match(/https?:\/\/[^\s"'<>]+/)?.[0];
-    if (!url)
-        return undefined;
-    const code = text.replace(/https?:\/\/\S+/g, " ").match(/\b[A-Z0-9]{4,}-[A-Z0-9]{4,}\b/)?.[0];
-    return { url, ...(code && { code }), agent };
+// runs a script in the box and returns its result
+export const runIn = (b, script) => sh(b, "bash -s", script);
+// runs the repo's setup.sh and start.sh now and waits for its ports; on failure, the log of the step that failed
+export async function prepare(b, seconds = 900) {
+    const r = await sh(b, `bash ${B}/prepare.sh ${Number(seconds)}`);
+    if (r.code === 0)
+        return { stage: "ready" };
+    const logs = await sh(b, `cd ${B}; for f in setup.log app.log; do [ -f $f ] && { echo "== $f"; tail -n 60 $f; }; done; true`);
+    return { stage: "failed", message: r.stdout.trim() || r.stderr.trim(), log: logs.stdout };
+}
+// starts the agent in a box made with an agent
+export async function startAgent(b, prompt) {
+    const r = await sh(b, "bash -s", `set -e\n${writeFiles({ ".bottleship/prompt.txt": prompt })}\n${start("run")}`);
+    if (r.code !== 0)
+        throw new BsError("start_failed", `could not start the agent in ${b.id} (exit ${r.code})`, `bottleship agent exec ${b.id} -- cat ~/.bottleship/agent.log`, { stderr: tail(r.stderr) });
 }
-// the login's output (all of it, for the URL) while it is the current step, else the agent's last lines
+const ANSI = /\x1b\[[0-9;?]*[A-Za-z]/g;
 export async function agentState(b, lines = 40) {
     // liveness first: once launch.sh is dead its state files are final, so a finish between the reads cannot look like "stopped"
     const r = await sh(b, `kill -0 "$(cat ${B}/pid 2>/dev/null)" 2>/dev/null && alive=1 || alive=
-L=$(cat ${B}/login 2>/dev/null)
-if [ "$L" = failed ]; then echo "login_failed $(cat ${B}/exit 2>/dev/null || echo 1)"
-elif [ -f ${B}/exit ]; then echo "exited $(cat ${B}/exit)"
-elif [ -n "$alive" ]; then
-  case "$L" in checking|pending) echo "waiting_for_login $(cat ${B}/agent-name 2>/dev/null)";; *) echo running;; esac
+if [ -f ${B}/exit ]; then echo "exited $(cat ${B}/exit)"
+elif [ -n "$alive" ]; then echo running
 else echo stopped; fi
-case "$L" in checking|pending|failed) head -c 20000 ${B}/login.log 2>/dev/null;; *) tail -n ${lines} ${B}/agent.log 2>/dev/null;; esac
+cat ${B}/stage 2>/dev/null || echo
+tail -n ${Number(lines)} ${B}/agent.log 2>/dev/null
 true`);
-    const nl = r.stdout.indexOf("\n");
-    const [state, arg] = r.stdout.slice(0, nl).split(" ");
-    const out = r.stdout.slice(nl + 1);
-    const last = (s) => s.replace(ANSI, "").split("\n").slice(-lines - 1).join("\n");
+    const [head, stage, ...rest] = r.stdout.split("\n");
+    const [state, code] = head.split(" ");
+    const env = stage.trim() ? { env: stage.trim() } : {};
+    const log = rest.join("\n").replace(ANSI, "");
     if (state === "exited")
-        return { agent: "exited", exitCode: Number(arg), log: out };
-    if (state === "login_failed")
-        return { agent: "login_failed", exitCode: Number(arg), log: last(out) };
-    if (state === "waiting_for_login") {
-        const login = parseLogin(out, arg);
-        return { agent: "waiting_for_login", ...(login && { login }), log: last(out) };
-    }
-    return { agent: state === "running" ? "running" : "stopped", log: out };
+        return { agent: "exited", exitCode: Number(code), ...env, log };
+    return { agent: state === "running" ? "running" : "stopped", ...env, log };
 }
-// right after a start: on the device route, waits until the login shows its URL or is not needed; a failed login throws
-export async function loginState(b, setup, seconds = 60) {
-    const until = Date.now() + seconds * 1000;
-    let s = await agentState(b);
-    while (s.agent === "waiting_for_login" && !s.login && Date.now() < until) {
-        await new Promise((r) => setTimeout(r, 300));
-        s = await agentState(b);
-    }
-    if (s.agent === "login_failed" || (s.agent === "waiting_for_login" && !s.login))
-        throw new BsError("login_failed", `the agent's device login in ${b.id} ${s.agent === "login_failed" ? "failed" : "showed no URL within a minute"}`, `read log${setup ? `; check that the user did this once: ${setup}` : ""}`, { log: s.log });
-    return s;
-}
-const busy = (s) => s.agent === "running" || s.agent === "waiting_for_login";
 // ponytail: polls every second; fine for one waiting agent, a blocking exec in the box if many wait
 export async function waitAgent(b, seconds, lines) {
     const until = Date.now() + seconds * 1000;
     let s = await agentState(b, lines);
-    while (busy(s) && Date.now() < until) {
+    while (s.agent === "running" && Date.now() < until) {
         await new Promise((r) => setTimeout(r, 1000));
         s = await agentState(b, lines);
     }
     return s;
 }
-// starts a follow-up; on the device route it returns the login the user has to approve first, if the box's login expired
+// starts a follow-up in the same conversation
 export async function ask(b, prompt) {
-    const r = await sh(b, "bash -s", `if ${RUNNING}; then echo running; exit 0; fi
-${writeFiles({ ".bottleship/prompt.txt": prompt })}
-${start("resume")}
-echo started`);
+    const r = await sh(b, `bash ${B}/ask.sh`, prompt);
     if (r.stdout.trim() === "running")
-        throw new BsError("agent_running", `the agent in ${b.id} is still working`, `wait for it: bottleship status ${b.id} --wait 600`);
+        throw new BsError("agent_running", `the agent in ${b.id} is still working`, `wait for it: bottleship agent status ${b.id} --wait 600`);
     if (r.stdout.trim() !== "started")
-        throw new BsError("ask_failed", `could not start the agent in ${b.id} (exit ${r.code})`, `bottleship exec ${b.id} -- cat ~/.bottleship/agent.log`, { stderr: tail(r.stderr) });
-    const s = await loginState(b);
-    return s.agent === "waiting_for_login" ? s.login : undefined;
+        throw new BsError("ask_failed", `could not start the agent in ${b.id} (exit ${r.code})`, `bottleship agent exec ${b.id} -- cat ~/.bottleship/agent.log`, { stderr: tail(r.stderr) });
 }
 // the env and workspace the agent sees, for exec
 export const inBox = (script) => `. ${B}/env.sh 2>/dev/null; cd "$HOME/workspace" 2>/dev/null; ${script}`;