lastlight-shared 0.1.0

package/dist/overlay-bootstrap.js

@@ -0,0 +1,304 @@
+/**
+ * Shared bootstrap for the private deployment overlay (`instance/`).
+ *
+ * The overlay is a separate, private folder (typically its own GitHub repo)
+ * holding this deployment's `config.yaml` + `secrets/` + optional asset
+ * overrides. It's mounted read-only at `/app/instance` and selected via
+ * `LASTLIGHT_OVERLAY_DIR`. On a clean server there's nothing to clone yet — so
+ * this module can *create* one from scratch:
+ *
+ *  - {@link scaffoldOverlayFiles} — write the default files into a fresh overlay
+ *    (never overwriting anything that already exists).
+ *  - {@link detectGh} — probe the GitHub CLI for install + auth status.
+ *  - {@link bootstrapOverlayRepo} — `git init` + initial commit, then offer to
+ *    create + push a private GitHub repo (via `gh` when authed, otherwise print
+ *    the exact git/GitHub commands to run by hand).
+ *
+ * Used by both setup entry points: the `lastlight setup` wizard (`src/setup.ts`)
+ * and host-local `lastlight server setup` (`src/cli-server.ts`).
+ */
+import { execFile, spawn } from "node:child_process";
+import { promisify } from "node:util";
+import fs from "node:fs";
+import path from "node:path";
+import * as p from "@clack/prompts";
+import chalk from "chalk";
+const exec = promisify(execFile);
+const dim = chalk.dim;
+const teal = chalk.hex("#1A7A8A");
+// ── templates ────────────────────────────────────────────────────────────────
+/** `.gitignore` for the overlay so it can be its own private repo without
+ *  leaking secrets. Everything under `secrets/` is ignored except the template. */
+export const OVERLAY_GITIGNORE = [
+    "# Host-only secrets — never commit. Everything under secrets/ is ignored",
+    "# except the template.",
+    "secrets/*",
+    "!secrets/.env.example",
+    ".env",
+    "*.pem",
+    "",
+].join("\n");
+/** Placeholder `config.yaml` for a fresh overlay (no managed repos yet). */
+export const OVERLAY_CONFIG_PLACEHOLDER = [
+    "# Last Light — private deployment overlay config",
+    "# Merged over the public config/default.yaml at startup; arrays replace,",
+    "# maps deep-merge, env vars override. Restart the agent to apply:",
+    "#   docker compose restart agent  (or: lastlight server restart agent)",
+    "",
+    "managedRepos:",
+    "  []  # add owner/repo entries — the bot ignores repos not listed here",
+    "",
+    "# Pin which core version this instance runs. `lastlight server update|setup`",
+    "# checks core out at this git tag/ref and rebuilds; unset (or main/latest)",
+    "# tracks main. Bump + commit here to drive deploys from the overlay.",
+    "# deploy:",
+    "#   version: v0.10.6",
+    "",
+].join("\n");
+/** Template `secrets/.env.example` — the only tracked file under `secrets/`.
+ *  Mirrors the keys `npx lastlight setup` writes into `secrets/.env`. */
+export const OVERLAY_ENV_EXAMPLE = [
+    "# ── Last Light — environment template ───────────────────────────",
+    "# Copy to secrets/.env and fill in. The whole instance/ folder is mounted",
+    "# read-only at /app/instance; the entrypoint reads secrets from",
+    "# /app/instance/secrets. secrets/.env and *.pem are gitignored.",
+    "",
+    "# ── Overlay (this deployment's private config + assets) ──",
+    "LASTLIGHT_OVERLAY_DIR=/app/instance",
+    "",
+    "# ── GitHub App (required) ────────────────────────────────",
+    "GITHUB_APP_ID=",
+    "# PEM lives at instance/secrets/app.pem; the entrypoint symlinks it to /app/app.pem.",
+    "GITHUB_APP_PRIVATE_KEY_PATH=./app.pem",
+    "GITHUB_APP_INSTALLATION_ID=",
+    "",
+    "# ── Webhook (required) — must match the GitHub App webhook secret ──",
+    "WEBHOOK_SECRET=",
+    "",
+    "# ── Domain (used by Caddy for TLS) ───────────────────────",
+    "DOMAIN=localhost",
+    "",
+    "# ── Model + provider API key ─────────────────────────────",
+    "LASTLIGHT_MODEL=anthropic/claude-sonnet-4-6",
+    "# Set the env var that matches your LASTLIGHT_MODEL's provider.",
+    "# The wizard-able registry (src/providers.ts): anthropic, openai, openrouter,",
+    "# google (GEMINI_API_KEY), mistral, groq, cerebras, xai, huggingface (HF_TOKEN),",
+    "# moonshotai, nvidia, fireworks, together, deepseek, zai, kimi-coding, minimax.",
+    "# ANTHROPIC_API_KEY=",
+    "# OPENAI_API_KEY=",
+    "# OPENROUTER_API_KEY=",
+    "",
+    "# ── Admin dashboard ──────────────────────────────────────",
+    "ADMIN_SECRET=",
+    "# ADMIN_PASSWORD=",
+    "",
+    "# ── Slack (optional) ─────────────────────────────────────",
+    "# SLACK_BOT_TOKEN=",
+    "# SLACK_APP_TOKEN=",
+    "# SLACK_DELIVERY_CHANNEL=",
+    "# SLACK_ALLOWED_USERS=",
+    "",
+].join("\n");
+/** README dropped into a freshly scaffolded overlay. */
+export const OVERLAY_README = [
+    "# lastlight-instance",
+    "",
+    "Private deployment overlay for [Last Light](https://github.com/nearform/lastlight).",
+    "Keeps deployment-specific config and secrets out of the public repo.",
+    "",
+    "Cloned into `instance/` next to the lastlight checkout's `docker-compose.yml`,",
+    "mounted read-only at `/app/instance`, selected via `LASTLIGHT_OVERLAY_DIR=/app/instance`.",
+    "",
+    "## Layout",
+    "",
+    "```",
+    "config.yaml            # overlay config — merged over public config/default.yaml",
+    "agent-context/*.md     # (optional) persona/rules overrides, merged by filename",
+    "workflows/*.yaml       # (optional) add or replace workflows by logical name",
+    "workflows/prompts/*.md # (optional) prompt overrides",
+    "skills/<name>/SKILL.md # (optional) skill overrides",
+    "secrets/               # host-only, gitignored: .env + GitHub App *.pem",
+    "  .env.example         # template (the only tracked file under secrets/)",
+    "```",
+    "",
+    "## First-time secrets",
+    "",
+    "```bash",
+    "cp secrets/.env.example secrets/.env   # then fill in keys, DOMAIN, etc.",
+    "cp /path/to/app.pem secrets/app.pem    # GitHub App private key",
+    "```",
+    "",
+    "Editing the overlay is **restart-only** (no image rebuild):",
+    "`git pull` then `lastlight server restart agent`.",
+    "",
+    "## Pinning the core version",
+    "",
+    "Add a `deploy.version` to `config.yaml` to pin which core release this",
+    "instance runs (a git tag/ref); unset — or `main`/`latest` — tracks `main`:",
+    "",
+    "```yaml",
+    "deploy:",
+    "  version: v0.10.6",
+    "```",
+    "",
+    "`lastlight server update` (and `server setup`) checks core out at that tag and",
+    "rebuilds. Bump + commit here and run `lastlight server update` on the host —",
+    "so this overlay repo is the single source of truth for the deployed version.",
+    "",
+].join("\n");
+/** Probe the GitHub CLI. Never throws — a missing/unauthed `gh` resolves to a
+ *  status the callers fall back from (print manual commands instead). */
+export async function detectGh() {
+    try {
+        await exec("gh", ["--version"], { timeout: 10_000 });
+    }
+    catch {
+        return { installed: false, authed: false };
+    }
+    let authed = false;
+    try {
+        await exec("gh", ["auth", "status"], { timeout: 10_000 });
+        authed = true;
+    }
+    catch {
+        return { installed: true, authed: false };
+    }
+    let login;
+    try {
+        const { stdout } = await exec("gh", ["api", "user", "--jq", ".login"], { timeout: 10_000 });
+        login = stdout.trim() || undefined;
+    }
+    catch {
+        /* authed but couldn't read login — leave undefined */
+    }
+    return { installed: true, authed, login };
+}
+/**
+ * Write the default overlay files into `instanceDir`, creating only what's
+ * missing — never overwriting an existing file. Returns the relative paths
+ * created so callers can report them.
+ */
+export function scaffoldOverlayFiles(instanceDir) {
+    const created = [];
+    const secretsDir = path.join(instanceDir, "secrets");
+    fs.mkdirSync(secretsDir, { recursive: true });
+    const writeIfMissing = (rel, content) => {
+        const abs = path.join(instanceDir, rel);
+        if (fs.existsSync(abs))
+            return;
+        fs.writeFileSync(abs, content, { encoding: "utf8" });
+        created.push(rel);
+    };
+    writeIfMissing("config.yaml", OVERLAY_CONFIG_PLACEHOLDER);
+    writeIfMissing(".gitignore", OVERLAY_GITIGNORE);
+    writeIfMissing("README.md", OVERLAY_README);
+    writeIfMissing(path.join("secrets", ".env.example"), OVERLAY_ENV_EXAMPLE);
+    return { created };
+}
+/** Run a command with inherited stdio so the user sees native git/gh output. */
+function run(label, cmd, args, cwd) {
+    p.log.step(chalk.bold(label));
+    console.log(dim(`  $ ${cmd} ${args.join(" ")}`));
+    return new Promise((resolve, reject) => {
+        const child = spawn(cmd, args, { stdio: "inherit", cwd });
+        child.on("error", reject);
+        child.on("exit", (code) => code === 0 ? resolve() : reject(new Error(`${label} failed (exit ${code ?? "signal"})`)));
+    });
+}
+async function gitCaptureSoft(args, cwd) {
+    try {
+        const { stdout } = await exec("git", args, { cwd, timeout: 20_000 });
+        return stdout.trim();
+    }
+    catch {
+        return null;
+    }
+}
+function isGitRepo(dir) {
+    return fs.existsSync(path.join(dir, ".git"));
+}
+/** Print the exact commands to version + publish the overlay by hand. */
+function printManualHint(instanceDir, gh, needsInit) {
+    const slug = gh.login ? `${gh.login}/lastlight-instance` : "<owner>/lastlight-instance";
+    const lines = ["To version + publish this overlay yourself:"];
+    if (needsInit) {
+        lines.push(`  git -C ${instanceDir} init -b main`, `  git -C ${instanceDir} add -A`, `  git -C ${instanceDir} commit -m "Initial Last Light overlay"`);
+    }
+    if (gh.installed) {
+        lines.push(`  gh repo create ${slug} --private --source ${instanceDir} --remote origin --push`);
+    }
+    else {
+        lines.push(`  # create a PRIVATE repo on GitHub (e.g. ${slug}), then:`, `  git -C ${instanceDir} remote add origin git@github.com:${slug}.git`, `  git -C ${instanceDir} push -u origin main`);
+    }
+    p.log.info(lines.map((l, i) => (i === 0 ? l : dim(l))).join("\n  "));
+    p.log.info(dim("Secrets (secrets/.env, *.pem) stay gitignored. To match the prod deploy-key style,") +
+        "\n  " +
+        dim("clone via an SSH host alias, e.g. git@github-instance:<owner>/lastlight-instance.git."));
+}
+/**
+ * Version `instanceDir` as a private git repo and (optionally) create + push a
+ * GitHub repo for it. Idempotent: skips `git init` when already a repo, and
+ * skips repo creation when an `origin` remote already exists. Falls back to
+ * printing the manual commands whenever `gh` is unavailable or the user declines.
+ */
+export async function bootstrapOverlayRepo(instanceDir, opts) {
+    let versioned = isGitRepo(instanceDir);
+    if (!versioned) {
+        if (opts.yes) {
+            printManualHint(instanceDir, opts.gh, true);
+            return;
+        }
+        const want = await p.confirm({
+            message: "Version instance/ as a private git repo now?",
+            initialValue: true,
+        });
+        if (p.isCancel(want) || !want) {
+            printManualHint(instanceDir, opts.gh, true);
+            return;
+        }
+        try {
+            await run("git init", "git", ["init", "-b", "main", instanceDir]);
+            await run("Stage overlay files", "git", ["-C", instanceDir, "add", "-A"]);
+            await run("Initial commit", "git", ["-C", instanceDir, "commit", "-m", "Initial Last Light overlay"]);
+            versioned = true;
+        }
+        catch (err) {
+            p.log.warn(`Couldn't auto-create the git repo: ${err.message}\n` +
+                "  (Is git's user.name / user.email configured?)");
+            printManualHint(instanceDir, opts.gh, !versioned);
+            return;
+        }
+    }
+    // Already (or now) a repo — does it already point somewhere?
+    const remotes = await gitCaptureSoft(["remote"], instanceDir);
+    if (remotes && remotes.split(/\s+/).includes("origin")) {
+        p.log.info("Overlay already has an 'origin' remote — leaving it as-is.");
+        return;
+    }
+    if (opts.gh.authed && !opts.yes) {
+        const want = await p.confirm({
+            message: "Create a private GitHub repo and push the overlay now?",
+            initialValue: true,
+        });
+        if (!p.isCancel(want) && want) {
+            const def = opts.gh.login ? `${opts.gh.login}/lastlight-instance` : "lastlight-instance";
+            const slug = await p.text({ message: "Repository (owner/name)", initialValue: def });
+            if (!p.isCancel(slug) && slug.trim()) {
+                try {
+                    await run("Create + push private repo", "gh", [
+                        "repo", "create", slug.trim(),
+                        "--private", "--source", instanceDir, "--remote", "origin", "--push",
+                    ]);
+                    p.log.success(`Pushed overlay to ${teal(slug.trim())} ${dim("(private)")}.`);
+                    return;
+                }
+                catch (err) {
+                    p.log.warn(`gh repo create failed: ${err.message}`);
+                    // fall through to the manual hint
+                }
+            }
+        }
+    }
+    printManualHint(instanceDir, opts.gh, false);
+}
+//# sourceMappingURL=overlay-bootstrap.js.map

package/dist/overlay-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"overlay-bootstrap.js","sourceRoot":"","sources":["../src/overlay-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AACjC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;AACtB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAElC,gFAAgF;AAEhF;mFACmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,0EAA0E;IAC1E,wBAAwB;IACxB,WAAW;IACX,uBAAuB;IACvB,MAAM;IACN,OAAO;IACP,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,4EAA4E;AAC5E,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,kDAAkD;IAClD,0EAA0E;IAC1E,mEAAmE;IACnE,wEAAwE;IACxE,EAAE;IACF,eAAe;IACf,wEAAwE;IACxE,EAAE;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,sEAAsE;IACtE,WAAW;IACX,sBAAsB;IACtB,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb;yEACyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,oEAAoE;IACpE,2EAA2E;IAC3E,iEAAiE;IACjE,iEAAiE;IACjE,EAAE;IACF,6DAA6D;IAC7D,qCAAqC;IACrC,EAAE;IACF,6DAA6D;IAC7D,gBAAgB;IAChB,sFAAsF;IACtF,uCAAuC;IACvC,6BAA6B;IAC7B,EAAE;IACF,uEAAuE;IACvE,iBAAiB;IACjB,EAAE;IACF,6DAA6D;IAC7D,kBAAkB;IAClB,EAAE;IACF,6DAA6D;IAC7D,6CAA6C;IAC7C,iEAAiE;IACjE,+EAA+E;IAC/E,kFAAkF;IAClF,iFAAiF;IACjF,sBAAsB;IACtB,mBAAmB;IACnB,uBAAuB;IACvB,EAAE;IACF,6DAA6D;IAC7D,eAAe;IACf,mBAAmB;IACnB,EAAE;IACF,6DAA6D;IAC7D,oBAAoB;IACpB,oBAAoB;IACpB,2BAA2B;IAC3B,wBAAwB;IACxB,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,wDAAwD;AACxD,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,sBAAsB;IACtB,EAAE;IACF,qFAAqF;IACrF,sEAAsE;IACtE,EAAE;IACF,gFAAgF;IAChF,2FAA2F;IAC3F,EAAE;IACF,WAAW;IACX,EAAE;IACF,KAAK;IACL,kFAAkF;IAClF,iFAAiF;IACjF,8EAA8E;IAC9E,sDAAsD;IACtD,qDAAqD;IACrD,yEAAyE;IACzE,0EAA0E;IAC1E,KAAK;IACL,EAAE;IACF,uBAAuB;IACvB,EAAE;IACF,SAAS;IACT,0EAA0E;IAC1E,iEAAiE;IACjE,KAAK;IACL,EAAE;IACF,6DAA6D;IAC7D,mDAAmD;IACnD,EAAE;IACF,6BAA6B;IAC7B,EAAE;IACF,wEAAwE;IACxE,4EAA4E;IAC5E,EAAE;IACF,SAAS;IACT,SAAS;IACT,oBAAoB;IACpB,KAAK;IACL,EAAE;IACF,gFAAgF;IAChF,8EAA8E;IAC9E,8EAA8E;IAC9E,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAab;yEACyE;AACzE,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1D,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5F,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACrD,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9C,MAAM,cAAc,GAAG,CAAC,GAAW,EAAE,OAAe,EAAQ,EAAE;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAC/B,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC;IAEF,cAAc,CAAC,aAAa,EAAE,0BAA0B,CAAC,CAAC;IAC1D,cAAc,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;IAChD,cAAc,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC5C,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAE1E,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAWD,gFAAgF;AAChF,SAAS,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,IAAc,EAAE,GAAY;IACnE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACxB,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,iBAAiB,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,CACzF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAc,EAAE,GAAY;IACxD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,yEAAyE;AACzE,SAAS,eAAe,CAAC,WAAmB,EAAE,EAAY,EAAE,SAAkB;IAC5E,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,qBAAqB,CAAC,CAAC,CAAC,4BAA4B,CAAC;IACxF,MAAM,KAAK,GAAa,CAAC,6CAA6C,CAAC,CAAC;IACxE,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CACR,YAAY,WAAW,eAAe,EACtC,YAAY,WAAW,SAAS,EAChC,YAAY,WAAW,yCAAyC,CACjE,CAAC;IACJ,CAAC;IACD,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,oBAAoB,IAAI,uBAAuB,WAAW,yBAAyB,CAAC,CAAC;IAClG,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,6CAA6C,IAAI,UAAU,EAC3D,YAAY,WAAW,qCAAqC,IAAI,MAAM,EACtE,YAAY,WAAW,sBAAsB,CAC9C,CAAC;IACJ,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,GAAG,CAAC,IAAI,CACR,GAAG,CAAC,oFAAoF,CAAC;QACvF,MAAM;QACN,GAAG,CAAC,uFAAuF,CAAC,CAC/F,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAAmB,EAAE,IAAmB;IACjF,IAAI,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IAEvC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC;YAC3B,OAAO,EAAE,8CAA8C;YACvD,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC9B,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;YAClE,MAAM,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;YAC1E,MAAM,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,4BAA4B,CAAC,CAAC,CAAC;YACtG,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,GAAG,CAAC,IAAI,CACR,sCAAuC,GAAa,CAAC,OAAO,IAAI;gBAC9D,iDAAiD,CACpD,CAAC;YACF,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;IACH,CAAC;IAED,6DAA6D;IAC7D,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;IAC9D,IAAI,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC;YAC3B,OAAO,EAAE,wDAAwD;YACjE,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,qBAAqB,CAAC,CAAC,CAAC,oBAAoB,CAAC;YACzF,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;YACrF,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE;wBAC5C,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE;wBAC7B,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ;qBACrE,CAAC,CAAC;oBACH,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;oBAC7E,OAAO;gBACT,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC/D,kCAAkC;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC"}

package/dist/providers.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Provider registry — single source of truth for the LLM providers Last Light
+ * knows how to wire end-to-end.
+ *
+ * pi-ai (`@earendil-works/pi-ai`) is provider-agnostic and supports 15+
+ * providers out of the box. Of those, only a subset is "wizard-able" here:
+ * they authenticate with a single API-key env var and expose a stable
+ * endpoint reachable from the sandbox egress firewall. Excluded are the
+ * OAuth-only providers (`openai-codex`, `github-copilot`), the multi-env
+ * Ambient-cred ones (`amazon-bedrock`, `google-vertex`, `azure-openai-*`,
+ * `cloudflare-*`), and the regional-CN variants.
+ *
+ * This registry is consumed by:
+ *   - `src/engine/llm.ts` — the cheap one-shot helper used by the
+ *     prompt screener + intent classifier. It builds requests for the
+ *     `openai-completions` family (which is most wizard-able providers —
+ *     Google and Mistral are routed through their OpenAI-compatible
+ *     endpoints) and the `anthropic-messages` family (Kimi for Coding,
+ *     MiniMax, Anthropic itself).
+ *   - `src/engine/agent-executor.ts` — forwards each provider's env var
+ *     into the sandbox so agentic-pi can auth.
+ *   - `src/sandbox/egress-allowlist.ts` — the SNI/firewall allowlist is
+ *     seeded from each provider's `host`.
+ *   - `src/cli/setup.ts` — the install wizard's step-4 provider picker.
+ *
+ * Keep this list aligned with pi-ai's provider registry. When pi-ai adds a
+ * new provider that we want to surface, add an entry here and everything
+ * else (forwarding, egress, wizard UI) follows automatically.
+ */
+/** API request/response family pi-ai uses to talk to a provider. */
+export type ApiType = 
+/** Anthropic Messages API — `system` field, content-block response. */
+"anthropic-messages"
+/** OpenAI Chat Completions API — `messages`, `choices[0].message.content`. */
+ | "openai-completions";
+/**
+ * Metadata for one wizard-able provider. The request-building differences
+ * between OpenAI-completions-family providers (maxTokensField name,
+ * extra headers, nested-model-id quirk) are small, so they live as optional
+ * fields here rather than separate adapter objects.
+ */
+export interface ProviderSpec {
+    /** pi-ai model-spec prefix — the part before `/` in `provider/model`. */
+    readonly prefix: string;
+    /** Display name (shown in the wizard). */
+    readonly displayName: string;
+    /** Env var that carries the API key (also the env var forwarded into the sandbox). */
+    readonly envKey: string;
+    /** API base URL — `chat/completions` or `messages` is appended per `api`. */
+    readonly baseUrl: string;
+    /** API request/response family. */
+    readonly api: ApiType;
+    /** Egress allowlist host — apex (matches all subdomains) or specific host. */
+    readonly host: string;
+    /** Small/fast model id used by the screener + classifier cheap helper. */
+    readonly fastModel: string;
+    /** Canonical primary model id (used as the wizard placeholder). */
+    readonly sampleModel: string;
+    /** OpenAI-completions only: body field for the token cap. Default `max_tokens`. */
+    readonly maxTokensField?: "max_tokens" | "max_completion_tokens";
+    /** OpenAI-completions only: keep the nested `vendor/model` tail verbatim (OpenRouter). */
+    readonly preserveNestedModelId?: boolean;
+    /** OpenAI-completions only: extra request headers (OpenRouter's referer/title). */
+    readonly extraHeaders?: Readonly<Record<string, string>>;
+    /** Optional wizard hint for the API-key prefix (used in placeholder + loose validation). */
+    readonly keyPrefix?: string;
+}
+/**
+ * The registry. Order matters — `defaultFastModel()` in `llm.ts` selects
+ * a fast model by iterating this list and picking the first provider
+ * whose env var is present. Always keep Anthropic first (best raw-latency
+ * cheap helper) then OpenAI then OpenRouter, then the rest grouped by
+ * families so the array is easy to scan.
+ */
+export declare const PROVIDERS: readonly ProviderSpec[];
+export declare function providerByPrefix(prefix: string): ProviderSpec | undefined;
+export declare function providerByEnvKey(envKey: string): ProviderSpec | undefined;
+/** All the env var names a harness must forward to reach every registered provider. */
+export declare const PROVIDER_ENV_KEYS: readonly string[];
+/** All the hosts the sandbox egress firewall must allowlist to reach these providers. */
+export declare const PROVIDER_HOSTS: readonly string[];
+/**
+ * Default model spec shipped with the harness. Keep aligned with the
+ * `OPENCODE_MODEL` default in `config/default.yaml` and the wizard's
+ * initial provider selection.
+ */
+export declare const DEFAULT_PROVIDER = "anthropic";
+export declare const DEFAULT_MODEL = "anthropic/claude-sonnet-4-6";
+/**
+ * OAuth (subscription-login) providers — the ones the API-key registry above
+ * deliberately excludes. These don't authenticate with a static key env var;
+ * a user logs in once (`lastlight oauth login <id>`) and pi-ai manages the
+ * token. Two consumption seams with different reach:
+ *
+ *   - **chat** (in-process pi-ai) supports ALL of these — the chat runner
+ *     passes the resolved token as the per-call `apiKey`.
+ *   - **sandbox** (agentic-pi) resolves creds from ENV only, so a provider is
+ *     sandbox-usable ONLY if `sandboxEnvVar` is set (the env var pi-ai reads
+ *     inside the sandbox). Codex has none → chat-only.
+ *
+ * Egress note: chat is in-process (not behind the sandbox firewall), and the
+ * one sandbox-capable OAuth provider whose models we ship (`anthropic`) reuses
+ * the `anthropic.com` host already in the API-key registry — so no OAuth host
+ * is added to the sandbox allowlist here.
+ */
+export interface OAuthProviderSpec {
+    /** pi-ai OAuth provider id — also `lastlight oauth login <id>`. */
+    readonly id: string;
+    /** Display name (wizard + CLI). */
+    readonly displayName: string;
+    /** pi-ai model-spec prefix (`provider` in `provider/model`) for its models. */
+    readonly modelPrefix: string;
+    /** Representative model spec — wizard placeholder / docs hint. */
+    readonly sampleModel: string;
+    /**
+     * Env var pi-ai reads for this provider's OAuth token inside a sandbox, or
+     * `null` when there's no env route (⇒ chat-only; cannot run sandbox phases).
+     */
+    readonly sandboxEnvVar: string | null;
+    /** True when login is mandatory (no API-key fallback). */
+    readonly oauthOnly: boolean;
+}
+export declare const OAUTH_PROVIDERS: readonly OAuthProviderSpec[];
+export declare function oauthProviderByModelPrefix(prefix: string): OAuthProviderSpec | undefined;
+export declare function oauthProviderById(id: string): OAuthProviderSpec | undefined;