dahrk-node 0.1.19 → 0.1.20

package/dist/main.js

@@ -1510,6 +1510,14 @@ function createGitService(opts = {}) {
   };
   const netEnv = (authEnv) => authEnv ?? { ...process.env, GIT_TERMINAL_PROMPT: "0" };
   const withTokenUser = (gitUrl) => /^https:\/\/[^@/]+@/.test(gitUrl) ? gitUrl : gitUrl.replace(/^https:\/\//, "https://x-access-token@");
+  const resolveRemoteAuth = (gitUrl, credentialToken) => {
+    const auth = credentialToken ? setupAuth(credentialToken) : void 0;
+    return {
+      remote: credentialToken ? withTokenUser(gitUrl) : gitUrl,
+      authEnv: auth?.env,
+      cleanup: () => auth?.cleanup()
+    };
+  };
   const mirrorPathFor = (repoId) => join3(mirrorsDir, sanitizeBranchName(repoId));
   const listWorktrees = (mirror) => {
     let out2;
@@ -1689,15 +1697,14 @@ function createGitService(opts = {}) {
         } catch {
         }
       }
-      const auth = opts2.credentialToken ? setupAuth(opts2.credentialToken) : void 0;
-      const remote = opts2.credentialToken ? withTokenUser(ref.gitUrl) : ref.gitUrl;
+      const { remote, authEnv, cleanup } = resolveRemoteAuth(ref.gitUrl, opts2.credentialToken);
       let pushed = false;
       let integration;
       try {
         let fetched = false;
         if (opts2.base) {
           try {
-            git(worktreePath, ["fetch", remote, opts2.base], netEnv(auth?.env));
+            git(worktreePath, ["fetch", remote, opts2.base], netEnv(authEnv));
             fetched = true;
           } catch (e) {
             log.warn(`base fetch failed for ${opts2.base}; skipping push-time integration: ${e.message}`);
@@ -1721,7 +1728,7 @@ function createGitService(opts = {}) {
               "merge",
               "--no-edit",
               "FETCH_HEAD"
-            ], auth?.env);
+            ], authEnv);
             integration = "clean";
             headSha = git(worktreePath, ["rev-parse", "HEAD"]).trim();
           } catch (mergeErr) {
@@ -1738,10 +1745,10 @@ function createGitService(opts = {}) {
             throw mergeErr;
           }
         }
-        git(worktreePath, ["push", remote, `HEAD:refs/heads/${branch}`], netEnv(auth?.env));
+        git(worktreePath, ["push", remote, `HEAD:refs/heads/${branch}`], netEnv(authEnv));
         pushed = true;
       } finally {
-        auth?.cleanup();
+        cleanup();
       }
       return { headSha, pushed, nothingToCommit: !dirty, commitsAhead, ...integration ? { integration } : {} };
     },
@@ -1752,12 +1759,11 @@ function createGitService(opts = {}) {
       }
       const wipRef = sanitizeBranchName(opts2.branch);
       const { headSha, dirty } = commitPending(worktreePath, opts2.message);
-      const auth = opts2.credentialToken ? setupAuth(opts2.credentialToken) : void 0;
-      const remote = opts2.credentialToken ? withTokenUser(ref.gitUrl) : ref.gitUrl;
+      const { remote, authEnv, cleanup } = resolveRemoteAuth(ref.gitUrl, opts2.credentialToken);
       try {
-        git(worktreePath, ["push", "--force", remote, `HEAD:refs/heads/${wipRef}`], netEnv(auth?.env));
+        git(worktreePath, ["push", "--force", remote, `HEAD:refs/heads/${wipRef}`], netEnv(authEnv));
       } finally {
-        auth?.cleanup();
+        cleanup();
       }
       return { headSha, pushed: true, nothingToCommit: !dirty, wipRef };
     },
@@ -1772,15 +1778,14 @@ function createGitService(opts = {}) {
       if (!dirty) return { dirty: false, headSha, pushed: false };
       git(worktreePath, ["branch", "--force", wipRef, tailSha]);
       let pushed = false;
-      const auth = opts2.credentialToken ? setupAuth(opts2.credentialToken) : void 0;
-      const remote = opts2.credentialToken ? withTokenUser(ref.gitUrl) : ref.gitUrl;
+      const { remote, authEnv, cleanup } = resolveRemoteAuth(ref.gitUrl, opts2.credentialToken);
       try {
-        git(worktreePath, ["push", "--force", remote, `${tailSha}:refs/heads/${wipRef}`], netEnv(auth?.env));
+        git(worktreePath, ["push", "--force", remote, `${tailSha}:refs/heads/${wipRef}`], netEnv(authEnv));
         pushed = true;
       } catch (e) {
         log.warn(`could not push the preserved tail to ${wipRef}: ${e.message}`);
       } finally {
-        auth?.cleanup();
+        cleanup();
       }
       git(worktreePath, ["reset", "--hard", headSha]);
       git(worktreePath, ["clean", "-fd", "--exclude", SCRATCH_DIR]);
@@ -4596,6 +4601,7 @@ var COMMANDS = /* @__PURE__ */ new Set([
   "logs",
   "diagnose",
   "run",
+  "repo",
   "service",
   "doctor",
   "status",
@@ -4619,6 +4625,7 @@ function parseCli(argv) {
     flagArgs = rest;
   }
   if (command === "run") return parseRun(flagArgs);
+  if (command === "repo") return parseRepo(flagArgs);
   if (command === "service") return parseService(flagArgs);
   if (command === "update") return parseUpdate(flagArgs);
   if (command === "logs") return parseLogs(flagArgs);
@@ -4633,6 +4640,8 @@ function parseCli(argv) {
         "hub-url": { type: "string" },
         ephemeral: { type: "boolean", default: false },
         foreground: { type: "boolean", default: false },
+        // `start`: enrol but do not install the service (the operator supervises the node themselves).
+        "no-service": { type: "boolean", default: false },
         // `stop` / `restart`: take the node down even though it has work in flight.
         force: { type: "boolean", default: false },
         // `status`: machine-readable output.
@@ -4654,7 +4663,8 @@ function parseCli(argv) {
     ephemeral,
     // An ephemeral node mints a throwaway id and persists nothing, so there is nothing coherent to hand to
     // a supervisor that restarts it on boot. It is a foreground node by definition.
-    foreground: (values.foreground ?? false) || ephemeral
+    foreground: (values.foreground ?? false) || ephemeral,
+    ...values["no-service"] ? { noService: true } : {}
   };
   if (command === "stop") return { kind: "stop", force };
   if (command === "restart") return { kind: "restart", flags, force };
@@ -4786,6 +4796,43 @@ function parseService(flagArgs) {
   };
   return { kind: "service", flags };
 }
+var REPO_ACTIONS = /* @__PURE__ */ new Set(["add"]);
+var isRepoAction = (s) => REPO_ACTIONS.has(s);
+function parseRepo(flagArgs) {
+  let values;
+  let positionals;
+  try {
+    ({ values, positionals } = parseArgs({
+      args: flagArgs,
+      options: {
+        name: { type: "string" },
+        "hub-url": { type: "string" },
+        token: { type: "string" },
+        help: { type: "boolean", default: false }
+      },
+      allowPositionals: true
+    }));
+  } catch (e) {
+    return { kind: "error", message: e.message };
+  }
+  if (values.help) return { kind: "help", command: "repo" };
+  if (positionals.length === 0) {
+    return { kind: "error", message: "repo: missing action (`dahrk repo add`)" };
+  }
+  if (positionals.length > 1) {
+    return { kind: "error", message: `repo: unexpected argument "${positionals[1]}" (one action at a time)` };
+  }
+  const action = positionals[0];
+  if (!isRepoAction(action)) {
+    return { kind: "error", message: `repo: unknown action "${action}" (expected add)` };
+  }
+  const flags = {
+    ...values.name ? { name: values.name } : {},
+    ...values["hub-url"] ? { hubUrl: values["hub-url"] } : {},
+    ...values.token ? { token: values.token } : {}
+  };
+  return { kind: "repo", flags };
+}
 function parseUpdate(flagArgs) {
   let values;
   try {
@@ -4830,6 +4877,8 @@ function usage(bin, command) {
       "                     setting DAHRK_FOREGROUND=1, which is easier to set in a Dockerfile or pm2 config.",
       "  --ephemeral        Do not persist (or read) node id and token; mint a throwaway id (CI / one-shot).",
       "                     Implies --foreground: a node with no persistent identity has nothing to daemonise.",
+      "  --no-service       Enrol (cache the token) but do not install the always-on service, for a node you",
+      "                     supervise yourself. Run it later with `dahrk start --foreground` (or your own supervisor).",
       "",
       "Only one node may run at a time on a host - they would share this machine's node id and race each",
       "other for Jobs - so a second `start` refuses rather than dialling the hub twice."
@@ -4930,6 +4979,30 @@ function usage(bin, command) {
       "  --token <token>    Enrolment token to verify against the hub (or set DAHRK_ENROL_TOKEN)."
     ].join("\n");
   }
+  if (command === "repo") {
+    return [
+      `Usage: ${bin} repo add [options]`,
+      "",
+      "Register the current git repository with the hub, so it can run workflows. Run it from inside the",
+      "repo - `cd your-repo && dahrk repo add` - and the node reads the `origin` remote and the current",
+      "branch itself: no form, no pasted git URL, because the node already sits next to the code.",
+      "",
+      "The git URL is registered in the form the host can authenticate. An HTTPS origin is kept as-is; an",
+      "SSH origin is kept when this host has an SSH key, and otherwise normalised to HTTPS with a warning.",
+      "Re-running on an already-registered repo is a no-op, not an error or a duplicate.",
+      "",
+      "This uses the node's existing enrolment - run `dahrk start --token <token>` first if it is not yet",
+      "enrolled. It dials the hub itself, so the daemon need not be running.",
+      "",
+      "Actions:",
+      "  add          Register the repository in the current directory.",
+      "",
+      "Options:",
+      "  --name <name>      Display name for the repo (default: the slug from the origin URL).",
+      "  --hub-url <url>    Hub URL to register with (or set DAHRK_HUB_URL).",
+      "  --token <token>    Enrolment token to authenticate with (default: the cached one)."
+    ].join("\n");
+  }
   if (command === "service") {
     return [
       `Usage: ${bin} service install|uninstall [options]`,
@@ -5006,6 +5079,7 @@ function usage(bin, command) {
     "  diagnose  Write a support bundle you can read, and send on if you choose. Uploads nothing.",
     "  status    Is it up, is it enrolled, what is it working on? (local, dials nothing)",
     "  run       Run a workflow locally (engine-backed), e.g. `run preflight`.",
+    "  repo      Register the current repository with the hub (`repo add`).",
     "  doctor    Preflight checks: Node, runtimes, hub reachability, token validity.",
     "  service   Install/uninstall the always-on service by hand (`start` does this for you).",
     "  update    Update the client to the latest release (or print how for your channel).",
@@ -5335,6 +5409,91 @@ async function runDoctor(inputs, deps = {}) {
   return checks.some((c) => c.status === "fail") ? 1 : 0;
 }
 
+// src/repo-add.ts
+import { createHash as createHash4 } from "crypto";
+var stripRepoSuffix = (s) => s.replace(/\.git$/i, "").replace(/\/+$/, "");
+function splitOwnerRepo(path) {
+  const parts = stripRepoSuffix(path).split("/").filter(Boolean);
+  if (parts.length < 2) return void 0;
+  const repo = parts[parts.length - 1];
+  const owner = parts.slice(0, -1).join("/");
+  return { owner, repo };
+}
+function parseGitRemote(url) {
+  const trimmed = url.trim();
+  if (!trimmed) return void 0;
+  const urlMatch = /^(?:ssh|https?):\/\/(?:[^@/]+@)?([^/:]+)(?::\d+)?\/(.+)$/i.exec(trimmed);
+  if (urlMatch) {
+    const parts = splitOwnerRepo(urlMatch[2]);
+    return parts ? { host: urlMatch[1], ...parts } : void 0;
+  }
+  const scpMatch = /^(?:[^@\s]+@)?([^/:\s]+):(.+)$/.exec(trimmed);
+  if (scpMatch) {
+    const parts = splitOwnerRepo(scpMatch[2]);
+    return parts ? { host: scpMatch[1], ...parts } : void 0;
+  }
+  return void 0;
+}
+var httpsFormOf = (r) => `https://${r.host}/${r.owner}/${r.repo}.git`;
+var isHttpsRemote = (url) => /^https?:\/\//i.test(url.trim());
+function chooseGitUrl(input) {
+  const originUrl = input.originUrl.trim();
+  if (isHttpsRemote(originUrl)) return { gitUrl: originUrl, converted: false };
+  if (input.sshKeyPresent) return { gitUrl: originUrl, converted: false };
+  const parsed = parseGitRemote(originUrl);
+  if (!parsed) return { gitUrl: originUrl, converted: false };
+  return { gitUrl: httpsFormOf(parsed), converted: true };
+}
+var deriveRepoName = (remote) => remote.repo;
+function deriveRepoId(gitUrl) {
+  const parsed = parseGitRemote(gitUrl);
+  const canonical2 = parsed ? `${parsed.host}/${parsed.owner}/${parsed.repo}`.toLowerCase() : gitUrl.trim().toLowerCase();
+  const hash = createHash4("sha256").update(canonical2).digest("hex").slice(0, 12);
+  const slug = (parsed ? parsed.repo : "repo").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "repo";
+  return `${slug}-${hash}`;
+}
+function hubHttpBase(url) {
+  const trimmed = url.trim().replace(/\/+$/, "");
+  if (/^wss:\/\//i.test(trimmed)) return trimmed.replace(/^wss:\/\//i, "https://");
+  if (/^ws:\/\//i.test(trimmed)) return trimmed.replace(/^ws:\/\//i, "http://");
+  return trimmed;
+}
+async function readJson(res) {
+  try {
+    const body = await res.json();
+    return body && typeof body === "object" ? body : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function driftOf(stored, repo) {
+  if (!stored) return void 0;
+  const drift = {};
+  if (typeof stored.defaultBranch === "string" && stored.defaultBranch !== repo.defaultBranch) drift.branch = stored.defaultBranch;
+  if (typeof stored.name === "string" && stored.name !== repo.name) drift.name = stored.name;
+  return drift.branch || drift.name ? drift : void 0;
+}
+async function registerRepo(deps, args) {
+  const url = `${args.base}/config/api/repositories`;
+  let res;
+  try {
+    res = await deps.fetch(url, {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${args.token}` },
+      body: JSON.stringify(args.repo)
+    });
+  } catch (e) {
+    return { kind: "error", message: `could not reach the hub at ${args.base}: ${e.message}` };
+  }
+  const stored = await readJson(res);
+  if (res.status === 200 || res.status === 409) {
+    const drift = driftOf(stored, args.repo);
+    return { kind: "already", ...drift ? { drift } : {} };
+  }
+  if (res.ok) return { kind: "registered" };
+  return { kind: "error", message: `the hub rejected the repo (HTTP ${res.status})` };
+}
+
 // src/lock.ts
 import { existsSync as existsSync9, mkdirSync as mkdirSync9, readFileSync as readFileSync7, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
 import { dirname as dirname6 } from "path";
@@ -5744,7 +5903,18 @@ function probeRepo(repoPath) {
     baseBranch = git(["rev-parse", "--abbrev-ref", "HEAD"]) || void 0;
   } catch {
   }
-  return { path: repoPath, isGitRepo: true, headResolves, ...baseBranch ? { baseBranch } : {} };
+  let remoteUrl;
+  try {
+    remoteUrl = git(["remote", "get-url", "origin"]) || void 0;
+  } catch {
+  }
+  return {
+    path: repoPath,
+    isGitRepo: true,
+    headResolves,
+    ...baseBranch ? { baseBranch } : {},
+    ...remoteUrl ? { remoteUrl } : {}
+  };
 }
 function gatherHostFacts(repoPath) {
   const root = worktreeRoot(process.env);
@@ -6749,7 +6919,7 @@ async function runStatus(inputs, deps) {
 }
 
 // src/main.ts
-var CLIENT_VERSION = "0.1.19";
+var CLIENT_VERSION = "0.1.20";
 var DEFAULT_HUB_URL = "wss://api.dahrk.ai";
 var list = (v) => (v ?? "").split(",").map((s) => s.trim()).filter(Boolean);
 var RUNTIMES2 = ["claude-code", "codex", "pi"];
@@ -6836,6 +7006,12 @@ async function start(flags) {
   if (wantsForeground(env, flags)) return startForeground(env, flags);
   const enrolled = await enrolToDisk(env);
   if (enrolled !== 0) return enrolled;
+  if (flags.noService) {
+    out("");
+    out(verdict("ok", "Enrolled. Not installing a service (--no-service)."));
+    out(hint("Run the node with `dahrk start --foreground` (or your own supervisor), or `dahrk start` to install the service."));
+    return 0;
+  }
   await offerUpdate(env);
   const outcome = await runNodeStart(serviceInputs(env));
   if (outcome.kind === "error") return outcome.code;
@@ -7081,6 +7257,69 @@ async function runWorkflow(flags) {
     clientVersion: CLIENT_VERSION
   });
 }
+async function runRepoAdd(flags) {
+  const env = applyEnvAliases(process.env);
+  if (flags.hubUrl) env.DAHRK_HUB_URL = flags.hubUrl;
+  if (flags.token) env.DAHRK_ENROL_TOKEN = flags.token;
+  const cwd = process.cwd();
+  const probe2 = probeRepo(cwd);
+  if (!probe2.isGitRepo) {
+    out("");
+    out(verdict("fail", `${cwd} is not a git repository.`));
+    out(hint("Run `dahrk repo add` from inside the repository you want to register."));
+    return 1;
+  }
+  if (!probe2.remoteUrl) {
+    out("");
+    out(verdict("fail", "This repository has no `origin` remote, so there is nothing to register."));
+    out(hint("Add one with `git remote add origin <url>`, then run `dahrk repo add` again."));
+    return 1;
+  }
+  const token = resolveEnrolToken(env);
+  if (!token) {
+    out("");
+    out(verdict("fail", "This node is not enrolled, so it cannot register a repository."));
+    out(hint("Enrol it first with `dahrk start --token <token>`."));
+    return 1;
+  }
+  const { gitUrl, converted } = chooseGitUrl({ originUrl: probe2.remoteUrl, sshKeyPresent: sshKeyPresent() });
+  if (converted) {
+    out("");
+    out(verdict("warn", `No SSH key found on this host, so the SSH remote was registered as HTTPS: ${gitUrl}`));
+    out(hint("Add an SSH key (or set up brokered credentials) if this repo must be cloned over SSH - see DHK-252."));
+  }
+  const parsed = parseGitRemote(gitUrl);
+  const name = flags.name ?? (parsed ? deriveRepoName(parsed) : "repo");
+  const repo = {
+    id: deriveRepoId(gitUrl),
+    name,
+    gitUrl,
+    // HEAD's branch is the run's base. An empty repo (no commits) has none yet; default to `main`.
+    defaultBranch: probe2.baseBranch ?? "main"
+  };
+  const base = hubHttpBase(env.DAHRK_HUB_URL ?? DEFAULT_HUB_URL);
+  const result = await registerRepo({ fetch }, { base, token, repo });
+  out("");
+  switch (result.kind) {
+    case "registered":
+      out(verdict("ok", `Registered ${name} with the hub.`));
+      out(kv("URL", gitUrl));
+      out(kv("Branch", repo.defaultBranch));
+      return 0;
+    case "already":
+      out(verdict("ok", `${name} is already registered - nothing to do.`));
+      if (result.drift) {
+        const bits = [];
+        if (result.drift.branch) bits.push(`branch ${result.drift.branch} (this repo is on ${repo.defaultBranch})`);
+        if (result.drift.name) bits.push(`name ${result.drift.name}`);
+        out(hint(`The hub's stored record differs - ${bits.join(", ")} - and was left unchanged.`));
+      }
+      return 0;
+    case "error":
+      out(verdict("fail", `Could not register the repository: ${result.message}`));
+      return 1;
+  }
+}
 async function main() {
   const invoked = basename2(process.argv[1] ?? "");
   const bin = !invoked || invoked.startsWith("main.") ? "dahrk" : invoked;
@@ -7127,6 +7366,9 @@ async function main() {
     case "run":
       process.exitCode = await runWorkflow(parsed.flags);
       break;
+    case "repo":
+      process.exitCode = await runRepoAdd(parsed.flags);
+      break;
     case "service": {
       if (parsed.flags.action === "uninstall") {
         process.exitCode = await runServiceUninstall();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dahrk-node",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "private": false,
   "license": "Apache-2.0",
   "type": "module",