directionallylocal 0.1.2 → 0.3.0

package/dist/cli.js

@@ -2,20 +2,26 @@ import { readFileSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { parseArgs } from "node:util";
 import { doctor, formatChecks } from "./doctor.js";
-import { briefStatus, connectLaptop, laptopsCommand, logsCommand, serverHome, serverRunsCommand } from "./home.js";
+import { briefStatus, connectLaptop, laptopsCommand, logsCommand, pairLaptop, serverHome, serverRunsCommand } from "./home.js";
 import { cancel, connect, describeError, laptopHome, pull, run, runs, servers, watch } from "./laptop/commands.js";
+import { loadRemotes } from "./laptop/config.js";
+import { setup } from "./laptop/setup.js";
+import { localCommand } from "./local/cli.js";
+import { setUpOnThisComputer } from "./local/setup.js";
 import { TtyPrompter } from "./prompt.js";
 import { readState } from "./state.js";
 import { DryRunSystem, RealSystem } from "./system.js";
 import { uninstall } from "./uninstall.js";
-import { PlainUi, TerminalUi, palette } from "./ui.js";
-import { up } from "./up.js";
+import { JsonUi, PlainUi, TerminalUi, palette } from "./ui.js";
+import { needs, parseAccessMode, parseProvidedAnswers, up } from "./up.js";
 const HELP = `Directionally Local: background coding agents on your own server.
 Send a task from your laptop; it runs in its own sandbox and comes back as a pull request.
 (dl is short for directionallylocal; both work.)
 
 On your laptop:
-  dl connect URL          connect to your server (approve the code it shows)
+  dl                      set up where agents run (the first time; afterwards, an overview)
+  dl setup                set up, or repair, a server over SSH (safe to re-run)
+  dl connect URL          connect to a server someone else set up (approve the code it shows)
   dl run "TASK"           run a task on the server, from inside a GitHub repository
                           (your uncommitted changes go along; Ctrl-C stops watching, not the task)
   dl runs                 your tasks and their pull requests
@@ -23,6 +29,8 @@ On your laptop:
   dl pull ID              check out a task's branch here
   dl servers              connected servers (dl servers remove NAME)
   run options: --server NAME, -m MODEL, --repo OWNER/NAME, --detach
+  dl local status         agents running on this computer: running?, where, how many fit
+  dl local uninstall [--purge]   stop and remove them (--purge also deletes keys and data)
 
 On the server:
   dl                      what this is, whether it's healthy, laptops, and runs
@@ -46,7 +54,14 @@ Unattended installs answer the questions with environment variables:
 
 Advanced:
   DL_ACCESS=loopback          don't expose the server; reach it over an SSH tunnel
+                              (or --access tailscale|loopback|ssh; ssh is the laptop's setup)
   DL_SKIP_CREDENTIAL_CHECK=1  don't check the keys with OpenRouter and GitHub (offline installs)
+
+Used by the laptop's setup (over SSH, as root):
+  dl up --access ssh --answers-stdin --events json
+                              install with the keys as one JSON object on stdin; progress as JSON lines
+  dl up --needs [--access ssh]   which keys dl up would still need, as JSON; changes nothing
+  dl pair --name NAME --json     a credential for that laptop, as JSON
 `;
 export async function main(argv, io = {
     out: (text) => process.stdout.write(text),
@@ -73,6 +88,10 @@ export async function main(argv, io = {
                 repo: { type: "string" },
                 detach: { type: "boolean" },
                 json: { type: "boolean" },
+                access: { type: "string" },
+                "answers-stdin": { type: "boolean" },
+                events: { type: "string" },
+                needs: { type: "boolean" },
             },
         });
     }
@@ -90,27 +109,84 @@ export async function main(argv, io = {
         io.out(HELP);
         return 0;
     }
-    const log = (line) => io.out(`${line}\n`);
+    if (values.events !== undefined && values.events !== "json") {
+        io.err(`--events takes json (got "${values.events}").\n\n${HELP}`);
+        return 2;
+    }
+    let access;
+    try {
+        access = values.access === undefined ? undefined : parseAccessMode(values.access);
+    }
+    catch (error) {
+        io.err(`${error.message}\n`);
+        return 2;
+    }
+    // `--events json`: stdout carries only the laptop's JSON events; everything else goes to
+    // stderr, and other tools' output to the install log, as with the live checklist.
+    const json = command === "up" && values.events === "json" && !values.needs;
+    const log = (line) => (json ? io.err : io.out)(`${line}\n`);
     // The live checklist needs a terminal; a dry run prints its plan line by line instead.
     const terminal = options.terminal ?? (process.stdout.isTTY === true);
-    const live = terminal && command === "up" && !values["dry-run"];
-    const ui = live ? new TerminalUi(io.out) : new PlainUi(io.out);
-    const colorOn = terminal && !process.env.NO_COLOR && process.env.TERM !== "dumb";
+    // --needs only looks: it mustn't even start a new install log.
+    const live = terminal && command === "up" && !values["dry-run"] && !values.needs && !json;
+    const jsonUi = json ? new JsonUi(io.out) : undefined;
+    const ui = jsonUi ?? (live ? new TerminalUi(io.out) : new PlainUi(io.out));
+    const colorOn = terminal && !json && !process.env.NO_COLOR && process.env.TERM !== "dumb";
     const colors = palette(colorOn);
     const laptopIO = { out: io.out, err: io.err, color: colorOn };
-    const system = values["dry-run"] ? new DryRunSystem(log) : new RealSystem(log, live ? { outputLog: UP_LOG } : {});
+    const logged = (live || json) && !values["dry-run"];
+    let system;
+    try {
+        system = values["dry-run"] ? new DryRunSystem(log) : new RealSystem(log, logged ? { outputLog: UP_LOG } : {});
+    }
+    catch (error) {
+        // Opening the install log is the first write, so this is where a non-root `up` stops.
+        const message = `Couldn't open ${UP_LOG}: ${describeError(error)}. Run it as root: sudo dl up`;
+        if (jsonUi)
+            jsonUi.error(message);
+        else
+            io.err(`\n  ${palette(live && !process.env.NO_COLOR).red("✗")} ${message}\n`);
+        return 1;
+    }
     try {
         switch (command) {
-            case "up":
+            case "up": {
+                if (values.needs) {
+                    io.out(`${JSON.stringify({ needs: await needs(system, access ? { access } : {}) })}\n`);
+                    return 0;
+                }
+                // Read before anything else happens, so a bad answer fails before any change.
+                const answers = values["answers-stdin"] ? parseProvidedAnswers(await readAnswers(options.stdin ?? process.stdin)) : undefined;
                 if (system.dryRun)
                     log("Dry run: nothing on this machine will change.\n");
                 await up(system, {
                     prompter: new TtyPrompter(),
                     ui,
+                    ...(access ? { access } : {}),
+                    ...(answers ? { answers } : {}),
                     ...(values["autopilot-version"] ? { autopilotVersion: values["autopilot-version"] } : {}),
                     ...(values["hotcell-version"] ? { hotcellVersion: values["hotcell-version"] } : {}),
                 });
                 return 0;
+            }
+            case "pair": {
+                // Only the laptop's setup runs this, and it reads the JSON; there's no human form.
+                if (!values.json || !values.name?.trim()) {
+                    io.err(`  Usage: dl pair --name NAME --json   ${colors.dim("(run by the laptop's setup, over SSH)")}\n`);
+                    return 2;
+                }
+                const state = await readState(system);
+                if (!state) {
+                    io.err("  Directionally Local isn't installed on this server yet; run dl up first.\n");
+                    return 1;
+                }
+                if (!isRoot()) {
+                    io.err("  Run it as root: sudo dl pair --name NAME --json\n");
+                    return 1;
+                }
+                await pairLaptop(system, state, values.name, io.out);
+                return 0;
+            }
             case "doctor": {
                 const checks = await doctor(system);
                 log(formatChecks(checks, terminal && !process.env.NO_COLOR));
@@ -125,6 +201,9 @@ export async function main(argv, io = {
                     // A laptop connected to servers gets its own home; otherwise, what this is and how to start.
                     if (!command && await laptopHome(laptopIO))
                         return 0;
+                    // A laptop with nothing set up yet: the wizard (it needs someone to answer it).
+                    if (!command && terminal && !isRoot() && (await loadRemotes()).length === 0)
+                        return await setup({ io: laptopIO, terminal, localSetup: (input) => setUpOnThisComputer(input) });
                     io.out(NOT_A_SERVER(colors));
                     return command ? 1 : 0;
                 }
@@ -140,6 +219,8 @@ export async function main(argv, io = {
                 await serverHome(system, state, io.out, colors);
                 return 0;
             }
+            case "setup":
+                return await setup({ io: laptopIO, terminal, localSetup: (input) => setUpOnThisComputer(input) });
             case "connect": {
                 const url = parsed.positionals[1];
                 if (!url) {
@@ -212,6 +293,8 @@ export async function main(argv, io = {
                     return await serverRunsCommand(system, io.out, colors);
                 return await logsCommand(system, [...rest, ...(values.follow ? ["-f"] : [])]);
             }
+            case "local":
+                return await localCommand(parsed.positionals.slice(1), { purge: Boolean(values.purge) }, io, colors, ui);
             case "uninstall":
                 await uninstall(system, { purge: Boolean(values.purge) });
                 return 0;
@@ -222,6 +305,12 @@ export async function main(argv, io = {
     }
     catch (error) {
         ui.finish();
+        if (jsonUi) {
+            // The event is what the laptop shows; the log's tail on stderr is for whoever looks.
+            jsonUi.error(describeError(error));
+            io.err(await logTail(UP_LOG, palette(false)));
+            return 1;
+        }
         const c = palette(live && !process.env.NO_COLOR);
         io.err(`\n  ${c.red("✗")} ${describeError(error).replace(/\n/g, "\n    ")}\n`);
         if (live)
@@ -235,13 +324,43 @@ const NOT_A_SERVER = (c) => `
   Background coding agents on your own server: send a task from your laptop,
   get a pull request back.
 
-  ${c.dim("Set up a server (as root, on Ubuntu or Debian):")}
+  ${c.dim("Set it up from your laptop (asks a few questions):")}
+     dl setup
+
+  ${c.dim("Or on a server (as root, on Ubuntu or Debian):")}
      curl -fsSL https://directionallylocal.run | sh
 
   ${c.dim("Already have one? Connect this laptop to it:")}
      dl connect https://your-server
 
 `;
+/**
+ * The `--answers-stdin` JSON: everything up to the end of stdin, or sooner once what came
+ * so far parses (a laptop that keeps the SSH channel open still gets going). Keys arrive
+ * this way so they're never in argv, the environment, or a file.
+ */
+export async function readAnswers(stdin) {
+    if (stdin.isTTY)
+        throw new Error("--answers-stdin reads one JSON object from a pipe, not a terminal.");
+    let text = "";
+    for await (const chunk of stdin) {
+        text += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+        if (text.length > 64 * 1024)
+            throw new Error("The answers on stdin are too long; expected one small JSON object.");
+        if (text.includes("\n") && parses(text))
+            return text;
+    }
+    return text;
+}
+function parses(text) {
+    try {
+        JSON.parse(text);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /** Ctrl-C aborts the command (a running task keeps going on the server). */
 async function interruptible(work) {
     const controller = new AbortController();

package/dist/doctor.js

@@ -1,7 +1,7 @@
 import { detectHost, MIN_DISK_GB } from "./detect.js";
 import { nodeAdvisory } from "./node-advisory.js";
 import { AUTOPILOT_PORT, AUTO_UPGRADES, HOTCELL_PORT, NODE_AUTO_UPDATES, PATHS, SERVICES, parseEnvFile } from "./layout.js";
-import { readState } from "./state.js";
+import { describeAccess, readState } from "./state.js";
 import { palette } from "./ui.js";
 /** `directionallylocal doctor`: every moving part, with a fix for each failure. */
 export async function doctor(system) {
@@ -9,7 +9,7 @@ export async function doctor(system) {
     const add = (check) => checks.push(check);
     const state = await readState(system);
     add(state
-        ? { name: "installed", ok: true, detail: `${state.release}, ${state.access.mode} at ${state.access.url}` }
+        ? { name: "installed", ok: true, detail: `${state.release}, ${state.access.mode === "ssh" ? describeAccess(state.access) : `${state.access.mode} at ${state.access.url}`}` }
         : { name: "installed", ok: false, detail: "not installed", fix: "sudo dl up" });
     const facts = await detectHost(system);
     const node = nodeAdvisory(facts.nodeVersion ?? "");
@@ -49,6 +49,7 @@ export async function doctor(system) {
     add({ name: "github", ok: github, detail: github ? "token configured" : "no token; runs can't push or open PRs", fix: "sudo dl up (asks for it)" });
     const autopilot = (await system.probe("curl", ["-s", "-o", "/dev/null", "-w", "%{http_code}", `http://127.0.0.1:${AUTOPILOT_PORT}/api/v1/health`])).stdout.trim();
     add({ name: "agent server API", ok: autopilot === "401", detail: autopilot === "401" ? "up (refuses requests without a token)" : `HTTP ${autopilot || "none"}`, fix: "dl logs autopilot · then dl up" });
+    // Loopback and SSH access have nothing published to check: the tunnel is the laptop's.
     if (state?.access.mode === "tailscale") {
         const serve = await system.probe("tailscale", ["serve", "status"]);
         const serving = serve.code === 0 && serve.stdout.includes(`127.0.0.1:${AUTOPILOT_PORT}`);

package/dist/home.js

@@ -1,7 +1,7 @@
 import { agentCapacity, detectHost } from "./detect.js";
 import { AUTOPILOT_PORT, CELL_MEMORY_MB, SERVICES } from "./layout.js";
-import { approvePairing, listLaptops, listServerRuns, ownerLink, pendingPairings, revokeLaptop } from "./server-api.js";
-import { readState } from "./state.js";
+import { approvePairing, createLaptopCredential, listLaptops, listServerRuns, ownerLink, pendingPairings, revokeLaptop } from "./server-api.js";
+import { describeAccess, readState } from "./state.js";
 import { palette } from "./ui.js";
 import { nextSteps } from "./up.js";
 const ABOUT = "Background coding agents on your own server: send a task from your laptop, get a pull request back.";
@@ -29,7 +29,7 @@ export async function serverHome(system, state, write, c) {
     const running = runs?.filter((run) => run.active).length ?? 0;
     const doneThisWeek = runs?.filter((run) => !run.active && Date.parse(run.createdAt) >= week).length ?? 0;
     const row = (label, value, hint = "") => `  ${c.dim(label.padEnd(11))}${value}${hint ? `   ${c.dim(hint)}` : ""}\n`;
-    write(`\n  ${c.bold("Directionally Local")}  ${verdict}  ${c.dim(state.access.url)}\n\n  ${ABOUT}\n\n`);
+    write(`\n  ${c.bold("Directionally Local")}  ${verdict}  ${c.dim(describeAccess(state.access))}\n\n  ${ABOUT}\n\n`);
     write(row("Laptops", laptops === undefined ? c.dim("unknown (run dl up to update)") : laptops.length === 0 ? "none connected yet" : `${laptops.length} connected · ${laptops.map((laptop) => laptop.name).join(", ")}`, "dl laptops"));
     write(row("Runs", runs === undefined ? c.dim("unknown (run dl up to update)") : `${running} running · ${doneThisWeek} this week`, "dl runs"));
     write(row("Capacity", `~${agentCapacity(facts, CELL_MEMORY_MB)} agents at once (estimate)`));
@@ -41,7 +41,7 @@ export async function serverHome(system, state, write, c) {
 /** `dl status --brief`: one line, for the login message. Never slow, never fails loudly. */
 export async function briefStatus(system, state, write, c) {
     const status = await health(system);
-    write(`\n  ${c.bold("Directionally Local")}  ${status.ok ? c.green("● healthy") : c.red(`● ${status.problems.join(", ")}`)}  ${c.dim(state.access.url)}\n  ${c.dim("Type")} dl ${c.dim("for what this is and what's running.")}\n\n`);
+    write(`\n  ${c.bold("Directionally Local")}  ${status.ok ? c.green("● healthy") : c.red(`● ${status.problems.join(", ")}`)}  ${c.dim(describeAccess(state.access))}\n  ${c.dim("Type")} dl ${c.dim("for what this is and what's running.")}\n\n`);
 }
 /**
  * `dl connect-laptop [CODE]`: approve a laptop's code, or explain how to connect one and
@@ -65,6 +65,18 @@ export async function connectLaptop(system, state, code, write, c) {
     write(`\n  ${c.dim("The laptop shows a code; approve it in that browser, or here with")} dl connect-laptop <code>\n\n`);
     return 0;
 }
+/**
+ * `dl pair --name NAME --json`: a credential for the laptop that's setting this server up
+ * over SSH, printed as one JSON line for it to keep. The token appears nowhere else.
+ */
+export async function pairLaptop(system, state, name, write) {
+    const trimmed = name.trim();
+    if (!trimmed || trimmed.length > 100 || /[\u0000-\u001f\u007f]/.test(trimmed)) {
+        throw new Error("--name must be 1 to 100 printable characters, e.g. the laptop's hostname.");
+    }
+    const paired = await createLaptopCredential(system, trimmed, state.access.url);
+    write(`${JSON.stringify({ token: paired.token, credentialId: paired.credentialId, name: paired.name, expiresAt: paired.expiresAt, url: paired.url })}\n`);
+}
 export async function laptopsCommand(system, args, write, c) {
     const laptops = await listLaptops(system);
     if (laptops === undefined) {

package/dist/laptop/commands.js

@@ -6,11 +6,15 @@ import { palette } from "../ui.js";
 import { RemoteApiError, RemoteClient, TERMINAL_STATUSES } from "./client.js";
 import { defaultRemoteName, loadRemotes, normalizeServerUrl, REMOTE_NAME_RE, removeRemote, resolveRemote, saveRemote } from "./config.js";
 import { detectGitHubRepository, snapshotWorkingTree } from "./git.js";
+import { sshCommandLine } from "./ssh.js";
 import { openBrowser } from "./open-browser.js";
+import { withConnections } from "./tunnel.js";
 /**
  * `dl` on a laptop: connect to a server, send it tasks, follow them, and check out the
  * pull requests. It talks to the server's API directly (the same one Autopilot's
  * `--on` uses, and shares its list of servers), so the laptop needs nothing else.
+ * Servers set up with `dl setup` are reached through an SSH tunnel that each command
+ * opens and closes (see tunnel.ts); `open` lets tests swap the tunnel out.
  */
 const execFileAsync = promisify(execFile);
 const RUN_END_EVENTS = new Set(["completed", "failed", "cancelled", "interrupted"]);
@@ -56,9 +60,11 @@ export async function connect(input, io = processIO) {
  * checkout (uncommitted changes go along). Follows it until it ends; Ctrl-C only detaches.
  */
 export async function run(input, io = processIO) {
-    const c = palette(io.color === true);
     const remote = await resolveRemote(input.server);
-    const client = new RemoteClient(remote.url, remote.token);
+    return withConnections(input.open, async (connections) => runOn(await connections.client(remote), remote, input, io));
+}
+async function runOn(client, remote, input, io) {
+    const c = palette(io.color === true);
     const repository = input.repository ?? await detectGitHubRepository(input.cwd);
     const snapshot = await snapshotWorkingTree(input.cwd);
     const [workspaces, models] = await Promise.all([client.workspaces(), client.models()]);
@@ -88,14 +94,17 @@ export async function run(input, io = processIO) {
 }
 /** `dl runs`: tasks on every connected server, newest first. */
 export async function runs(input, io = processIO) {
-    const c = palette(io.color === true);
     const remotes = input.server ? [await resolveRemote(input.server)] : await loadRemotes();
     if (remotes.length === 0)
         throw new Error("This laptop isn't connected to a server yet. Run: dl connect https://your-server");
+    return withConnections(input.open, (connections) => listRuns(remotes, connections, input.json === true, io));
+}
+async function listRuns(remotes, connections, json, io) {
+    const c = palette(io.color === true);
     const rows = [];
     for (const remote of remotes) {
         try {
-            const list = await new RemoteClient(remote.url, remote.token).listConversations();
+            const list = await (await connections.client(remote)).listConversations();
             rows.push(...list.filter((entry) => entry.kind === "code").map((entry) => ({ ...entry, server: remote.name })));
         }
         catch (error) {
@@ -103,7 +112,7 @@ export async function runs(input, io = processIO) {
         }
     }
     rows.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
-    if (input.json) {
+    if (json) {
         io.out(`${JSON.stringify(rows, null, 2)}\n`);
         return;
     }
@@ -122,21 +131,26 @@ export async function runs(input, io = processIO) {
 }
 /** `dl watch <id>`: replay and follow a task's output. */
 export async function watch(input, io = processIO) {
-    const { remote, run: found } = await findRun(input.id, input.server);
-    const client = new RemoteClient(remote.url, remote.token);
-    const finished = TERMINAL_STATUSES.has(found.status) && !found.activeRunId;
-    return follow(client, remote, found.conversationId, 0, input.signal, io, finished ? found.lastEventId : undefined);
+    return withConnections(input.open, async (connections) => {
+        const { remote, run: found } = await findRun(input.id, input.server, connections);
+        const client = await connections.client(remote);
+        const finished = TERMINAL_STATUSES.has(found.status) && !found.activeRunId;
+        return follow(client, remote, found.conversationId, 0, input.signal, io, finished ? found.lastEventId : undefined);
+    });
 }
 export async function cancel(input, io = processIO) {
     const c = palette(io.color === true);
-    const { remote, run: found } = await findRun(input.id, input.server);
-    await new RemoteClient(remote.url, remote.token).cancel(found.conversationId);
-    io.out(`  ${c.green("✓")} Stopped ${found.conversationId.slice(0, 8)}\n`);
+    await withConnections(input.open, async (connections) => {
+        const { remote, run: found } = await findRun(input.id, input.server, connections);
+        await (await connections.client(remote)).cancel(found.conversationId);
+        io.out(`  ${c.green("✓")} Stopped ${found.conversationId.slice(0, 8)}\n`);
+    });
 }
 /** `dl pull <id>`: check out a task's branch here. */
 export async function pull(input, io = processIO) {
     const c = palette(io.color === true);
-    const { run: found } = await findRun(input.id, input.server);
+    // The server is only asked for the branch name; the code itself comes from GitHub.
+    const { run: found } = await withConnections(input.open, (connections) => findRun(input.id, input.server, connections));
     const branch = found.branch;
     if (!branch)
         throw new Error("That task has no branch");
@@ -164,40 +178,44 @@ export async function servers(args, io = processIO) {
     const c = palette(io.color === true);
     if (args[0] === "remove") {
         const name = args[1] ?? "";
-        if (!(await removeRemote(name))) {
+        const removed = (await loadRemotes()).find((remote) => remote.name === name);
+        if (!removed || !(await removeRemote(name))) {
             io.err(`  ${c.red("✗")} Not connected to "${name}".\n`);
             return 1;
         }
-        io.out(`  ${c.green("✓")} Forgot ${name}. To disconnect it on the server too: sudo dl laptops remove "${clientName()}"\n`);
+        const onServer = `sudo dl laptops remove "${clientName()}"`;
+        io.out(`  ${c.green("✓")} Forgot ${name}. To disconnect it on the server too: ${removed.ssh ? `${sshCommandLine(removed.ssh)} '${onServer}'` : onServer}\n`);
         return 0;
     }
     const remotes = await loadRemotes();
     if (remotes.length === 0) {
-        io.out(`\n  Not connected to a server yet.  ${c.bold("dl connect https://your-server")}\n\n`);
+        io.out(`\n  Not connected to a server yet.  ${c.bold("dl setup")}  ${c.dim("or, for a server someone else set up:")} ${c.bold("dl connect https://your-server")}\n\n`);
         return 0;
     }
     io.out("\n");
     for (const remote of remotes)
-        io.out(`  ${c.green("●")} ${remote.name.padEnd(16)} ${remote.url}  ${c.dim(`until ${remote.expiresAt.slice(0, 10)}`)}\n`);
+        io.out(`  ${c.green("●")} ${remote.name.padEnd(16)} ${where(remote)}  ${c.dim(`until ${remote.expiresAt.slice(0, 10)}`)}\n`);
     io.out("\n");
     return 0;
 }
 /** `dl` on a laptop: what this is, which servers it's connected to, what to type next. */
-export async function laptopHome(io = processIO) {
+export async function laptopHome(io = processIO, open) {
     const c = palette(io.color === true);
     const remotes = await loadRemotes();
     if (remotes.length === 0)
         return false;
     let running = 0;
     let total = 0;
-    for (const remote of remotes) {
-        const list = await new RemoteClient(remote.url, remote.token).listConversations().catch(() => undefined);
-        running += list?.filter((entry) => entry.activeRunId !== null).length ?? 0;
-        total += list?.length ?? 0;
-    }
+    await withConnections(open, async (connections) => {
+        for (const remote of remotes) {
+            const list = await connections.client(remote).then((client) => client.listConversations()).catch(() => undefined);
+            running += list?.filter((entry) => entry.activeRunId !== null).length ?? 0;
+            total += list?.length ?? 0;
+        }
+    });
     io.out(`\n  ${c.bold("Directionally Local")}  ${c.dim("on this laptop")}\n\n`);
     io.out("  Background coding agents on your own server: send a task, get a pull request back.\n\n");
-    io.out(`  ${c.dim("Servers".padEnd(11))}${remotes.map((remote) => `${remote.name} ${c.dim(remote.url)}`).join(", ")}   ${c.dim("dl servers")}\n`);
+    io.out(`  ${c.dim("Servers".padEnd(11))}${remotes.map((remote) => `${remote.name} ${c.dim(where(remote))}`).join(", ")}   ${c.dim("dl servers")}\n`);
     io.out(`  ${c.dim("Tasks".padEnd(11))}${running} running · ${total} in all   ${c.dim("dl runs")}\n\n`);
     io.out(`  ${c.dim("Send a task, from inside a GitHub repository:")}\n     ${c.bold('dl run "fix the flaky checkout test"')}\n\n`);
     return true;
@@ -285,20 +303,25 @@ class EventRenderer {
         this.io.out(`${text}\n`);
     }
 }
-async function findRun(id, server) {
+async function findRun(id, server, connections) {
     const needle = id.trim().toLowerCase();
     if (!/^[0-9a-f-]{4,36}$/.test(needle))
         throw new Error("Task IDs are the short hex IDs dl runs shows");
     const remotes = server ? [await resolveRemote(server)] : await loadRemotes();
     const matches = [];
+    const unreachable = [];
     for (const remote of remotes) {
-        const list = await new RemoteClient(remote.url, remote.token).listConversations(200).catch(() => []);
+        const list = await connections.client(remote).then((client) => client.listConversations(200)).catch((error) => {
+            unreachable.push(`${remote.name}: ${describeError(error)}`);
+            return [];
+        });
         for (const entry of list)
             if (entry.conversationId.startsWith(needle))
                 matches.push({ remote, run: entry });
     }
+    // Say why when a server couldn't be asked (e.g. its SSH tunnel failed), rather than "no task".
     if (matches.length === 0)
-        throw new Error(`No task ${id} on ${server ?? "any connected server"}`);
+        throw new Error(`No task ${id} on ${server ?? "any connected server"}${unreachable.length ? `\n${unreachable.join("\n")}` : ""}`);
     if (matches.length > 1)
         throw new Error(`${id} matches several tasks; use more characters`);
     return matches[0];
@@ -316,6 +339,10 @@ function pickModel(models, requested, preferred) {
         throw new Error("The server offers no models");
     return first;
 }
+/** Where a server is, as people know it: its URL, or the SSH destination its tunnel goes to. */
+function where(remote) {
+    return remote.ssh ? `ssh ${remote.ssh.target}${remote.ssh.port ? `:${remote.ssh.port}` : ""}` : remote.url;
+}
 function clientName() {
     const host = hostname().replace(/\.local$/, "").replace(/[^\p{L}\p{N} ._'()@-]/gu, "-").slice(0, 40) || "laptop";
     return `${host} (dl)`;

package/dist/laptop/config.js

@@ -85,5 +85,15 @@ function isRemote(value) {
     if (!value || typeof value !== "object")
         return false;
     const entry = value;
-    return ["name", "url", "token", "credentialId", "expiresAt", "addedAt"].every((key) => typeof entry[key] === "string");
+    if (!["name", "url", "token", "credentialId", "expiresAt", "addedAt"].every((key) => typeof entry[key] === "string"))
+        return false;
+    return entry.ssh === undefined || isSshAccess(entry.ssh);
+}
+function isSshAccess(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const ssh = value;
+    return typeof ssh.target === "string" && ssh.target.length > 0 && !ssh.target.startsWith("-") &&
+        (ssh.port === undefined || (typeof ssh.port === "number" && Number.isInteger(ssh.port) && ssh.port > 0 && ssh.port < 65536)) &&
+        (ssh.identityFile === undefined || typeof ssh.identityFile === "string");
 }

package/dist/laptop/credentials.js

@@ -0,0 +1,129 @@
+import { join } from "node:path";
+/** Autopilot's config, where `autopilot` keeps the user's OpenRouter key. */
+export function autopilotConfigPath(env, home) {
+    return join(env.XDG_CONFIG_HOME?.trim() || join(home, ".config"), "kimiflare", "config.json");
+}
+export async function validateOpenRouterKey(key, fetchImpl) {
+    if (!/^sk-or-[A-Za-z0-9_-]{10,}$/.test(key))
+        return "That doesn't look like an OpenRouter key (sk-or-…).";
+    if (!fetchImpl)
+        return undefined;
+    try {
+        const response = await fetchImpl("https://openrouter.ai/api/v1/key", { headers: { Authorization: `Bearer ${key}` } });
+        if (response.status === 401 || response.status === 403)
+            return "OpenRouter rejected that key.";
+    }
+    catch {
+        // Offline: the format is right, and the server checks it again.
+    }
+    return undefined;
+}
+export async function validateGitHubToken(token, fetchImpl) {
+    if (!/^(github_pat_|ghp_|gho_|ghu_)[A-Za-z0-9_]{20,}$/.test(token))
+        return { problem: "That doesn't look like a GitHub token (github_pat_… or ghp_…)." };
+    if (!fetchImpl)
+        return {};
+    try {
+        const response = await fetchImpl("https://api.github.com/user", { headers: { Authorization: `Bearer ${token}`, "User-Agent": "directionallylocal" } });
+        if (response.status === 401)
+            return { problem: "GitHub rejected that token." };
+        if (response.ok) {
+            const user = await response.json();
+            if (typeof user.login === "string")
+                return { login: user.login };
+        }
+    }
+    catch {
+        // Offline isn't fatal.
+    }
+    return {};
+}
+/** Finds, confirms, or asks for exactly the keys in `needs`. */
+export async function gatherKeys(needs, input) {
+    const { ui } = input;
+    const answers = {};
+    const wanted = needs.filter((need) => need === "github" || need === "openrouter");
+    if (wanted.length === 0)
+        return answers;
+    ui.questions(`${wanted.length === 1 ? "1 key" : "2 keys"}, kept on your server only; then it sets itself up.`);
+    if (wanted.includes("github"))
+        answers.githubToken = await githubToken(input);
+    if (wanted.includes("openrouter"))
+        answers.openrouterKey = await openrouterKey(input);
+    return answers;
+}
+async function githubToken({ ui, prompter, sources }) {
+    const fromCli = (await sources.gh().catch(() => undefined))?.trim();
+    if (fromCli) {
+        const checked = await validateGitHubToken(fromCli, sources.fetch);
+        if (checked.problem) {
+            ui.warn(`Your GitHub CLI login didn't work (${checked.problem}); asking for a token instead.`);
+        }
+        else {
+            const who = checked.login ? ` (${checked.login})` : "";
+            if (await confirm(ui, prompter, `Use your GitHub CLI login${who}? It stays on your server.`)) {
+                ui.answered("GitHub", `${checked.login ? `signed in as ${checked.login} · ` : ""}from the GitHub CLI`);
+                return fromCli;
+            }
+        }
+    }
+    return askUntilValid(ui, "GitHub", async () => {
+        const token = await prompter.secret(ui.prompt("GitHub token", "fine-grained: github.com/settings/personal-access-tokens/new"));
+        const checked = await validateGitHubToken(token, sources.fetch);
+        return { value: token, ...(checked.problem ? { problem: checked.problem } : {}), ...(checked.login ? { detail: `signed in as ${checked.login}` } : {}) };
+    });
+}
+async function openrouterKey({ ui, prompter, sources }) {
+    const candidates = [];
+    const fromEnv = sources.env.OPENROUTER_API_KEY?.trim();
+    if (fromEnv)
+        candidates.push({ key: fromEnv, question: "Use the OpenRouter key in OPENROUTER_API_KEY?", from: "from OPENROUTER_API_KEY" });
+    const config = await sources.readFile(autopilotConfigPath(sources.env, sources.home));
+    const fromAutopilot = config ? readAutopilotKey(config) : undefined;
+    if (fromAutopilot && fromAutopilot !== fromEnv)
+        candidates.push({ key: fromAutopilot, question: "Use the OpenRouter key from Autopilot?", from: "from Autopilot" });
+    for (const candidate of candidates) {
+        const problem = await validateOpenRouterKey(candidate.key, sources.fetch);
+        if (problem) {
+            ui.warn(`The OpenRouter key ${candidate.from} didn't work (${problem})`);
+            continue;
+        }
+        if (await confirm(ui, prompter, `${candidate.question} It stays on your server.`)) {
+            ui.answered("OpenRouter", candidate.from);
+            return candidate.key;
+        }
+    }
+    return askUntilValid(ui, "OpenRouter", async () => {
+        const key = await prompter.secret(ui.prompt("OpenRouter key", "openrouter.ai/keys"));
+        const problem = await validateOpenRouterKey(key, sources.fetch);
+        return { value: key, ...(problem ? { problem } : {}) };
+    });
+}
+function readAutopilotKey(text) {
+    try {
+        const value = JSON.parse(text).openrouterApiKey;
+        return typeof value === "string" && value.trim() ? value.trim() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** A Y/n question; Enter means yes. */
+export async function confirm(ui, prompter, question) {
+    const answer = (await prompter.text(ui.prompt(question, "Y/n"))).trim().toLowerCase();
+    return answer === "" || answer === "y" || answer === "yes";
+}
+async function askUntilValid(ui, label, ask) {
+    for (let attempt = 1;; attempt++) {
+        const { value, problem, detail } = await ask();
+        if (!problem) {
+            ui.answered(label, detail);
+            return value.trim();
+        }
+        if (attempt >= 3) {
+            ui.rejected(problem);
+            throw new Error(problem);
+        }
+        ui.rejected(`${problem} Try again.`);
+    }
+}