iterate 0.2.0 → 0.2.3

package/README.md

@@ -29,11 +29,10 @@ Initial setup (writes auth + launcher config):
 
 ```bash
 npx iterate setup \
-  --base-url https://dev-yourname-os.dev.iterate.com \
+  --os-base-url https://dev-yourname-os.dev.iterate.com \
+  --daemon-base-url http://localhost:3001 \
   --admin-password-env-var-name SERVICE_AUTH_TOKEN \
-  --user-id usr_... \
-  --repo-path managed \
-  --auto-install true \
+  --user-email dev-yourname@iterate.com \
   --scope global
 ```
 
@@ -51,6 +50,9 @@ npx iterate os project list
 - `iterate install` - force clone/install for resolved checkout
 - `iterate whoami`
 - `iterate os ...`
+- `iterate daemon ...`
+
+`setup --scope global` writes auth + launcher values into `global`; `setup --scope workspace` writes them into `workspaces[process.cwd()]`.
 
 ## Config file
 
@@ -70,11 +72,10 @@ Config shape:
   },
   "workspaces": {
     "/absolute/workspace/path": {
-      "baseUrl": "https://dev-yourname-os.dev.iterate.com",
+      "osBaseUrl": "https://dev-yourname-os.dev.iterate.com",
+      "daemonBaseUrl": "http://localhost:3001",
       "adminPasswordEnvVarName": "SERVICE_AUTH_TOKEN",
-      "userId": "usr_...",
-      "repoPath": "/absolute/path/to/iterate",
-      "autoInstall": false
+      "userEmail": "dev-yourname@iterate.com"
     }
   }
 }
@@ -114,11 +115,10 @@ You can pin explicitly:
 
 ```bash
 npx iterate setup \
-  --base-url https://dev-yourname-os.dev.iterate.com \
+  --os-base-url https://dev-yourname-os.dev.iterate.com \
+  --daemon-base-url http://localhost:3001 \
   --admin-password-env-var-name SERVICE_AUTH_TOKEN \
-  --user-id usr_... \
-  --repo-path local \
-  --auto-install false \
+  --user-email dev-yourname@iterate.com \
   --scope workspace
 ```
 

package/bin/iterate.js

@@ -1,66 +1,130 @@
 #!/usr/bin/env node
 // @ts-check
 
-import { spawn } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import process from "node:process";
-import { pathToFileURL } from "node:url";
-import * as prompts from "@clack/prompts";
-import { createTRPCClient, httpLink } from "@trpc/client";
-import { initTRPC } from "@trpc/server";
-import { createAuthClient } from "better-auth/client";
-import { adminClient } from "better-auth/client/plugins";
-import superjson from "superjson";
-import { createCli } from "trpc-cli";
-import { proxify } from "trpc-cli/dist/proxify.js";
-import { z } from "zod/v4";
-
-const DEFAULT_REPO_URL = "https://github.com/iterate/iterate.git";
-const XDG_CONFIG_PATH = join(
-  process.env.XDG_CONFIG_HOME ? process.env.XDG_CONFIG_HOME : join(homedir(), ".config"),
-  "iterate",
-  "config.json",
-);
-const XDG_REPO_DIR = join(
-  process.env.XDG_DATA_HOME ? process.env.XDG_DATA_HOME : join(homedir(), ".local", "share"),
-  "iterate",
-  "repo",
-);
-const DEFAULT_REPO_DIR = XDG_REPO_DIR;
-const CONFIG_PATH = XDG_CONFIG_PATH;
-const APP_ROUTER_PATH = join("apps", "os", "backend", "trpc", "root.ts");
+import { fileURLToPath } from "node:url";
+
+// --- Local delegation (must run before any heavy imports) ---
 
 /**
- * @typedef {{
- *   repoPath?: string;
- *   repoRef?: string;
- *   repoUrl?: string;
- *   autoInstall?: boolean;
- * }} LauncherConfig
+ * Walk up from `startDir` looking for `relativePath` to exist.
+ * Returns the directory where it was found, or null.
+ * @param {string} relativePath
+ * @param {string} [startDir]
+ * @returns {string | null}
  */
+const findUp = (relativePath, startDir = process.cwd()) => {
+  let dir = resolve(startDir);
+  while (true) {
+    if (existsSync(join(dir, relativePath))) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+};
+
+const __filename = fileURLToPath(import.meta.url);
 
 /**
- * @typedef {{
- *   global?: Record<string, unknown>;
- *   workspaces?: Record<string, Record<string, unknown>>;
- * } & Record<string, unknown>} ConfigFile
+ * If we're already running from a local version, skip delegation to avoid loops.
+ * Otherwise, find the closest local iterate CLI and re-exec into it.
  */
+const delegateToLocal = () => {
+  if (process.env.__ITERATE_CLI_DELEGATED) return;
+
+  const selfReal = realpathSync(__filename);
+
+  // 1. Check if we're inside the iterate repo (has pnpm-workspace.yaml at root)
+  const repoRoot = findUp("pnpm-workspace.yaml");
+  if (repoRoot) {
+    const repoScript = join(repoRoot, "packages/iterate/bin/iterate.js");
+    if (existsSync(repoScript) && realpathSync(repoScript) !== selfReal) {
+      reExec(repoScript);
+      return;
+    }
+  }
 
-/** @typedef {"env" | "config" | "cwd" | "default"} RepoDirSource */
+  // 2. Check for a local node_modules install
+  const nmRoot = findUp("node_modules/.bin/iterate");
+  if (nmRoot) {
+    const nmScript = join(nmRoot, "node_modules/.bin/iterate");
+    if (existsSync(nmScript) && realpathSync(nmScript) !== selfReal) {
+      reExec(nmScript);
+      return;
+    }
+  }
+};
 
 /**
- * @typedef {{
- *   repoDir: string;
- *   repoDirSource: RepoDirSource;
- *   repoRef?: string;
- *   repoUrl: string;
- *   autoInstall: boolean;
- *   cwdRepoDir?: string;
- *   launcherConfig: LauncherConfig;
- * }} RuntimeOptions
+ * Re-exec into `scriptPath` with the same argv, never returning.
+ * @param {string} scriptPath
  */
+const reExec = (scriptPath) => {
+  try {
+    execFileSync(process.execPath, [scriptPath, ...process.argv.slice(2)], {
+      stdio: "inherit",
+      env: { ...process.env, __ITERATE_CLI_DELEGATED: "1" },
+    });
+  } catch (e) {
+    process.exit(e && typeof e === "object" && "status" in e ? Number(e.status) || 1 : 1);
+  }
+  process.exit(0);
+};
+
+delegateToLocal();
+
+// --- Normal CLI startup (dynamic imports so delegation can short-circuit first) ---
+
+const prompts = await import("@clack/prompts");
+const { createTRPCClient, httpLink } = await import("@trpc/client");
+const { initTRPC } = await import("@trpc/server");
+const { createAuthClient } = await import("better-auth/client");
+const { adminClient } = await import("better-auth/client/plugins");
+const { default: superjson } = await import("superjson");
+const { createCli } = await import("trpc-cli");
+const { proxify } = await import("trpc-cli/dist/proxify.js");
+const { z } = await import("zod/v4");
+
+const XDG_CONFIG_PARENT = join(
+  process.env.XDG_CONFIG_HOME ? process.env.XDG_CONFIG_HOME : join(homedir(), ".config"),
+  "iterate",
+);
+
+const XDG_CONFIG_PATH = join(XDG_CONFIG_PARENT, "config.json");
+const CONFIG_PATH = XDG_CONFIG_PATH;
+// todo write json schema to file too - need to make everything zod first
+// const CONFIG_SCHEMA_PATH = join(XDG_CONFIG_PARENT, "config-schema.json");
+
+const SetupInput = z.object({
+  osBaseUrl: z
+    .string()
+    .describe(`Base URL for OS API (for example https://dev-yourname-os.dev.iterate.com)`),
+  daemonBaseUrl: z.string().describe(`Base URL for daemon API (for example http://localhost:3001)`),
+  adminPasswordEnvVarName: z.string().describe("Env var name containing admin password"),
+  userEmail: z.string().describe("User email to impersonate for OS calls"),
+  scope: z.enum(["workspace", "global"]).describe("Where to store launcher config"),
+});
+
+const AuthConfig = z.object({
+  osBaseUrl: z.string(),
+  daemonBaseUrl: z.string(),
+  adminPasswordEnvVarName: z.string(),
+  userEmail: z.string(),
+});
+
+const ConfigFile = z.object({
+  global: AuthConfig.partial().optional(),
+  workspaces: z.record(z.string(), AuthConfig).optional(),
+  /** a place where I put old/invalid configs I can't quite let go of */
+  rubbish: z.unknown().optional(),
+});
+
+/** @typedef {import('zod').infer<typeof AuthConfig>} AuthConfig */
+/** @typedef {import('zod').infer<typeof ConfigFile>} ConfigFile */
 
 /**
  * @typedef {{
@@ -71,14 +135,6 @@ const APP_ROUTER_PATH = join("apps", "os", "backend", "trpc", "root.ts");
  * }} SpawnOptions
  */
 
-/**
- * @typedef {{
- *   repoDir: string;
- *   repoRef?: string;
- *   repoUrl: string;
- * }} CheckoutOptions
- */
-
 const isAgent =
   process.env.AGENT === "1" ||
   process.env.OPENCODE === "1" ||
@@ -87,28 +143,6 @@ const isAgent =
 
 const t = initTRPC.meta().create();
 
-const SetupInput = z.object({
-  baseUrl: z
-    .string()
-    .describe(`Base URL for os API (for example https://dev-yourname-os.dev.iterate.com)`),
-  adminPasswordEnvVarName: z.string().describe("Env var name containing admin password"),
-  userId: z.string().describe("User ID to impersonate for os calls"),
-  repoPath: z.string().describe("Path to iterate checkout (or 'local' / 'managed' shortcuts)"),
-  autoInstall: z.boolean().describe("Auto install dependencies when missing"),
-  scope: z.enum(["workspace", "global"]).describe("Where to store launcher config"),
-});
-
-const AuthConfig = z.object({
-  baseUrl: z.string(),
-  adminPasswordEnvVarName: z.string(),
-  userId: z.string(),
-});
-
-/** @param {string} message */
-const log = (message) => {
-  process.stderr.write(`[iterate] ${message}\n`);
-};
-
 /**
  * @param {unknown} value
  * @returns {value is Record<string, unknown>}
@@ -117,44 +151,6 @@ const isObject = (value) => {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 };
 
-/** @param {unknown} value */
-const nonEmptyString = (value) => {
-  if (typeof value !== "string") {
-    return undefined;
-  }
-  const trimmed = value.trim();
-  return trimmed.length > 0 ? trimmed : undefined;
-};
-
-/** @param {string} input */
-const normalizePath = (input) => {
-  if (input === "~") {
-    return homedir();
-  }
-  if (input.startsWith("~/")) {
-    return join(homedir(), input.slice(2));
-  }
-  if (isAbsolute(input)) {
-    return input;
-  }
-  return resolve(input);
-};
-
-/** @param {unknown} value */
-const parseBoolean = (value) => {
-  if (typeof value !== "string") {
-    return undefined;
-  }
-  const normalized = value.toLowerCase();
-  if (normalized === "1" || normalized === "true") {
-    return true;
-  }
-  if (normalized === "0" || normalized === "false") {
-    return false;
-  }
-  return undefined;
-};
-
 /** @returns {ConfigFile} */
 const readConfigFile = () => {
   if (!existsSync(CONFIG_PATH)) {
@@ -169,30 +165,9 @@ const readConfigFile = () => {
     throw new Error(`Invalid JSON in ${CONFIG_PATH}: ${detail}`);
   }
 
-  if (!isObject(parsed)) {
-    throw new Error(`${CONFIG_PATH} must contain a JSON object.`);
-  }
   return parsed;
 };
 
-/** @param {unknown} launcher */
-const sanitizeLauncherConfig = (launcher) => {
-  if (!isObject(launcher)) {
-    return {};
-  }
-  return {
-    repoPath: nonEmptyString(launcher.repoPath),
-    repoRef: nonEmptyString(launcher.repoRef),
-    repoUrl: nonEmptyString(launcher.repoUrl),
-    autoInstall: typeof launcher.autoInstall === "boolean" ? launcher.autoInstall : undefined,
-  };
-};
-
-/** @param {ConfigFile} configFile */
-const getGlobalConfig = (configFile) => {
-  return isObject(configFile.global) ? configFile.global : {};
-};
-
 /**
  * @param {ConfigFile} configFile
  * @param {string} workspacePath
@@ -209,119 +184,42 @@ const getWorkspaceConfig = (configFile, workspacePath) => {
  */
 const getMergedWorkspaceConfig = (configFile, workspacePath) => {
   return {
-    ...getGlobalConfig(configFile),
+    ...configFile.global,
     ...getWorkspaceConfig(configFile, workspacePath),
   };
 };
 
-/** @param {string} workspacePath */
-const readLauncherConfig = (workspacePath) => {
-  const configFile = readConfigFile();
-  return sanitizeLauncherConfig(getMergedWorkspaceConfig(configFile, workspacePath));
-};
-
 /**
- * @param {{
- *   launcherPatch: Partial<LauncherConfig>;
- *   workspacePatch?: Record<string, unknown>;
- *   scope: "workspace" | "global";
- *   workspacePath: string;
- * }} options
+ * @param {{ patch?: Partial<AuthConfig>; scope: "workspace" | "global"; workspacePath: string; }} options
+ * @returns {ConfigFile}
  */
-const writeLauncherConfig = ({ launcherPatch, workspacePatch, scope, workspacePath }) => {
-  const configFile = readConfigFile();
-  const existingGlobal = getGlobalConfig(configFile);
-  const existingWorkspaces = isObject(configFile.workspaces) ? configFile.workspaces : {};
-
-  const nextGlobal = scope === "global" ? { ...existingGlobal, ...launcherPatch } : existingGlobal;
-  const nextWorkspaces =
-    scope === "workspace" || workspacePatch
-      ? {
-          ...existingWorkspaces,
-          [workspacePath]: {
-            ...getWorkspaceConfig(configFile, workspacePath),
-            ...(scope === "workspace" ? launcherPatch : {}),
-            ...(workspacePatch ?? {}),
-          },
-        }
-      : existingWorkspaces;
-
-  mkdirSync(dirname(CONFIG_PATH), { recursive: true });
-  const { launcher: _unusedLauncher, ...rest } = configFile;
-  const next = {
-    ...rest,
-    global: nextGlobal,
-    workspaces: nextWorkspaces,
-  };
-  writeFileSync(CONFIG_PATH, `${JSON.stringify(next, null, 2)}\n`);
-  return next;
-};
-
-/** @param {string} dir */
-const isIterateRepo = (dir) => {
-  return (
-    existsSync(join(dir, ".git")) &&
-    existsSync(join(dir, "pnpm-workspace.yaml")) &&
-    existsSync(join(dir, APP_ROUTER_PATH))
+const writeNewConfig = ({ patch, scope, workspacePath }) => {
+  patch = Object.fromEntries(
+    Object.entries(patch || {}).filter(([_key, value]) => value !== undefined),
   );
-};
+  const configFile = readConfigFile();
+  const cloned = structuredClone(configFile);
 
-/** @param {string} startDir */
-const findNearestIterateRepo = (startDir) => {
-  let current = resolve(startDir);
-  for (;;) {
-    if (isIterateRepo(current)) {
-      return current;
-    }
-    const parent = dirname(current);
-    if (parent === current) {
-      return undefined;
-    }
-    current = parent;
+  if (scope === "global") {
+    cloned.global = { ...configFile.global, ...patch };
   }
-};
-
-/** @returns {RuntimeOptions} */
-const resolveRuntimeOptions = () => {
-  const launcherConfig = readLauncherConfig(process.cwd());
-  const cwdRepoDir = findNearestIterateRepo(process.cwd());
-  const envRepoDir = nonEmptyString(process.env.ITERATE_REPO_DIR);
-
-  let repoDir;
-  /** @type {RepoDirSource} */
-  let repoDirSource;
-
-  if (envRepoDir) {
-    repoDir = normalizePath(envRepoDir);
-    repoDirSource = "env";
-  } else if (launcherConfig.repoPath) {
-    repoDir = normalizePath(launcherConfig.repoPath);
-    repoDirSource = "config";
-  } else if (cwdRepoDir) {
-    repoDir = cwdRepoDir;
-    repoDirSource = "cwd";
-  } else {
-    repoDir = DEFAULT_REPO_DIR;
-    repoDirSource = "default";
+  if (scope === "workspace" && workspacePath) {
+    cloned.workspaces ||= {};
+    // @ts-expect-error - we know it's a string
+    cloned.workspaces[workspacePath] = {
+      ...configFile.workspaces?.[workspacePath],
+      ...patch,
+    };
   }
 
-  const repoRef = nonEmptyString(process.env.ITERATE_REPO_REF) ?? launcherConfig.repoRef;
-  const repoUrl =
-    nonEmptyString(process.env.ITERATE_REPO_URL) ?? launcherConfig.repoUrl ?? DEFAULT_REPO_URL;
-  const autoInstall =
-    parseBoolean(process.env.ITERATE_AUTO_INSTALL) ??
-    launcherConfig.autoInstall ??
-    (repoDirSource === "cwd" ? false : true);
+  const parsed = ConfigFile.safeParse(cloned);
+  if (!parsed.success) {
+    throw new Error(`Invalid config file: ${z.prettifyError(parsed.error)}`);
+  }
 
-  return {
-    repoDir,
-    repoDirSource,
-    repoRef,
-    repoUrl,
-    autoInstall,
-    cwdRepoDir,
-    launcherConfig,
-  };
+  mkdirSync(dirname(CONFIG_PATH), { recursive: true });
+  writeFileSync(CONFIG_PATH, `${JSON.stringify(parsed.data, null, 2)}\n`);
+  return cloned;
 };
 
 /** @param {string} workspacePath */
@@ -330,8 +228,8 @@ const readAuthConfig = (workspacePath) => {
   const mergedConfig = getMergedWorkspaceConfig(configFile, workspacePath);
   const parsed = AuthConfig.safeParse(mergedConfig);
   if (!parsed.success) {
-    throw new Error(
-      `Config file ${CONFIG_PATH} is missing auth config for ${workspacePath}. Have you run \`iterate setup\`?\n${z.prettifyError(parsed.error)}`,
+    return new Error(
+      `Invalid auth config for ${workspacePath} (in config file ${CONFIG_PATH}). Have you run \`iterate setup\`?\n${z.prettifyError(parsed.error)}`,
     );
   }
   return parsed.data;
@@ -350,11 +248,83 @@ const setCookiesToCookieHeader = (setCookies) => {
   return [...byName.entries()].map(([k, v]) => `${k}=${v}`).join("; ");
 };
 
-/** @param {z.infer<typeof AuthConfig>} authConfig */
-const authDance = async (authConfig) => {
+const impersonationUserIdCache = new Map();
+
+/**
+ * @param {{
+ *   superadminAuthClient: any;
+ *   userEmail: string;
+ *   baseUrl: string;
+ * }} options
+ */
+const resolveImpersonationUserId = async ({ superadminAuthClient, userEmail, baseUrl }) => {
+  const normalizedEmail = userEmail.trim().toLowerCase();
+  const cacheKey = `${baseUrl}::${normalizedEmail}`;
+  const cachedUserId = impersonationUserIdCache.get(cacheKey);
+  if (cachedUserId) {
+    return cachedUserId;
+  }
+
+  /** @type {any[]} */
+  let users = [];
+
+  try {
+    const result = await superadminAuthClient.admin.listUsers({
+      query: {
+        filterField: "email",
+        filterOperator: "eq",
+        filterValue: normalizedEmail,
+        limit: 10,
+      },
+      fetchOptions: {
+        throw: true,
+      },
+    });
+    users = Array.isArray(result?.users) ? result.users : [];
+  } catch {
+    const result = await superadminAuthClient.admin.listUsers({
+      query: {
+        searchField: "email",
+        searchOperator: "contains",
+        searchValue: normalizedEmail,
+        limit: 100,
+      },
+      fetchOptions: {
+        throw: true,
+      },
+    });
+    users = Array.isArray(result?.users) ? result.users : [];
+  }
+
+  const exactMatches = users.filter(
+    (user) =>
+      user &&
+      typeof user === "object" &&
+      "email" in user &&
+      typeof user.email === "string" &&
+      user.email.toLowerCase() === normalizedEmail &&
+      "id" in user &&
+      typeof user.id === "string",
+  );
+
+  if (exactMatches.length === 0) {
+    throw new Error(`No user found with email ${userEmail}`);
+  }
+  if (exactMatches.length > 1) {
+    throw new Error(`Multiple users found with email ${userEmail}`);
+  }
+
+  const resolvedUserId = exactMatches[0].id;
+  impersonationUserIdCache.set(cacheKey, resolvedUserId);
+  return resolvedUserId;
+};
+
+/** @param {import('zod').infer<typeof AuthConfig>} authConfig */
+const osAuthDance = async (authConfig) => {
+  /** @type {string[] | undefined} */
   let superadminSetCookie;
   const authClient = createAuthClient({
-    baseURL: authConfig.baseUrl,
+    baseURL: authConfig.osBaseUrl,
     fetchOptions: {
       throw: true,
     },
@@ -376,20 +346,26 @@ const authDance = async (authConfig) => {
   });
 
   const superadminAuthClient = createAuthClient({
-    baseURL: authConfig.baseUrl,
+    baseURL: authConfig.osBaseUrl,
     fetchOptions: {
       throw: true,
       onRequest: (ctx) => {
-        ctx.headers.set("origin", authConfig.baseUrl);
+        ctx.headers.set("origin", authConfig.osBaseUrl);
         ctx.headers.set("cookie", setCookiesToCookieHeader(superadminSetCookie));
       },
     },
     plugins: [adminClient()],
   });
 
+  const userId = await resolveImpersonationUserId({
+    superadminAuthClient,
+    userEmail: authConfig.userEmail,
+    baseUrl: authConfig.osBaseUrl,
+  });
+
   let impersonateSetCookie;
   await superadminAuthClient.admin.impersonateUser({
-    userId: authConfig.userId,
+    userId,
     fetchOptions: {
       throw: true,
       onResponse: (ctx) => {
@@ -401,11 +377,11 @@ const authDance = async (authConfig) => {
   const userCookies = setCookiesToCookieHeader(impersonateSetCookie);
 
   const userClient = createAuthClient({
-    baseURL: authConfig.baseUrl,
+    baseURL: authConfig.osBaseUrl,
     fetchOptions: {
       throw: true,
       onRequest: (ctx) => {
-        ctx.headers.set("origin", authConfig.baseUrl);
+        ctx.headers.set("origin", authConfig.osBaseUrl);
         ctx.headers.set("cookie", userCookies);
       },
     },
@@ -414,139 +390,38 @@ const authDance = async (authConfig) => {
   return { userCookies, userClient };
 };
 
-/** @param {string} repoDir */
-const loadAppRouter = async (repoDir) => {
-  const appRouterPath = join(repoDir, APP_ROUTER_PATH);
-  if (!existsSync(appRouterPath)) {
-    throw new Error(`Could not find ${APP_ROUTER_PATH} under ${repoDir}.`);
+/** @param {{baseUrl: string}} params */
+const loadAppRouter = async (params) => {
+  const url = `${params.baseUrl}/api/trpc-cli-procedures`;
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new Error(`${url} got ${response.status}: ${await response.text()}`);
   }
-  const rootModule = await import(pathToFileURL(appRouterPath).href);
-  if (!rootModule || typeof rootModule !== "object" || !("appRouter" in rootModule)) {
-    throw new Error(`Failed to load appRouter from ${appRouterPath}`);
-  }
-  return rootModule.appRouter;
-};
-
-/** @param {unknown} error */
-const commandMissing = (error) => {
-  return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
-};
-
-/** @param {SpawnOptions} options */
-const run = ({ command, args, cwd, env }) => {
-  return new Promise((resolvePromise, rejectPromise) => {
-    const child = spawn(command, args, {
-      cwd,
-      env,
-      stdio: "inherit",
-    });
 
-    child.on("error", (error) => {
-      rejectPromise(error);
-    });
-
-    child.on("close", (code, signal) => {
-      if (signal) {
-        rejectPromise(new Error(`${command} exited with signal ${signal}`));
-        return;
-      }
-      resolvePromise(code ?? 0);
-    });
+  const router = await response.json().catch((e) => {
+    throw new Error(`${url} returned invalid router: ${e.message}`);
   });
-};
-
-/** @param {SpawnOptions} options */
-const runChecked = async ({ command, args, cwd, env }) => {
-  const code = await run({ command, args, cwd, env });
-  if (code !== 0) {
-    throw new Error(`Command failed (${code}): ${command} ${args.join(" ")}`);
-  }
-};
-
-/** @param {CheckoutOptions} options */
-const ensureRepoCheckout = async ({ repoDir, repoRef, repoUrl }) => {
-  if (existsSync(repoDir)) {
-    if (!existsSync(join(repoDir, APP_ROUTER_PATH))) {
-      throw new Error(`Expected ${APP_ROUTER_PATH} in ${repoDir}.`);
-    }
-    if (!existsSync(join(repoDir, ".git"))) {
-      throw new Error(`Expected git checkout at ${repoDir}, but .git is missing.`);
-    }
-    return;
-  }
-
-  mkdirSync(dirname(repoDir), { recursive: true });
-  const cloneArgs = ["clone", "--depth", "1"];
-  if (repoRef) {
-    cloneArgs.push("--branch", repoRef, "--single-branch");
-  }
-  cloneArgs.push(repoUrl, repoDir);
-
-  log(`cloning iterate repo into ${repoDir}`);
-  try {
-    await runChecked({ command: "git", args: cloneArgs });
-    const envClientPath = join(repoDir, "apps/os/env-client.ts");
-    // todo: remove this as soon as this branch is merged into main
-    writeFileSync(
-      envClientPath,
-      readFileSync(envClientPath, "utf8").replace("import.meta.env.", "import.meta.env?."),
-    );
-  } catch (error) {
-    if (commandMissing(error)) {
-      throw new Error("git is required but was not found on PATH.");
-    }
-    throw error;
-  }
-};
-
-/** @param {string} repoDir */
-const hasInstalledDependencies = (repoDir) => {
-  return existsSync(join(repoDir, "node_modules", ".modules.yaml"));
-};
-
-/** @param {{ repoDir: string }} options */
-const installDependencies = async ({ repoDir }) => {
-  log("installing dependencies with pnpm");
-  const installArgs = ["install", "--frozen-lockfile"];
-  try {
-    await runChecked({
-      command: "corepack",
-      args: ["pnpm", ...installArgs],
-      cwd: repoDir,
-    });
-    return;
-  } catch (error) {
-    if (!commandMissing(error)) {
-      throw error;
-    }
-  }
-
-  try {
-    await runChecked({
-      command: "pnpm",
-      args: installArgs,
-      cwd: repoDir,
-    });
-  } catch (error) {
-    if (commandMissing(error)) {
-      throw new Error("pnpm/corepack is required but was not found on PATH.");
-    }
-    throw error;
+  if (!Array.isArray(router?.procedures)) {
+    throw new Error(`${url} returned invalid router: ${JSON.stringify(router)}`);
   }
+  /** @type {{procedures: any[]}} */
+  return router;
 };
 
-/** @param {string} repoDir */
-const getRuntimeProcedures = async (repoDir) => {
-  const appRouter = await loadAppRouter(repoDir);
-  const proxiedRouter = proxify(appRouter, async () => {
+/** @param {{ baseUrl: string }} params */
+const getOsProcedures = async (params) => {
+  const appRouter = await loadAppRouter(params);
+  /** @type {{}} */
+  const proxiedRouter = proxify(appRouter.procedures, async () => {
     return createTRPCClient({
       links: [
         httpLink({
-          url: `${readAuthConfig(process.cwd()).baseUrl}/api/trpc/`,
+          url: `${params.baseUrl}/api/trpc/`,
           transformer: superjson,
           fetch: async (request, init) => {
             const authConfig = readAuthConfig(process.cwd());
-            const { userCookies } = await authDance(authConfig);
+            if (authConfig instanceof Error) throw authConfig;
+            const { userCookies } = await osAuthDance(authConfig);
             const headers = new Headers(init?.headers);
             headers.set("cookie", userCookies);
             return fetch(request, { ...init, headers });
@@ -556,92 +431,176 @@ const getRuntimeProcedures = async (repoDir) => {
     });
   });
 
-  return {
-    whoami: t.procedure.mutation(async () => {
-      const authConfig = readAuthConfig(process.cwd());
-      const { userClient } = await authDance(authConfig);
-      return await userClient.getSession();
-    }),
-    os: proxiedRouter,
+  return proxiedRouter;
+};
+
+/**
+ * Creates a fetch wrapper that calls /api/trpc-stream/* instead of /api/trpc/*.
+ * The streaming endpoint returns SSE: log lines as `event: log` and the final
+ * tRPC response as `event: response`, which we reassemble into a normal Response.
+ * @param {string} daemonBaseUrl
+ * @returns {typeof globalThis.fetch}
+ */
+const streamingFetch = (daemonBaseUrl) => {
+  return async (/** @type {any} */ input, /** @type {any} */ init) => {
+    // Rewrite URL from /api/trpc/X to /api/trpc-stream/X
+    const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+    const rewritten = url.replace(
+      `${daemonBaseUrl}/api/trpc/`,
+      `${daemonBaseUrl}/api/trpc-stream/`,
+    );
+    const res = await fetch(rewritten, init);
+    if (rewritten === url) return res;
+
+    const contentType = res.headers.get("content-type") || "";
+    // If the daemon didn't respond with SSE, pass through as-is (non-streaming endpoint)
+    if (!contentType.includes("text/event-stream")) return res;
+    // Parse SSE stream: print log events to stderr, collect the final response
+    const reader = res.body?.getReader();
+    if (!reader) return res;
+    const decoder = new TextDecoder();
+    let buffer = "";
+    /** @type {string | null} */
+    let responseBody = null;
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      buffer += decoder.decode(value, { stream: true });
+      // Process complete SSE messages (double newline delimited)
+      const parts = buffer.split("\n\n");
+      buffer = parts.pop() || "";
+      for (const part of parts) {
+        const lines = part.split("\n");
+        const event = lines[0].split(": ")[1];
+        const data = lines[1].split(": ").slice(1).join(": ");
+        if (event === "log") {
+          /** @type {{level: "debug" | "info" | "warn" | "error"; args: unknown[]}} */
+          const detail = JSON.parse(data);
+          console[detail.level](...detail.args);
+        } else if (event === "response") {
+          responseBody = data;
+        }
+      }
+    }
+    // Reconstruct a normal Response from the final payload so tRPC client is happy
+    return new Response(responseBody, {
+      status: res.status,
+      headers: { "content-type": "application/json" },
+    });
   };
 };
 
+/** @param {{ daemonBaseUrl: string }} params */
+const getDaemonProcedures = async (params) => {
+  const daemonRouter = await loadAppRouter({ baseUrl: params.daemonBaseUrl });
+  const proxiedRouter = proxify(daemonRouter.procedures, async () => {
+    return createTRPCClient({
+      links: [
+        httpLink({
+          url: `${params.daemonBaseUrl}/api/trpc/`,
+          fetch: streamingFetch(params.daemonBaseUrl),
+        }),
+      ],
+    });
+  });
+
+  return proxiedRouter;
+};
+
 const launcherProcedures = {
   doctor: t.procedure
     .meta({ description: "Show launcher config and resolved runtime options" })
     .mutation(async () => {
-      const runtime = resolveRuntimeOptions();
-      return {
-        configPath: CONFIG_PATH,
-        repoDir: runtime.repoDir,
-        repoDirSource: runtime.repoDirSource,
-        autoInstall: runtime.autoInstall,
-        repoRef: runtime.repoRef ?? null,
-        repoUrl: runtime.repoUrl,
-        cwdRepoDir: runtime.cwdRepoDir ?? null,
-        repoExists: existsSync(runtime.repoDir),
-        dependenciesInstalled: hasInstalledDependencies(runtime.repoDir),
-      };
+      const configFile = readConfigFile();
+      const parsed = ConfigFile.safeParse(configFile);
+      if (!parsed.success) {
+        throw new Error(`Invalid config file ${CONFIG_PATH}: ${z.prettifyError(parsed.error)}`);
+      }
+      const current = readAuthConfig(process.cwd());
+      if (current instanceof Error) throw current;
+      return { configPath: CONFIG_PATH, current };
     }),
   setup: t.procedure
-    .input(SetupInput)
-    .meta({ description: "Configure auth + launcher defaults for current workspace" })
+    .input(SetupInput.partial())
+    .meta({ prompt: true, description: "Configure auth + launcher defaults for current workspace" })
     .mutation(async ({ input }) => {
-      const runtime = resolveRuntimeOptions();
-
-      const rawRepoPath = input.repoPath.trim().toLowerCase();
-      let repoPath = normalizePath(input.repoPath);
-      if (rawRepoPath === "managed") {
-        repoPath = DEFAULT_REPO_DIR;
-      } else if (rawRepoPath === "local") {
-        if (!runtime.cwdRepoDir) {
-          throw new Error(
-            "'local' repoPath was selected but current directory is not inside an iterate repo",
-          );
-        }
-        repoPath = runtime.cwdRepoDir;
-      }
-
-      const next = writeLauncherConfig({
-        launcherPatch: { repoPath, autoInstall: input.autoInstall },
-        workspacePatch: {
-          baseUrl: input.baseUrl,
+      writeNewConfig({
+        scope: input.scope || "workspace",
+        patch: {
+          osBaseUrl: input.osBaseUrl,
+          daemonBaseUrl: input.daemonBaseUrl,
           adminPasswordEnvVarName: input.adminPasswordEnvVarName,
-          userId: input.userId,
+          userEmail: input.userEmail,
         },
-        scope: input.scope,
         workspacePath: process.cwd(),
       });
-      return {
-        configPath: CONFIG_PATH,
-        launcher: sanitizeLauncherConfig(getMergedWorkspaceConfig(next, process.cwd())),
-        scope: input.scope,
-      };
-    }),
-  install: t.procedure
-    .meta({ description: "Clone repo if needed, then run pnpm install" })
-    .mutation(async () => {
-      const runtime = resolveRuntimeOptions();
-      await ensureRepoCheckout(runtime);
-      await installDependencies({ repoDir: runtime.repoDir });
-      return { repoDir: runtime.repoDir };
+
+      const current = readAuthConfig(process.cwd());
+      if (current instanceof Error) throw current;
+      return { configPath: CONFIG_PATH, current };
     }),
+
+  whoami: t.procedure.mutation(async () => {
+    const authConfig = readAuthConfig(process.cwd());
+    if (authConfig instanceof Error) throw authConfig;
+    const { userClient } = await osAuthDance(authConfig);
+    return await userClient.getSession();
+  }),
 };
 
-/** @param {string[]} args */
-const runCli = async (args) => {
-  const runtime = resolveRuntimeOptions();
-  await ensureRepoCheckout(runtime);
+const runCli = async () => {
+  const authConfig = readAuthConfig(process.cwd());
 
-  if (runtime.autoInstall && !hasInstalledDependencies(runtime.repoDir)) {
-    await installDependencies({ repoDir: runtime.repoDir });
+  /** @type {(problem: string) => (e: Error) => {}} */
+  const errorProcedure = (problem) => (e) => {
+    const message = `${problem}: ${e.message}`;
+    return t.procedure.meta({ description: message }).mutation(() => {
+      throw new Error(problem, { cause: e });
+    });
+  };
+
+  /** @type {import("@trpc/server").AnyRouter[]} */
+  const routers = [t.router(launcherProcedures)];
+
+  if (authConfig instanceof Error) {
+    routers.push(
+      t.router({
+        os: errorProcedure(`Invalid auth config`)(authConfig),
+        daemon: errorProcedure(`Invalid auth config`)(authConfig),
+      }),
+    );
+  } else {
+    const [osProcedures, daemonProcedures] = await Promise.allSettled([
+      getOsProcedures({ baseUrl: authConfig.osBaseUrl }),
+      getDaemonProcedures({ daemonBaseUrl: authConfig.daemonBaseUrl }),
+    ]);
+
+    if (osProcedures.status === "fulfilled") {
+      routers.push(t.router({ os: osProcedures.value }));
+    } else {
+      routers.push(
+        t.router({
+          os: errorProcedure(`Couldn't connect to os at ${authConfig.osBaseUrl}`)(
+            osProcedures.reason,
+          ),
+        }),
+      );
+    }
+    if (daemonProcedures.status === "fulfilled") {
+      // don't nest daemon procedures under "daemon"
+      routers.push(daemonProcedures.value);
+    } else {
+      routers.push(
+        t.router({
+          daemon: errorProcedure(`Couldn't connect to daemon at ${authConfig.daemonBaseUrl}`)(
+            daemonProcedures.reason,
+          ),
+        }),
+      );
+    }
   }
 
-  const runtimeProcedures = await getRuntimeProcedures(runtime.repoDir);
-  const router = t.router({
-    ...launcherProcedures,
-    ...runtimeProcedures,
-  });
+  const router = t.mergeRouters(...routers);
 
   const cli = createCli({
     router,
@@ -650,15 +609,13 @@ const runCli = async (args) => {
     description: "Iterate CLI",
   });
 
-  process.argv = [process.argv[0], process.argv[1], ...args];
   await cli.run({
     prompts: isAgent ? undefined : prompts,
   });
 };
 
 const main = async () => {
-  const args = process.argv.slice(2);
-  await runCli(args);
+  await runCli();
 };
 
 main().catch((error) => {

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "iterate",
-  "version": "0.2.0",
+  "version": "0.2.3",
   "description": "CLI for iterate",
-  "license": "AGPL-3.0-only",
+  "license": "Apache-2.0",
   "type": "module",
   "repository": {
     "type": "git",
@@ -40,7 +40,7 @@
     "@trpc/server": "^11.7.2",
     "better-auth": "1.4.3",
     "superjson": "^2.2.2",
-    "trpc-cli": "^0.12.2",
+    "trpc-cli": "0.12.4",
     "zod": "4.1.12"
   }
 }