directionallylocal 0.1.0 → 0.2.0

package/dist/cli.js

@@ -2,14 +2,14 @@ import { readFileSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { parseArgs } from "node:util";
 import { doctor, formatChecks } from "./doctor.js";
-import { briefStatus, connectLaptop, laptopsCommand, logsCommand, serverHome, serverRunsCommand } from "./home.js";
+import { briefStatus, connectLaptop, laptopsCommand, logsCommand, pairLaptop, serverHome, serverRunsCommand } from "./home.js";
 import { cancel, connect, describeError, laptopHome, pull, run, runs, servers, watch } from "./laptop/commands.js";
 import { TtyPrompter } from "./prompt.js";
 import { readState } from "./state.js";
 import { DryRunSystem, RealSystem } from "./system.js";
 import { uninstall } from "./uninstall.js";
-import { PlainUi, TerminalUi, palette } from "./ui.js";
-import { up } from "./up.js";
+import { JsonUi, PlainUi, TerminalUi, palette } from "./ui.js";
+import { needs, parseAccessMode, parseProvidedAnswers, up } from "./up.js";
 const HELP = `Directionally Local: background coding agents on your own server.
 Send a task from your laptop; it runs in its own sandbox and comes back as a pull request.
 (dl is short for directionallylocal; both work.)
@@ -46,7 +46,14 @@ Unattended installs answer the questions with environment variables:
 
 Advanced:
   DL_ACCESS=loopback          don't expose the server; reach it over an SSH tunnel
+                              (or --access tailscale|loopback|ssh; ssh is the laptop's setup)
   DL_SKIP_CREDENTIAL_CHECK=1  don't check the keys with OpenRouter and GitHub (offline installs)
+
+Used by the laptop's setup (over SSH, as root):
+  dl up --access ssh --answers-stdin --events json
+                              install with the keys as one JSON object on stdin; progress as JSON lines
+  dl up --needs [--access ssh]   which keys dl up would still need, as JSON; changes nothing
+  dl pair --name NAME --json     a credential for that laptop, as JSON
 `;
 export async function main(argv, io = {
     out: (text) => process.stdout.write(text),
@@ -73,6 +80,10 @@ export async function main(argv, io = {
                 repo: { type: "string" },
                 detach: { type: "boolean" },
                 json: { type: "boolean" },
+                access: { type: "string" },
+                "answers-stdin": { type: "boolean" },
+                events: { type: "string" },
+                needs: { type: "boolean" },
             },
         });
     }
@@ -90,27 +101,84 @@ export async function main(argv, io = {
         io.out(HELP);
         return 0;
     }
-    const log = (line) => io.out(`${line}\n`);
+    if (values.events !== undefined && values.events !== "json") {
+        io.err(`--events takes json (got "${values.events}").\n\n${HELP}`);
+        return 2;
+    }
+    let access;
+    try {
+        access = values.access === undefined ? undefined : parseAccessMode(values.access);
+    }
+    catch (error) {
+        io.err(`${error.message}\n`);
+        return 2;
+    }
+    // `--events json`: stdout carries only the laptop's JSON events; everything else goes to
+    // stderr, and other tools' output to the install log, as with the live checklist.
+    const json = command === "up" && values.events === "json" && !values.needs;
+    const log = (line) => (json ? io.err : io.out)(`${line}\n`);
     // The live checklist needs a terminal; a dry run prints its plan line by line instead.
     const terminal = options.terminal ?? (process.stdout.isTTY === true);
-    const live = terminal && command === "up" && !values["dry-run"];
-    const ui = live ? new TerminalUi(io.out) : new PlainUi(io.out);
-    const colorOn = terminal && !process.env.NO_COLOR && process.env.TERM !== "dumb";
+    // --needs only looks: it mustn't even start a new install log.
+    const live = terminal && command === "up" && !values["dry-run"] && !values.needs && !json;
+    const jsonUi = json ? new JsonUi(io.out) : undefined;
+    const ui = jsonUi ?? (live ? new TerminalUi(io.out) : new PlainUi(io.out));
+    const colorOn = terminal && !json && !process.env.NO_COLOR && process.env.TERM !== "dumb";
     const colors = palette(colorOn);
     const laptopIO = { out: io.out, err: io.err, color: colorOn };
-    const system = values["dry-run"] ? new DryRunSystem(log) : new RealSystem(log, live ? { outputLog: UP_LOG } : {});
+    const logged = (live || json) && !values["dry-run"];
+    let system;
+    try {
+        system = values["dry-run"] ? new DryRunSystem(log) : new RealSystem(log, logged ? { outputLog: UP_LOG } : {});
+    }
+    catch (error) {
+        // Opening the install log is the first write, so this is where a non-root `up` stops.
+        const message = `Couldn't open ${UP_LOG}: ${describeError(error)}. Run it as root: sudo dl up`;
+        if (jsonUi)
+            jsonUi.error(message);
+        else
+            io.err(`\n  ${palette(live && !process.env.NO_COLOR).red("✗")} ${message}\n`);
+        return 1;
+    }
     try {
         switch (command) {
-            case "up":
+            case "up": {
+                if (values.needs) {
+                    io.out(`${JSON.stringify({ needs: await needs(system, access ? { access } : {}) })}\n`);
+                    return 0;
+                }
+                // Read before anything else happens, so a bad answer fails before any change.
+                const answers = values["answers-stdin"] ? parseProvidedAnswers(await readAnswers(options.stdin ?? process.stdin)) : undefined;
                 if (system.dryRun)
                     log("Dry run: nothing on this machine will change.\n");
                 await up(system, {
                     prompter: new TtyPrompter(),
                     ui,
+                    ...(access ? { access } : {}),
+                    ...(answers ? { answers } : {}),
                     ...(values["autopilot-version"] ? { autopilotVersion: values["autopilot-version"] } : {}),
                     ...(values["hotcell-version"] ? { hotcellVersion: values["hotcell-version"] } : {}),
                 });
                 return 0;
+            }
+            case "pair": {
+                // Only the laptop's setup runs this, and it reads the JSON; there's no human form.
+                if (!values.json || !values.name?.trim()) {
+                    io.err(`  Usage: dl pair --name NAME --json   ${colors.dim("(run by the laptop's setup, over SSH)")}\n`);
+                    return 2;
+                }
+                const state = await readState(system);
+                if (!state) {
+                    io.err("  Directionally Local isn't installed on this server yet; run dl up first.\n");
+                    return 1;
+                }
+                if (!isRoot()) {
+                    io.err("  Run it as root: sudo dl pair --name NAME --json\n");
+                    return 1;
+                }
+                await pairLaptop(system, state, values.name, io.out);
+                return 0;
+            }
             case "doctor": {
                 const checks = await doctor(system);
                 log(formatChecks(checks, terminal && !process.env.NO_COLOR));
@@ -222,6 +290,12 @@ export async function main(argv, io = {
     }
     catch (error) {
         ui.finish();
+        if (jsonUi) {
+            // The event is what the laptop shows; the log's tail on stderr is for whoever looks.
+            jsonUi.error(describeError(error));
+            io.err(await logTail(UP_LOG, palette(false)));
+            return 1;
+        }
         const c = palette(live && !process.env.NO_COLOR);
         io.err(`\n  ${c.red("✗")} ${describeError(error).replace(/\n/g, "\n    ")}\n`);
         if (live)
@@ -242,6 +316,33 @@ const NOT_A_SERVER = (c) => `
      dl connect https://your-server
 
 `;
+/**
+ * The `--answers-stdin` JSON: everything up to the end of stdin, or sooner once what came
+ * so far parses (a laptop that keeps the SSH channel open still gets going). Keys arrive
+ * this way so they're never in argv, the environment, or a file.
+ */
+export async function readAnswers(stdin) {
+    if (stdin.isTTY)
+        throw new Error("--answers-stdin reads one JSON object from a pipe, not a terminal.");
+    let text = "";
+    for await (const chunk of stdin) {
+        text += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+        if (text.length > 64 * 1024)
+            throw new Error("The answers on stdin are too long; expected one small JSON object.");
+        if (text.includes("\n") && parses(text))
+            return text;
+    }
+    return text;
+}
+function parses(text) {
+    try {
+        JSON.parse(text);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /** Ctrl-C aborts the command (a running task keeps going on the server). */
 async function interruptible(work) {
     const controller = new AbortController();

package/dist/doctor.js

@@ -1,7 +1,7 @@
 import { detectHost, MIN_DISK_GB } from "./detect.js";
 import { nodeAdvisory } from "./node-advisory.js";
 import { AUTOPILOT_PORT, AUTO_UPGRADES, HOTCELL_PORT, NODE_AUTO_UPDATES, PATHS, SERVICES, parseEnvFile } from "./layout.js";
-import { readState } from "./state.js";
+import { describeAccess, readState } from "./state.js";
 import { palette } from "./ui.js";
 /** `directionallylocal doctor`: every moving part, with a fix for each failure. */
 export async function doctor(system) {
@@ -9,7 +9,7 @@ export async function doctor(system) {
     const add = (check) => checks.push(check);
     const state = await readState(system);
     add(state
-        ? { name: "installed", ok: true, detail: `${state.release}, ${state.access.mode} at ${state.access.url}` }
+        ? { name: "installed", ok: true, detail: `${state.release}, ${state.access.mode === "ssh" ? describeAccess(state.access) : `${state.access.mode} at ${state.access.url}`}` }
         : { name: "installed", ok: false, detail: "not installed", fix: "sudo dl up" });
     const facts = await detectHost(system);
     const node = nodeAdvisory(facts.nodeVersion ?? "");
@@ -49,6 +49,7 @@ export async function doctor(system) {
     add({ name: "github", ok: github, detail: github ? "token configured" : "no token; runs can't push or open PRs", fix: "sudo dl up (asks for it)" });
     const autopilot = (await system.probe("curl", ["-s", "-o", "/dev/null", "-w", "%{http_code}", `http://127.0.0.1:${AUTOPILOT_PORT}/api/v1/health`])).stdout.trim();
     add({ name: "agent server API", ok: autopilot === "401", detail: autopilot === "401" ? "up (refuses requests without a token)" : `HTTP ${autopilot || "none"}`, fix: "dl logs autopilot · then dl up" });
+    // Loopback and SSH access have nothing published to check: the tunnel is the laptop's.
     if (state?.access.mode === "tailscale") {
         const serve = await system.probe("tailscale", ["serve", "status"]);
         const serving = serve.code === 0 && serve.stdout.includes(`127.0.0.1:${AUTOPILOT_PORT}`);

package/dist/home.js

@@ -1,7 +1,7 @@
 import { agentCapacity, detectHost } from "./detect.js";
 import { AUTOPILOT_PORT, CELL_MEMORY_MB, SERVICES } from "./layout.js";
-import { approvePairing, listLaptops, listServerRuns, ownerLink, pendingPairings, revokeLaptop } from "./server-api.js";
-import { readState } from "./state.js";
+import { approvePairing, createLaptopCredential, listLaptops, listServerRuns, ownerLink, pendingPairings, revokeLaptop } from "./server-api.js";
+import { describeAccess, readState } from "./state.js";
 import { palette } from "./ui.js";
 import { nextSteps } from "./up.js";
 const ABOUT = "Background coding agents on your own server: send a task from your laptop, get a pull request back.";
@@ -29,7 +29,7 @@ export async function serverHome(system, state, write, c) {
     const running = runs?.filter((run) => run.active).length ?? 0;
     const doneThisWeek = runs?.filter((run) => !run.active && Date.parse(run.createdAt) >= week).length ?? 0;
     const row = (label, value, hint = "") => `  ${c.dim(label.padEnd(11))}${value}${hint ? `   ${c.dim(hint)}` : ""}\n`;
-    write(`\n  ${c.bold("Directionally Local")}  ${verdict}  ${c.dim(state.access.url)}\n\n  ${ABOUT}\n\n`);
+    write(`\n  ${c.bold("Directionally Local")}  ${verdict}  ${c.dim(describeAccess(state.access))}\n\n  ${ABOUT}\n\n`);
     write(row("Laptops", laptops === undefined ? c.dim("unknown (run dl up to update)") : laptops.length === 0 ? "none connected yet" : `${laptops.length} connected · ${laptops.map((laptop) => laptop.name).join(", ")}`, "dl laptops"));
     write(row("Runs", runs === undefined ? c.dim("unknown (run dl up to update)") : `${running} running · ${doneThisWeek} this week`, "dl runs"));
     write(row("Capacity", `~${agentCapacity(facts, CELL_MEMORY_MB)} agents at once (estimate)`));
@@ -41,7 +41,7 @@ export async function serverHome(system, state, write, c) {
 /** `dl status --brief`: one line, for the login message. Never slow, never fails loudly. */
 export async function briefStatus(system, state, write, c) {
     const status = await health(system);
-    write(`\n  ${c.bold("Directionally Local")}  ${status.ok ? c.green("● healthy") : c.red(`● ${status.problems.join(", ")}`)}  ${c.dim(state.access.url)}\n  ${c.dim("Type")} dl ${c.dim("for what this is and what's running.")}\n\n`);
+    write(`\n  ${c.bold("Directionally Local")}  ${status.ok ? c.green("● healthy") : c.red(`● ${status.problems.join(", ")}`)}  ${c.dim(describeAccess(state.access))}\n  ${c.dim("Type")} dl ${c.dim("for what this is and what's running.")}\n\n`);
 }
 /**
  * `dl connect-laptop [CODE]`: approve a laptop's code, or explain how to connect one and
@@ -65,6 +65,18 @@ export async function connectLaptop(system, state, code, write, c) {
     write(`\n  ${c.dim("The laptop shows a code; approve it in that browser, or here with")} dl connect-laptop <code>\n\n`);
     return 0;
 }
+/**
+ * `dl pair --name NAME --json`: a credential for the laptop that's setting this server up
+ * over SSH, printed as one JSON line for it to keep. The token appears nowhere else.
+ */
+export async function pairLaptop(system, state, name, write) {
+    const trimmed = name.trim();
+    if (!trimmed || trimmed.length > 100 || /[\u0000-\u001f\u007f]/.test(trimmed)) {
+        throw new Error("--name must be 1 to 100 printable characters, e.g. the laptop's hostname.");
+    }
+    const paired = await createLaptopCredential(system, trimmed, state.access.url);
+    write(`${JSON.stringify({ token: paired.token, credentialId: paired.credentialId, name: paired.name, expiresAt: paired.expiresAt, url: paired.url })}\n`);
+}
 export async function laptopsCommand(system, args, write, c) {
     const laptops = await listLaptops(system);
     if (laptops === undefined) {

package/dist/server-api.js

@@ -42,6 +42,28 @@ export async function ownerLink(system, url) {
     const link = result.stdout.trim().split("\n").at(-1);
     return result.code === 0 && link?.startsWith("http") ? link : undefined;
 }
+/** How long a laptop's credential lasts; re-running the laptop's setup pairs it again. */
+export const LAPTOP_CREDENTIAL_DAYS = 90;
+/**
+ * Creates a credential for a laptop that set this server up over SSH, so it never has to
+ * show a code and wait for approval: being root here already proves it's the owner's.
+ * The token comes back in the command's output, so that output stays out of the log.
+ */
+export async function createLaptopCredential(system, name, url) {
+    const result = await autopilotServer(system, [
+        "aster", "token", "create", "--name", name, "--workspace", "default", "--expires-in-days", String(LAPTOP_CREDENTIAL_DAYS), "--json",
+    ], { secretOutput: true });
+    if (result.code !== 0) {
+        throw new Error(`Couldn't create a credential for the laptop${result.stderr.trim() ? `: ${result.stderr.trim().split("\n").slice(-3).join(" ")}` : ""}; run dl up to update this server.`);
+    }
+    const created = parseJson(result);
+    const { credentialId, expiresAt, token } = created ?? {};
+    // Never echo the output when it doesn't parse: it may hold the token.
+    if (typeof token !== "string" || !token || typeof credentialId !== "string" || typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) {
+        throw new Error("Autopilot created a credential but its answer wasn't what dl expects; run dl up to update this server.");
+    }
+    return { token, credentialId, name, expiresAt: new Date(expiresAt).toISOString(), url };
+}
 function parseJson(result) {
     if (result.code !== 0)
         return undefined;

package/dist/state.js

@@ -1,4 +1,9 @@
 import { PATHS } from "./layout.js";
+export const ACCESS_MODES = ["tailscale", "loopback", "ssh"];
+/** How people reach this server, in words (the address alone means little for a tunnel). */
+export function describeAccess(access) {
+    return access.mode === "ssh" ? "over SSH from your laptop" : access.url;
+}
 export async function readState(system) {
     const raw = await system.readFile(PATHS.state);
     if (!raw)

package/dist/ui.js

@@ -201,6 +201,39 @@ export class PlainUi {
     warn(text) { this.write(`!! ${text}\n`); }
     finish() { }
 }
+/**
+ * For the laptop that runs `dl up` over SSH and draws the progress itself: one JSON object
+ * per line (NDJSON) on stdout, nothing else there. Nothing is asked in this mode, so a
+ * rejected answer is only a warning, and a prompt is never shown.
+ */
+export class JsonUi {
+    write;
+    interactive = false;
+    constructor(write = (text) => process.stdout.write(text)) {
+        this.write = write;
+    }
+    title(text) { this.emit({ event: "title", text }); }
+    line(status, label, detail) { this.emit({ event: "line", status, label, detail }); }
+    plan(steps) { this.emit({ event: "plan", steps: steps.map(({ id, label }) => ({ id, label })) }); }
+    start(id, detail) { this.emit({ event: "start", id, detail }); }
+    done(id, detail) { this.emit({ event: "done", id, detail }); }
+    fail(id, message) { this.emit({ event: "fail", id, message }); }
+    questions(intro) { this.emit({ event: "questions", text: intro }); }
+    prompt(label) { return label; }
+    answered(label, detail) { this.emit({ event: "answered", label, detail }); }
+    rejected(message) { this.emit({ event: "warn", text: message }); }
+    ready(headline, items, extra = {}) {
+        this.emit({ event: "ready", headline, items: items.map(({ label, value }) => ({ label, value })), about: extra.about, footer: extra.footer });
+    }
+    warn(text) { this.emit({ event: "warn", text }); }
+    /** The last event of a failed run (not part of Ui: the CLI reports failures, not `up`). */
+    error(message) { this.emit({ event: "error", message }); }
+    finish() { }
+    emit(event) {
+        // JSON.stringify drops undefined fields and escapes newlines, so each event is one line.
+        this.write(`${JSON.stringify(event)}\n`);
+    }
+}
 /** Records events for tests. */
 export class RecordingUi {
     interactive = false;

package/dist/up.js

@@ -2,7 +2,7 @@ import { randomBytes } from "node:crypto";
 import { hostname } from "node:os";
 import { agentCapacity, detectHost, preflightProblems } from "./detect.js";
 import { AUTOPILOT_PORT, CELL_MEMORY_MB, GITHUB_PROXY_PORT, HOTCELL_EGRESS_PORT, HOTCELL_PORT, PATHS, SERVICES, USERS, AUTO_UPGRADES, NODE_AUTO_UPDATES, asterConfig, autoUpgrades, autopilotBin, autopilotEnv, autopilotUnit, MOTD_SCRIPT, cellDockerfile, cellImage, githubEnv, hotcellBin, hotcellEnv, hotcellUnit, metadataBlockUnit, motdScript, nodeAutoUpdates, parseEnvFile, } from "./layout.js";
-import { readState, writeState } from "./state.js";
+import { ACCESS_MODES, readState, writeState } from "./state.js";
 import { PlainUi } from "./ui.js";
 import { ownerLink } from "./server-api.js";
 const DRY_RUN_BRIDGE_IP = "172.17.0.1";
@@ -26,9 +26,9 @@ export async function up(system, options) {
     ui.line("done", "Checked this machine", `${facts.os.prettyName.replace(/ LTS$/, "")} · ${facts.cpus} CPU · ${(facts.memoryMb / 1024).toFixed(1)} GB · ${facts.diskFreeGb} GB free`);
     // Every question comes first, so the long part runs unattended.
     const previous = await readState(system);
-    const access = accessMode(env, previous);
+    const access = accessMode(options.access, env, previous);
     const check = env.DL_SKIP_CREDENTIAL_CHECK === "1" ? undefined : fetchImpl;
-    const answers = await collectAnswers(system, ui, options.prompter, env, check, facts, access);
+    const answers = await collectAnswers(system, ui, options.prompter, given(env, options.answers), check, facts, access);
     ui.plan([
         ...(access === "tailscale" ? [{ id: "tailnet", label: "Joining your tailnet" }] : []),
         { id: "docker", label: "Setting up Docker" },
@@ -121,6 +121,10 @@ export async function up(system, options) {
         return { value: apiKey, detail: "sandboxes and keys ready" };
     });
     const url = await step("access", async () => {
+        // Moving off Tailscale: stop publishing on the tailnet, so the only way in is the new one.
+        if (access !== "tailscale" && previous?.access.mode === "tailscale") {
+            await system.run("tailscale", ["serve", "--https=443", `http://127.0.0.1:${AUTOPILOT_PORT}`, "off"], { allowFailure: true });
+        }
         const address = access === "tailscale" ? await serveOverTailscale(system) : `http://127.0.0.1:${AUTOPILOT_PORT}`;
         await system.writeFile(PATHS.autopilotEnv, autopilotEnv({ hotcellApiKey, image, bridgeIp, publicUrl: address }), { mode: 0o640, owner: `root:${USERS.autopilot}`, secret: true });
         await system.run("systemctl", ["enable", SERVICES.autopilot]);
@@ -141,8 +145,15 @@ export async function up(system, options) {
         access: { mode: access, url },
     };
     await writeState(system, state);
-    const link = await ownerLink(system, url);
     const capacity = agentCapacity(facts, CELL_MEMORY_MB);
+    if (access === "ssh") {
+        // The laptop set this up, pairs itself (`dl pair`), and prints its own summary, so there's
+        // no browser link to make: a one-time owner link would only be a secret in its output.
+        await installLoginStatus(system);
+        ui.ready("Ready", [{ label: "On your laptop, from inside a GitHub repository", value: 'dl run "fix the flaky checkout test"' }]);
+        return { url, ownerLink: undefined, capacity, state };
+    }
+    const link = await ownerLink(system, url);
     await installLoginStatus(system);
     ui.ready("Ready", nextSteps({ url, ownerLink: link, access }), {
         about: [
@@ -171,46 +182,116 @@ async function installLoginStatus(system) {
         return;
     await system.writeFile(MOTD_SCRIPT, motdScript(), { mode: 0o755 });
 }
-function accessMode(env, previous) {
+/** Checks an access mode named by `--access` or DL_ACCESS. */
+export function parseAccessMode(value, source = "--access") {
+    const mode = ACCESS_MODES.find((entry) => entry === value);
+    if (mode)
+        return mode;
+    throw new Error(`${source} must be ${ACCESS_MODES.join(", ").replace(/, ([^,]+)$/, " or $1")} (got "${value}"); an own domain and the instant address are coming.`);
+}
+/** The flag wins, then DL_ACCESS, then what the last `up` chose; Tailscale on a fresh machine. */
+function accessMode(flag, env, previous) {
+    if (flag)
+        return flag;
     const requested = env.DL_ACCESS?.trim();
     if (requested === undefined || requested === "")
         return previous?.access.mode ?? "tailscale";
-    if (requested === "tailscale" || requested === "loopback")
-        return requested;
-    throw new Error(`DL_ACCESS must be tailscale or loopback (got "${requested}"); an own domain and the instant address are coming.`);
+    return parseAccessMode(requested, "DL_ACCESS");
 }
-async function collectAnswers(system, ui, prompter, env, fetchImpl, facts, access) {
+/**
+ * `dl up --needs`: the answers a real `up` would require on this machine, without asking for
+ * or changing anything (it only reads files and runs read-only probes). The laptop asks for
+ * exactly these before it starts the install. Answers in DL_* variables don't count: the
+ * laptop's `up` takes its answers from stdin.
+ */
+export async function needs(system, options = {}) {
+    const access = accessMode(options.access, options.env ?? process.env, await readState(system));
+    const missing = await missingAnswers(system, await detectHost(system), access);
+    return ["tailscale", "openrouter", "github"].filter((need) => missing[need]);
+}
+/**
+ * Which answers this machine still lacks: the model key unless Hotcell has one, a GitHub
+ * token unless its env file has one, a Tailscale key only for Tailscale access off a tailnet.
+ */
+async function missingAnswers(system, facts, access) {
     const tailscaleRunning = access !== "tailscale" || (facts.tailscale && await tailscaleIsUp(system));
-    const hasModelKey = await hotcellHasKey(system, "openrouter");
-    const hasGitHub = Boolean(parseEnvFile(await system.readFile(PATHS.githubEnv)).GITHUB_TOKEN);
+    return {
+        tailscale: !tailscaleRunning,
+        openrouter: !(await hotcellHasKey(system, "openrouter")),
+        github: !parseEnvFile(await system.readFile(PATHS.githubEnv)).GITHUB_TOKEN,
+    };
+}
+function given(env, provided) {
+    if (provided) {
+        return { tailscaleAuthKey: provided.tailscaleAuthKey, openRouterKey: provided.openrouterKey, githubToken: provided.githubToken, source: "from your laptop", final: true };
+    }
+    return { tailscaleAuthKey: env.DL_TAILSCALE_AUTH_KEY, openRouterKey: env.DL_OPENROUTER_API_KEY, githubToken: env.DL_GITHUB_TOKEN, source: "from the environment", final: false };
+}
+/**
+ * The answers from `--answers-stdin`. Parse errors never quote the input: it holds keys.
+ * Unknown fields are ignored, so a newer laptop can send more than this server knows.
+ */
+export function parseProvidedAnswers(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new Error("The answers on stdin aren't valid JSON; expected one object like {\"openrouterKey\": \"sk-or-…\"}.");
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+        throw new Error("The answers on stdin must be one JSON object.");
+    const record = parsed;
+    const answers = {};
+    for (const key of ["openrouterKey", "githubToken", "tailscaleAuthKey"]) {
+        const value = record[key];
+        if (value === undefined || value === null)
+            continue;
+        if (typeof value !== "string")
+            throw new Error(`The answer "${key}" on stdin must be a string.`);
+        answers[key] = value;
+    }
+    return answers;
+}
+async function collectAnswers(system, ui, prompter, provided, fetchImpl, facts, access) {
+    const missing = await missingAnswers(system, facts, access);
     if (system.dryRun) {
         return {
-            tailscaleAuthKey: tailscaleRunning ? undefined : "<asked>",
-            openRouterKey: hasModelKey ? undefined : "<asked>",
-            githubToken: hasGitHub ? undefined : "<asked>",
+            tailscaleAuthKey: missing.tailscale ? "<asked>" : undefined,
+            openRouterKey: missing.openrouter ? "<asked>" : undefined,
+            githubToken: missing.github ? "<asked>" : undefined,
         };
     }
-    const typed = [
-        !tailscaleRunning && !env.DL_TAILSCALE_AUTH_KEY,
-        !hasModelKey && !env.DL_OPENROUTER_API_KEY,
-        !hasGitHub && !env.DL_GITHUB_TOKEN,
+    const typed = provided.final ? 0 : [
+        missing.tailscale && !provided.tailscaleAuthKey,
+        missing.openrouter && !provided.openRouterKey,
+        missing.github && !provided.githubToken,
     ].filter(Boolean).length;
     if (typed > 0)
         ui.questions(`${typed === 1 ? "One key" : `${typed} keys`}, then it runs on its own. Typing is hidden.`);
-    const tailscaleAuthKey = tailscaleRunning ? undefined : await askValidated(ui, env.DL_TAILSCALE_AUTH_KEY, "Tailscale auth key", () => prompter.secret(ui.prompt("Tailscale auth key", "login.tailscale.com/admin/settings/keys")), async (value) => /^tskey-[A-Za-z0-9-]+$/.test(value) ? {} : { problem: "That doesn't look like a Tailscale auth key (tskey-…)." });
-    const openRouterKey = hasModelKey ? undefined : await askValidated(ui, env.DL_OPENROUTER_API_KEY, "OpenRouter API key", () => prompter.secret(ui.prompt("OpenRouter API key", "stays in Hotcell; sandboxes and laptops never see it")), async (value) => ({ ...await validateOpenRouterKey(value, fetchImpl).then((problem) => problem ? { problem } : { detail: "kept in Hotcell" }) }));
-    const githubToken = hasGitHub ? undefined : await askValidated(ui, env.DL_GITHUB_TOKEN, "GitHub token", () => prompter.secret(ui.prompt("GitHub token", "fine-grained · Contents + Pull requests read/write")), (value) => validateGitHubToken(value, fetchImpl));
+    // With final answers there's no one to ask: a missing one fails before anything changes.
+    const asking = (ask) => provided.final ? undefined : ask;
+    const tailscaleAuthKey = !missing.tailscale ? undefined : await askValidated(ui, provided.tailscaleAuthKey, provided.source, "Tailscale auth key", asking(() => prompter.secret(ui.prompt("Tailscale auth key", "login.tailscale.com/admin/settings/keys"))), async (value) => /^tskey-[A-Za-z0-9-]+$/.test(value) ? {} : { problem: "That doesn't look like a Tailscale auth key (tskey-…)." });
+    const openRouterKey = !missing.openrouter ? undefined : await askValidated(ui, provided.openRouterKey, provided.source, "OpenRouter API key", asking(() => prompter.secret(ui.prompt("OpenRouter API key", "stays in Hotcell; sandboxes and laptops never see it"))), async (value) => ({ ...await validateOpenRouterKey(value, fetchImpl).then((problem) => problem ? { problem } : { detail: "kept in Hotcell" }) }));
+    const githubToken = !missing.github ? undefined : await askValidated(ui, provided.githubToken, provided.source, "GitHub token", asking(() => prompter.secret(ui.prompt("GitHub token", "fine-grained · Contents + Pull requests read/write"))), (value) => validateGitHubToken(value, fetchImpl));
     return { tailscaleAuthKey, openRouterKey, githubToken };
 }
-/** Takes an env answer as-is (failing fast if invalid) or asks up to three times. */
-async function askValidated(ui, fromEnv, label, ask, validate) {
+/**
+ * Takes a given answer as-is (failing fast if invalid) or asks up to three times. Without a
+ * way to ask (answers from the laptop), a missing answer is a failure.
+ */
+async function askValidated(ui, fromEnv, source, label, ask, validate) {
     if (fromEnv) {
         const { problem, detail } = await validate(fromEnv.trim());
         if (problem)
             throw new Error(problem);
-        ui.line("done", label, detail ? `${detail} · from the environment` : "from the environment");
+        ui.line("done", label, detail ? `${detail} · ${source}` : source);
         return fromEnv.trim();
     }
+    if (!ask) {
+        ui.line("failed", label, "not given");
+        throw new Error(`This server needs ${/^[AEIOU]/.test(label) ? "an" : "a"} ${label} and none was given ${source.replace(/^from/, "by")}.`);
+    }
     for (let attempt = 1;; attempt++) {
         const value = (await ask()).trim();
         const { problem, detail } = value ? await validate(value) : { problem: "An answer is required.", detail: undefined };

package/install.sh

@@ -8,21 +8,24 @@
 # key, and sets up Hotcell + Autopilot as services. Safe to run again.
 #
 # Unattended: export DL_TAILSCALE_AUTH_KEY, DL_OPENROUTER_API_KEY and DL_GITHUB_TOKEN first.
+# Install only (the laptop's setup, which then runs `dl up` itself over SSH): DL_INSTALL_ONLY=1.
 # Pin a version: DL_VERSION=0.1.0. Install from a local tarball: DL_PACKAGE=/path/to.tgz.
 set -eu
 
 say() { printf '%s\n' "$*"; }
 fail() { printf '\n  directionallylocal: %s\n' "$*" >&2; exit 1; }
 
-# The same look as `dl up`: a step shows "·" while it runs and becomes "✓" when done.
-# Without a terminal (or with NO_COLOR) it's plain lines.
+# The same look as `dl up`: a running step has a spinner and a timer, and becomes "✓"
+# when done. Without a terminal (or with NO_COLOR) it's plain lines.
 if [ -t 1 ] && [ -z "${NO_COLOR:-}" ] && [ "${TERM:-}" != "dumb" ]; then
   FANCY=1
 else
   FANCY=""
 fi
+STEP=""
 step() {
-  if [ -n "$FANCY" ]; then printf '  \033[36m·\033[0m %s' "$1"; else say ".. $1"; fi
+  STEP=$1
+  if [ -n "$FANCY" ]; then printf '  \033[36m⠋\033[0m %s' "$1"; else say ".. $1"; fi
 }
 step_done() {
   if [ -n "$FANCY" ]; then printf '\r\033[2K  \033[32m✓\033[0m %-33s\033[2m%s\033[0m\n' "$1" "${2:-}"; else say "ok $1${2:+: $2}"; fi
@@ -40,11 +43,43 @@ as_root() {
   fi
 }
 
+# The spinner frame for tick $1 (POSIX sh has no arrays, and multibyte cut isn't portable).
+frame() {
+  case $(($1 % 10)) in
+    0) printf '⠋' ;; 1) printf '⠙' ;; 2) printf '⠹' ;; 3) printf '⠸' ;; 4) printf '⠼' ;;
+    5) printf '⠴' ;; 6) printf '⠦' ;; 7) printf '⠧' ;; 8) printf '⠇' ;; *) printf '⠏' ;;
+  esac
+}
+
+# On failure, show only this step's own output, not the earlier steps' in the same log.
+show_step_log() {
+  tail -n "+$(($1 + 1))" "$LOG" | tail -n 15 | while IFS= read -r line; do
+    if [ -n "$FANCY" ]; then printf '    \033[2m%s\033[0m\n' "$line" >&2; else printf '    %s\n' "$line" >&2; fi
+  done
+}
+
 quietly() {
   what=$1
   shift
-  if ! "$@" >>"$LOG" 2>&1; then
-    tail -n 20 "$LOG" >&2
+  from=$(wc -l <"$LOG")
+  if [ -z "$FANCY" ]; then
+    "$@" >>"$LOG" 2>&1 || { show_step_log "$from"; fail "$what failed"; }
+    return 0
+  fi
+  # Run in the background and animate the current step until it finishes.
+  "$@" >>"$LOG" 2>&1 &
+  pid=$!
+  started=$(date +%s)
+  tick=0
+  while kill -0 "$pid" 2>/dev/null; do
+    elapsed=$(($(date +%s) - started))
+    printf '\r\033[2K  \033[36m%s\033[0m %-33s\033[2m%d:%02d\033[0m' "$(frame "$tick")" "$STEP" $((elapsed / 60)) $((elapsed % 60))
+    tick=$((tick + 1))
+    sleep 0.1
+  done
+  if ! wait "$pid"; then
+    printf '\r\033[2K  \033[31m✗\033[0m %s\n\n' "$STEP"
+    show_step_log "$from"
     fail "$what failed"
   fi
 }
@@ -102,6 +137,12 @@ main() {
   quietly "installing $package" as_root npm install -g --no-audit --no-fund --loglevel=error "$package"
   step_done "Got the installer" "dl $(dl --version 2>/dev/null || echo "")"
 
+  # The laptop's setup stops here: it asks for the keys itself and runs `dl up` next,
+  # with its own progress display.
+  if [ "${DL_INSTALL_ONLY:-}" = "1" ]; then
+    return 0
+  fi
+
   # Prompts read the terminal, not this piped script. Test by opening it: the device
   # node exists even when there's no controlling terminal.
   # dl up continues the same screen, so it skips its own title.

package/package.json

@@ -1,7 +1,15 @@
 {
   "name": "directionallylocal",
-  "version": "0.1.0",
-  "description": "One-line server install for Directionally Local: Hotcell sandboxes and Autopilot, ready for autopilot --on",
+  "version": "0.2.0",
+  "description": "Directionally Local: background coding agents on your own server. One-line server install, and the dl command for your server and laptop.",
+  "homepage": "https://directionallylocal.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/directionally-local/installer.git"
+  },
+  "bugs": {
+    "url": "https://github.com/directionally-local/installer/issues"
+  },
   "type": "module",
   "bin": {
     "directionallylocal": "bin/directionallylocal.mjs",