hostwares-cli 2.4.1

package/dist/index.js

@@ -0,0 +1,199 @@
+#!/usr/bin/env node
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+import { dirname, join } from "path";
+import { setVersion } from "./agent/run.js";
+import { reportError } from "./errors.js";
+import { login } from "./auth/device.js";
+import { startChat } from "./commands/chat.js";
+import { getConfig, saveConfig, clearConfig, isAuthenticated } from "./config.js";
+import { listSessions } from "./session/store.js";
+import { c, glyph, BANNER_LINES } from "./ui/theme.js";
+import * as ui from "./ui/render.js";
+import { isAborted } from "@hostwares/agent-client";
+/**
+ * Entry point.
+ *
+ * Argument parsing is hand-rolled rather than pulled from commander. The old
+ * CLI depended on commander purely to register a dozen subcommands that each
+ * did `chat("Deploy a site named ...")` - they were natural-language prompts
+ * wearing a subcommand costume, and the dependency bought nothing. What is left
+ * here is either a real API call or a thin wrapper that says what it forwards.
+ */
+const VERSION = readVersion();
+setVersion(VERSION);
+async function main(argv) {
+    const [cmd, ...rest] = argv;
+    switch (cmd) {
+        case undefined:
+            return interactive();
+        case "chat":
+            requireAuth();
+            return startChat({ resume: rest.includes("--resume") || rest.includes("-r") });
+        case "ask": {
+            requireAuth();
+            const message = rest.filter(a => !a.startsWith("-")).join(" ");
+            if (!message)
+                return startChat({});
+            return startChat({ oneShot: message });
+        }
+        case "login":
+            // --token skips the browser flow for CI and scripted installs.
+            if (rest[0] === "--token" && rest[1]) {
+                saveConfig({ apiKey: rest[1] });
+                ui.success("Signed in with the supplied token.");
+                return 0;
+            }
+            return (await login({ noBrowser: rest.includes("--no-browser") })) ? 0 : 1;
+        case "logout":
+            clearConfig();
+            ui.success("Signed out on this machine.");
+            return 0;
+        case "sessions":
+            return showSessions();
+        case "list":
+        case "ls":
+            requireAuth();
+            return listSites();
+        case "version":
+        case "--version":
+        case "-v":
+            console.log(VERSION);
+            return 0;
+        case "help":
+        case "--help":
+        case "-h":
+            showHelp();
+            return 0;
+        default:
+            // An unrecognised first word is far more likely to be a question than a
+            // typo'd command, so it is forwarded rather than rejected. `hw why is my
+            // site down` should work.
+            requireAuth();
+            return startChat({ oneShot: argv.join(" ") });
+    }
+}
+function interactive() {
+    showBanner();
+    if (!isAuthenticated()) {
+        ui.line(`  Run ${c.bold("hw login")} to get started.`);
+        ui.line();
+        return Promise.resolve(0);
+    }
+    return startChat({});
+}
+function requireAuth() {
+    if (isAuthenticated())
+        return;
+    ui.error("Not signed in.");
+    ui.note("Run `hw login` first.");
+    process.exit(1);
+}
+function showBanner() {
+    const tag = [
+        `  ${c.bold("Hostwares")} ${c.dim(`v${VERSION}`)}`,
+        `  ${c.dim("AI DevOps in your terminal")}`,
+        "",
+        isAuthenticated()
+            ? `  ${c.green(glyph.tick)} ${c.dim("Signed in")}`
+            : `  ${c.dim(`${glyph.arrow} Not signed in`)}`,
+    ];
+    ui.line();
+    BANNER_LINES.forEach((art, i) => ui.line(`  ${c.green(art)}${tag[i] ?? ""}`));
+    ui.line();
+    ui.line(c.dim(`  Ask anything. ${c.bold("/help")} for commands, ${c.bold("!cmd")} for a shell command.`));
+    ui.line();
+}
+function showHelp() {
+    ui.line();
+    ui.line(`  ${c.bold("hw")} ${c.dim("— AI DevOps in your terminal")}`);
+    ui.line();
+    const rows = [
+        ["hw", "Start an interactive session"],
+        ["hw ask \"...\"", "Ask one question and exit"],
+        ["hw chat --resume", "Continue this folder's last conversation"],
+        ["hw list", "List your deployments"],
+        ["hw sessions", "Sessions saved on this machine"],
+        ["hw login", "Sign in (--token <key> for CI)"],
+        ["hw logout", "Sign out on this machine"],
+        ["hw version", "Print the version"],
+    ];
+    for (const [name, help] of rows)
+        ui.line(`  ${c.green(name.padEnd(20))} ${c.dim(help)}`);
+    ui.line();
+    ui.line(c.dim("  Anything else is treated as a question: hw why is my deploy failing"));
+    ui.line();
+}
+function showSessions() {
+    const sessions = listSessions();
+    if (!sessions.length) {
+        ui.line(c.dim("  No saved sessions yet."));
+        return 0;
+    }
+    ui.line();
+    for (const s of sessions.slice(0, 25)) {
+        const here = s.cwd === process.cwd() ? c.green(`  ${glyph.tick} here`) : "";
+        ui.line(`  ${s.cwd}${here}`);
+        ui.line(c.dim(`    ${s.turnCount} turns · ${s.creditsSpent.toFixed(2)} credits`));
+    }
+    ui.line();
+    return 0;
+}
+/**
+ * A real API call, not a prompt in disguise.
+ *
+ * The sidebar calls these "Deployments" while the model and the route are still
+ * "sites"; the user-facing word follows the product.
+ */
+async function listSites() {
+    try {
+        const cfg = getConfig();
+        const r = await fetch(`${cfg.baseUrl}/api/sites`, { headers: { Authorization: `Bearer ${cfg.apiKey}` } });
+        if (!r.ok) {
+            ui.error(r.status === 401 ? "Not signed in. Run `hw login`." : `Could not list deployments (HTTP ${r.status}).`);
+            return 1;
+        }
+        const res = await r.json();
+        const sites = Array.isArray(res) ? res : (res?.sites ?? []);
+        if (!sites.length) {
+            ui.line(c.dim("  No deployments yet. Ask me to deploy something to get started."));
+            return 0;
+        }
+        ui.line();
+        for (const s of sites) {
+            const dot = s.status === "RUNNING" ? c.green("●")
+                : s.status === "FAILED" ? c.red("●")
+                    : c.yellow("●");
+            ui.line(`  ${dot} ${c.bold((s.name ?? "unnamed").padEnd(24))} ${c.dim(s.domain ?? s.status ?? "")}`);
+        }
+        ui.line();
+        return 0;
+    }
+    catch (e) {
+        reportError(e);
+        return 1;
+    }
+}
+function readVersion() {
+    // Read from package.json rather than a literal. The banner used to hardcode
+    // "v1.1.0" beside a --version that read the manifest, so the two drifted the
+    // moment either changed - a bug that had already been fixed once for
+    // --version alone.
+    try {
+        const here = dirname(fileURLToPath(import.meta.url));
+        const pkg = JSON.parse(readFileSync(join(here, "..", "package.json"), "utf8"));
+        return pkg.version ?? "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+main(process.argv.slice(2))
+    .then(code => process.exit(code))
+    .catch(e => {
+    // Ctrl-C during startup is a normal exit, not a crash to report.
+    if (isAborted(e))
+        process.exit(130);
+    reportError(e);
+    process.exit(1);
+});

package/dist/session/store.js

@@ -0,0 +1,144 @@
+import { createHash } from "crypto";
+import { join } from "path";
+import { existsSync, readFileSync, readdirSync, unlinkSync, mkdirSync } from "fs";
+import { HW_DIR, writeJsonSecure } from "../config.js";
+/**
+ * Per-project session state: which server conversation this directory is
+ * talking to, and a local record of the exchange.
+ *
+ * The bug this replaces was severe and silent. The old filename was:
+ *
+ *     Buffer.from(cwd).toString("base64url").slice(0, 20)
+ *
+ * described in a comment as "hash the cwd". It is not a hash - it is base64 of
+ * the path truncated to 20 characters, which is the first FIFTEEN BYTES of the
+ * absolute path. Every directory under `/Users/<name>/` encodes to the same
+ * filename. Verified on the reporting machine: one session file existed for
+ * every project, its stored `cwd` was `/Users/<name>`, and each project
+ * silently inherited and then overwrote the previous one's conversation.
+ * `loadSession` never compared the stored cwd to the actual one, so nothing
+ * ever surfaced the mismatch.
+ *
+ * Now: sha256 of the path, and the stored cwd is verified on load.
+ */
+const SESSION_DIR = join(HW_DIR, "sessions");
+/** Bumped when the on-disk shape changes; older files are ignored, not crashed on. */
+const SCHEMA_VERSION = 2;
+function sessionPath(cwd) {
+    const hash = createHash("sha256").update(cwd).digest("hex").slice(0, 24);
+    return join(SESSION_DIR, `${hash}.json`);
+}
+export function newSession(cwd = process.cwd()) {
+    const now = new Date().toISOString();
+    return {
+        version: SCHEMA_VERSION,
+        cwd,
+        conversationId: null,
+        createdAt: now,
+        updatedAt: now,
+        turns: [],
+        creditsSpent: 0,
+    };
+}
+/**
+ * Load this directory's session, or null.
+ *
+ * Returns null rather than throwing for every failure mode - a corrupt or
+ * foreign session file must degrade to "start fresh", never to a crash on
+ * startup.
+ *
+ * Note what is NOT here: the old loader scanned past assistant messages for the
+ * substrings "can't access your local", "outside my scope" and "out of scope",
+ * and silently DELETED the entire session if it found any, printing
+ * "↻ Fresh session (cleared stale context)". It was a workaround for a model
+ * that used to refuse local access; the model no longer does. It also fired on
+ * any legitimate discussion of those phrases, and it destroyed history with no
+ * backup - which is a large part of why the CLI appeared to remember nothing.
+ */
+export function loadSession(cwd = process.cwd()) {
+    const file = sessionPath(cwd);
+    if (!existsSync(file))
+        return null;
+    try {
+        const data = JSON.parse(readFileSync(file, "utf8"));
+        if (data.version !== SCHEMA_VERSION)
+            return null;
+        // The guard the old code lacked. With a correct hash this should never
+        // fire, but a stale file from a renamed directory would otherwise resume
+        // someone else's conversation into this project.
+        if (data.cwd !== cwd)
+            return null;
+        if (!Array.isArray(data.turns))
+            return null;
+        return {
+            version: SCHEMA_VERSION,
+            cwd,
+            conversationId: typeof data.conversationId === "string" ? data.conversationId : null,
+            createdAt: data.createdAt ?? new Date().toISOString(),
+            updatedAt: data.updatedAt ?? new Date().toISOString(),
+            turns: data.turns.filter(isTurn),
+            creditsSpent: typeof data.creditsSpent === "number" ? data.creditsSpent : 0,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function isTurn(t) {
+    return Boolean(t) && typeof t === "object"
+        && typeof t.content === "string"
+        && (t.role === "user" || t.role === "assistant");
+}
+/** How many turns to keep locally. The server holds the authoritative transcript. */
+const MAX_LOCAL_TURNS = 200;
+export function saveSession(session) {
+    mkdirSync(SESSION_DIR, { recursive: true, mode: 0o700 });
+    session.updatedAt = new Date().toISOString();
+    if (session.turns.length > MAX_LOCAL_TURNS) {
+        session.turns = session.turns.slice(-MAX_LOCAL_TURNS);
+    }
+    // Atomic + 0600: session files carry conversation text, and a half-written
+    // one loses the session.
+    writeJsonSecure(sessionPath(session.cwd), session);
+}
+/**
+ * Append a turn.
+ *
+ * The timestamp is set HERE, once, when the turn is recorded. The old
+ * autoSave() rewrote every entry with `new Date().toISOString()` on every save,
+ * so the whole history collapsed to the time of the last write and the record
+ * of when anything happened was destroyed.
+ */
+export function appendTurn(session, role, content) {
+    session.turns.push({ role, content, at: new Date().toISOString() });
+}
+export function deleteSession(cwd = process.cwd()) {
+    try {
+        unlinkSync(sessionPath(cwd));
+    }
+    catch { /* already gone */ }
+}
+/** Every session on this machine, newest first. Powers `hw sessions`. */
+export function listSessions() {
+    if (!existsSync(SESSION_DIR))
+        return [];
+    const out = [];
+    for (const name of readdirSync(SESSION_DIR)) {
+        if (!name.endsWith(".json"))
+            continue;
+        try {
+            const data = JSON.parse(readFileSync(join(SESSION_DIR, name), "utf8"));
+            if (data.version !== SCHEMA_VERSION || !data.cwd)
+                continue;
+            out.push({
+                cwd: data.cwd,
+                conversationId: data.conversationId ?? null,
+                updatedAt: data.updatedAt,
+                turnCount: Array.isArray(data.turns) ? data.turns.length : 0,
+                creditsSpent: data.creditsSpent ?? 0,
+            });
+        }
+        catch { /* skip unreadable */ }
+    }
+    return out.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
+}

package/dist/ui/input.js

@@ -0,0 +1,242 @@
+import { createInterface } from "readline";
+import { c } from "./theme.js";
+/**
+ * Single owner of stdin.
+ *
+ * This module exists because of one bug and a family of bugs behind it. The
+ * permission prompt used to read a keypress like this:
+ *
+ *     stdin.setRawMode(true);
+ *     stdin.once("data", d => { ... process.stdout.write(ch + "\n"); });
+ *
+ * while the REPL's readline interface was STILL attached to stdin and still in
+ * terminal mode. Both received the keypress, so both echoed it: pressing `y`
+ * once printed `yy`. A commit went in claiming to fix that; it stopped
+ * multi-character answers echoing but never detached readline, so the bug
+ * survived in the shipped build. Any leftover keystroke also stayed in
+ * readline's line buffer and was submitted as the user's NEXT message.
+ *
+ * The fix is not more careful escape handling - it is having exactly one reader
+ * at a time. `question()` and `readKey()` both go through `withExclusiveStdin`,
+ * which pauses the REPL interface, does its work, and resumes it. Nothing else
+ * in the codebase is allowed to touch `process.stdin`.
+ */
+let repl = null;
+/** Serialises overlapping reads so two prompts can never race for stdin. */
+let queue = Promise.resolve();
+export function createReplInterface(prompt) {
+    repl = createInterface({
+        input: process.stdin,
+        output: process.stdout,
+        prompt,
+        // Ctrl-C is handled explicitly via the SIGINT event so an in-flight
+        // request can be aborted without killing the process.
+        terminal: process.stdout.isTTY === true,
+        historySize: 500,
+    });
+    return repl;
+}
+export function closeRepl() {
+    repl?.close();
+    repl = null;
+}
+/**
+ * Run `fn` as the only consumer of stdin.
+ *
+ * Pausing the readline Interface is not enough on its own: in terminal mode,
+ * with the REPL mid `for await (... of rl)`, readline keeps its own `data`
+ * listener on stdin and echoes keys. Pressing `y` at a permission prompt then
+ * registered TWICE — once echoed by readline, once by the raw reader below —
+ * producing "yy" and, worse, feeding a stray "y" into the next prompt.
+ *
+ * The fix is to remove stdin's listeners entirely for the duration of `fn` and
+ * restore them afterwards, so the raw reader is genuinely the only consumer.
+ */
+async function withExclusiveStdin(fn) {
+    const run = queue.then(async () => {
+        const wasRepl = repl;
+        const stdin = process.stdin;
+        // Snapshot and detach every data/keypress listener currently on stdin
+        // (these belong to readline). We reattach them in the finally block.
+        const dataListeners = stdin.listeners("data");
+        const keypressListeners = stdin.listeners("keypress");
+        wasRepl?.pause();
+        for (const l of dataListeners)
+            stdin.removeListener("data", l);
+        for (const l of keypressListeners)
+            stdin.removeListener("keypress", l);
+        try {
+            return await fn();
+        }
+        finally {
+            // Reattach readline's listeners, then repaint its prompt — resume() alone
+            // leaves the line unpainted so the terminal looks frozen until a keypress.
+            for (const l of dataListeners)
+                stdin.on("data", l);
+            for (const l of keypressListeners)
+                stdin.on("keypress", l);
+            if (wasRepl) {
+                wasRepl.resume();
+            }
+        }
+    });
+    // Keep the chain alive even if this call rejects, or one failed prompt would
+    // deadlock every later one.
+    queue = run.catch(() => undefined);
+    return run;
+}
+/**
+ * Read a single keypress without waiting for Enter.
+ *
+ * Returns the lowercased character, or a named key for the control sequences
+ * that must not be swallowed. Ctrl-C in raw mode arrives as the byte 0x03 and
+ * does NOT raise SIGINT - the old code treated it as "any other key", i.e. a
+ * silent "no", so Ctrl-C at a permission prompt neither cancelled nor exited.
+ */
+export async function readKey(allowed) {
+    if (!process.stdin.isTTY) {
+        // Piped or CI: there is no interactive user to answer, and blocking forever
+        // is the worst outcome. Callers treat "" as "no answer given".
+        return "";
+    }
+    return withExclusiveStdin(() => new Promise(resolve => {
+        const stdin = process.stdin;
+        const wasRaw = stdin.isRaw === true;
+        const cleanup = () => {
+            stdin.removeListener("data", onData);
+            // Restore precisely what we found. `wasRaw || false` (the old code) is
+            // not the same thing: it restores raw mode whenever readline had it on,
+            // which is a different state from "what it was before I touched it".
+            if (stdin.isTTY)
+                stdin.setRawMode(wasRaw);
+            if (!wasRaw)
+                stdin.pause();
+        };
+        const onData = (buf) => {
+            const seq = buf.toString("utf8");
+            let key;
+            if (seq === "")
+                key = "ctrl-c";
+            else if (seq === "\u001b[A")
+                key = "up";
+            else if (seq === "\u001b[B")
+                key = "down";
+            else if (seq === "\u001b[C")
+                key = "right";
+            else if (seq === "\u001b[D")
+                key = "left";
+            else if (seq === "")
+                key = "escape";
+            else if (seq === "\r" || seq === "\n")
+                key = "enter";
+            else
+                key = seq[0]?.toLowerCase() ?? "";
+            // Ignore keys the caller does not accept instead of treating them as a
+            // decision. Pressing an arrow key should not silently mean "no".
+            if (allowed && !allowed.includes(key) && key !== "ctrl-c" && key !== "escape")
+                return;
+            cleanup();
+            // Echo exactly once, and only a real character.
+            if (key.length === 1)
+                process.stdout.write(key);
+            process.stdout.write("\n");
+            resolve(key);
+        };
+        stdin.setRawMode(true);
+        stdin.resume();
+        stdin.on("data", onData);
+    }));
+}
+/** Read a full line, with Enter to submit. Used for free-text answers. */
+export async function question(prompt) {
+    if (!process.stdin.isTTY)
+        return "";
+    return withExclusiveStdin(() => new Promise(resolve => {
+        const rl = createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+        rl.question(prompt, answer => { rl.close(); resolve(answer.trim()); });
+    }));
+}
+/**
+ * A yes/no confirmation with a safe default.
+ *
+ * `defaultAnswer` is what Enter means. It is false everywhere a destructive
+ * action is involved: a user holding Enter to get through prompts must not be
+ * able to approve a deletion by momentum.
+ */
+export async function confirm(prompt, defaultAnswer = false) {
+    const hint = defaultAnswer ? "[Y/n]" : "[y/N]";
+    process.stdout.write(`${prompt} ${c.dim(hint)} `);
+    const key = await readKey();
+    if (key === "ctrl-c" || key === "escape")
+        return false;
+    if (key === "enter" || key === "")
+        return defaultAnswer;
+    return key === "y";
+}
+/**
+ * Scope picker after `t` — Kiro-style: ↑↓ to navigate, ↵ to select
+ * Returns 0: Specific paths, 1: Complete directory, 2: Entire Tool, -1: cancelled
+ */
+export async function pickScope(options) {
+    if (!process.stdin.isTTY)
+        return 0;
+    return withExclusiveStdin(() => new Promise(resolve => {
+        let idx = 0;
+        const stdin = process.stdin;
+        const wasRaw = stdin.isRaw === true;
+        const render = () => {
+            // Move cursor up to redraw options in place
+            // First render: just print, subsequent: overwrite
+            process.stdout.write(`\n ${c.dim("Press")} ${c.bold("(↑↓)")} ${c.dim("to navigate ·")} ${c.bold("(↵)")} ${c.dim("to select scope")}\n`);
+            for (let i = 0; i < options.length; i++) {
+                const sel = i === idx;
+                const arrow = sel ? c.cyan(">") : " ";
+                const txt = sel ? c.bold(c.cyan(options[i])) : c.dim(options[i]);
+                process.stdout.write(`${arrow} ${txt}\n`);
+            }
+        };
+        const cleanup = () => {
+            stdin.removeListener("data", onData);
+            if (stdin.isTTY)
+                stdin.setRawMode(wasRaw);
+            if (!wasRaw)
+                stdin.pause();
+        };
+        const onData = (buf) => {
+            const seq = buf.toString("utf8");
+            if (seq === "") {
+                cleanup();
+                resolve(-1);
+                return;
+            }
+            if (seq === "") {
+                cleanup();
+                resolve(-1);
+                return;
+            }
+            if (seq === "\u001b[A") {
+                idx = (idx - 1 + options.length) % options.length; // up
+                // Clear previous render (options.length+1 lines)
+                process.stdout.write(`\x1b[${options.length + 1}A\x1b[J`);
+                render();
+                return;
+            }
+            if (seq === "\u001b[B") {
+                idx = (idx + 1) % options.length; // down
+                process.stdout.write(`\x1b[${options.length + 1}A\x1b[J`);
+                render();
+                return;
+            }
+            if (seq === "\r" || seq === "\n") {
+                cleanup();
+                process.stdout.write("\n");
+                resolve(idx);
+                return;
+            }
+        };
+        stdin.setRawMode(true);
+        stdin.resume();
+        stdin.on("data", onData);
+        render();
+    }));
+}