cawdev-cli 0.9.0 → 1.0.0-beta

package/runner/bootstrap.mjs

@@ -30,8 +30,9 @@ import { spawn } from 'node:child_process';
 import { access, chmod, mkdir, writeFile } from 'node:fs/promises';
 import { createInterface } from 'node:readline/promises';
 import { homedir, hostname } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
+import { dirname, join } from 'node:path';
 import { painter } from '../lib/ansi.mjs';
+import { absolute } from './paths.mjs';
 import { Select, pickFromLine, pickManyFromLine, plainLines } from './select.mjs';
 import { signInThroughBrowser, storedSession } from './sign-in.mjs';
 import { saveToken, tokenFile } from './token-store.mjs';
@@ -106,7 +107,9 @@ export function checkoutFor(root, slug) {
     // the root the person named. Everything else is already inside it, because
     // the separator is the character the line above removes.
     .replace(/^\.+$/, '-');
-  return join(resolve(root), safe);
+  // `absolute` and not `resolve`: `~/code` through resolve alone was
+  // `<cwd>/~/code`, which is the bug R289 started from.
+  return join(absolute(root), safe);
 }
 
 async function exists(path) {
@@ -160,7 +163,11 @@ export async function mintRunnerToken(session, slugs, name) {
   if (!minted?.secret) {
     throw new Error('The platform minted a token but did not return it.');
   }
-  return minted.secret;
+  // R283: the id travels alongside the secret from here on, so a later
+  // `cawdev config add-project` can widen THIS token's grants
+  // (`PUT /api/tokens/{id}/grants`) instead of minting a new one and leaving
+  // the old one live on the Tokens page for somebody to notice and revoke.
+  return { secret: minted.secret, id: minted.token?.id ?? null };
 }
 
 /**
@@ -185,19 +192,26 @@ export function cloneInto(gitUrl, path) {
   });
 }
 
-/** Whether `claude` is on the PATH at all — a cheaper question than "is it signed in". */
-export function findAgent(command = 'claude') {
-  return new Promise((done) => {
-    const child = spawn(process.platform === 'win32' ? 'where' : 'which', [command], {
-      stdio: ['ignore', 'pipe', 'ignore'],
+/** Whether the agent is on the PATH at all — a cheaper question than "is it signed in". */
+export async function findAgents(commands = ['agy', 'claude']) {
+  const found = [];
+  for (const command of Array.isArray(commands) ? commands : [commands]) {
+    const where = await new Promise((done) => {
+      const child = spawn(process.platform === 'win32' ? 'where' : 'which', [command], {
+        stdio: ['ignore', 'pipe', 'ignore'],
+      });
+      let out = '';
+      child.stdout.on('data', (chunk) => {
+        out += chunk;
+      });
+      child.on('error', () => done(null));
+      child.on('close', (code) => done(code === 0 && out.trim() ? out.trim().split('\n')[0] : null));
     });
-    let out = '';
-    child.stdout.on('data', (chunk) => {
-      out += chunk;
-    });
-    child.on('error', () => done(null));
-    child.on('close', (code) => done(code === 0 && out.trim() ? out.trim().split('\n')[0] : null));
-  });
+    if (where) {
+      found.push({ command, where });
+    }
+  }
+  return found;
 }
 
 /**
@@ -285,7 +299,7 @@ export async function setUpThisMachine({
   configPath = runnerConfigPath(),
   signIn = signInThroughBrowser,
   session: given = null,
-  agent = findAgent,
+  agent = findAgents,
 } = {}) {
   const session = given ?? (await storedSession(url));
 
@@ -360,7 +374,7 @@ export async function setUpThisMachine({
         say(`  ${ink.muted(`Skipping ${project.slug}.`)}`);
         continue;
       }
-      entries.push({ slug: project.slug, path: resolve(typed) });
+      entries.push({ slug: project.slug, path: absolute(typed) });
       continue;
     }
     say('');
@@ -377,25 +391,46 @@ export async function setUpThisMachine({
   // R93's one question this cannot answer for itself. Asked BEFORE the token is
   // minted, so somebody who has to go and log in elsewhere has not left a
   // credential behind them.
-  const where = await agent();
-  say('');
-  if (where) {
-    say(`  ${ink.muted('This machine spawns')} ${ink.text('claude')} ${ink.muted(`(${where}) for every run.`)}`);
-  } else {
-    say(`  ${ink.warn('!')} ${ink.muted('No')} ${ink.text('claude')} ${ink.muted('on this PATH. Install Claude Code before a run can start.')}`);
+  const agentInfos = await agent();
+  if (agentInfos.length === 0) {
+    say(`  ${ink.warn('!')} ${ink.muted('Neither Claude Code nor Antigravity CLI found on PATH. Install at least one before a run can start.')}`);
+    throw new Error('No supported coding agent found.');
   }
-  say(`  ${ink.muted('It cannot sign in for you: a runner whose Claude Code is logged out')}`);
-  say(`  ${ink.muted('boots fine and then fails every run.')}`);
-  if (!await confirm(ask, 'Is Claude Code signed in on this machine?')) {
-    throw new Error(
-      'Sign in first — run `claude` once in a terminal and follow it — then run cawdev again.\n'
-        + '  Nothing has been created, so there is nothing to undo.',
-    );
+
+  const chosenAgents = agentInfos.length === 1
+    ? agentInfos
+    : (await askMany(ask, say, new Select({
+      title: 'Which coding agents do you want to use on this machine?',
+      rows: agentInfos.map((a) => ({
+        id: a.command,
+        label: a.command === 'agy' ? 'Antigravity CLI' : 'Claude Code',
+        hint: a.where,
+      })),
+    }))).map((row) => agentInfos.find((a) => a.command === row.id));
+
+  if (!chosenAgents.length) {
+    throw new Error('You must select at least one coding agent to run.');
+  }
+
+  say('');
+  for (const a of chosenAgents) {
+    const agentDisplayName = a.command === 'agy' ? 'Antigravity CLI' : 'Claude Code';
+    say(`  ${ink.muted('This machine spawns')} ${ink.text(a.command)} ${ink.muted(`(${a.where}) for every run.`)}`);
+    if (!await confirm(ask, `Is ${agentDisplayName} signed in on this machine?`)) {
+      throw new Error(
+        `Sign in first — run \`${a.command}\` once in a terminal and follow it — then run cawdev again.\n`
+          + '  Nothing has been created, so there is nothing to undo.',
+      );
+    }
   }
 
   const name = defaultRunnerName();
-  const token = await mintRunnerToken(session, entries.map((entry) => entry.slug), name);
-  const config = configFor({ url, token, name, entries });
+  const minted = await mintRunnerToken(session, entries.map((entry) => entry.slug), name);
+  const config = configFor({ url, token: minted.secret, name, entries });
+  config.agentCommands = chosenAgents.map(a => a.command);
+  // R283: kept beside the secret so a later `cawdev config add-project` can
+  // widen this token in place rather than minting a second one.
+  config.tokenId = minted.id;
   await write(configPath, config);
 
   say('');
@@ -477,13 +512,13 @@ export async function mintForThisMachine({
   say(`  ${ink.success('✓')} ${ink.muted('Signed in as')} ${ink.text(session.email)}`);
 
   const name = config.name ?? defaultRunnerName();
-  const token = await mintRunnerToken(session, slugs, name);
+  const minted = await mintRunnerToken(session, slugs, name);
 
   // Filed under the name the DAEMON will look for, which is not always the door
   // a person came through — in development the console is on `:4200` and the
   // API it proxies to is on `:8091`, and both are this one cawdev. Storing it
   // under the sign-in URL puts a working credential somewhere nothing reads.
-  await store(storeUrl, token, { name });
+  await store(storeUrl, minted.secret, { name, id: minted.id });
 
   say(`  ${ink.success('✓')} ${ink.muted('Minted a')} ${ink.text('runner:operate')} `
     + `${ink.muted(`token for ${slugs.length} project${slugs.length === 1 ? '' : 's'}`)}`);
@@ -497,5 +532,5 @@ export async function mintForThisMachine({
   }
   say('');
 
-  return { token, slugs, name };
+  return { token: minted.secret, tokenId: minted.id, slugs, name };
 }

package/runner/cawdev.mjs

@@ -26,11 +26,18 @@ import { homedir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { attach, urlFrom, valueOf } from './attach.mjs';
-import { asker, mintForThisMachine, setUpThisMachine } from './bootstrap.mjs';
+import { asker, askOne, mintForThisMachine, setUpThisMachine } from './bootstrap.mjs';
 import { liveSockets, probeSocket, socketPathFor } from './control.mjs';
+import {
+  addProject, addWorkspace, readConfigFile, reloadIfRunning, setAcceptsRulesFromConsole,
+  setAgentEnabled,
+} from './configure.mjs';
+import { Select } from './select.mjs';
+import { storedSession } from './sign-in.mjs';
 import { loadToken } from './token-store.mjs';
 import { painter } from '../lib/ansi.mjs';
 import { mark } from './brand.mjs';
+import { cliVersion, isBelow } from '../lib/version.mjs';
 
 const HERE = dirname(new URL(import.meta.url).pathname);
 const RUNNER = join(HERE, 'runner.mjs');
@@ -46,14 +53,26 @@ const USAGE = `
   cawdev --no-start         attach only; never launch a daemon
   cawdev --watch-only       do not sign in; watch without being able to act
   cawdev --leave-running    leave the daemon running when you quit
+  cawdev --version          this CLI's version, and the platform's
   cawdev --help
 
+  cawdev config                          a menu: add a project, add a
+                                          workspace, agents, console rules
+  cawdev config add-project              serve one more project you can write to
+  cawdev config add-workspace            another checkout for a project you
+                                          already serve — R47's concurrency
+  cawdev config agent enable|disable <claude|agy>
+  cawdev config rules on|off             accept permission rules from the console
+  cawdev config show                     this machine's config, token redacted
+
   On a machine with no config, cawdev sets one up: it signs you in through the
   browser, asks which projects this machine should run agents for, clones them,
-  and mints its own runner token. No token is ever typed.
+  and mints its own runner token. No token is ever typed. \`cawdev config\` is
+  the same walk, one change at a time, on a machine already set up.
 
   Inside: enter prompts the session you are watching, / takes a command
-  (/help lists them), L lists the runs, and q stops the machine and leaves.
+  (/help lists them), L lists the runs, c configures this machine (the same
+  menu as \`cawdev config\`, on screen), and q stops the machine and leaves.
   It asks twice while sessions are running. --leave-running keeps it up.
 `;
 
@@ -280,22 +299,10 @@ export function daemonUrl(file, env = process.env) {
   return String(env.CAWDEV_URL ?? file?.url ?? DEFAULT_URL).replace(/\/+$/, '');
 }
 
-/**
- * The config as an object, or null if it will not parse.
- *
- * Null rather than a throw: an unreadable config is the daemon's complaint to
- * make — it names the file and the parse error — and swallowing it here to
- * offer a setup walk would replace a precise message with a wrong guess about
- * what somebody wants.
- */
-export async function readConfigFile(path) {
-  try {
-    const parsed = JSON.parse(await readFile(path, 'utf8'));
-    return parsed && typeof parsed === 'object' ? parsed : null;
-  } catch {
-    return null;
-  }
-}
+// `readConfigFile` lives in configure.mjs since R288 — the attached UI reads
+// the file too, and this module imports attach.mjs. Re-exported so nothing
+// that imported it from here has to move.
+export { readConfigFile };
 
 /**
  * The setup walk, with the terminal handed to it and taken back.
@@ -337,6 +344,181 @@ async function runMint(configPath, file, argv, ink) {
   });
 }
 
+/**
+ * This CLI's version against the platform's — R283.
+ *
+ * Best-effort and silent on the happy path, matching `acceptsConsoleRules`'
+ * own philosophy (R126's comment on the daemon side): a mismatch is worth a
+ * line, agreement is worth nothing. Never thrown from here — a network hiccup
+ * is not evidence of a stale CLI, and `cawdev` has an attach to get on with.
+ */
+async function warnIfVersionMismatched(url, ink) {
+  try {
+    const mine = await cliVersion();
+    const response = await fetch(`${url}/api/health`);
+    if (!response.ok) return;
+    const health = await response.json();
+    if (health.version && health.version !== mine && health.version !== 'unknown') {
+      console.log(`  ${ink.warn('!')} ${ink.muted(`This CLI is ${mine}; ${url} is on ${health.version}.`)}`);
+      console.log(`  ${ink.muted('Update this machine\'s cawdev if things look wrong.')}`);
+    }
+    if (isBelow(mine, health.minimumCliVersion)) {
+      console.log(`  ${ink.danger('!')} ${ink.text(`This CLI (${mine}) is below what ${url} requires `
+        + `(${health.minimumCliVersion}) — the daemon will refuse to start until it is updated.`)}`);
+    }
+  } catch {
+    // Best-effort. readConfig's own health check, before registering, is
+    // where a genuinely unreachable platform actually matters.
+  }
+}
+
+/**
+ * `cawdev --version`: this CLI's own version, and the platform's.
+ *
+ * Works with no config and no sign-in — `/api/health` needs neither — so it
+ * answers on a machine that has not been set up at all yet.
+ */
+async function runVersion(argv, ink) {
+  const mine = await cliVersion();
+  console.log(`  ${ink.muted('cawdev')} ${ink.text(mine)}`);
+  const url = urlFrom(argv);
+  try {
+    const response = await fetch(`${url}/api/health`);
+    const health = response.ok ? await response.json() : null;
+    if (health) {
+      console.log(`  ${ink.muted(url)} ${ink.text(health.version)}`);
+      if (isBelow(mine, health.minimumCliVersion)) {
+        console.log(`  ${ink.danger('This CLI is below the minimum that platform requires')} `
+          + `(${health.minimumCliVersion}). Update it.`);
+      } else if (health.version !== mine && health.version !== 'unknown') {
+        console.log(`  ${ink.muted('These differ — update whichever is behind.')}`);
+      }
+    } else {
+      console.log(`  ${ink.muted(url)} ${ink.warn('did not answer')}`);
+    }
+  } catch (failure) {
+    console.log(`  ${ink.muted(url)} ${ink.warn(`unreachable (${failure.message})`)}`);
+  }
+}
+
+/**
+ * `cawdev config` — R283's granular half of the setup walk, on a machine
+ * already configured. A direct subcommand (`add-project`, `add-workspace`,
+ * `agent enable|disable <command>`, `rules on|off`, `show`) or, with none, a
+ * menu — the same `Select` widget everything that offers a choice uses.
+ */
+async function runConfig(args, ink) {
+  const configPath = await findConfig(args);
+  if (!configPath) {
+    throw new Error('No config on this machine yet. Run `cawdev --setup` first.');
+  }
+  const file = await readConfigFile(configPath);
+  if (!file) {
+    throw new Error(`Could not read ${configPath}.`);
+  }
+
+  if (args[0] === 'show') {
+    printConfig(file, ink, (line) => console.log(line));
+    return;
+  }
+
+  const url = daemonUrl(file);
+  const session = await storedSession(url);
+  if (!session.signedIn) {
+    throw new Error('Not signed in on this machine. Run `cawdev --setup` first.');
+  }
+
+  const ask = asker();
+  const say = (line) => console.log(line);
+  try {
+    const action = args.length ? args : await pickAction(ask, say);
+    await runAction(action, { configPath, file, url, session, ask, say, ink });
+  } finally {
+    ask.close();
+  }
+}
+
+export async function pickAction(ask, say, pick = askOne) {
+  const picked = await pick(ask, say, new Select({
+    title: 'What do you want to change on this machine?',
+    rows: [
+      { id: 'add-project', label: 'Add a project' },
+      { id: 'add-workspace', label: 'Add a workspace to a project' },
+      { id: 'agent-enable', label: 'Enable an agent (claude / agy)' },
+      { id: 'agent-disable', label: 'Disable an agent' },
+      { id: 'rules-on', label: 'Accept permission rules from the console' },
+      { id: 'rules-off', label: 'Stop accepting rules from the console' },
+      { id: 'show', label: 'Show this machine\'s config' },
+    ],
+  }));
+  const id = picked.row.id;
+  if (id === 'agent-enable' || id === 'agent-disable') {
+    const command = (await ask.line('  Which agent — claude or agy? ')).trim();
+    return ['agent', id === 'agent-enable' ? 'enable' : 'disable', command];
+  }
+  if (id === 'rules-on') return ['rules', 'on'];
+  if (id === 'rules-off') return ['rules', 'off'];
+  return [id];
+}
+
+export async function runAction([verb, ...rest], { configPath, file, url, session, ask, say, ink }) {
+  if (verb === 'show') {
+    printConfig(file, ink, say);
+    return;
+  }
+  if (verb === 'add-project') {
+    await addProject({ configPath, file, url, session, ask, say, ink });
+    await afterProjectsChanged(file, say, ink);
+    return;
+  }
+  if (verb === 'add-workspace') {
+    await addWorkspace({ configPath, file, url, session, ask, say, ink });
+    await afterProjectsChanged(file, say, ink);
+    return;
+  }
+  if (verb === 'agent') {
+    const [sub, command] = rest;
+    if (!['claude', 'agy'].includes(command)) {
+      throw new Error('Name an agent: cawdev config agent enable|disable claude|agy');
+    }
+    await setAgentEnabled({
+      file, configPath, ask, say, ink, command, enabled: sub === 'enable',
+    });
+    await reloadIfRunning(file.name, say, ink);
+    return;
+  }
+  if (verb === 'rules') {
+    const [sub] = rest;
+    await setAcceptsRulesFromConsole({ file, configPath, ask, say, ink, enabled: sub === 'on' });
+    await reloadIfRunning(file.name, say, ink);
+    return;
+  }
+  throw new Error(`Not a cawdev config command: ${verb}. See cawdev --help.`);
+}
+
+/**
+ * Adding a project or a workspace is NOT hot-swappable — `config.projects` is
+ * read once at boot and threaded everywhere by value, unlike the three
+ * settings runner.mjs's SIGHUP handler re-reads. So this only says why
+ * nothing happened yet, on the daemon this config would actually restart as.
+ */
+export async function afterProjectsChanged(file, say, ink, { probe = probeSocket } = {}) {
+  if (await probe(socketPathFor(file.name))) {
+    say(`  ${ink.muted('A runner is already running here, on the config it booted with.')}`);
+    say(`  ${ink.muted('Attach and quit to stop it, and the next cawdev starts one on what you just set up.')}`);
+  }
+}
+
+/** The config as somebody would want to read it back — never the secret. */
+export function printConfig(file, ink, say) {
+  const shown = { ...file };
+  if (shown.token) shown.token = `${String(shown.token).slice(0, 10)}…`;
+  say(JSON.stringify(shown, null, 2)
+    .split('\n')
+    .map((line) => `  ${ink.text(line)}`)
+    .join('\n'));
+}
+
 async function main() {
   const argv = process.argv.slice(2);
   const ink = painter();
@@ -346,6 +528,16 @@ async function main() {
     return;
   }
 
+  if (argv[0] === 'config') {
+    await runConfig(argv.slice(1), ink);
+    return;
+  }
+
+  if (argv.includes('--version')) {
+    await runVersion(argv, ink);
+    return;
+  }
+
   // The mark, once, before anything else happens. It is the only decoration in
   // the program and it is here because this is the moment somebody is waiting:
   // a browser about to open, or a daemon about to boot.
@@ -353,6 +545,10 @@ async function main() {
     console.log(`\n${line}\n`);
   }
 
+  // R283. Best-effort, silent when the two agree — see the function's own
+  // comment for why this never throws.
+  await warnIfVersionMismatched(urlFrom(argv), ink);
+
   // Asked for by name, the walk runs even where one has been done before —
   // that is what "again" means, and adding a project to this machine is the
   // ordinary reason. A daemon already running keeps the config it booted with,