instabox 0.4.2 → 0.4.3

package/skills/instabox-move-all/scripts/stage-env.mjs

@@ -0,0 +1,313 @@
+#!/usr/bin/env node
+// Stages the checked Environment items for the box, filtered, in a local
+// directory laid out like the box's HOME, plus a setup script that merges
+// them into what the box already has and installs the tools.
+//
+//   node stage-env.mjs --selection selection.json --out DIR
+//   tar -C DIR -czf - . | instabox ssh BOX -- 'tar -xzf - --skip-old-files --warning=no-unknown-keyword -C ~'
+//   instabox ssh BOX -- 'bash -l ~/.config/instabox-move/setup.sh'
+//
+// Lines that look like credentials are replaced by a comment, macOS-only
+// lines are commented out, and this machine's HOME is rewritten to the box's.
+// Credentials themselves go to the Vault (push-creds.mjs), never here.
+import { chmodSync, mkdirSync, readFileSync, writeFileSync, readlinkSync, symlinkSync } from 'node:fs';
+import { basename, dirname, extname, join } from 'node:path';
+import {
+  BOX_HOME,
+  MACOS_ONLY,
+  SECRET_KEY_LINE,
+  SECRET_VALUE,
+  STAGE_DIR,
+  isBinary,
+  isMain,
+  isSecretName,
+  listFiles,
+  lstatOrNull,
+  readJSON,
+} from './lib.mjs';
+import { installCommands } from './tools.mjs';
+import { SHELL_RC } from './scan.mjs';
+
+const SHELL_BLOCK = /^\s*(?:if|elif|else|fi|for|while|until|do|done|case|esac|then|function\b|[A-Za-z_][\w-]*\s*\(\)\s*\{?|\{|\}|;;)|(?:\bthen|\bdo|\{|\()\s*(?:#.*)?$/;
+
+function commentStyle(path) {
+  const b = basename(path);
+  const e = extname(path);
+  if (e === '.lua') return '--';
+  if (e === '.vim' || b === '.vimrc' || b === '.gvimrc') return '"';
+  if (b === '.psqlrc') return '--';
+  return '#';
+}
+
+// Filters one text file. Returns the new text and how many lines were changed.
+export function scrubText(text, { path, home, shell = false }) {
+  const c = shell ? null : commentStyle(path);
+  let secrets = 0;
+  let macos = 0;
+  const out = text.split('\n').map((line) => {
+    const assign = line.match(/^\s*(?:export\s+|declare\s+-x\s+|typeset\s+-x\s+)?([A-Za-z_][A-Za-z0-9_]*)=/);
+    const secret =
+      SECRET_VALUE.test(line) ||
+      (shell && assign && isSecretName(assign[1])) ||
+      (!shell && SECRET_KEY_LINE.test(line) && !/^\s*(?:#|;|--|")/.test(line));
+    if (secret) {
+      secrets++;
+      const what = assign ? ` ${assign[1]}` : '';
+      // `:` keeps an if/for body valid when its only line goes.
+      return shell
+        ? `: # [instabox-move-all] removed${what}: looked like a credential (it is in the Vault if you moved it)`
+        : `${c} [instabox-move-all] removed a line that looked like a credential`;
+    }
+    if (MACOS_ONLY.test(line) && !/^\s*(?:#|--|")/.test(line)) {
+      if (shell && SHELL_BLOCK.test(line)) return line.split(home).join(BOX_HOME); // a condition on a macOS path is just false here
+      macos++;
+      return shell ? `: # [macOS only] ${line.trim()}` : `${c} [macOS only] ${line.trim()}`;
+    }
+    return line.split(home).join(BOX_HOME);
+  });
+  return { text: out.join('\n'), secrets, macos };
+}
+
+// Deep copy of a JSON value with this HOME rewritten, credentials and macOS-only commands dropped.
+function scrubJSON(v, home, drop) {
+  if (typeof v === 'string') return v.split(home).join(BOX_HOME);
+  if (Array.isArray(v)) return v.map((x) => scrubJSON(x, home, drop)).filter((x) => x !== undefined);
+  if (v && typeof v === 'object') {
+    const o = {};
+    for (const [k, x] of Object.entries(v)) {
+      if (drop(k, x)) continue;
+      const y = scrubJSON(x, home, drop);
+      if (y !== undefined) o[k] = y;
+    }
+    return o;
+  }
+  return v;
+}
+
+const secretString = (k, x) => typeof x === 'string' && (SECRET_VALUE.test(x) || isSecretName(k));
+
+export function scrubClaudeSettings(s, home) {
+  const notes = [];
+  if (s.apiKeyHelper) notes.push('apiKeyHelper left out (a local script): set ANTHROPIC_API_KEY in the Vault instead');
+  const copy = { ...s };
+  delete copy.apiKeyHelper;
+  const out = scrubJSON(copy, home, (k, x) => {
+    if (secretString(k, x)) return true;
+    // Hooks and status lines that call macOS-only programs.
+    if (k === 'command' && typeof x === 'string' && MACOS_ONLY.test(x)) {
+      notes.push(`left out a macOS-only command: ${x.slice(0, 60)}`);
+      return true;
+    }
+    return false;
+  });
+  // A hook entry whose command was dropped is dropped too.
+  if (out.hooks) {
+    for (const [ev, list] of Object.entries(out.hooks)) {
+      if (!Array.isArray(list)) continue;
+      out.hooks[ev] = list
+        .map((m) => (m && Array.isArray(m.hooks) ? { ...m, hooks: m.hooks.filter((h) => h.command || h.type !== 'command') } : m))
+        .filter((m) => !m || !Array.isArray(m.hooks) || m.hooks.length);
+      if (!out.hooks[ev].length) delete out.hooks[ev];
+    }
+    if (!Object.keys(out.hooks).length) delete out.hooks;
+  }
+  if (out.statusLine && !out.statusLine.command) delete out.statusLine;
+  return { settings: out, notes };
+}
+
+export function scrubMcp(servers, home) {
+  const out = {};
+  for (const [name, s] of Object.entries(servers || {})) {
+    if (!s.command) continue; // remote servers are signed in to again on the box
+    const c = scrubJSON(s, home, (k, x) => secretString(k, x));
+    // A Homebrew path on macOS is on PATH on the box under the same name.
+    if (/^\/(?:opt\/homebrew|usr\/local)\/bin\//.test(c.command)) c.command = basename(c.command);
+    out[name] = c;
+  }
+  return out;
+}
+
+const q = (s) => `'${String(s).replace(/'/g, `'\\''`)}'`;
+
+export function stage(sel, outDir) {
+  const home = sel.home;
+  const files = [];
+  const filtered = {};
+  const notes = [];
+  const write = (rel, data, mode = 0o644) => {
+    const p = join(outDir, rel);
+    mkdirSync(dirname(p), { recursive: true });
+    writeFileSync(p, data);
+    chmodSync(p, mode);
+    files.push(rel);
+  };
+  const copyText = (src, rel, { shell = false } = {}) => {
+    const st = lstatOrNull(src);
+    if (!st) return;
+    if (st.isSymbolicLink()) {
+      const t = readlinkSync(src).split(home).join(BOX_HOME);
+      const p = join(outDir, rel);
+      mkdirSync(dirname(p), { recursive: true });
+      symlinkSync(t, p);
+      files.push(rel);
+      return;
+    }
+    const buf = readFileSync(src);
+    const mode = st.mode & 0o777;
+    if (isBinary(buf)) return write(rel, buf, mode);
+    const r = scrubText(buf.toString('utf8'), { path: src, home, shell });
+    if (r.secrets || r.macos) filtered[rel] = { credentialLines: r.secrets, macosLines: r.macos };
+    write(rel, r.text, mode);
+  };
+  const copyTree = (srcDir, rel) => {
+    for (const f of listFiles(srcDir, (n) => n === '.git' || n === 'node_modules' || n === '.DS_Store')) copyText(join(srcDir, f), `${rel}/${f}`);
+  };
+  const S = STAGE_DIR;
+  const setup = [];
+  const once = []; // marker-guarded steps
+
+  const shellFiles = [];
+  for (const e of sel.environment) {
+    if (e.kind === 'dotfile') {
+      const src = join(home, e.path);
+      if (SHELL_RC.includes(e.path)) {
+        const name = e.path.replace(/^\./, '');
+        copyText(src, `${S}/shell/${name}`, { shell: true });
+        shellFiles.push(e.path);
+      } else if (e.path === '.gitconfig' || e.path === '.config/git/config') {
+        copyText(src, `${S}/${e.path === '.gitconfig' ? 'gitconfig' : 'git-config'}`);
+        const inc = `${BOX_HOME}/${S}/${e.path === '.gitconfig' ? 'gitconfig' : 'git-config'}`;
+        setup.push([
+          'gitconfig include',
+          `git config --global --get-all include.path | grep -qxF ${q(inc)} || git config --global --add include.path ${q(inc)}`,
+        ]);
+      } else if (e.dir) copyTree(src, e.path);
+      else copyText(src, e.path);
+    } else if (e.id === 'env:claude:settings') {
+      const s = readJSON(join(home, '.claude', 'settings.json'));
+      if (s) {
+        const r = scrubClaudeSettings(s, home);
+        notes.push(...r.notes);
+        write(`${S}/claude/settings.json`, JSON.stringify(r.settings, null, 2) + '\n');
+        setup.push([
+          'Claude settings merge',
+          `mkdir -p ~/.claude && if [ -f ~/.claude/settings.json ]; then jq -s '.[0] * .[1]' ~/.claude/settings.json ~/${S}/claude/settings.json > ~/.claude/settings.json.new && mv ~/.claude/settings.json.new ~/.claude/settings.json; else cp ~/${S}/claude/settings.json ~/.claude/settings.json; fi`,
+        ]);
+      }
+    } else if (e.id === 'env:claude:CLAUDE.md' || e.id === 'env:codex:AGENTS.md') {
+      const staged = `${S}/${e.id === 'env:claude:CLAUDE.md' ? 'claude/CLAUDE.md' : 'codex/AGENTS.md'}`;
+      copyText(join(home, e.path), staged);
+      once.push([
+        e.id,
+        `mkdir -p ~/${dirname(e.path)} && if [ -s ~/${e.path} ]; then printf '\\n' >> ~/${e.path} && cat ~/${staged} >> ~/${e.path}; else cp ~/${staged} ~/${e.path}; fi`,
+      ]);
+    } else if (e.id === 'env:codex:config') {
+      copyText(join(home, e.path), `${S}/codex/config.toml`);
+      setup.push([
+        'Codex config',
+        `mkdir -p ~/.codex && if [ -e ~/.codex/config.toml ]; then echo "kept the box's ~/.codex/config.toml; yours is in ~/${S}/codex/config.toml"; else cp ~/${S}/codex/config.toml ~/.codex/config.toml; fi`,
+      ]);
+    } else if (e.id === 'env:claude:mcp') {
+      const mcp = scrubMcp(readJSON(join(home, '.claude.json'))?.mcpServers, home);
+      write(`${S}/claude/mcp.json`, JSON.stringify(mcp, null, 2) + '\n');
+      for (const name of Object.keys(mcp).sort())
+        setup.push([
+          `MCP server ${name}`,
+          `claude mcp get ${q(name)} >/dev/null 2>&1 || claude mcp add-json --scope user ${q(name)} "$(jq -c --arg n ${q(name)} '.[$n]' ~/${S}/claude/mcp.json)"`,
+        ]);
+    } else if (e.names && (e.kind === 'claude' || e.kind === 'agents')) {
+      for (const n of e.names) {
+        const src = join(home, e.path, n);
+        if (lstatOrNull(src)?.isDirectory()) copyTree(src, `${e.path}/${n}`);
+        else copyText(src, `${e.path}/${n}`);
+      }
+    }
+  }
+
+  // Shell: the box keeps its own startup files and sources yours from them.
+  const bashSide = shellFiles.filter((f) => !f.startsWith('.z')).map((f) => `~/${S}/shell/${f.replace(/^\./, '')}`);
+  if (bashSide.length)
+    once.push([
+      'bashrc',
+      `cat >> ~/.bashrc <<'EOF'\n\n# instabox-move-all: the shell setup from your old machine\nif [ -z "\${__instabox_moved_rc-}" ]; then __instabox_moved_rc=1; for f in ${bashSide.join(' ')}; do [ -r "$f" ] && . "$f"; done; fi\nEOF`,
+    ]);
+  const zsh = shellFiles.filter((f) => f.startsWith('.z'));
+  const toolSel = { apt: [], npm: [], uv: [], cargo: [], go: [], ...(sel.tools || {}) };
+  if (zsh.length) {
+    toolSel.apt = [...new Set([...toolSel.apt, 'zsh'])].sort();
+    for (const f of zsh) {
+      const staged = `~/${S}/shell/${f.replace(/^\./, '')}`;
+      if (f === '.zprofile') continue;
+      setup.push([`~/${f}`, `[ -e ~/${f} ] || cp ${staged} ~/${f}`]);
+    }
+    // zsh does not read /etc/profile, where the box's environment and the Vault's variables come from.
+    setup.push([
+      '~/.zprofile',
+      `[ -e ~/.zprofile ] || { echo "emulate sh -c '. /etc/profile'  # instabox-move-all: the box's environment and Vault"; cat ~/${S}/shell/zprofile 2>/dev/null || true; } > ~/.zprofile`,
+    ]);
+    notes.push('zsh is installed but bash stays the login shell; switch with: sudo chsh -s "$(command -v zsh)" dev');
+  }
+
+  // .env files from the Vault, linked into their repos.
+  for (const c of sel.credentials) {
+    if (!c.link) continue;
+    setup.push([
+      `link ${c.link}`,
+      `mkdir -p ${q(dirname(c.link))} && { [ -e ${q(c.link)} ] && [ ! -L ${q(c.link)} ] && echo ${q(`kept the existing ${c.link}`)} || ln -sfn ${q(`${BOX_HOME}/${c.path}`)} ${q(c.link)}; }`,
+    ]);
+  }
+
+  const tools = installCommands(toolSel);
+  const script = [
+    '#!/usr/bin/env bash',
+    '# Written by instabox-move-all (stage-env.mjs). Safe to run again.',
+    'set -u',
+    `S=~/${S}`,
+    '# Every failed step is collected and reported at the end; the script then exits 1.',
+    'failed=()',
+    'fail() { failed+=("$1"); echo "instabox-move-all: failed: $1" >&2; }',
+    'step() { eval "$2" || fail "$1"; }',
+    'once() { [ -e "$S/.done-$1" ] && return 0; if eval "$2"; then touch "$S/.done-$1"; else fail "$1"; fi; }',
+    '',
+    '# Config',
+    ...setup.map(([label, cmd]) => `step ${q(label)} ${q(cmd)}`),
+    ...once.map(([k, cmd]) => `once ${q(k.replace(/[^A-Za-z0-9.-]/g, '-'))} ${q(cmd)}`),
+    '',
+    '# Tools (fresh Linux installs; nothing copied from macOS)',
+    ...tools,
+    '',
+    'if [ ${#failed[@]} -gt 0 ]; then',
+    '  printf \'instabox-move-all: %d step(s) failed:\\n\' "${#failed[@]}" >&2',
+    '  printf \'  %s\\n\' "${failed[@]}" >&2',
+    '  exit 1',
+    'fi',
+    'echo "instabox-move-all: environment set up"',
+    '',
+  ].join('\n');
+  write(`${S}/setup.sh`, script, 0o755);
+  if (lstatOrNull(join(outDir, '.ssh'))) chmodSync(join(outDir, '.ssh'), 0o700);
+  return { out: outDir, files: files.sort(), filtered, notes, setup: `~/${S}/setup.sh` };
+}
+
+function main() {
+  const args = process.argv.slice(2);
+  const get = (n) => {
+    const i = args.indexOf(n);
+    return i >= 0 ? args[i + 1] : undefined;
+  };
+  const selFile = get('--selection');
+  const out = get('--out');
+  if (!selFile || !out || args.length !== 4) {
+    process.stderr.write('usage: stage-env.mjs --selection selection.json --out DIR\n');
+    process.exit(2);
+  }
+  const sel = JSON.parse(readFileSync(selFile, 'utf8'));
+  if (lstatOrNull(out) && listFiles(out).length) {
+    process.stderr.write(`${out} is not empty: give a new directory\n`);
+    process.exit(1);
+  }
+  mkdirSync(out, { recursive: true, mode: 0o700 });
+  process.stdout.write(JSON.stringify(stage(sel, out), null, 2) + '\n');
+}
+
+if (isMain(import.meta)) main();

package/skills/instabox-move-all/scripts/tools.mjs

@@ -0,0 +1,173 @@
+// Global tools from this machine, as install commands for the Debian box.
+// Never copies binaries: everything is installed fresh for Linux.
+
+// Homebrew formula -> Debian package. null: already on the universal template.
+// A string starting with 'uv:' or 'npm:' installs with that tool instead.
+export const BREW_TO_LINUX = {
+  git: null,
+  gh: null,
+  node: null,
+  nvm: null,
+  python: null,
+  'python@3.10': null,
+  'python@3.11': null,
+  'python@3.12': null,
+  'python@3.13': null,
+  'python@3.14': null,
+  go: null,
+  rust: null,
+  rustup: null,
+  'rustup-init': null,
+  uv: null,
+  docker: null,
+  'docker-compose': null,
+  'docker-buildx': null,
+  curl: null,
+  jq: null,
+  openssl: null,
+  'openssl@3': null,
+  coreutils: null,
+  findutils: null,
+  'gnu-sed': null,
+  'gnu-tar': null,
+  grep: null,
+  gawk: 'gawk',
+  ripgrep: 'ripgrep',
+  fd: 'fd-find',
+  fzf: 'fzf',
+  bat: 'bat',
+  eza: 'eza',
+  tree: 'tree',
+  htop: 'htop',
+  btop: 'btop',
+  tmux: 'tmux',
+  screen: 'screen',
+  zsh: 'zsh',
+  fish: 'fish',
+  neovim: 'neovim',
+  vim: 'vim',
+  emacs: 'emacs-nox',
+  nano: 'nano',
+  wget: 'wget',
+  watch: 'procps',
+  'git-lfs': 'git-lfs',
+  'git-delta': 'git-delta',
+  tig: 'tig',
+  lazygit: null,
+  direnv: 'direnv',
+  zoxide: 'zoxide',
+  shellcheck: 'shellcheck',
+  shfmt: 'shfmt',
+  cmake: 'cmake',
+  ninja: 'ninja-build',
+  'pkg-config': 'pkg-config',
+  pkgconf: 'pkgconf',
+  autoconf: 'autoconf',
+  automake: 'automake',
+  libtool: 'libtool',
+  protobuf: 'protobuf-compiler',
+  sqlite: 'sqlite3',
+  postgresql: 'postgresql-client',
+  'postgresql@14': 'postgresql-client',
+  'postgresql@15': 'postgresql-client',
+  'postgresql@16': 'postgresql-client',
+  'postgresql@17': 'postgresql-client',
+  libpq: 'libpq-dev',
+  mysql: 'default-mysql-client',
+  'mysql-client': 'default-mysql-client',
+  redis: 'redis-tools',
+  graphviz: 'graphviz',
+  ffmpeg: 'ffmpeg',
+  imagemagick: 'imagemagick',
+  pandoc: 'pandoc',
+  httpie: 'httpie',
+  p7zip: '7zip',
+  'xz': 'xz-utils',
+  zstd: 'zstd',
+  rsync: 'rsync',
+  mosh: 'mosh',
+  gnupg: 'gnupg',
+  'pinentry-mac': null,
+  mas: null,
+  awscli: 'uv:awscli',
+  pipx: 'pipx',
+  poetry: 'uv:poetry',
+  ruff: 'uv:ruff',
+  black: 'uv:black',
+  'pre-commit': 'uv:pre-commit',
+  pnpm: 'npm:pnpm',
+  yarn: 'npm:yarn',
+  typescript: 'npm:typescript',
+  ruby: 'ruby-full',
+  'openjdk': 'default-jdk',
+  maven: 'maven',
+  gradle: 'gradle',
+  hugo: 'hugo',
+  yq: 'yq',
+  'just': 'just',
+};
+
+// npm globals the box has already.
+const NPM_SKIP = new Set(['npm', 'corepack', '@anthropic-ai/claude-code', '@openai/codex', 'open-computer-use', 'instabox']);
+
+// One group from scan.mjs (tool:brew, tool:npm, ...) -> {apt, npm, uv, cargo, go, manual}.
+export function mapTools(groups) {
+  const out = { apt: new Set(), npm: new Set(), uv: new Set(), cargo: new Set(), go: new Set(), manual: [] };
+  for (const g of groups) {
+    if (g.manager === 'brew') {
+      for (const n of g.names) {
+        if (!(n in BREW_TO_LINUX)) {
+          out.manual.push(`brew ${n}: no automatic Linux package; install it by hand if you need it`);
+          continue;
+        }
+        const t = BREW_TO_LINUX[n];
+        if (t === null) continue;
+        if (t.startsWith('uv:')) out.uv.add(t.slice(3));
+        else if (t.startsWith('npm:')) out.npm.add(t.slice(4));
+        else out.apt.add(t);
+      }
+    } else if (g.manager === 'npm') {
+      for (const n of g.names) if (!NPM_SKIP.has(n)) out.npm.add(n);
+    } else if (g.manager === 'uv') {
+      for (const n of g.names) out.uv.add(n);
+    } else if (g.manager === 'cargo') {
+      for (const n of g.names) out.cargo.add(n);
+    } else if (g.manager === 'go') {
+      for (const n of g.names) out.go.add(n);
+      for (const n of g.unknown || []) out.manual.push(`~/go/bin/${n}: module unknown; \`go install <module>@latest\` on the box`);
+    }
+  }
+  const sorted = (s) => [...s].sort();
+  return { apt: sorted(out.apt), npm: sorted(out.npm), uv: sorted(out.uv), cargo: sorted(out.cargo), go: sorted(out.go), manual: out.manual };
+}
+
+// A one-line preview of what a tool group becomes on the box.
+export function describeTools(g) {
+  const m = mapTools([g]);
+  const parts = [];
+  if (m.apt.length) parts.push(`apt: ${m.apt.join(' ')}`);
+  if (m.npm.length) parts.push(`npm -g: ${m.npm.join(' ')}`);
+  if (m.uv.length) parts.push(`uv tool: ${m.uv.join(' ')}`);
+  if (m.cargo.length) parts.push(`cargo install: ${m.cargo.join(' ')}`);
+  if (m.go.length) parts.push(`go install: ${m.go.join(' ')}`);
+  if (m.manual.length) parts.push(`by hand: ${m.manual.map((s) => s.split(':')[0]).join(', ')}`);
+  return parts.join('; ') || 'nothing to install (already on the box)';
+}
+
+const q = (s) => `'${String(s).replace(/'/g, `'\\''`)}'`;
+
+// Shell lines that install the tools on the box (run as dev, with sudo).
+// Lines for setup.sh, which defines `fail` (collects a failed step for the final report).
+export function installCommands(m) {
+  const cmds = [];
+  if (m.apt.length)
+    cmds.push(
+      `sudo apt-get update -qq || fail 'apt-get update'; for p in ${m.apt.map(q).join(' ')}; do sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq "$p" || fail "apt: $p"; done`,
+    );
+  // The box's npm prefix is /usr/local, owned by root.
+  if (m.npm.length) cmds.push(`sudo npm install -g ${m.npm.map(q).join(' ')} || fail ${q(`npm -g: ${m.npm.join(' ')}`)}`);
+  for (const n of m.uv) cmds.push(`uv tool install ${q(n)} || fail ${q(`uv tool: ${n}`)}`);
+  for (const n of m.go) cmds.push(`go install ${q(`${n}@latest`)} || fail ${q(`go: ${n}`)}`);
+  for (const n of m.cargo) cmds.push(`cargo install --locked ${q(n)} || fail ${q(`cargo: ${n}`)}`);
+  return cmds;
+}