directionallylocal 0.2.0 → 0.4.0

package/dist/cli.js

@@ -2,27 +2,39 @@ import { readFileSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { parseArgs } from "node:util";
 import { doctor, formatChecks } from "./doctor.js";
+import { serverKeysCommand } from "./keys.js";
 import { briefStatus, connectLaptop, laptopsCommand, logsCommand, pairLaptop, serverHome, serverRunsCommand } from "./home.js";
-import { cancel, connect, describeError, laptopHome, pull, run, runs, servers, watch } from "./laptop/commands.js";
+import { cancel, connect, describeError, laptopHome, pull, run, runs, servers, use, watch } from "./laptop/commands.js";
+import { loadRemotes } from "./laptop/config.js";
+import { keys } from "./laptop/keys.js";
+import { setup } from "./laptop/setup.js";
+import { localCommand } from "./local/cli.js";
+import { setUpOnThisComputer } from "./local/setup.js";
 import { TtyPrompter } from "./prompt.js";
 import { readState } from "./state.js";
 import { DryRunSystem, RealSystem } from "./system.js";
 import { uninstall } from "./uninstall.js";
 import { JsonUi, PlainUi, TerminalUi, palette } from "./ui.js";
 import { needs, parseAccessMode, parseProvidedAnswers, up } from "./up.js";
-const HELP = `Directionally Local: background coding agents on your own server.
-Send a task from your laptop; it runs in its own sandbox and comes back as a pull request.
+const HELP = `Directionally Local: coding agents that run on this computer or on your own server.
+Send a task; it runs in its own sandbox and comes back as a pull request.
 (dl is short for directionallylocal; both work.)
 
 On your laptop:
-  dl connect URL          connect to your server (approve the code it shows)
-  dl run "TASK"           run a task on the server, from inside a GitHub repository
+  dl                      set up the first time; afterwards, an overview
+  dl setup                set up or repair where your agents run (safe to re-run)
+  dl connect URL          connect to a server someone else set up (approve the code it shows)
+  dl run "TASK"           run a task, from inside a GitHub repository
                           (your uncommitted changes go along; Ctrl-C stops watching, not the task)
   dl runs                 your tasks and their pull requests
   dl watch ID             follow a task      dl cancel ID   stop one
   dl pull ID              check out a task's branch here
-  dl servers              connected servers (dl servers remove NAME)
-  run options: --server NAME, -m MODEL, --repo OWNER/NAME, --detach
+  dl servers              where agents run (dl servers remove NAME · dl servers rename OLD NEW)
+  dl use [NAME]           where tasks go without --server (no NAME: show it)
+  dl keys [openrouter|github]   which keys are set, or replace one (--server NAME)
+  run options: --server NAME, -m/--model MODEL, --repo OWNER/NAME, --detach
+  dl local status         agents running on this computer: running?, where, how many fit
+  dl local uninstall [--purge]   stop and remove them (--purge also deletes keys and data)
 
 On the server:
   dl                      what this is, whether it's healthy, laptops, and runs
@@ -33,6 +45,7 @@ On the server:
   dl runs                 tasks running or done, with their pull requests
   dl logs [hotcell|autopilot] [-f]   the services' logs
   dl doctor               check every part, with a fix for each problem
+  dl keys [set openrouter|github]   which keys are set, or replace one (hidden input)
   dl uninstall [--purge]  remove everything (--purge also removes config and data)
 
 up options:
@@ -54,6 +67,7 @@ Used by the laptop's setup (over SSH, as root):
                               install with the keys as one JSON object on stdin; progress as JSON lines
   dl up --needs [--access ssh]   which keys dl up would still need, as JSON; changes nothing
   dl pair --name NAME --json     a credential for that laptop, as JSON
+  dl keys set openrouter|github --stdin --json   replace a key read from stdin
 `;
 export async function main(argv, io = {
     out: (text) => process.stdout.write(text),
@@ -84,6 +98,8 @@ export async function main(argv, io = {
                 "answers-stdin": { type: "boolean" },
                 events: { type: "string" },
                 needs: { type: "boolean" },
+                identity: { type: "string" },
+                stdin: { type: "boolean" },
             },
         });
     }
@@ -193,6 +209,9 @@ export async function main(argv, io = {
                     // A laptop connected to servers gets its own home; otherwise, what this is and how to start.
                     if (!command && await laptopHome(laptopIO))
                         return 0;
+                    // A laptop with nothing set up yet: the wizard (it needs someone to answer it).
+                    if (!command && terminal && !isRoot() && (await loadRemotes()).length === 0)
+                        return await setup({ io: laptopIO, terminal, localSetup: (input) => setUpOnThisComputer(input) });
                     io.out(NOT_A_SERVER(colors));
                     return command ? 1 : 0;
                 }
@@ -208,6 +227,8 @@ export async function main(argv, io = {
                 await serverHome(system, state, io.out, colors);
                 return 0;
             }
+            case "setup":
+                return await setup({ io: laptopIO, terminal, localSetup: (input) => setUpOnThisComputer(input), ...(values.identity ? { identityFile: values.identity } : {}) });
             case "connect": {
                 const url = parsed.positionals[1];
                 if (!url) {
@@ -252,6 +273,8 @@ export async function main(argv, io = {
             }
             case "servers":
                 return await servers(parsed.positionals.slice(1), laptopIO);
+            case "use":
+                return await use(parsed.positionals.slice(1), laptopIO);
             case "runs":
                 // On a server, its runs; on a laptop, the tasks it sent.
                 if (!(await readState(system))) {
@@ -280,6 +303,20 @@ export async function main(argv, io = {
                     return await serverRunsCommand(system, io.out, colors);
                 return await logsCommand(system, [...rest, ...(values.follow ? ["-f"] : [])]);
             }
+            case "keys": {
+                // On a server, its own keys (as root); on a laptop, the keys where its agents run.
+                if (!(await readState(system)))
+                    return await keys(parsed.positionals.slice(1), { ...(values.server ? { server: values.server } : {}), io: laptopIO, terminal });
+                if (!isRoot()) {
+                    io.err(`  Run it as root: sudo dl ${parsed.positionals.join(" ")}\n`);
+                    return 1;
+                }
+                return await serverKeysCommand(system, parsed.positionals.slice(1), { json: Boolean(values.json), stdin: Boolean(values.stdin) }, {
+                    out: io.out, err: io.err, colors, stdin: options.stdin ?? process.stdin, prompter: new TtyPrompter(),
+                });
+            }
+            case "local":
+                return await localCommand(parsed.positionals.slice(1), { purge: Boolean(values.purge) }, io, colors, ui);
             case "uninstall":
                 await uninstall(system, { purge: Boolean(values.purge) });
                 return 0;
@@ -306,10 +343,13 @@ export async function main(argv, io = {
 const NOT_A_SERVER = (c) => `
   ${c.bold("Directionally Local")}  ${c.dim("isn't set up on this machine.")}
 
-  Background coding agents on your own server: send a task from your laptop,
+  Coding agents that run on this computer or on your own server: send a task,
   get a pull request back.
 
-  ${c.dim("Set up a server (as root, on Ubuntu or Debian):")}
+  ${c.dim("Set it up here, or on a server over SSH (asks a few questions):")}
+     dl setup
+
+  ${c.dim("Or on a server (as root, on Ubuntu or Debian):")}
      curl -fsSL https://directionallylocal.run | sh
 
   ${c.dim("Already have one? Connect this laptop to it:")}

package/dist/keys.js

@@ -0,0 +1,188 @@
+/**
+ * `dl keys` on a server: replace the OpenRouter key or the GitHub token where `dl up`
+ * stored them, restart the one service that reads it, and show which keys are set (never
+ * their values). Keys come in on stdin (or hidden input on the server's own terminal),
+ * never argv, so they stay out of `ps`, shell history, and logs.
+ *
+ *   OpenRouter  Hotcell's file keystore, as the hotcell user   → restart hotcell.service
+ *   GitHub      /etc/autopilot/github.env (0640 root:autopilot) → restart autopilot.service
+ *
+ * The laptop's `dl keys` runs `dl keys set <which> --stdin --json` here over SSH.
+ */
+import { AUTOPILOT_PORT, HOTCELL_PORT, PATHS, SERVICES, USERS, githubEnv, hotcellBin, parseEnvFile } from "./layout.js";
+import { asHotcell, validateGitHubToken, validateOpenRouterKey, waitUntil } from "./up.js";
+export const KEY_NAMES = ["openrouter", "github"];
+export const KEY_LABELS = { openrouter: "OpenRouter", github: "GitHub" };
+export function parseKeyName(value) {
+    return KEY_NAMES.find((name) => name === value?.trim().toLowerCase());
+}
+/** Format first, then (with `fetchImpl`) the service itself; offline isn't fatal. */
+export async function checkKey(which, value, fetchImpl) {
+    if (!value)
+        return { problem: "No key was given." };
+    if (which === "openrouter") {
+        const problem = await validateOpenRouterKey(value, fetchImpl);
+        return problem ? { problem } : {};
+    }
+    return validateGitHubToken(value, fetchImpl);
+}
+/** The key wasn't accepted; nothing was stored or restarted. */
+export class KeyRejectedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "KeyRejectedError";
+    }
+}
+/** Stores the key exactly where `dl up` does, then restarts the service that reads it and waits for it. */
+export async function setServerKey(system, which, value, options = {}) {
+    const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const key = value.trim();
+    const checked = await checkKey(which, key, options.fetchImpl);
+    if (checked.problem)
+        throw new KeyRejectedError(checked.problem);
+    if (which === "openrouter") {
+        if (!(await system.exists(hotcellBin())))
+            throw new Error("Hotcell isn't installed here; run dl up first.");
+        // Over stdin into Hotcell's keystore: never in argv, env files, or Autopilot's config. It replaces the old one.
+        await asHotcell(system, ["keys", "add", "openrouter", "--stdin"], { input: key, describe: "hotcell keys add openrouter --stdin (as hotcell)" });
+        // Hotcell reads its keystore at startup.
+        await system.run("systemctl", ["restart", SERVICES.hotcell]);
+        await waitUntil(system, sleep, "Hotcell", () => hotcellAnswers(system));
+        return { ok: true, key: which, detail: "replaced in Hotcell; Hotcell restarted" };
+    }
+    await system.mkdir(PATHS.autopilotEtc, { mode: 0o750, owner: `root:${USERS.autopilot}` });
+    await system.writeFile(PATHS.githubEnv, githubEnv(key), { mode: 0o640, owner: `root:${USERS.autopilot}`, secret: true });
+    // Autopilot reads GITHUB_TOKEN from its env file at startup.
+    await system.run("systemctl", ["restart", SERVICES.autopilot]);
+    await waitUntil(system, sleep, "Autopilot", () => autopilotAnswers(system));
+    return { ok: true, key: which, detail: `${checked.detail ? `${checked.detail}; ` : ""}Autopilot restarted` };
+}
+/** Which keys this server has. Reads and probes only; the GitHub login is a quick, optional API call. */
+export async function listServerKeys(system, options = {}) {
+    let openrouter = { key: "openrouter", set: false };
+    if (await system.exists(hotcellBin())) {
+        const listed = await system.probe("runuser", [
+            "-u", USERS.hotcell, "--", "env", `HOTCELL_HOME=${PATHS.hotcellHome}`, "HOTCELL_KEYSTORE=file", "NO_COLOR=1", "/usr/bin/node", hotcellBin(), "keys", "ls",
+        ]);
+        if (listed.code === 0)
+            openrouter = { key: "openrouter", ...hotcellKeyListed(listed.stdout, "openrouter") };
+    }
+    const token = parseEnvFile(await system.readFile(PATHS.githubEnv)).GITHUB_TOKEN;
+    return [openrouter, await githubListing(token, options.fetchImpl)];
+}
+/**
+ * A provider's row in `hotcell keys ls` (`openrouter  sk-or…ab  file`), with Hotcell's
+ * mask. A column that's long enough to be a key isn't shown, in case the format changes.
+ */
+export function hotcellKeyListed(stdout, provider) {
+    const plain = stdout.replace(/\x1b\[[0-9;]*m/g, "");
+    const row = plain.split("\n").map((line) => line.trim().split(/\s+/)).find((cells) => cells[0] === provider);
+    if (!row)
+        return { set: false };
+    const mask = row[1];
+    return mask && mask.length <= 12 && (mask.includes("…") || /^•+$/.test(mask)) ? { set: true, detail: mask } : { set: true };
+}
+/** The GitHub row: set or not, and whose token it is when GitHub answers within a few seconds. */
+export async function githubListing(token, fetchImpl) {
+    if (!token)
+        return { key: "github", set: false };
+    if (!fetchImpl)
+        return { key: "github", set: true };
+    const quick = (input, init) => fetchImpl(input, { ...init, signal: AbortSignal.timeout(5_000) });
+    const checked = await validateGitHubToken(token, quick);
+    // A stored token in an unexpected format still counts as set; only GitHub's own refusal is a problem.
+    if (checked.problem && /rejected/.test(checked.problem))
+        return { key: "github", set: true, problem: checked.problem };
+    return { key: "github", set: true, ...(checked.detail ? { detail: checked.detail } : {}) };
+}
+/** `dl keys` as text: one line per key, values never shown. */
+export function formatKeyListing(listing, c, where, replaceWith) {
+    const rows = listing.map((entry) => {
+        const label = KEY_LABELS[entry.key].padEnd(12);
+        if (!entry.set)
+            return `  ${c.red("✗")} ${label}${c.dim("not set")}   ${replaceWith(entry.key)}\n`;
+        if (entry.problem)
+            return `  ${c.red("✗")} ${label}${entry.problem}   ${c.dim("replace it:")} ${replaceWith(entry.key)}\n`;
+        return `  ${c.green("✓")} ${label}${c.dim(entry.detail ?? "set")}\n`;
+    });
+    const hint = listing.every((entry) => entry.set && !entry.problem)
+        ? `\n  ${c.dim("Replace one:")} ${replaceWith("openrouter")}   ${c.dim("or")}   ${replaceWith("github")}\n`
+        : "";
+    return `\n  ${c.bold("Keys")} ${c.dim(where)}\n\n${rows.join("")}${hint}\n`;
+}
+/**
+ * One line from stdin: the key, up to the first newline or the end. Never echoed, and a
+ * parse error never quotes it.
+ */
+export async function readKeyLine(stdin) {
+    if (stdin.isTTY)
+        throw new Error("--stdin reads the key from a pipe, not a terminal; leave it off to type the key (hidden).");
+    let text = "";
+    for await (const chunk of stdin) {
+        text += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+        if (text.includes("\n"))
+            break;
+        if (text.length > 4096)
+            throw new Error("The key on stdin is too long; expected one line.");
+    }
+    const line = text.split("\n")[0].trim();
+    if (line.length > 4096)
+        throw new Error("The key on stdin is too long; expected one line.");
+    return line;
+}
+const SERVER_USAGE = "  Usage: dl keys                          which keys are set\n"
+    + "         dl keys set openrouter|github    replace one (hidden input; --stdin reads it from a pipe)\n";
+/**
+ * `dl keys [ls]`, `dl keys set <openrouter|github> [--stdin] [--json]`, and `dl keys
+ * <openrouter|github>` (the same as `set`), as root on a server.
+ */
+export async function serverKeysCommand(system, args, flags, deps) {
+    const c = deps.colors;
+    const env = deps.env ?? process.env;
+    const fetchImpl = env.DL_SKIP_CREDENTIAL_CHECK === "1" ? undefined : deps.fetchImpl ?? fetch;
+    const [first, second] = args;
+    if (first === undefined || first === "ls" || first === "list") {
+        const listing = await listServerKeys(system, { fetchImpl });
+        if (flags.json)
+            deps.out(`${JSON.stringify({ keys: listing })}\n`);
+        else
+            deps.out(formatKeyListing(listing, c, "on this server", (key) => `sudo dl keys set ${key}`));
+        return 0;
+    }
+    const which = parseKeyName(first === "set" ? second : first);
+    if (!which || (first !== "set" && second !== undefined)) {
+        deps.err(SERVER_USAGE);
+        return 2;
+    }
+    try {
+        let value;
+        if (flags.stdin)
+            value = await readKeyLine(deps.stdin);
+        else if (!flags.json)
+            value = await deps.prompter.secret(`  ${KEY_LABELS[which]} ${which === "github" ? "token" : "key"} (hidden): `);
+        else
+            throw new Error("--json needs the key on stdin: dl keys set KEY --stdin --json");
+        const result = await setServerKey(system, which, value, { fetchImpl, ...(deps.sleep ? { sleep: deps.sleep } : {}) });
+        if (flags.json)
+            deps.out(`${JSON.stringify(result)}\n`);
+        else
+            deps.out(`  ${c.green("✓")} ${KEY_LABELS[which]} ${which === "github" ? "token" : "key"} replaced  ${c.dim(result.detail)}\n`);
+        return 0;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (flags.json)
+            deps.out(`${JSON.stringify({ ok: false, key: which, error: message })}\n`);
+        else
+            deps.err(`  ${c.red("✗")} ${message}\n`);
+        return 1;
+    }
+}
+async function hotcellAnswers(system) {
+    return (await system.probe("curl", ["-fsS", "-o", "/dev/null", `http://127.0.0.1:${HOTCELL_PORT}/`])).code === 0
+        || (await system.probe("sh", ["-c", `ss -ltn | grep -q '127.0.0.1:${HOTCELL_PORT}'`])).code === 0;
+}
+/** Without a token the Aster API answers 401: up, and refusing strangers. */
+async function autopilotAnswers(system) {
+    return (await system.probe("curl", ["-s", "-o", "/dev/null", "-w", "%{http_code}", `http://127.0.0.1:${AUTOPILOT_PORT}/api/v1/health`])).stdout.trim() === "401";
+}