laneyard 0.1.0 → 0.3.0

package/dist/src/heuristics/platforms.js

@@ -0,0 +1,77 @@
+/**
+ * Which platforms a project builds for.
+ *
+ * Named knowledge of mobile toolchains — that `.xcodeproj` means Xcode, that
+ * `build.gradle` means Gradle — hence its place in this module, and the
+ * boundary that comes with it: nothing here refuses anything. It answers a
+ * question; `setup` writes the answer down and the checklist reads it.
+ *
+ * It lives here rather than in `cli/detect.ts` because two callers need the
+ * same answer. Setup proposes a configuration from it, and the checklist
+ * decides which sections apply from it. Two copies of this reasoning would be
+ * free to disagree about the same repository, and the checklist would be the
+ * one that looked wrong.
+ */
+/**
+ * What a repository looks like from the outside, as a table.
+ *
+ * The depth is deliberate: an app in a monorepo sits one level down
+ * (`android/build.gradle`, `ios/App.xcodeproj`), which is where Flutter and
+ * React Native put them.
+ */
+export const PLATFORM_MARKERS = [
+    {
+        platform: "ios",
+        globs: ["*.xcodeproj", "*.xcworkspace", "*/*.xcodeproj", "*/*.xcworkspace"],
+        onlyDirectories: true,
+    },
+    {
+        platform: "android",
+        globs: ["build.gradle", "build.gradle.kts", "*/build.gradle", "*/build.gradle.kts"],
+        onlyDirectories: false,
+    },
+];
+/**
+ * What the repository contains.
+ *
+ * Never throws. An absent clone is a reason to answer "nothing found", not to
+ * fail the checklist that was about to explain why the clone is absent.
+ */
+export async function detectPlatforms(find) {
+    const found = [];
+    // Sequential, and in the table's order, so the answer is stable: this list
+    // decides the order of the sections someone reads.
+    for (const marker of PLATFORM_MARKERS) {
+        try {
+            const paths = await find(marker.globs, { onlyDirectories: marker.onlyDirectories });
+            if (paths.length > 0)
+                found.push(marker.platform);
+        }
+        catch {
+            // A marker that cannot be looked for is simply not found.
+        }
+    }
+    return found;
+}
+/**
+ * The configuration first, then the repository.
+ *
+ * An empty configured list counts as saying nothing: `platforms: []` is what a
+ * commented-out line leaves behind, and reading it as "this project builds for
+ * nothing" would silently empty the checklist.
+ */
+export function platformsOf(configured, detected) {
+    const chosen = configured && configured.length > 0 ? configured : detected;
+    // Normalised through the table: a hand-written `[android, ios]` must not
+    // reorder the screen, and a platform named twice must not appear twice.
+    return PLATFORM_MARKERS.map((m) => m.platform).filter((p) => chosen.includes(p));
+}
+/** The two steps in one call, for callers that have a directory to look at. */
+export async function resolvePlatforms(configured, find) {
+    // The repository is only listed when the configuration did not answer:
+    // globbing a workspace costs a directory walk, and a project that says what
+    // it builds for should not pay for one.
+    if (configured && configured.length > 0)
+        return platformsOf(configured, []);
+    return platformsOf(undefined, await detectPlatforms(find));
+}

package/dist/src/heuristics/readiness.js

@@ -0,0 +1,336 @@
+import { findBlockingActions } from "./blocking-actions.js";
+const ok = (detail) => ({ state: "ok", detail });
+const warn = (detail, fix, fixIn) => ({
+    state: "warn",
+    detail,
+    ...(fix === undefined ? {} : { fix }),
+    ...(fixIn === undefined ? {} : { fixIn }),
+});
+const undetermined = (detail, fix) => ({
+    state: "unknown",
+    detail,
+    ...(fix === undefined ? {} : { fix }),
+});
+/** A rejection is not always an `Error`; a checklist saying "undefined" is worse than useless. */
+const reasonOf = (cause) => cause instanceof Error ? cause.message : String(cause);
+/** Identity and wording live here so a check and its fallback cannot drift apart. */
+const META = {
+    repository: { id: "repository", title: "repository reachable without a password" },
+    dependencies: { id: "dependencies", title: "dependencies installable" },
+    appStoreConnect: { id: "app-store-connect", title: "App Store Connect authentication" },
+    match: { id: "match", title: "match usable without intervention" },
+    blockingActions: { id: "blocking-actions", title: "no action known to stop and ask" },
+    androidKeystore: { id: "android-keystore", title: "keystore reachable without a prompt" },
+    playStore: { id: "play-store", title: "Play Store service account" },
+    platforms: { id: "platforms", title: "what this project builds for" },
+};
+/**
+ * Does the remote answer without asking anyone for credentials?
+ *
+ * The probe is injected — `Workspace` already knows how to run git with
+ * `GIT_TERMINAL_PROMPT=0` and how to keep the repository URL, which may carry a
+ * token, out of its own error messages. Redacting is the probe's job, not this
+ * check's: whatever it rejects with is repeated verbatim.
+ */
+export async function checkRepository(probe) {
+    try {
+        await probe();
+        return { ...META.repository, ...ok("the remote answers without asking for credentials.") };
+    }
+    catch (cause) {
+        return {
+            ...META.repository,
+            ...warn(reasonOf(cause), "Give the project a key it can use without a passphrase — " +
+                "`git_auth: {kind: ssh_key, ref: /path/to/key}` in config.yml — or a URL that needs no password. " +
+                "A run that meets a credentials prompt does not fail: it waits."),
+        };
+    }
+}
+export async function checkDependencies(input) {
+    const { workspace } = input;
+    if (!workspace.ok) {
+        return { ...META.dependencies, ...undetermined(`could not read the workspace: ${workspace.reason}`) };
+    }
+    if (workspace.value.hasGemfile) {
+        try {
+            await input.bundleCheck();
+            return { ...META.dependencies, ...ok("the Gemfile's bundle is installed.") };
+        }
+        catch (cause) {
+            return {
+                ...META.dependencies,
+                ...warn(reasonOf(cause), "Run `bundle install` in the project's workspace."),
+            };
+        }
+    }
+    let fastlane;
+    try {
+        fastlane = await input.findFastlane();
+    }
+    catch (cause) {
+        return { ...META.dependencies, ...undetermined(`could not look for fastlane: ${reasonOf(cause)}`) };
+    }
+    if (fastlane !== null) {
+        // Not a failure, but a fact worth stating: a system fastlane can be
+        // upgraded underneath a project that was working yesterday.
+        return {
+            ...META.dependencies,
+            ...ok(`no Gemfile — runs use ${fastlane}, whose version nothing pins.`),
+        };
+    }
+    return {
+        ...META.dependencies,
+        ...warn("no Gemfile, and no fastlane on the PATH: a run has nothing to execute.", 'Add a Gemfile with `gem "fastlane"` and run `bundle install`, or install fastlane system-wide.'),
+    };
+}
+/** Any suffix: the key is split across several variables, and their names vary by lane. */
+const API_KEY = /^APP_STORE_CONNECT_API_KEY/;
+const STORE_API_KEY = "Store an App Store Connect API key — `APP_STORE_CONNECT_API_KEY_ID`, " +
+    "`APP_STORE_CONNECT_API_KEY_ISSUER_ID` and the `.p8` contents — from the secrets tab. " +
+    "An API key does not expire on its own.";
+export function checkAppStoreConnect(secretKeys) {
+    if (secretKeys.some((key) => API_KEY.test(key))) {
+        return { ...META.appStoreConnect, ...ok("an App Store Connect API key is in the vault.") };
+    }
+    if (secretKeys.includes("FASTLANE_SESSION")) {
+        return {
+            ...META.appStoreConnect,
+            ...warn("only a FASTLANE_SESSION: Apple sessions expire, and the run that finds it expired " +
+                "stops and asks for a verification code.", STORE_API_KEY, "secrets"),
+        };
+    }
+    return {
+        ...META.appStoreConnect,
+        ...warn("no App Store Connect credential in the vault: a lane that uploads will ask for an Apple ID.", STORE_API_KEY, "secrets"),
+    };
+}
+/** The two names for the same action. `match` is the older one, still the common one. */
+const MATCH_ACTIONS = new Set(["match", "sync_code_signing"]);
+/** "beta and release" reads better than a list of one, and than a trailing comma. */
+function nameList(names) {
+    const unique = [...new Set(names)];
+    if (unique.length <= 1)
+        return unique[0] ?? "";
+    return `${unique.slice(0, -1).join(", ")} and ${unique[unique.length - 1]}`;
+}
+export function checkMatch(uses, secretKeys) {
+    if (!uses.ok) {
+        return { ...META.match, ...undetermined(`could not read the lanes: ${uses.reason}`) };
+    }
+    const calls = uses.value.flatMap((lane) => lane.actions.filter((a) => MATCH_ACTIONS.has(a.name)).map((action) => ({ lane: lane.lane, action })));
+    if (calls.length === 0) {
+        return { ...META.match, ...ok("no lane uses match.") };
+    }
+    if (!secretKeys.includes("MATCH_PASSWORD")) {
+        return {
+            ...META.match,
+            ...warn(`${nameList(calls.map((c) => c.lane))} calls match, but MATCH_PASSWORD is not in the vault: ` +
+                "match asks for the passphrase and waits for it.", "Store `MATCH_PASSWORD` from the secrets tab.", "secrets"),
+        };
+    }
+    const writable = calls.filter((c) => c.action.args["readonly"] === false);
+    if (writable.length > 0) {
+        return {
+            ...META.match,
+            ...warn(`${nameList(writable.map((c) => c.lane))} calls match with \`readonly: false\`: it may try to ` +
+                "create certificates, which needs an Apple account interactively.", "Pass `readonly: true` so it only fetches what already exists."),
+        };
+    }
+    // `match(readonly: ENV["RO"])` arrives with no `readonly` at all: the sidecar
+    // reports literal arguments and refuses to guess at the rest. Calling that
+    // green would be the checklist claiming to know something it does not.
+    const undecided = calls.filter((c) => !("readonly" in c.action.args));
+    if (undecided.length > 0) {
+        return {
+            ...META.match,
+            ...undetermined(`MATCH_PASSWORD is stored, but \`readonly\` is not a literal in ` +
+                `${nameList(undecided.map((c) => c.lane))}: Laneyard reads literal arguments only, and will not guess.`, "Pass `readonly: true` in the call itself if that is what you mean."),
+        };
+    }
+    return { ...META.match, ...ok("MATCH_PASSWORD is stored, and every match call is readonly.") };
+}
+export function checkBlockingActions(uses) {
+    if (!uses.ok) {
+        return { ...META.blockingActions, ...undetermined(`could not read the lanes: ${uses.reason}`) };
+    }
+    const findings = uses.value.flatMap((lane) => findBlockingActions(lane.actions).map((finding) => ({ lane: lane.lane, finding })));
+    if (findings.length === 0) {
+        return { ...META.blockingActions, ...ok("no lane calls an action known to stop and ask.") };
+    }
+    return {
+        ...META.blockingActions,
+        ...warn(findings.map((f) => `${f.lane} calls ${f.finding.action}: it ${f.finding.because}`).join("; ") + ".", 
+        // The same fix stated twice reads as two different fixes.
+        [...new Set(findings.map((f) => f.finding.fix))].join(" ")),
+    };
+}
+/** `build_android_app` is the newer name for the same action. */
+const GRADLE_ACTIONS = new Set(["gradle", "build_android_app"]);
+/**
+ * The arguments that say a lane hands gradle a keystore of its own.
+ *
+ * Read literally, like everything else here. `gradle(storePassword: ENV["PW"])`
+ * arrives with no `storePassword` at all — the sidecar drops what it cannot
+ * read — and this check says so rather than inventing a verdict.
+ */
+const KEYSTORE_ARGS = ["storeFile", "storePassword"];
+/** `ANDROID_KEYSTORE_PASSWORD`, `KEYSTORE_PASSWORD`, `STORE_PASSWORD`. */
+const KEYSTORE_PASSWORD = /(^|_)(KEYSTORE|STORE)_PASSWORD$/;
+const STORE_KEYSTORE_PASSWORD = "Store the keystore passphrase as `ANDROID_KEYSTORE_PASSWORD` from the secrets tab, " +
+    "and read it in the lane with `storePassword: ENV[\"ANDROID_KEYSTORE_PASSWORD\"]`.";
+export function checkAndroidKeystore(uses, secretKeys) {
+    if (!uses.ok) {
+        return { ...META.androidKeystore, ...undetermined(`could not read the lanes: ${uses.reason}`) };
+    }
+    const calls = uses.value.flatMap((lane) => lane.actions.filter((a) => GRADLE_ACTIONS.has(a.name)).map((action) => ({ lane: lane.lane, action })));
+    if (calls.length === 0) {
+        return { ...META.androidKeystore, ...ok("no lane builds with gradle.") };
+    }
+    const signing = calls.filter((c) => KEYSTORE_ARGS.some((arg) => arg in c.action.args));
+    if (signing.length === 0) {
+        // Deliberately a statement about what was read, not about the build: a
+        // keystore configured in `build.gradle` or through the environment is
+        // invisible from here, and claiming it is absent would be a guess.
+        return {
+            ...META.androidKeystore,
+            ...ok("no lane passes `storeFile` or `storePassword` to gradle: nothing here needs unlocking."),
+        };
+    }
+    const withoutPassphrase = signing.filter((c) => !("storePassword" in c.action.args));
+    if (withoutPassphrase.length === 0) {
+        return {
+            ...META.androidKeystore,
+            ...ok(`${nameList(signing.map((c) => c.lane))} passes \`storePassword\` in the call itself: ` +
+                "gradle has what it needs."),
+        };
+    }
+    if (secretKeys.some((key) => KEYSTORE_PASSWORD.test(key))) {
+        return { ...META.androidKeystore, ...ok("a keystore passphrase is in the vault.") };
+    }
+    return {
+        ...META.androidKeystore,
+        ...warn(`${nameList(withoutPassphrase.map((c) => c.lane))} hands gradle a keystore, but no keystore ` +
+            "passphrase is in the vault: gradle asks for it and waits.", STORE_KEYSTORE_PASSWORD, "secrets"),
+    };
+}
+/** The two names for the same action. `supply` is the older one. */
+const PLAY_UPLOAD_ACTIONS = new Set(["upload_to_play_store", "supply"]);
+/** `SUPPLY_JSON_KEY` and `SUPPLY_JSON_KEY_DATA`, the names fastlane itself reads. */
+const PLAY_JSON_KEY = /^SUPPLY_JSON_KEY/;
+/** The same credential, named in the call instead of in the vault. */
+const PLAY_KEY_ARGS = ["json_key", "json_key_data"];
+const STORE_PLAY_KEY = "Store the service account JSON as `SUPPLY_JSON_KEY_DATA` from the secrets tab. " +
+    "A service account does not expire on its own.";
+export function checkPlayStore(uses, secretKeys) {
+    if (!uses.ok) {
+        return { ...META.playStore, ...undetermined(`could not read the lanes: ${uses.reason}`) };
+    }
+    const calls = uses.value.flatMap((lane) => lane.actions
+        .filter((a) => PLAY_UPLOAD_ACTIONS.has(a.name))
+        .map((action) => ({ lane: lane.lane, action })));
+    if (calls.length === 0) {
+        return { ...META.playStore, ...ok("no lane uploads to the Play Store.") };
+    }
+    if (secretKeys.some((key) => PLAY_JSON_KEY.test(key))) {
+        return { ...META.playStore, ...ok("a Play Store service account is in the vault.") };
+    }
+    const named = calls.filter((c) => PLAY_KEY_ARGS.some((arg) => arg in c.action.args));
+    if (named.length > 0) {
+        // A path in a Fastfile says nothing about whether that file exists on this
+        // machine. Neither a tick nor a warning would be honest.
+        return {
+            ...META.playStore,
+            ...undetermined(`${nameList(named.map((c) => c.lane))} passes \`json_key\` in the call: whether that file is ` +
+                "on this machine is not something a Fastfile says.", STORE_PLAY_KEY),
+        };
+    }
+    return {
+        ...META.playStore,
+        ...warn(`${nameList(calls.map((c) => c.lane))} uploads to the Play Store, but no service account is in ` +
+            "the vault: supply stops and asks which credentials to use.", STORE_PLAY_KEY, "secrets"),
+    };
+}
+/**
+ * The line a project with no platform gets instead of half a checklist.
+ *
+ * It is not a check — nothing was examined — and it is not a warning either.
+ * It says what is missing and where to write it down, and then the shared
+ * checks above it still stand on their own.
+ */
+function platformNote(platforms) {
+    return {
+        ...META.platforms,
+        ...undetermined(platforms.ok
+            ? "no platform detected: no Xcode project and no Gradle build in the repository, " +
+                "and laneyard.yml names none. Only the checks above apply."
+            : `could not tell: ${platforms.reason}. Only the checks above apply.`, "Add `platforms: [ios]`, `[android]` or both to laneyard.yml in the repository, " +
+            "and the checks for that platform appear here."),
+    };
+}
+/**
+ * The checklist itself: a table, so that adding a check is adding a row.
+ *
+ * Exported because the order it declares is the order the interface shows, and
+ * a test that checks that should read the same list.
+ */
+export const SECTIONS = [
+    {
+        platform: "all",
+        checks: [
+            { ...META.repository, run: (i) => checkRepository(i.probeRepository) },
+            { ...META.dependencies, run: (i) => checkDependencies(i.dependencies) },
+            { ...META.blockingActions, run: (i) => checkBlockingActions(i.uses) },
+        ],
+    },
+    {
+        platform: "ios",
+        checks: [
+            { ...META.appStoreConnect, run: (i) => checkAppStoreConnect(i.secretKeys) },
+            { ...META.match, run: (i) => checkMatch(i.uses, i.secretKeys) },
+        ],
+    },
+    {
+        platform: "android",
+        checks: [
+            { ...META.androidKeystore, run: (i) => checkAndroidKeystore(i.uses, i.secretKeys) },
+            { ...META.playStore, run: (i) => checkPlayStore(i.uses, i.secretKeys) },
+        ],
+    },
+];
+/**
+ * Runs the sections that apply, and guarantees the list comes back whole.
+ *
+ * Each check already commits to not throwing. This wrapper exists because that
+ * promise is worth exactly as much as the next person to edit a check: one
+ * probe misbehaving must cost one line of the checklist, not the checklist.
+ */
+export async function runChecklist(input) {
+    // Read once and defensively: this is the one value used outside a check body,
+    // and a malformed one must not be the thing that empties the whole screen.
+    const platforms = input.platforms && input.platforms.ok && Array.isArray(input.platforms.value)
+        ? input.platforms.value
+        : [];
+    const sections = await Promise.all(SECTIONS.filter((s) => s.platform === "all" || platforms.includes(s.platform)).map(async (section) => ({
+        platform: section.platform,
+        checks: await Promise.all(section.checks.map(async ({ id, title, run }) => {
+            try {
+                return await run(input);
+            }
+            catch (cause) {
+                return {
+                    id,
+                    title,
+                    state: "unknown",
+                    detail: `the check itself failed: ${reasonOf(cause)}`,
+                };
+            }
+        })),
+    })));
+    // The shared section is always first and always present, so the note about a
+    // missing platform sits under the checks that still applied.
+    const shared = sections[0];
+    if (platforms.length === 0 && shared) {
+        shared.checks.push(platformNote(input.platforms ?? { ok: true, value: [] }));
+    }
+    return sections;
+}

package/dist/src/logs/redact.js

@@ -0,0 +1,86 @@
+/** What a redacted value is replaced with. Fixed width, so it leaks no length. */
+const MARKER = "••••••";
+/**
+ * Values shorter than this are left alone.
+ *
+ * A two-character secret would match constantly and turn the log into confetti
+ * while hiding nothing an attacker could not guess. Refusing is more honest than
+ * pretending to protect it.
+ */
+export const MIN_LENGTH = 4;
+/**
+ * Removes secret values from a stream of text.
+ *
+ * The difficulty is not the replacement, it is the boundaries: a pseudo-terminal
+ * cuts its output wherever it likes, so a secret can arrive as `hun` then `ter2`.
+ * Replacing chunk by chunk would let it through in two pieces — and the file on
+ * disk would contain it in full.
+ *
+ * So the redactor holds back the last few characters, exactly as many as could
+ * still turn out to be the beginning of a secret, and releases them only once
+ * they cannot. `flush()` empties that buffer at the end of the run.
+ */
+/**
+ * One-shot removal, for text that is not part of the live stream.
+ *
+ * A run's error summary is stored in the database and rendered in the interface
+ * without ever passing through the stream, so it needs its own pass. Using the
+ * live `Redactor` instance here would corrupt its buffer mid-run.
+ */
+export function scrub(text, values) {
+    let out = text;
+    for (const value of [...new Set(values.filter((v) => v.length >= MIN_LENGTH))].sort((a, b) => b.length - a.length)) {
+        out = out.split(value).join(MARKER);
+    }
+    return out;
+}
+export class Redactor {
+    values;
+    longest;
+    held = "";
+    constructor(values) {
+        // Longest first: replacing "token" before "token-suffix" would leave the
+        // suffix behind in the log.
+        this.values = [...new Set(values.filter((v) => v.length >= MIN_LENGTH))].sort((a, b) => b.length - a.length);
+        this.longest = this.values.reduce((max, v) => Math.max(max, v.length), 0);
+    }
+    replaceAll(text) {
+        let out = text;
+        for (const value of this.values)
+            out = out.split(value).join(MARKER);
+        return out;
+    }
+    /**
+     * How many trailing characters could still turn into a secret.
+     *
+     * Holding a fixed window of `longest - 1` would be correct but wasteful: with
+     * a 200-character API key in the vault, every chunk would stall its last 199
+     * characters until the next one arrived, and the live terminal would lag
+     * visibly. So we keep only what is genuinely ambiguous — the longest suffix
+     * that is a proper prefix of some secret — which is usually nothing at all.
+     */
+    ambiguousTail(text) {
+        const max = Math.min(this.longest - 1, text.length);
+        for (let length = max; length > 0; length -= 1) {
+            const suffix = text.slice(text.length - length);
+            if (this.values.some((value) => value.startsWith(suffix)))
+                return length;
+        }
+        return 0;
+    }
+    /** Takes a chunk, returns the part that is safe to write out. */
+    push(chunk) {
+        if (this.values.length === 0)
+            return chunk;
+        const combined = this.replaceAll(this.held + chunk);
+        const keep = this.ambiguousTail(combined);
+        this.held = combined.slice(combined.length - keep);
+        return keep === 0 ? combined : combined.slice(0, combined.length - keep);
+    }
+    /** Releases the tail. Call once, when the stream is over. */
+    flush() {
+        const rest = this.replaceAll(this.held);
+        this.held = "";
+        return rest;
+    }
+}

package/dist/src/main.js

@@ -3,16 +3,22 @@ import { realpathSync } from "node:fs";
 import { mkdir } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { bold, dim, field, heading } from "./cli/style.js";
 import { fileURLToPath } from "node:url";
-import { runAddCommand } from "./cli/add.js";
+import { runSetupCommand } from "./cli/setup.js";
+import { runSecretCommand } from "./cli/secret.js";
+import { runUserCommand } from "./cli/user.js";
 import { ConfigStore } from "./config/store.js";
 import { CacheStore } from "./db/cache.js";
 import { openDatabase } from "./db/open.js";
 import { RunStore } from "./db/runs.js";
+import { SecretStore } from "./db/secrets.js";
 import { buildApp } from "./server/app.js";
+import { Vault } from "./secrets/vault.js";
 import { makeInvoke } from "./sidecar/bridge.js";
 import { LaneReader } from "./sidecar/lanes.js";
-export const version = "0.1.0";
+import { UsesReader } from "./sidecar/uses.js";
+export const version = "0.3.0";
 /** Assembles the server from a data folder. */
 export async function createServerFromConfig(root) {
     const config = new ConfigStore(join(root, "config.yml"));
@@ -20,19 +26,31 @@ export async function createServerFromConfig(root) {
     if (!loaded.ok)
         throw new Error(`Unreadable configuration: ${loaded.error}`);
     const db = openDatabase(join(root, "laneyard.db"));
-    // No run can survive the shutdown of the process that carried it.
-    new RunStore(db).interruptActive();
+    // No run that had begun can survive the shutdown of the process that carried
+    // it. Queued runs never began, so they stay queued for the next start.
+    new RunStore(db).interruptInFlight();
     const cache = new CacheStore(db);
+    const vault = await Vault.open(root, new SecretStore(db));
     const app = await buildApp({
         config,
         db,
         root,
+        vault,
         lanes: async (slug, workspacePath, fastlaneDir) => {
             const resolved = await config.resolve(slug, workspacePath);
             const reader = new LaneReader(cache, makeInvoke(resolved?.settings.runtime ?? "bundle"));
             return reader.read(slug, workspacePath, fastlaneDir);
         },
+        uses: async (slug, workspacePath, fastlaneDir) => {
+            const resolved = await config.resolve(slug, workspacePath);
+            const reader = new UsesReader(cache, makeInvoke(resolved?.settings.runtime ?? "bundle"));
+            return reader.read(slug, workspacePath, fastlaneDir);
+        },
     });
+    // Anything left queued from the previous life starts moving again now. Without
+    // this, `wake()` would only ever be called from the trigger route, and three
+    // runs queued before a restart would wait for someone to trigger a fourth.
+    app.queue.wake();
     return { app, db, config };
 }
 /** Real startup, outside tests. */
@@ -45,7 +63,24 @@ async function main() {
     });
     const server = config.server();
     await app.listen({ port: server.port, host: server.bind });
-    console.log(`Laneyard is listening on http://localhost:${server.port}`);
+    const projects = config.projects();
+    process.stdout.write(heading(`laneyard ${version}`) +
+        field("listening", `http://localhost:${server.port}`) +
+        "\n" +
+        field("config", join(root, "config.yml")) +
+        "\n" +
+        field("projects", projects.length === 0
+            ? dim("none yet")
+            : projects.map((p) => p.slug).join(", ")) +
+        "\n" +
+        (projects.length === 0
+            ? // A server with nothing to build should say what to do next rather
+                // than sit there looking successful.
+                "\n" +
+                    dim("  No project yet. From a folder that already uses fastlane:\n") +
+                    `  ${bold("laneyard setup")}\n`
+            : "") +
+        "\n");
 }
 /**
  * True when this file is what the user launched, rather than something that
@@ -68,7 +103,12 @@ function invokedDirectly() {
 }
 const USAGE = `laneyard — a self-hosted web UI for fastlane
 
-  laneyard add        adopt the project in the current directory
+  laneyard setup      set up the project in the current directory
+                      --yes accepts every detected value without asking
+  laneyard secret set NAME [--project <slug>]
+                      store a secret, its value read from standard input
+  laneyard user add NAME [--role admin|builder]
+                      create an account, its password read from standard input
   laneyard            start the server
   laneyard --version  print the version
 
@@ -83,7 +123,7 @@ function explainStartupFailure(cause) {
     if (message.includes("ENOENT") && message.includes("config.yml")) {
         return ("No configuration yet.\n\n" +
             "  cd into a project that already uses fastlane, then run:\n" +
-            "    laneyard add\n\n" +
+            "    laneyard setup\n\n" +
             "That writes " + join(homeDir(), "config.yml") + " for you.");
     }
     return message;
@@ -98,13 +138,16 @@ if (invokedDirectly()) {
         process.stdout.write(`${version}\n`);
         process.exit(0);
     }
-    if (command === "add") {
+    if (command === "setup") {
         const home = homeDir();
         await mkdir(home, { recursive: true });
         const slugIndex = rest.indexOf("--slug");
         const slug = slugIndex === -1 ? undefined : rest[slugIndex + 1];
+        // `--yes` accepts every proposal, for scripts and for anyone who has done
+        // this before. Interactive is the default because the values are guesses.
+        const yes = rest.includes("--yes") || rest.includes("-y");
         try {
-            process.exit(await runAddCommand(process.cwd(), join(home, "config.yml"), slug));
+            process.exit(await runSetupCommand(process.cwd(), join(home, "config.yml"), { slug, yes }));
         }
         catch (cause) {
             // A taken slug or an unreadable file are ordinary situations. A stack
@@ -113,6 +156,33 @@ if (invokedDirectly()) {
             process.exit(1);
         }
     }
+    // Above the catch-all below, which would otherwise reject it as unknown.
+    if (command === "secret") {
+        const home = homeDir();
+        await mkdir(home, { recursive: true });
+        process.exit(await runSecretCommand(home, rest, {
+            stdin: process.stdin,
+            interactive: process.stdin.isTTY === true,
+            out: (text) => process.stdout.write(text),
+            err: (text) => process.stderr.write(text),
+        }));
+    }
+    if (command === "user") {
+        const home = homeDir();
+        await mkdir(home, { recursive: true });
+        process.exit(await runUserCommand(home, rest, {
+            stdin: process.stdin,
+            interactive: process.stdin.isTTY === true,
+            out: (text) => process.stdout.write(text),
+            err: (text) => process.stderr.write(text),
+        }));
+    }
+    // 0.1.0 shipped this as `add`. Anyone who learned that name deserves a
+    // sentence rather than "Unknown command".
+    if (command === "add") {
+        process.stderr.write("`laneyard add` is now `laneyard setup`.\n");
+        process.exit(1);
+    }
     if (command !== undefined) {
         process.stderr.write(`Unknown command: ${command}\n\n${USAGE}`);
         process.exit(1);