directionallylocal 0.1.2 → 0.3.0

package/dist/laptop/ssh.js

@@ -0,0 +1,211 @@
+import { spawn } from "node:child_process";
+import { join } from "node:path";
+/**
+ * The concrete hosts in an ssh config. Wildcard and negated patterns are defaults, not
+ * places to connect to, so they're skipped; `Match` blocks are ignored. ssh takes the first
+ * value it finds for each option, so a host's own block wins, then global or `Host *` lines.
+ */
+export function parseSshConfig(text, home) {
+    const blocks = [];
+    const global = {};
+    let current = global;
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const match = /^(\S+?)(?:\s*=\s*|\s+)(.+)$/.exec(line);
+        if (!match)
+            continue;
+        const key = match[1].toLowerCase();
+        const value = match[2].trim();
+        if (key === "host") {
+            const block = { patterns: value.split(/\s+/).map(unquote), settings: {} };
+            blocks.push(block);
+            current = block.settings;
+            continue;
+        }
+        if (key === "match") {
+            current = undefined;
+            continue;
+        }
+        if (!current)
+            continue;
+        const setting = unquote(value);
+        if (key === "hostname")
+            current.hostName ??= setting;
+        else if (key === "user")
+            current.user ??= setting;
+        else if (key === "identityfile")
+            current.identityFile ??= expandHome(setting, home);
+        else if (key === "port" && /^\d+$/.test(setting))
+            current.port ??= Number(setting);
+    }
+    const defaults = { ...global };
+    for (const block of blocks) {
+        if (!block.patterns.includes("*"))
+            continue;
+        for (const [key, value] of Object.entries(block.settings))
+            defaults[key] ??= value;
+    }
+    const hosts = new Map();
+    for (const block of blocks) {
+        for (const pattern of block.patterns) {
+            if (/[*?!]/.test(pattern) || hosts.has(pattern))
+                continue;
+            const host = { alias: pattern };
+            for (const source of [block.settings, defaults]) {
+                for (const [key, value] of Object.entries(source))
+                    host[key] ??= value;
+            }
+            hosts.set(pattern, host);
+        }
+    }
+    return [...hosts.values()];
+}
+/** How a config host reads in a list: root@203.0.113.10, or with a port when it isn't 22. */
+export function describeHost(host) {
+    const port = host.port && host.port !== 22 ? `:${host.port}` : "";
+    return `${host.user ? `${host.user}@` : ""}${host.hostName ?? host.alias}${port}`;
+}
+/** Private keys in ~/.ssh: the files that have a matching .pub next to them. */
+export function discoverKeys(sshDir, names) {
+    const present = new Set(names);
+    const preferred = ["id_ed25519", "id_ecdsa", "id_rsa"];
+    return names
+        .filter((name) => !name.endsWith(".pub") && present.has(`${name}.pub`))
+        .sort((a, b) => rank(a) - rank(b) || a.localeCompare(b))
+        .map((name) => join(sshDir, name));
+    function rank(name) {
+        const index = preferred.indexOf(name);
+        return index === -1 ? preferred.length : index;
+    }
+}
+/** `user@host`, `host`, `user@host:2222`, or `user@[2001:db8::1]:2222` as typed by the user. */
+export function parseTarget(input) {
+    const text = input.trim().replace(/^ssh\s+/, "");
+    const match = /^(?:([A-Za-z0-9._-]+)@)?(\[[0-9A-Fa-f:.]+\]|[A-Za-z0-9._-]+)(?::(\d{1,5}))?$/.exec(text);
+    if (!match || match[2].startsWith("-"))
+        throw new Error(`"${input.trim()}" isn't a server address; type it like root@203.0.113.10 or root@box.example.com:2222`);
+    const host = match[2].replace(/^\[(.*)\]$/, "$1");
+    const port = match[3] ? Number(match[3]) : undefined;
+    if (port !== undefined && (port < 1 || port > 65535))
+        throw new Error(`${port} isn't a port`);
+    return { target: `${match[1] ? `${match[1]}@` : ""}${host}`, ...(port && port !== 22 ? { port } : {}) };
+}
+/** Options for every non-interactive ssh: no password prompts, a bounded wait, and trust on first use. */
+export function sshOptions(access) {
+    if (access.target.startsWith("-"))
+        throw new Error(`Not a server: ${access.target}`);
+    return [
+        "-o", "BatchMode=yes",
+        "-o", "ConnectTimeout=10",
+        "-o", "StrictHostKeyChecking=accept-new",
+        ...(access.port ? ["-p", String(access.port)] : []),
+        // With a chosen key, offer only it: an agent full of keys can hit the server's MaxAuthTries first.
+        ...(access.identityFile ? ["-i", access.identityFile, "-o", "IdentitiesOnly=yes"] : []),
+    ];
+}
+/** The command line people would type for this server, for messages. */
+export function sshCommandLine(access) {
+    return ["ssh", ...(access.port ? ["-p", String(access.port)] : []), ...(access.identityFile ? ["-i", access.identityFile] : []), access.target].join(" ");
+}
+export const realSshExec = (access, command, options = {}) => new Promise((resolve, reject) => {
+    const child = spawn("ssh", [...sshOptions(access), access.target, command], {
+        stdio: ["pipe", "pipe", "pipe"],
+        ...(options.signal ? { signal: options.signal } : {}),
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", lines((chunk) => { stdout += chunk; }, options.onStdoutLine));
+    child.stderr.on("data", lines((chunk) => { stderr += chunk; }, options.onStderrLine));
+    child.on("error", (error) => reject(error.code === "ENOENT" ? new Error("ssh isn't installed on this computer") : error));
+    child.on("close", (code) => resolve({ code: code ?? 255, stdout, stderr }));
+    // Always close stdin: a remote command reading it would otherwise wait forever.
+    child.stdin.on("error", () => { });
+    child.stdin.end(options.input ?? "");
+});
+/** Collects a stream's text and calls back once per complete line. */
+export function lines(collect, onLine) {
+    let pending = "";
+    return (chunk) => {
+        const text = chunk.toString();
+        collect(text);
+        if (!onLine)
+            return;
+        pending += text;
+        const parts = pending.split("\n");
+        pending = parts.pop() ?? "";
+        for (const part of parts)
+            onLine(part.replace(/\r$/, ""));
+    };
+}
+/** The server refused our keys; the wizard offers others from ~/.ssh. */
+export class SshAuthError extends Error {
+    access;
+    constructor(access, detail) {
+        super(`The server didn't accept this computer's SSH key (${detail}).`);
+        this.access = access;
+        this.name = "SshAuthError";
+    }
+}
+const SUPPORTED_OS = new Set(["ubuntu 22.04", "ubuntu 24.04", "debian 12"]);
+// One round trip: who we are, the OS, the CPU, and whether we can become root without a password.
+const PROBE = 'id -u; id -un; . /etc/os-release; echo "$ID $VERSION_ID"; uname -m; ' +
+    'if [ "$(id -u)" = 0 ]; then echo root; elif sudo -n true 2>/dev/null; then echo sudo; else echo nosudo; fi';
+/** Connects once and checks the server can take an install: a supported OS, and root or passwordless sudo. */
+export async function checkServer(access, ssh, display) {
+    const result = await ssh(access, PROBE);
+    const newHostKey = /Permanently added/i.test(result.stderr);
+    if (result.code === 255 || result.stdout.trim() === "") {
+        const detail = lastLine(result.stderr) || `ssh exited with ${result.code}`;
+        if (/Permission denied|Too many authentication failures|no mutual signature|Authentication failed/i.test(result.stderr)) {
+            throw new SshAuthError(access, detail);
+        }
+        if (/Host key verification failed|REMOTE HOST IDENTIFICATION HAS CHANGED/i.test(result.stderr)) {
+            throw new Error(`${display}'s SSH host key changed since this computer last connected, so it stopped (that can mean someone is in the middle). If you rebuilt the server, remove the old key with: ssh-keygen -R ${hostOf(access.target)}`);
+        }
+        throw new Error(`Couldn't reach ${display} over SSH: ${detail}\n  Check that this works: ${sshCommandLine(access)}`);
+    }
+    const [uid, user, osLine, arch, privilege] = result.stdout.trim().split("\n").map((line) => line.trim());
+    const os = formatOs(osLine ?? "");
+    const facts = {
+        user: user || "?",
+        root: uid === "0",
+        sudo: privilege === "sudo",
+        os,
+        arch: arch === "aarch64" ? "arm64" : arch || "?",
+        newHostKey,
+    };
+    if (!facts.root && !facts.sudo) {
+        throw new Error([
+            `${facts.user} on ${display} isn't root and can't use sudo without a password, and setup needs one of them.`,
+            `  Either connect as root (root@${hostOf(access.target)}), or let ${facts.user} use sudo without a password:`,
+            `     echo '${facts.user} ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/${facts.user}`,
+        ].join("\n"));
+    }
+    if (!SUPPORTED_OS.has((osLine ?? "").toLowerCase().replace(/"/g, ""))) {
+        throw new Error(`${display} runs ${os || "an unknown system"}; Directionally Local needs Ubuntu 22.04, Ubuntu 24.04, or Debian 12.`);
+    }
+    return facts;
+}
+function formatOs(line) {
+    const [id = "", version = ""] = line.replace(/"/g, "").split(/\s+/);
+    const names = { ubuntu: "Ubuntu", debian: "Debian" };
+    return `${names[id] ?? id} ${version}`.trim();
+}
+export function hostOf(target) {
+    return target.slice(target.lastIndexOf("@") + 1);
+}
+function lastLine(text) {
+    return text.trim().split("\n").filter((line) => !/Permanently added/i.test(line)).at(-1)?.trim() ?? "";
+}
+function unquote(value) {
+    return value.length >= 2 && value.startsWith('"') && value.endsWith('"') ? value.slice(1, -1) : value;
+}
+function expandHome(path, home) {
+    return path.replace(/^~(?=$|\/)/, home).replace(/%d/g, home);
+}
+/** Single-quotes a value for the remote shell. */
+export function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}

package/dist/laptop/tunnel.js

@@ -0,0 +1,120 @@
+import { spawn } from "node:child_process";
+import { connect, createServer } from "node:net";
+import { RemoteClient } from "./client.js";
+import { sshCommandLine, sshOptions } from "./ssh.js";
+const realSpawn = (args) => spawn("ssh", args, { stdio: ["ignore", "ignore", "pipe"] });
+/** The ssh arguments for a tunnel from a local port to the server's loopback port. */
+export function tunnelArgs(access, localPort, remotePort) {
+    return ["-N", "-o", "ExitOnForwardFailure=yes", ...sshOptions(access), "-L", `127.0.0.1:${localPort}:127.0.0.1:${remotePort}`, access.target];
+}
+export function createOpener(options = {}) {
+    const spawnTunnel = options.spawn ?? realSpawn;
+    const freePort = options.freePort ?? pickFreePort;
+    const accepts = options.accepts ?? acceptsConnections;
+    const timeoutMs = options.timeoutMs ?? 20_000;
+    const pollMs = options.pollMs ?? 100;
+    return async (remote) => {
+        if (!remote.ssh)
+            return { url: remote.url, close: async () => { } };
+        const access = remote.ssh;
+        const remotePort = Number(new URL(remote.url).port || 80);
+        const port = await freePort();
+        const child = spawnTunnel(tunnelArgs(access, port, remotePort));
+        let stderr = "";
+        child.stderr?.on("data", (chunk) => { stderr += chunk.toString(); });
+        let exited = child.exitCode !== null;
+        child.once("exit", () => { exited = true; });
+        // If this process ends without closing the tunnel (an uncaught error), take ssh with it.
+        const onExit = () => { if (!exited)
+            child.kill("SIGTERM"); };
+        process.once("exit", onExit);
+        const close = async () => {
+            process.off("exit", onExit);
+            if (exited)
+                return;
+            const gone = new Promise((resolve) => {
+                child.once("exit", () => resolve());
+                setTimeout(resolve, 2000).unref?.();
+            });
+            child.kill("SIGTERM");
+            await gone;
+        };
+        const deadline = Date.now() + timeoutMs;
+        for (;;) {
+            if (exited) {
+                await close();
+                const detail = stderr.trim().split("\n").at(-1)?.trim();
+                throw new Error(`Couldn't open an SSH tunnel to ${remote.name} (${access.target})${detail ? `: ${detail}` : ""}\n  Check that this works: ${sshCommandLine(access)}`);
+            }
+            if (await accepts(port))
+                return { url: `http://127.0.0.1:${port}`, close };
+            if (Date.now() >= deadline) {
+                await close();
+                throw new Error(`Timed out after ${Math.round(timeoutMs / 1000)}s opening an SSH tunnel to ${remote.name} (${access.target}).\n  Check that this works: ${sshCommandLine(access)}`);
+            }
+            await new Promise((resolve) => setTimeout(resolve, pollMs));
+        }
+    };
+}
+export const openRemote = createOpener();
+/**
+ * The endpoints one command uses: at most one tunnel per server, reused across its
+ * requests, all closed when the command ends (commands close it in `finally`, which also
+ * runs when Ctrl-C aborts a watch).
+ */
+export class Connections {
+    opener;
+    open = new Map();
+    constructor(opener = openRemote) {
+        this.opener = opener;
+    }
+    async client(remote) {
+        let endpoint = this.open.get(remote.name);
+        if (!endpoint) {
+            endpoint = this.opener(remote);
+            this.open.set(remote.name, endpoint);
+        }
+        return new RemoteClient((await endpoint).url, remote.token);
+    }
+    async close() {
+        const endpoints = [...this.open.values()];
+        this.open.clear();
+        await Promise.all(endpoints.map((endpoint) => endpoint.then((entry) => entry.close(), () => { })));
+    }
+}
+/** Runs `work` with a fresh set of connections and always closes them. */
+export async function withConnections(opener, work) {
+    const connections = new Connections(opener);
+    try {
+        return await work(connections);
+    }
+    finally {
+        await connections.close();
+    }
+}
+/** A port nothing listens on right now (the OS picks it; ssh binds it a moment later). */
+export function pickFreePort() {
+    return new Promise((resolve, reject) => {
+        const server = createServer();
+        server.unref();
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => {
+            const address = server.address();
+            const port = typeof address === "object" && address ? address.port : 0;
+            server.close(() => port ? resolve(port) : reject(new Error("no free port")));
+        });
+    });
+}
+export function acceptsConnections(port) {
+    return new Promise((resolve) => {
+        const socket = connect({ host: "127.0.0.1", port });
+        const done = (ok) => {
+            socket.removeAllListeners();
+            socket.destroy();
+            resolve(ok);
+        };
+        socket.setTimeout(1000, () => done(false));
+        socket.once("connect", () => done(true));
+        socket.once("error", () => done(false));
+    });
+}

package/dist/local/check.js

@@ -0,0 +1,194 @@
+/**
+ * Whether this computer can run the agents: platform, Docker (whichever runtime the user
+ * has), a patched Node, git, and disk. Read-only: every probe goes through `System`.
+ */
+import { dirname, join } from "node:path";
+import { agentCapacity, parseDfFreeGb, parseInterfaceIp, parseOsRelease } from "../detect.js";
+import { nodeAdvisory } from "../node-advisory.js";
+import { LOCAL_CELL_MEMORY_MB, LOCAL_MIN_DISK_GB } from "./layout.js";
+const DOCKER_INFO = "{{.ServerVersion}}|{{.OperatingSystem}}|{{.MemTotal}}|{{.NCPU}}";
+export async function checkComputer(system, options) {
+    const platform = options.platform ?? process.platform;
+    const env = options.env ?? process.env;
+    const home = options.home;
+    const [osName, df, git] = await Promise.all([
+        describeOs(system, platform),
+        system.probe("df", ["-Pk", home]),
+        system.probe("git", ["--version"]),
+    ]);
+    const dockerCli = await findDockerCli(system, home);
+    const { docker, denied } = dockerCli ? await findDocker(system, dockerCli, home, platform, env) : { docker: undefined, denied: false };
+    const dockerApp = platform === "darwin" && !docker ? await installedDockerApp(system, home) : undefined;
+    const bridge = platform === "linux" ? await system.probe("ip", ["-4", "-o", "addr", "show", "docker0"]) : undefined;
+    const systemd = platform === "linux" ? await system.probe("systemctl", ["--user", "is-system-running"]) : undefined;
+    const execPath = options.execPath ?? process.execPath;
+    return {
+        platform,
+        osName,
+        arch: options.arch ?? process.arch,
+        node: { path: await stableNodePath(system, execPath), version: options.nodeVersion ?? process.versions.node },
+        git: git.code === 0 ? git.stdout.trim().replace(/^git version /, "") : undefined,
+        diskFreeGb: parseDfFreeGb(df.stdout),
+        dockerCli,
+        docker,
+        dockerApp,
+        bridgeIp: bridge ? parseInterfaceIp(bridge.stdout) : undefined,
+        // "degraded" (one failed unit somewhere) still runs ours fine.
+        systemdUser: systemd ? ["running", "degraded", "starting"].includes(systemd.stdout.trim()) : false,
+        dockerDenied: denied,
+    };
+}
+/** What stops setup before it changes anything, each with how to fix it. */
+export function computerProblems(facts) {
+    const problems = [];
+    if (facts.platform !== "darwin" && facts.platform !== "linux") {
+        return [`Running agents on this computer works on macOS and Linux, not ${facts.platform}. Set up a server instead: curl -fsSL https://directionallylocal.run | sh`];
+    }
+    if (facts.platform === "linux" && !facts.systemdUser) {
+        problems.push("A systemd user session is needed to keep the agents running (systemctl --user). Log in to a desktop session, or set up a server instead.");
+    }
+    const node = nodeAdvisory(facts.node.version);
+    if (!node.ok) {
+        problems.push(`${node.message} ${facts.platform === "darwin" ? "Update Node (brew upgrade node, or nodejs.org)" : "Update Node (nodejs.org or your package manager)"}, then run this again.`);
+    }
+    if (!facts.git) {
+        problems.push(facts.platform === "darwin" ? "git isn't installed. Install it with: xcode-select --install" : "git isn't installed. Install it with your package manager (e.g. sudo apt install git).");
+    }
+    if (!facts.docker)
+        problems.push(dockerFix(facts));
+    if (facts.diskFreeGb < LOCAL_MIN_DISK_GB) {
+        problems.push(`At least ${LOCAL_MIN_DISK_GB} GB of free disk is needed for the sandbox image and workspaces (found ${facts.diskFreeGb} GB).`);
+    }
+    return problems;
+}
+function dockerFix(facts) {
+    if (facts.platform === "linux") {
+        if (facts.dockerDenied)
+            return "Docker is installed but you can't use it. Add yourself to the docker group (sudo usermod -aG docker $USER), log out and back in, then run this again.";
+        if (facts.dockerCli)
+            return "Docker isn't running. Start it (sudo systemctl start docker, or open Docker Desktop), then run this again.";
+        return "Docker isn't installed. Install Docker Engine (https://docs.docker.com/engine/install/) or Docker Desktop, then run this again.";
+    }
+    if (facts.dockerApp)
+        return `${facts.dockerApp} is installed but didn't start. Open it, wait until it says it's running, then run this again.`;
+    if (facts.dockerCli)
+        return "Docker isn't running. Start Docker Desktop, OrbStack, or colima (colima start), then run this again.";
+    return "Docker isn't installed. Install Docker Desktop (https://www.docker.com/products/docker-desktop/), OrbStack (brew install orbstack), or colima (brew install colima docker && colima start), then run this again.";
+}
+/** How many agents fit at once, by what Docker has (the VM on macOS). */
+export function localCapacity(docker) {
+    return agentCapacity({ memoryMb: docker.memoryMb, cpus: docker.cpus }, LOCAL_CELL_MEMORY_MB);
+}
+export function supportedPlatform(platform) {
+    return platform === "darwin" || platform === "linux" ? platform : undefined;
+}
+async function describeOs(system, platform) {
+    if (platform === "darwin") {
+        const version = (await system.probe("sw_vers", ["-productVersion"])).stdout.trim();
+        return version ? `macOS ${version}` : "macOS";
+    }
+    if (platform === "linux")
+        return parseOsRelease(await system.readFile("/etc/os-release") ?? "").prettyName || "Linux";
+    return platform;
+}
+async function findDockerCli(system, home) {
+    const onPath = (await system.probe("sh", ["-c", "command -v docker"])).stdout.trim();
+    if (onPath)
+        return onPath;
+    // Launched from a GUI or a fresh shell, the runtimes' own bin dirs may not be on PATH.
+    for (const candidate of [
+        "/usr/local/bin/docker",
+        "/opt/homebrew/bin/docker",
+        "/Applications/Docker.app/Contents/Resources/bin/docker",
+        join(home, ".orbstack", "bin", "docker"),
+        "/usr/bin/docker",
+    ]) {
+        if (await system.exists(candidate))
+            return candidate;
+    }
+    return undefined;
+}
+/**
+ * The Docker endpoint to use. Hotcell talks to Docker through DOCKER_HOST (not the CLI's
+ * context), and a LaunchAgent has none of the shell's environment, so this resolves the
+ * endpoint once and the services get it explicitly. A DOCKER_HOST the user set wins.
+ */
+async function findDocker(system, cli, home, platform, env) {
+    const candidates = [];
+    if (env.DOCKER_HOST?.trim()) {
+        candidates.push(env.DOCKER_HOST.trim());
+    }
+    else {
+        const context = (await system.probe(cli, ["context", "inspect", "--format", "{{.Endpoints.docker.Host}}"])).stdout.trim();
+        if (context)
+            candidates.push(context);
+        const sockets = platform === "darwin"
+            ? [join(home, ".docker", "run", "docker.sock"), join(home, ".orbstack", "run", "docker.sock"), join(home, ".colima", "default", "docker.sock"), join(home, ".colima", "docker.sock"), "/var/run/docker.sock"]
+            : ["/var/run/docker.sock", ...(env.XDG_RUNTIME_DIR ? [join(env.XDG_RUNTIME_DIR, "docker.sock")] : [])];
+        for (const socket of sockets)
+            if (await system.exists(socket))
+                candidates.push(`unix://${socket}`);
+    }
+    let denied = false;
+    for (const host of [...new Set(candidates)]) {
+        const info = await system.probe(cli, ["info", "--format", DOCKER_INFO], { env: { DOCKER_HOST: host } });
+        if (/permission denied/i.test(info.stderr))
+            denied = true;
+        const [version, os, memTotal, ncpu] = info.stdout.trim().split("|");
+        if (info.code !== 0 || !version)
+            continue;
+        return {
+            docker: {
+                host,
+                runtime: runtimeName(host, os ?? ""),
+                version,
+                memoryMb: Math.round(Number(memTotal) / 1024 / 1024) || 0,
+                cpus: Number(ncpu) || 0,
+            },
+            denied: false,
+        };
+    }
+    return { docker: undefined, denied };
+}
+function runtimeName(host, os) {
+    if (host.includes("/.orbstack/") || /orbstack/i.test(os))
+        return "OrbStack";
+    if (host.includes("/.colima/"))
+        return "colima";
+    if (/docker desktop/i.test(os) || host.includes("/.docker/run/"))
+        return "Docker Desktop";
+    if (host.includes("/run/user/"))
+        return "Docker (rootless)";
+    return "Docker";
+}
+/** Docker Desktop or OrbStack, installed as an app; undefined when neither is. */
+export async function installedDockerApp(system, home) {
+    for (const [name, path] of [
+        ["Docker Desktop", "/Applications/Docker.app"],
+        ["OrbStack", "/Applications/OrbStack.app"],
+        ["Docker Desktop", join(home, "Applications", "Docker.app")],
+        ["OrbStack", join(home, "Applications", "OrbStack.app")],
+    ]) {
+        if (await system.exists(path))
+            return name;
+    }
+    return undefined;
+}
+/**
+ * A Node path that survives upgrades: Homebrew's versioned Cellar path disappears on the
+ * next `brew upgrade`, but its opt/ link follows the formula, security fixes included.
+ */
+export async function stableNodePath(system, execPath) {
+    const match = execPath.match(/^(.*)\/Cellar\/(node(?:@\d+)?)\/[^/]+\/bin\/node$/);
+    if (match) {
+        const opt = `${match[1]}/opt/${match[2]}/bin/node`;
+        if (await system.exists(opt))
+            return opt;
+    }
+    return execPath;
+}
+/** PATH for the services: Node, the docker CLI, git, and the system's basics. */
+export function servicePath(facts) {
+    const dirs = [dirname(facts.node.path), ...(facts.dockerCli ? [dirname(facts.dockerCli)] : []), "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin", "/usr/sbin", "/sbin"];
+    return [...new Set(dirs)].join(":");
+}

package/dist/local/cli.js

@@ -0,0 +1,43 @@
+/** `dl local status` and `dl local uninstall [--purge]`: agents running on this computer. */
+import { homedir } from "node:os";
+import { localStatus, uninstallFromThisComputer } from "./setup.js";
+export const LOCAL_HELP = `  dl local status         agents on this computer: running?, where, how many fit
+  dl local uninstall [--purge]   stop and remove them (--purge also deletes keys and data)
+`;
+export async function localCommand(args, flags, io, colors, ui, options = {}) {
+    const [sub = "status"] = args;
+    if (sub === "status") {
+        io.out(formatLocalStatus(await localStatus(options), colors, options.home ?? homedir()));
+        return 0;
+    }
+    if (sub === "uninstall") {
+        await uninstallFromThisComputer({ ui, purge: Boolean(flags.purge), ...options });
+        ui.finish();
+        return 0;
+    }
+    io.err(`  Unknown: dl local ${sub}\n\n${LOCAL_HELP}`);
+    return 2;
+}
+export function formatLocalStatus(status, c, home) {
+    const short = (path) => (path.startsWith(`${home}/`) ? `~${path.slice(home.length)}` : path);
+    if (!status.installed || !status.state) {
+        const leftovers = status.services.hotcell.installed || status.services.autopilot.installed;
+        return `\n  ${c.bold("Directionally Local")}  ${c.dim("isn't set up on this computer.")}\n${leftovers ? `\n  ${c.yellow("!")} Its services are still registered; remove them with: dl local uninstall\n` : ""}\n`;
+    }
+    const { state, services } = status;
+    const mark = (ok) => (ok ? c.green("✓") : c.red("✗"));
+    const line = (ok, label, detail) => `  ${mark(ok)} ${label.padEnd(12)}${c.dim(detail)}\n`;
+    const describe = (entry) => entry.running ? `running${entry.pid ? ` (pid ${entry.pid})` : ""}` : entry.installed ? "stopped" : "not installed";
+    const healthy = services.hotcell.running && services.autopilot.running && status.answering && status.dockerRunning;
+    return [
+        `\n  ${c.bold("Directionally Local")}  ${c.dim("on this computer")}  ${healthy ? c.green("running") : c.red("needs attention")}\n\n`,
+        line(status.dockerRunning, "Docker", status.dockerRunning ? state.dockerRuntime : `${state.dockerRuntime} isn't running; start it`),
+        line(services.hotcell.running, "Hotcell", `${describe(services.hotcell)} · 127.0.0.1:${state.ports.hotcell} · ${state.hotcellVersion}`),
+        line(services.autopilot.running && status.answering, "Autopilot", `${describe(services.autopilot)}${status.answering ? "" : ", not answering"} · ${state.url} · ${state.autopilotVersion}`),
+        `\n  ${c.dim("Fits")}        ${status.capacity !== undefined ? `~${status.capacity} agents at once (estimate, from Docker's memory)` : "unknown while Docker is stopped"}\n`,
+        `  ${c.dim("Installed")}   ${short(status.paths.current)}\n`,
+        `  ${c.dim("Logs")}        ${short(status.paths.logs)}\n`,
+        `  ${c.dim("Starts")}      at login (${status.platform === "darwin" ? "LaunchAgents" : "systemd --user"}); tasks pause while this computer sleeps\n`,
+        healthy ? "\n" : `\n  ${c.dim("Fix it by running setup again; it repairs and keeps your keys.")}\n\n`,
+    ].join("");
+}