gitroots 0.0.0-stage → 0.5.0

package/src/commands/attach.js

@@ -0,0 +1,262 @@
+// gitroots attach <session> · full screen, prefix ctrl-g
+import { c, pad, fit, width } from '../ui/ansi.js';
+import { line, interactive, enterFullscreen, leaveFullscreen, paintFrame, size, parseKeys, FRAMES } from '../ui/term.js';
+import { json, next, sessionState } from '../ui/components.js';
+import { liveLog } from '../data/live.js';
+import { createBackup } from './backup.js';
+
+export async function run(_cmd, rest, flags, store) {
+  const [id] = rest;
+  if (!id) throw new Error('which session? gitroots attach <session> · see gitroots watch');
+  const s = store.session(id);
+  if (flags.shell) return shell(store, s);
+  if (flags.json) { json({ session: s, transcript: store.transcript(s.id) }); return 0; }
+  if (!interactive()) {
+    // Piped: print the transcript tail instead of taking over the terminal.
+    for (const t of store.transcript(s.id)) line(t.who === 'log' ? `       ${t.time}  ${t.verb.padEnd(8)}${t.body}${t.add || ''}` : `${t.who === 'you' ? 'you  ' : 'agent'}  ${t.text.replace(/[§*]/g, '')}`);
+    if (s.ask) line(`◐ ${s.agent} asks: ${s.ask.question}`);
+    return 0;
+  }
+  return attach(store, s.id);
+}
+
+// A shell next to the agent. Sessions on this machine get a real local shell;
+// remote machines need agentd and a connected relay.
+async function shell(store, s) {
+  const m = store.machine(s.machine);
+  if (!m.self) {
+    throw new Error(`${s.id} runs on ${m.name} · a remote shell goes through agentd on ${m.name}, which this sample org does not have · sessions on ${store.machines().find((x) => x.self)?.name || 'this machine'} open a real shell`);
+  }
+  const { spawn } = await import('node:child_process');
+  const sh = process.env.SHELL || (process.platform === 'win32' ? process.env.ComSpec || 'cmd.exe' : '/bin/sh');
+  line(`${c.g(c.b('gitroots'))}  shell for ${c.b(s.id)} on ${m.name} ${c.m(`· ${s.repo} · ${s.branch} · exit to return`)}`);
+  store.record({ actor: store.org.user, action: 'shell', target: s.id, decision: 'allowed', note: m.name, repo: s.repo });
+  store.save();
+  return new Promise((resolve) => {
+    const child = spawn(sh, [], { stdio: 'inherit', env: { ...process.env, GITROOTS_SESSION: s.id } });
+    child.on('exit', (code) => { line(c.m(`  shell closed · ${s.id} keeps running`)); resolve(code ?? 0); });
+  });
+}
+
+const REPLIES = {
+  's-2c91': [
+    [ // Yes, run on staging
+      { verb: 'run', body: 'odoo-bin -d staging -u pos_refund --stop-after-init', ms: 900 },
+      { verb: 'output', body: 'post-migrate 17.0.1.3: adding column pos_order.refunded_amount', ms: 700 },
+      { verb: 'output', body: 'backfilled 18,402 orders in 38.6s · ', add: 'OK', ms: 1400 },
+      { verb: 'backup', body: 'auto · before risky · kept', add: '  ✓', ms: 400 },
+      { say: 'The migration ran on staging: 18,402 orders backfilled, no errors. PR #412 is ready for your approval.' },
+    ],
+    [ // erp_test first
+      { verb: 'run', body: 'odoo-bin -d erp_test -u pos_refund --stop-after-init', ms: 900 },
+      { verb: 'output', body: 'backfilled 2,117 orders in 6.1s · ', add: 'OK', ms: 1200 },
+      { say: 'It ran cleanly on erp_test (2,117 orders). Say the word and I will run it on staging.' },
+    ],
+    [ // show SQL
+      { say: 'Here is what post-migrate.py runs:\n§ALTER TABLE pos_order ADD COLUMN refunded_amount numeric DEFAULT 0;§\n§UPDATE pos_order o SET refunded_amount = r.total FROM (§\n§  SELECT refund_order_id, SUM(amount_total) total FROM pos_order_refund GROUP BY 1) r§\n§WHERE o.id = r.refund_order_id;§' },
+    ],
+  ],
+};
+
+export function attach(store, id) {
+  const s = store.session(id);
+  return new Promise((resolve) => {
+    const st = {
+      tick: 0, input: '', prefix: false, choice: 0, flash: null, busy: false, mode: null,
+      running: null, // the activity line in progress
+    };
+    const say = (msg, tone = 'g') => { st.flash = { msg, tone, until: Date.now() + 3500 }; };
+    const transcript = () => (store.d.transcripts[s.id] = store.d.transcripts[s.id] || []);
+
+    const play = async (steps) => {
+      st.busy = true;
+      s.state = 'running';
+      for (const step of steps) {
+        if (step.say) { transcript().push({ who: 'agent', text: step.say }); continue; }
+        const entry = { who: 'log', verb: step.verb, body: step.body, add: step.add, time: new Date().toTimeString().slice(0, 8) };
+        transcript().push(entry);
+        st.running = entry;
+        await new Promise((r) => setTimeout(r, step.ms || 600));
+        st.running = null;
+      }
+      s.turns++;
+      s.updated = 'just now';
+      st.busy = false;
+      store.save();
+    };
+
+    const answer = (idx) => {
+      const ask = s.ask;
+      transcript().push({ who: 'you', text: `${idx + 1}. ${ask.options[idx]}` });
+      store.record({ actor: store.org.user, action: 'agent approval', target: `${s.id} · ${ask.options[idx]}`, decision: 'recorded', note: s.agent, repo: s.repo });
+      s.ask = undefined;
+      store.save();
+      const script = (REPLIES[s.id] || [])[idx] || [{ say: `OK: ${ask.options[idx].toLowerCase()}.` }];
+      play(script);
+    };
+
+    const send = (text) => {
+      transcript().push({ who: 'you', text });
+      store.save();
+      play([{ verb: 'think', body: `Reading the request: "${text.slice(0, 60)}"`, ms: 900 }, { say: 'On it. I will post progress here and ask before anything risky.' }]);
+    };
+
+    const detach = (msg) => {
+      clearInterval(timer);
+      process.stdin.off('data', onData);
+      process.stdout.off('resize', draw);
+      process.stdin.setRawMode(false);
+      process.stdin.pause();
+      leaveFullscreen();
+      store.save();
+      if (msg !== false) {
+        line(`${c.g('✓')} Detached from ${c.b(s.id)} ${c.m('·')} it keeps running on ${s.machine}   ${sessionState(s)}`);
+        line(next(`gitroots attach ${s.id}`, 'gitroots watch'));
+      }
+      resolve(0);
+    };
+
+    const onKey = async (k) => {
+      if (st.mode && st.mode.type === 'transfer') {
+        const m = st.mode;
+        if (k.name === 'escape' || k.name === 'ctrl-c') st.mode = null;
+        else if (k.name === 'up' || k.name === 'left') m.idx = (m.idx - 1 + m.targets.length) % m.targets.length;
+        else if (k.name === 'down' || k.name === 'right' || k.name === 'tab') m.idx = (m.idx + 1) % m.targets.length;
+        else if (k.name === 'enter') {
+          const to = m.targets[m.idx].name;
+          st.mode = null;
+          clearInterval(timer);
+          process.stdin.off('data', onData);
+          process.stdin.setRawMode(false);
+          leaveFullscreen();
+          const { transfer } = await import('./transfer.js');
+          try { await transfer(store, s.id, to); } catch (e) { line(`${c.r('✕')} ${e.message}`); }
+          await new Promise((r) => setTimeout(r, 1200));
+          enterFullscreen();
+          process.stdin.setRawMode(true);
+          process.stdin.resume();
+          process.stdin.on('data', onData);
+          timer = setInterval(tickDraw, 100);
+        }
+        return;
+      }
+      if (st.prefix) {
+        st.prefix = false;
+        switch (k.ch || k.name) {
+          case 'd': case 'q': return detach();
+          case 'b': { const b = createBackup(store, s, 'manual'); store.record({ actor: store.org.user, action: 'backup', target: `${s.id} · ${b.id}`, decision: 'allowed', note: 'from attach', repo: s.repo }); store.save(); say(`✓ backup ${b.id} saved · ${b.sizeMb} MB`); return; }
+          case 't': {
+            const targets = store.machines().filter((m) => m.online && m.name !== s.machine);
+            if (targets.length) st.mode = { type: 'transfer', idx: 0, targets }; else say('no other machine is online', 'w');
+            return;
+          }
+          case 'f': {
+            const nid = store.nextSessionId();
+            store.d.sessions.push({ ...s, id: nid, state: 'idle', ask: undefined, forkedFrom: s.id, updated: 'just now' });
+            store.record({ actor: store.org.user, action: 'fork', target: `${s.id} → ${nid}`, decision: 'allowed', repo: s.repo });
+            store.save();
+            say(`✓ forked → ${nid} · gitroots attach ${nid}`);
+            return;
+          }
+          case 's': {
+            const { default: crypto } = await import('node:crypto');
+            const url = `https://${process.env.GITROOTS_RELAY_DOMAIN || `${store.org.relay.name}.relay.gitroots.com`}/s/${crypto.randomBytes(4).toString('base64url').slice(0, 5)}`;
+            store.d.tunnels.push({ id: store.nextTunnelId(), session: s.id, machine: s.machine, target: 'live view', access: 'read-only link', viewers: 0, traffic: '0 B', at: new Date().toISOString(), url });
+            store.record({ actor: store.org.user, action: 'share', target: `${s.id} read-only`, decision: 'allowed', repo: s.repo });
+            store.save();
+            say(`✓ read-only link ${url}`);
+            return;
+          }
+          case 'h': say(`${store.d.hiddenTurns?.[s.id] || 0} earlier turns are kept in the session backups · gitroots backups --session ${s.id}`, 's'); return;
+          case 'ctrl-g': st.input += ''; say('ctrl-g sent to the agent', 's'); return;
+          default: say('ctrl-g then d detach · b backup · t transfer · f fork · s share · h history', 'w'); return;
+        }
+      }
+      if (k.name === 'ctrl-g') { st.prefix = true; return; }
+      if (k.name === 'ctrl-c') { say('^C goes to the agent · ctrl-g d detaches and keeps it running', 'w'); return; }
+      if (s.ask && !st.busy && !st.input) {
+        if (k.name === 'up') { st.choice = (st.choice - 1 + s.ask.options.length) % s.ask.options.length; return; }
+        if (k.name === 'down') { st.choice = (st.choice + 1) % s.ask.options.length; return; }
+        if (k.ch && /^[1-9]$/.test(k.ch) && Number(k.ch) <= s.ask.options.length) { st.choice = Number(k.ch) - 1; return; }
+        if (k.name === 'enter') { answer(st.choice); return; }
+      }
+      if (k.name === 'enter') { if (st.input.trim() && !st.busy) { send(st.input.trim()); st.input = ''; } return; }
+      if (k.name === 'backspace') { st.input = st.input.slice(0, -1); return; }
+      if (k.ch) st.input += k.ch;
+    };
+
+    const draw = () => {
+      const { cols, rows } = size();
+      const spin = FRAMES[st.tick % FRAMES.length];
+      const m = store.machines().find((x) => x.name === s.machine) || { os: '' };
+      const left = `  ${c.g(c.b('gitroots'))}   ${c.b(`attached · ${s.id}`)}   ${c.s(`${s.agent} on ${s.machine} (${m.os})`)}   ${c.s(`${s.repo} · ${s.branch}`)}   ${s.ask && !st.busy ? c.w('◐ waiting input') : st.busy ? c.g(`${spin} working`) : sessionState(s)}`;
+      const right = `${c.s(`latency 42 ms · backup ${s.backup}`)}  `;
+      const top = c.bg('attach')(fit(left, cols - width(right)) + right);
+
+      const body = [];
+      body.push(c.m(`gitroots · connected through relay ${store.org.relay.name} · this is the agent's own session, streamed live`));
+      body.push(c.m('gitroots · other viewers: none · controls: you'));
+      body.push('');
+      const hidden = store.d.hiddenTurns?.[s.id];
+      if (hidden) { const t = `── earlier · ${hidden} turns hidden · press `; body.push(`${c.m(t)}${c.bg('key')(c.b(' ctrl-g h '))} ${c.m(`for history ${'─'.repeat(Math.max(0, cols - width(t) - 30))}`)}`); body.push(''); }
+
+      const fmt = (text) => text.replace(/§([^§]*)§/g, (_, x) => c.s(x)).replace(/\*([^*]+)\*/g, (_, x) => c.b(x));
+      const tr = store.transcript(s.id);
+      if (!tr.length) {
+        for (const e of liveLog(s, Math.floor(st.tick / 16), 8)) body.push(`${c.m(e.time)}  ${pad(e.verb, 8)}${e.body}${e.add ? c.g(e.add) : ''}${e.del ? c.r(e.del) : ''}${e.fail ? c.r(e.fail) : ''}${e.last && e.running ? `  ${c.i(spin)}` : ''}`);
+        body.push('');
+      }
+      for (const [ti, t] of tr.entries()) {
+        if (t.who === 'log') {
+          body.push(`${' '.repeat(8)}${c.m(t.time)}  ${c.i(pad(t.verb, 8))}${t.body}${t.add ? c.g(t.add) : ''}${st.running === t ? `  ${c.i(spin)} ${c.s('running')}` : ''}`);
+          if (tr[ti + 1] && tr[ti + 1].who !== 'log') body.push('');
+          continue;
+        }
+        const lines = t.text.split('\n');
+        const who = t.who === 'you' ? c.i(c.b(pad('you', 8))) : c.g(c.b(pad('agent', 8)));
+        lines.forEach((l, i) => body.push(`${i === 0 ? who : ' '.repeat(8)}${fmt(l)}`));
+        body.push('');
+      }
+      if (s.ask && !st.busy) {
+        body.push(`${c.w(c.b(`  ◐ Approval needed`))}  ${s.ask.question}`);
+        s.ask.options.forEach((o, i) => body.push(i === st.choice ? `    ${c.g(`❯ ${i + 1}. ${o}`)}` : `      ${i + 1}. ${o}`));
+        body.push('');
+      }
+
+      const BH = rows - 4;
+      const view = body.slice(-BH);
+      while (view.length < BH) view.push('');
+      const sep = c.m('─'.repeat(cols - 2));
+      const cursor = c.bg('green')(c.ink(' '));
+      const prompt = `${c.g('❯')} ${st.input}${cursor}${st.prefix ? `   ${c.w('ctrl-g …')}` : ''}`;
+
+      let bottom;
+      if (st.mode && st.mode.type === 'transfer') {
+        const md = st.mode;
+        bottom = `  ${c.s(`transfer ${s.id} to`)}  ${md.targets.map((t, i) => (i === md.idx ? c.bg('sel')(c.b(` ❯ ${t.name} `)) : c.m(`  ${t.name} `))).join(' ')}   ${c.m('←→ choose · enter go · esc cancel')}`;
+      } else {
+        const k = (key, label) => `${c.bg('key')(c.b(` ${key} `))} ${label}`;
+        const keys = `  ${[k('ctrl-g d', 'detach, keep running'), k('ctrl-g b', 'backup now'), k('ctrl-g t', 'transfer'), k('ctrl-g f', 'fork'), k('ctrl-g s', 'share read-only')].join('  ')}`;
+        const hint = c.m('prefix ctrl-g · everything else goes to the agent  ');
+        bottom = `${fit(keys, Math.max(0, cols - width(hint)))}${hint}`;
+      }
+      if (st.flash && Date.now() < st.flash.until) {
+        const msg = c[st.flash.tone](st.flash.msg);
+        bottom = `${fit(bottom, Math.max(0, cols - width(msg) - 4))}  ${msg}  `;
+      }
+      const frame = [top, ...view.map((l) => ` ${fit(l, cols - 2)}`), ` ${sep}`, ` ${prompt}`, c.bg('bar')(fit(bottom, cols))];
+      paintFrame(frame.slice(0, rows));
+    };
+
+    const tickDraw = () => { st.tick++; draw(); };
+    const onData = (buf) => { (async () => { for (const k of parseKeys(buf)) await onKey(k); draw(); })(); };
+
+    enterFullscreen();
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.on('data', onData);
+    process.stdout.on('resize', draw);
+    let timer = setInterval(tickDraw, 100);
+    draw();
+  });
+}

package/src/commands/audit.js

@@ -0,0 +1,150 @@
+// gitroots audit · audit <ev-id> · audit follow
+import { c, h, pad, fit, state as colorState } from '../ui/ansi.js';
+import { line, write, motion, sleep } from '../ui/term.js';
+import { dot, decision, json, csv, next } from '../ui/components.js';
+import { FOLLOW_POOL } from '../data/sample.js';
+import { apiAudit } from '../connected.js';
+
+export async function run(_cmd, rest, flags, store) {
+  const [sub] = rest;
+  if (sub === 'follow' || flags.follow) return follow(flags, store);
+  if (sub && /^ev-\d+$/.test(sub)) return detail(sub, flags, store);
+  if (sub) throw new Error(`unknown: gitroots audit ${sub} · try gitroots audit, audit <ev-id>, audit follow`);
+  return list(flags, store);
+}
+
+function sinceMinutes(s) {
+  const m = /^(\d+)\s*(m|h|d)$/.exec(String(s));
+  if (!m) throw new Error(`--since takes 30m, 2h or 1d (got ${s})`);
+  return Number(m[1]) * { m: 1, h: 60, d: 1440 }[m[2]];
+}
+
+async function list(flags, store) {
+  let ev = store.api ? await apiAudit(store) : [...store.audit()];
+  if (flags.repo) ev = ev.filter((e) => e.repo === flags.repo);
+  if (flags.actor) ev = ev.filter((e) => e.actor === flags.actor);
+  if (flags.action) ev = ev.filter((e) => e.action === flags.action);
+  if (flags.decision) ev = ev.filter((e) => e.decision === flags.decision);
+  if (flags.pr) ev = ev.filter((e) => String(e.pr) === String(flags.pr).replace('#', ''));
+  if (flags.since) {
+    const mins = sinceMinutes(flags.since);
+    ev = ev.filter((e) => {
+      if (e.at) return (Date.now() - Date.parse(e.at)) / 60000 <= mins;
+      // sample events carry only a clock time, as seen from the sample's 14:21
+      const [hh, mm] = e.time.split(':').map(Number);
+      return 14 * 60 + 21 - (hh * 60 + mm) <= mins;
+    });
+  }
+  ev.sort((a, b) => (b.at || '').localeCompare(a.at || '') || b.time.localeCompare(a.time) || b.id.localeCompare(a.id));
+  const total = ev.length;
+  if (flags.json) { json(ev); return 0; }
+  if (flags.csv) { csv(ev, ['id', 'time', 'at', 'actor', 'action', 'target', 'decision', 'note', 'repo', 'pr']); return 0; }
+  const limit = flags.all ? ev.length : Number(flags.limit || 7);
+  const shown = ev.slice(0, limit);
+  line(`  ${h(`${pad('TIME', 8)}${pad('ACTOR', 13)}${pad('ACTION', 16)}${pad('TARGET', 40)}${pad('DECISION', 35)}ID`)}`);
+  for (const e of shown) {
+    line(`  ${c.m(pad(e.time, 8))}${fit(e.actor, 12)} ${fit(e.action, 15)} ${fit(e.target, 39)} ${pad(decision(e.decision), 12)}${c.m(pad(e.note || '', 23))}${c.m(e.id)}`);
+  }
+  if (!shown.length) line(c.m('  no events match'));
+  line(`    ${c.m(`${shown.length} of ${total} events · --actor · --action · --decision blocked · --json · --csv for compliance exports`)}`);
+  const blocked = shown.find((e) => e.decision === 'blocked');
+  line();
+  line(next(blocked ? `gitroots audit ${blocked.id}` : 'gitroots audit follow'));
+  return 0;
+}
+
+async function detail(id, flags, store) {
+  let e;
+  if (store.api) {
+    e = (await apiAudit(store)).find((x) => x.id === id);
+    if (!e) throw new Error(`no audit event ${id}`);
+  } else e = store.event(id);
+  if (flags.json) { json(e); return 0; }
+  line(`  ${c.b(e.id)}   ${decision(e.decision)}   ${c.m(`${e.time}${e.at ? ` · ${e.at}` : ''}`)}`);
+  line();
+  const row = (k, v) => v && line(`    ${c.s(pad(k, 10))}${v}`);
+  row('actor', e.actor);
+  row('action', e.action);
+  row('repo', e.repo);
+  row('target', e.target);
+  row('rule', e.rule);
+  if (e.note !== e.rule) row('note', e.note);
+  if (e.pr) row('pr', `#${e.pr}`);
+  if (e.metadata && Object.keys(e.metadata).length) row('metadata', c.m(JSON.stringify(e.metadata)));
+  line();
+  if (e.decision === 'blocked' && e.action === 'push') {
+    line(`    ${c.m('nothing left the machine · the attempt is kept for review')}`);
+    if (!e.ack && !store.api) { e.ack = true; store.save(); }
+    line();
+    line(next(e.repo ? `gitroots branch rules ${e.repo} ${e.target.split(' · ')[0]}` : 'gitroots audit'));
+  } else if (e.pr) line(next(`gitroots pr view ${e.pr}`));
+  else line(next('gitroots audit'));
+  return 0;
+}
+
+function hms(d) { return d.toTimeString().slice(0, 8); }
+
+// Signed in: poll the API and print events as they arrive.
+async function followApi(flags, store) {
+  if (!flags.json) {
+    line(`${c.g('● live')}  ${c.s(`${store.org.name} · ${store.api.server}`)} ${dot()} ${c.m('ctrl-c to stop')}`);
+    line();
+  }
+  let stop = false;
+  process.on('SIGINT', () => { stop = true; });
+  const seen = new Set((await apiAudit(store)).map((e) => e.id));
+  const every = Number(flags.interval || 3) * 1000;
+  let shown = 0;
+  while (!stop) {
+    const t0 = Date.now();
+    while (!stop && Date.now() - t0 < every) await sleep(100);
+    if (stop) break;
+    let events;
+    try { events = await apiAudit(store); } catch (e) { if (!flags.json) line(c.w(`◐ ${e.message} · retrying`)); continue; }
+    const fresh = events.filter((e) => !seen.has(e.id)).sort((a, b) => a.at.localeCompare(b.at));
+    for (const e of fresh) {
+      seen.add(e.id);
+      shown++;
+      if (flags.json) process.stdout.write(`${JSON.stringify(e)}\n`);
+      else line(`${c.m(new Date(e.at).toTimeString().slice(0, 8))}   ${pad(e.actor, 13)}${pad(e.action, 16)}${pad(e.target, 40)}${pad(decision(e.decision), 11)}  ${c.m(e.note || '')}`);
+    }
+  }
+  if (!flags.json) { line(); line(c.m(`  stopped · ${shown} new events`)); }
+  return 0;
+}
+
+async function follow(flags, store) {
+  if (store.api) return followApi(flags, store);
+  const anim = motion();
+  if (!flags.json) {
+    line(`${c.g('● live')}  ${c.s('all repos · all actors')} ${dot()} ${c.m('ctrl-c to stop')}`);
+    line();
+  }
+  let i = 0;
+  let stop = false;
+  process.on('SIGINT', () => { stop = true; });
+  const max = flags.count ? Number(flags.count) : anim ? Infinity : 10;
+  while (!stop && i < max) {
+    const e = FOLLOW_POOL[i % FOLLOW_POOL.length];
+    // sample stream: shown live, not written to your audit log
+    const ev = { id: `ev-${store.d.counters.ev + i}`, at: new Date().toISOString(), time: hms(new Date()), ...e, sample: true };
+    if (flags.json) process.stdout.write(`${JSON.stringify(ev)}\n`);
+    else {
+      const row = `${c.m(hms(new Date()))}   ${pad(e.actor, 13)}${pad(e.action, 16)}${pad(e.target, 40)}${pad(decision(e.decision), 11)}  ${c.m(e.note || '')}`;
+      if (anim && colorState.color) {
+        // new rows flash with a soft green background, then settle
+        write(`${c.bg('attach')(row)}\n`);
+        await sleep(450);
+        write(`\x1b[1A\r\x1b[2K${row}\n`);
+      } else line(row);
+    }
+    i++;
+    if (anim) {
+      const wait = 1400 + Math.random() * 1800;
+      const t0 = Date.now();
+      while (!stop && Date.now() - t0 < wait) await sleep(100);
+    }
+  }
+  if (!flags.json) { line(); line(c.m(`  stopped · ${i} events`)); }
+  return 0;
+}

package/src/commands/auth.js

@@ -0,0 +1,99 @@
+// gitroots login · logout · whoami
+import fs from 'node:fs';
+import { c, pad } from '../ui/ansi.js';
+import { line, ask, select, interactive, spinner } from '../ui/term.js';
+import { brand, dot, json, next } from '../ui/components.js';
+import { Api, DEFAULT_SERVER, readConfig, writeConfig, savePassword, forgetPassword } from '../api.js';
+
+export async function run(cmd, rest, flags) {
+  if (cmd === 'logout') return logout(flags);
+  if (cmd === 'whoami') return whoami(flags);
+  return login(flags);
+}
+
+async function login(flags) {
+  const prev = readConfig();
+  const server = String(flags.server || prev.server || DEFAULT_SERVER).replace(/\/+$/, '');
+  const username = flags.username || flags.u || (interactive() ? await ask('Username or email', { def: prev.username }) : null);
+  if (!username) throw new Error('pass --username');
+  let password;
+  if (flags['password-stdin']) password = fs.readFileSync(0, 'utf8').replace(/\r?\n$/, '');
+  else if (process.env.GITROOTS_PASSWORD) password = process.env.GITROOTS_PASSWORD;
+  else password = await ask('Password', { hidden: true });
+  if (!password) throw new Error('no password given');
+
+  const api = new Api({ server, username, password });
+  const sp = spinner((f) => `${c.i(f)} ${c.s(`Signing in to ${server}…`)}`);
+  let me;
+  let orgs;
+  let memberships;
+  try {
+    me = await api.me();
+    [orgs, memberships] = await Promise.all([api.orgs(), api.memberships().catch(() => [])]);
+  } catch (e) {
+    sp.stop(`${c.r('✕')} ${e.message}`);
+    return 1;
+  }
+  sp.stop();
+  if (!me) { line(`${c.r('✕')} signed in, but the API did not return a user named ${username}`); return 1; }
+
+  const mine = memberships.filter((m) => m.user === me.id && m.is_active !== false);
+  const roleOf = (o) => (mine.find((m) => m.organization === o.id) || {}).role || (me.is_staff ? 'staff' : 'member');
+  let org = null;
+  if (flags.org) org = orgs.find((o) => o.slug === flags.org || o.name === flags.org || String(o.id) === String(flags.org));
+  else if (orgs.length === 1) org = orgs[0];
+  else if (orgs.length > 1) {
+    if (!interactive()) org = orgs[0];
+    else {
+      line(`${c.i(c.b('?'))} Which organisation?`);
+      const res = await select({
+        count: orgs.length,
+        render: (idx) => orgs.map((o, i) => `${i === idx ? c.g('❯') : ' '} ${pad(o.name, 30)}${c.m(`${o.slug} · ${roleOf(o)}`)}`).join('\n'),
+      });
+      if (res.action === 'cancel') return 1;
+      org = orgs[res.index];
+    }
+  }
+
+  const store = savePassword(server, username, password);
+  writeConfig({
+    server, username, userId: me.id, email: me.email,
+    org: org ? { id: org.id, name: org.name, slug: org.slug, role: roleOf(org), plan: org.subscription_plan } : null,
+    signedInAt: new Date().toISOString(),
+  });
+  if (flags.json) { json({ server, user: me.username, org: org?.slug || null, credentials: store }); return 0; }
+  line(`${c.g('✓')} Signed in as ${c.b(me.username)}  ${c.m(`${server}${org ? ` · org ${org.name} · ${roleOf(org)}` : ' · no organisation yet'}`)}`);
+  line(`  ${c.m(`password kept in ${store === 'keychain' ? 'the macOS Keychain' : 'credentials.json (mode 600)'}`)}`);
+  line(next('gitroots status'));
+  return 0;
+}
+
+function logout(flags) {
+  const cfg = readConfig();
+  if (!cfg.username) { line(c.m('○ not signed in')); return 0; }
+  forgetPassword(cfg.server, cfg.username);
+  writeConfig({ server: cfg.server });
+  if (flags.json) { json({ signedOut: cfg.username }); return 0; }
+  line(`${c.g('✓')} Signed out ${c.b(cfg.username)} ${c.m(`· ${cfg.server}`)}`);
+  return 0;
+}
+
+async function whoami(flags) {
+  const cfg = readConfig();
+  const api = Api.fromConfig();
+  if (!api) {
+    if (flags.json) { json({ signedIn: false }); return 1; }
+    line(`${c.m('○ not signed in')} ${dot()} sample org in use`);
+    line(next('gitroots login'));
+    return 1;
+  }
+  let me = null;
+  let err = null;
+  try { me = await api.me(); } catch (e) { err = e.message; }
+  if (flags.json) { json({ signedIn: Boolean(me), server: cfg.server, user: me, org: cfg.org, error: err }); return me ? 0 : 1; }
+  if (!me) { line(`${c.r('✕')} ${err || 'user not found'}`); return 1; }
+  line(`${brand()} ${dot()} ${c.b(me.username)} ${c.m(`<${me.email}>`)}${me.is_staff ? c.m(' · staff') : ''}`);
+  line(`  ${c.s(pad('server', 8))}${cfg.server}`);
+  line(`  ${c.s(pad('org', 8))}${cfg.org ? `${cfg.org.name} ${c.m(`(${cfg.org.slug} · ${cfg.org.role}${cfg.org.plan ? ` · ${cfg.org.plan}` : ''})`)}` : c.m('none')}`);
+  return 0;
+}

package/src/commands/backup.js

@@ -0,0 +1,106 @@
+// gitroots backup <session> · backups · backup policy
+import { c, h, pad } from '../ui/ansi.js';
+import { line, runSteps } from '../ui/term.js';
+import { dot, json, next } from '../ui/components.js';
+
+export async function run(cmd, rest, flags, store) {
+  if (cmd === 'backups' || rest[0] === 'list' || rest[0] === 'ls') return list(flags, store);
+  if (rest[0] === 'policy' && rest[1] === 'set') return policySet(flags, store);
+  if (rest[0] === 'policy') return policy(flags, store);
+  const id = rest[0];
+  if (!id) throw new Error('which session? gitroots backup <session> [--label "…"]');
+  const s = store.session(id);
+  if (flags.json) { const b = createBackup(store, s, flags.label); store.save(); json(b); return 0; }
+  const b = await backupWithSteps(store, s, flags.label || 'manual');
+  line(`    ${next(`gitroots restore ${b.id}`)}`);
+  return 0;
+}
+
+export function createBackup(store, s, label = 'manual') {
+  const sizeMb = Math.round((0.3 + s.turns * 0.0135 + s.changed * 0.05) * 10) / 10;
+  const b = {
+    id: store.nextBackupId(), session: s.id, agent: s.agent, machine: s.machine, label, turn: s.turns, sizeMb,
+    created: 'just now', at: new Date().toISOString(), head: s.head, files: s.changed, prompt: s.lastPrompt || '', repo: s.repo,
+  };
+  store.d.backups.push(b);
+  s.backup = 'just now';
+  return b;
+}
+
+export async function backupWithSteps(store, s, label, { indent = '  ' } = {}) {
+  const convoMb = Math.round(s.turns * 0.0127 * 10) / 10;
+  let b;
+  await runSteps([
+    { name: 'Conversation', live: `reading ${s.turns} turns…`, ms: 500, ok: `${s.turns} turns · ${convoMb} MB` },
+    { name: 'Workspace', live: 'git stash · diff · untracked files…', ms: 700, ok: `HEAD ${s.head} · ${s.changed} file${s.changed === 1 ? '' : 's'} changed${s.stash ? ` · ${s.stash} stash` : ''}` },
+    { name: 'Environment', live: 'sealing secrets…', ms: 300, ok: '12 vars · 2 secrets sealed' },
+  ], { nameWidth: 15, indent });
+  b = createBackup(store, s, label);
+  store.record({ actor: store.org.user, action: 'backup', target: `${s.id} · ${b.id}`, decision: 'allowed', note: label, repo: s.repo });
+  store.save();
+  const pol = store.d.backupPolicy;
+  line(`${indent}${c.g('✓')} Backup ${c.b(b.id)} saved   ${c.m(`${b.sizeMb} MB · encrypted · ${pol.storage}, ${pol.region}`)}`);
+  return b;
+}
+
+function list(flags, store) {
+  let rows = [...store.backups()];
+  if (flags.repo) rows = rows.filter((b) => b.repo === flags.repo);
+  if (flags.session) rows = rows.filter((b) => b.session === flags.session);
+  rows.sort((a, b) => b.id.localeCompare(a.id));
+  if (flags.json) { json(rows); return 0; }
+  const shown = flags.all ? rows : rows.slice(0, 7);
+  line(`  ${h(`${pad('ID', 9)}${pad('SESSION', 10)}${pad('AGENT', 14)}${pad('MACHINE', 13)}${pad('LABEL', 22)}${pad('TURN', 8)}${pad('SIZE', 10)}CREATED`)}`);
+  for (const b of shown) {
+    const fresh = b.created === 'just now';
+    line(`  ${fresh ? c.b(pad(b.id, 9)) : pad(b.id, 9)}${pad(b.session, 10)}${pad(b.agent, 14)}${pad(b.machine, 13)}${pad(b.label, 22)}${pad(String(b.turn), 8)}${pad(`${b.sizeMb} MB`, 10)}${fresh ? c.g(b.created) : c.m(b.created)}`);
+  }
+  line();
+  line(`  ${c.m(`${shown.length} of ${rows.length} backups${rows.length > shown.length ? ' · gitroots backups --all for more' : ''}`)}`);
+  line();
+  policy({}, store, true);
+  return 0;
+}
+
+function policy(flags, store, embedded = false) {
+  const p = store.d.backupPolicy;
+  if (flags.json) { json(p); return 0; }
+  const on = (v) => (v ? c.g('on') : c.m('off'));
+  line(`${h('Policy')}  ${c.m('(gitroots backup policy)')}`);
+  line(`  ${pad('every', 13)}${pad(p.every, 34)}${pad('before risky commands', 24)}${on(p.beforeRisky)}`);
+  line(`  ${pad('every turn', 13)}${pad(p.everyTurn ? c.g('on') : c.m('off'), 34)}${pad('before transfer', 24)}${on(p.beforeTransfer)}`);
+  line(`  ${pad('keep', 13)}${pad(p.keep, 34)}${pad('storage', 24)}${p.storage}${p.storage === 'gitroots cloud' ? ` ${dot()} ${c.m('or --store s3://your-bucket')}` : ''}`);
+  if (!embedded) { line(); line(next('gitroots backups')); }
+  return 0;
+}
+
+// gitroots backup policy set --every 10m --every-turn on --before-risky on --before-transfer on --keep "30 days" --store s3://bucket
+function policySet(flags, store) {
+  const p = store.d.backupPolicy;
+  const onoff = (v, name) => {
+    if (v === true || v === 'on' || v === 'true' || v === 'yes') return true;
+    if (v === false || v === 'off' || v === 'false' || v === 'no') return false;
+    throw new Error(`--${name} takes on or off`);
+  };
+  const changed = [];
+  if (flags.every !== undefined) {
+    const m = /^(\d+)\s*(m|min|h)$/.exec(String(flags.every));
+    if (!m) throw new Error('--every takes a time like 10m or 1h');
+    p.every = `${m[1]} ${m[2] === 'h' ? 'h' : 'min'} while running`; changed.push('every');
+  }
+  if (flags['every-turn'] !== undefined) { p.everyTurn = onoff(flags['every-turn'], 'every-turn'); changed.push('every turn'); }
+  if (flags['before-risky'] !== undefined) { p.beforeRisky = onoff(flags['before-risky'], 'before-risky'); changed.push('before risky commands'); }
+  if (flags['before-transfer'] !== undefined) { p.beforeTransfer = onoff(flags['before-transfer'], 'before-transfer'); changed.push('before transfer'); }
+  if (flags.keep !== undefined) { p.keep = String(flags.keep); changed.push('keep'); }
+  if (flags.store !== undefined) {
+    if (!/^(s3|gs|az):\/\/[^/]+/.test(flags.store) && flags.store !== 'gitroots') throw new Error('--store takes gitroots or s3://bucket, gs://bucket, az://container');
+    p.storage = flags.store === 'gitroots' ? 'gitroots cloud' : flags.store; changed.push('storage');
+  }
+  if (!changed.length) throw new Error('nothing to change · --every, --every-turn, --before-risky, --before-transfer, --keep, --store');
+  store.record({ actor: store.org.user, action: 'backup policy', target: changed.join(', '), decision: 'allowed' });
+  store.save();
+  if (flags.json) { json(p); return 0; }
+  line(`  ${c.g('✓')} Backup policy updated ${c.m(`· ${changed.join(', ')}`)}`);
+  line();
+  return policy({}, store);
+}