directionallylocal 0.3.0 → 0.4.0

package/dist/local/keys.js

@@ -0,0 +1,100 @@
+/**
+ * `dl keys` for "on this computer": the same as on a server, in the user's home. The
+ * OpenRouter key goes to Hotcell's 0600 file keystore over stdin (HOTCELL_KEYSTORE=file,
+ * see setup.ts for why not the Keychain), the GitHub token to the 0600 github.env, and
+ * the service that reads it (a LaunchAgent or a systemd user unit) restarts.
+ */
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { checkKey, githubListing, hotcellKeyListed, KeyRejectedError } from "../keys.js";
+import { RealSystem } from "../system.js";
+import { supportedPlatform } from "./check.js";
+import { LOCAL_SERVICES, localGithubEnv, localHotcellBin, localPaths, parseLocalEnvFile, serviceFile } from "./layout.js";
+import { httpStatus } from "./probes.js";
+import { userId } from "./services.js";
+import { hotcellCliEnv } from "./setup.js";
+import { readLocalState } from "./state.js";
+async function installed(options) {
+    const home = options.home ?? homedir();
+    const platform = supportedPlatform(options.platform ?? process.platform);
+    if (!platform)
+        throw new Error("Agents run on this computer only on macOS and Linux.");
+    const system = options.system ?? new RealSystem(() => { });
+    const paths = localPaths(home, platform);
+    const state = await readLocalState(system, paths);
+    if (!state)
+        throw new Error("Directionally Local isn't set up on this computer; run dl setup.");
+    return {
+        system,
+        home,
+        platform,
+        paths,
+        state,
+        node: options.execPath ?? process.execPath,
+        sleep: options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))),
+    };
+}
+/** Stores the key where setup does, restarts the service that reads it, and waits for it to answer. */
+export async function setLocalKey(which, value, options = {}) {
+    const key = value.trim();
+    const checked = await checkKey(which, key, options.fetchImpl);
+    if (checked.problem)
+        throw new KeyRejectedError(checked.problem);
+    const ctx = await installed(options);
+    const { system, paths, state, node } = ctx;
+    const uid = await userId(system);
+    if (which === "openrouter") {
+        await system.run(node, [localHotcellBin(paths), "keys", "add", "openrouter", "--stdin"], {
+            input: key,
+            env: hotcellCliEnv(paths),
+            describe: "hotcell keys add openrouter --stdin",
+        });
+        await restartService(ctx, uid, "hotcell");
+        await waitUntil(ctx, "Hotcell", async () => await httpStatus(system, node, `http://127.0.0.1:${state.ports.hotcell}/`) > 0);
+        return { ok: true, key: which, detail: "replaced in Hotcell; Hotcell restarted" };
+    }
+    await system.writeFile(paths.githubEnv, localGithubEnv(key), { mode: 0o600, secret: true });
+    await restartService(ctx, uid, "autopilot");
+    // Without a token the Aster API answers 401: up, and refusing strangers.
+    await waitUntil(ctx, "Autopilot", async () => await httpStatus(system, node, `${state.url}/api/v1/health`) === 401);
+    return { ok: true, key: which, detail: `${checked.detail ? `${checked.detail}; ` : ""}Autopilot restarted` };
+}
+/** Which keys this computer's install has; never their values. */
+export async function listLocalKeys(options = {}) {
+    const { system, paths, node } = await installed(options);
+    let openrouter = { key: "openrouter", set: false };
+    if (await system.exists(localHotcellBin(paths))) {
+        const listed = await system.probe(node, [localHotcellBin(paths), "keys", "ls"], { env: { ...hotcellCliEnv(paths), NO_COLOR: "1" } });
+        if (listed.code === 0)
+            openrouter = { key: "openrouter", ...hotcellKeyListed(listed.stdout, "openrouter") };
+    }
+    const token = parseLocalEnvFile(await system.readFile(paths.githubEnv)).GITHUB_TOKEN;
+    return [openrouter, await githubListing(token, options.fetchImpl)];
+}
+/**
+ * Restarts one service so it reads its keys again: `launchctl kickstart -k` on macOS (or
+ * bootstrap, when it isn't loaded), `systemctl --user restart` on Linux.
+ */
+async function restartService(ctx, uid, service) {
+    const { system, platform, paths } = ctx;
+    if (platform === "darwin") {
+        const restarted = await system.run("launchctl", ["kickstart", "-k", `gui/${uid}/${LOCAL_SERVICES[service].label}`], { allowFailure: true });
+        if (restarted.code === 0)
+            return;
+        const file = serviceFile(paths, platform, service);
+        if (!(await system.exists(file)))
+            throw new Error(`The ${service} service isn't installed on this computer; run dl setup to repair it.`);
+        await system.run("launchctl", ["bootstrap", `gui/${uid}`, file]);
+        return;
+    }
+    await system.run("systemctl", ["--user", "restart", LOCAL_SERVICES[service].unit]);
+}
+async function waitUntil(ctx, what, ready) {
+    for (let attempt = 0; attempt < 60; attempt++) {
+        if (await ready())
+            return;
+        await ctx.sleep(1_000);
+    }
+    const log = join(ctx.paths.logs, LOCAL_SERVICES[what === "Hotcell" ? "hotcell" : "autopilot"].log);
+    throw new Error(`${what} didn't come back up; see ${log.startsWith(`${ctx.home}/`) ? `~${log.slice(ctx.home.length)}` : log}`);
+}

package/dist/local/setup.js

@@ -320,7 +320,7 @@ async function openDockerApp(ctx, facts, options) {
     }
     return facts;
 }
-function hotcellCliEnv(paths) {
+export function hotcellCliEnv(paths) {
     return { HOME: paths.hotcellHome, HOTCELL_HOME: paths.hotcellHome, HOTCELL_KEYSTORE: "file" };
 }
 async function hotcellHasKey(system, node, paths, provider) {

package/dist/local/test-support/fake-computer.js

@@ -17,6 +17,8 @@ export class FakeComputer {
     containers = [];
     /** launchd labels or systemd units that are running. */
     running = new Set();
+    /** Services restarted in place (launchctl kickstart -k, systemctl --user restart), in order. */
+    restarted = [];
     /** Ports something else on this computer listens on. */
     busy = new Set();
     credentials = [];
@@ -128,8 +130,13 @@ export class FakeComputer {
                 this.files.set(`${home}/keys.json`, { content: "{}", mode: 0o600 });
                 return ok("stored\n");
             }
-            if (args[1] === "keys" && args[2] === "ls")
-                return !this.files.has(`${options.env?.HOTCELL_HOME ?? ""}/keys.json`) ? ok("") : ok([...this.hotcellKeys.keys()].map((key) => `  ${key}  file\n`).join(""));
+            if (args[1] === "keys" && args[2] === "ls") {
+                if (!this.files.has(`${options.env?.HOTCELL_HOME ?? ""}/keys.json`))
+                    return ok("");
+                // Like Hotcell's own listing: a header, then each provider with its masked value.
+                const mask = (value) => value.length <= 8 ? "•".repeat(Math.max(4, value.length)) : `${value.slice(0, 5)}…${value.slice(-2)}`;
+                return ok(`PROVIDER  KEY           SOURCE\n${[...this.hotcellKeys].map(([key, value]) => `${key.padEnd(8)}  ${mask(value).padEnd(12)}  file\n`).join("")}`);
+            }
             return ok();
         }
         if (command.endsWith("/node") && args[0]?.endsWith("autopilot-ai/bin/autopilot.mjs")) {
@@ -172,8 +179,10 @@ export class FakeComputer {
             case "systemctl":
                 if (args[1] === "is-system-running")
                     return this.systemdUser ? ok("running\n") : fail("Failed to connect to bus");
-                if (args[1] === "restart")
+                if (args[1] === "restart") {
                     this.running.add(args[2]);
+                    this.restarted.push(args[2]);
+                }
                 if (args[1] === "disable" && args[2] === "--now")
                     this.running.delete(args[3]);
                 if (args[1] === "is-active")
@@ -192,6 +201,14 @@ export class FakeComputer {
                     const label = args[1].split("/").at(-1);
                     return this.running.delete(label) ? ok() : fail("Boot-out failed: 3: No such process");
                 }
+                if (args[0] === "kickstart") {
+                    // -k restarts a loaded service; one that isn't loaded can't be kickstarted.
+                    const label = args.at(-1).split("/").at(-1);
+                    if (!this.running.has(label))
+                        return fail("Could not find service");
+                    this.restarted.push(label);
+                    return ok();
+                }
                 if (args[0] === "print") {
                     const label = args[1].split("/").at(-1);
                     return this.running.has(label) ? ok(`${args[1]} = {\n\tstate = running\n\tpid = 4242\n}\n`) : fail("Could not find service");

package/dist/up.js

@@ -35,7 +35,7 @@ export async function up(system, options) {
         { id: "software", label: "Installing Hotcell + Autopilot" },
         { id: "image", label: "Building the sandbox image" },
         { id: "services", label: "Starting services" },
-        { id: "access", label: access === "tailscale" ? "Opening private access" : "Starting the API" },
+        { id: "access", label: access === "tailscale" ? "Opening private access" : "Starting the server" },
     ]);
     const step = async (id, work) => {
         ui.start(id);
@@ -131,7 +131,9 @@ export async function up(system, options) {
         await system.run("systemctl", ["restart", SERVICES.autopilot]);
         // Without a token the Aster API answers 401: the server is up and refusing strangers.
         await waitUntil(system, sleep, "Autopilot", async () => (await system.probe("curl", ["-s", "-o", "/dev/null", "-w", "%{http_code}", `http://127.0.0.1:${AUTOPILOT_PORT}/api/v1/health`])).stdout.trim() === "401");
-        return { value: address, detail: address.replace(/^https?:\/\//, "") };
+        // The API only listens on this machine: say who can reach it rather than a loopback address.
+        const reach = access === "tailscale" ? address.replace(/^https?:\/\//, "") : access === "ssh" ? "private · reached over SSH" : "private · this machine only";
+        return { value: address, detail: reach };
     });
     const now = (options.now ?? (() => new Date()))().toISOString();
     const state = {
@@ -390,7 +392,7 @@ async function latestVersion(system, pkg) {
         throw new Error(`Couldn't look up the latest ${pkg} on npm${result.stderr ? `: ${result.stderr.trim()}` : ""}`);
     return version;
 }
-function asHotcell(system, args, options = {}) {
+export function asHotcell(system, args, options = {}) {
     return system.run("runuser", [
         "-u", USERS.hotcell, "--", "env", `HOTCELL_HOME=${PATHS.hotcellHome}`, "HOTCELL_KEYSTORE=file",
         "/usr/bin/node", hotcellBin(), ...args,
@@ -492,7 +494,7 @@ async function serveOverTailscale(system) {
         throw new Error("Tailscale is up but reported no DNS name for this machine; is MagicDNS on?");
     return `https://${dnsName}`;
 }
-async function waitUntil(system, sleep, what, ready, unit = what.toLowerCase()) {
+export async function waitUntil(system, sleep, what, ready, unit = what.toLowerCase()) {
     if (system.dryRun)
         return;
     for (let attempt = 0; attempt < 60; attempt++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "directionallylocal",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Directionally Local: background coding agents on your own server. One-line server install, and the dl command for your server and laptop.",
   "homepage": "https://directionallylocal.com",
   "repository": {