lastlight 0.1.8 → 0.2.0

package/dist/setup.js

@@ -3,23 +3,44 @@
  * Last Light setup wizard — `npx lastlight setup`
  *
  * Guides a user from a bare server to a fully configured Last Light instance.
- * Uses only Node.js built-ins: readline/promises, crypto, fs, child_process.
- * Zero new dependencies.
+ * Uses @clack/prompts for the interactive UI and chalk for styling.
  */
-import { createInterface } from "node:readline/promises";
 import { randomBytes } from "node:crypto";
-import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync, copyFileSync, } from "node:fs";
+import { existsSync, readFileSync, readdirSync, writeFileSync, mkdirSync, chmodSync, copyFileSync, symlinkSync, lstatSync, unlinkSync, } from "node:fs";
 import { resolve, join } from "node:path";
 import { execSync } from "node:child_process";
+import * as p from "@clack/prompts";
+import chalk from "chalk";
+// ── Brand colors ───────────────────────────────────────────────────────────
+const gold = chalk.hex("#F0B429");
+const teal = chalk.hex("#1A7A8A");
+const orange = chalk.hex("#E8752A");
+const dim = chalk.dim;
+const bright = chalk.white.bold;
 // ── Validation helpers (exported for unit tests) ────────────────────────────
-/** Returns true if the string is a positive integer (no decimals, no leading spaces). */
 export function isPositiveInt(s) {
     return /^\d+$/.test(s) && parseInt(s, 10) > 0;
 }
 /**
- * Returns true if the file at `filePath` exists and starts with a PEM header.
- * Accepts both RSA PRIVATE KEY and PKCS8 PRIVATE KEY formats.
+ * Try to resolve a PEM path. Checks: as given, relative to cwd, relative
+ * to parent dir (for when the wizard chdir'd into a clone), and with ~ expanded.
+ * Returns the resolved absolute path or null if not found.
  */
+function resolvePem(input) {
+    let expanded = input;
+    if (expanded.startsWith("~/")) {
+        expanded = join(process.env.HOME || "", expanded.slice(2));
+    }
+    const candidates = [
+        resolve(expanded),
+        resolve("..", expanded),
+    ];
+    for (const candidate of candidates) {
+        if (isPemFile(candidate))
+            return candidate;
+    }
+    return null;
+}
 export function isPemFile(filePath) {
     try {
         const content = readFileSync(filePath, "utf8");
@@ -30,28 +51,39 @@ export function isPemFile(filePath) {
         return false;
     }
 }
-/** Returns true if the key has the `sk-ant-` prefix. */
 export function isAnthropicKey(s) {
     return s.startsWith("sk-ant-");
 }
-/** Returns true if the token has the `xoxb-` prefix. */
+export function isOpenaiKey(s) {
+    return s.startsWith("sk-") && !s.startsWith("sk-ant-") && !s.startsWith("sk-or-");
+}
+export function isOpenrouterKey(s) {
+    return s.startsWith("sk-or-");
+}
+/**
+ * Default model — kept aligned with `config.ts`'s `DEFAULT_MODEL`.
+ * Update both in lockstep when the canonical default changes.
+ */
+export const DEFAULT_LASTLIGHT_MODEL = "anthropic/claude-sonnet-4-6";
 export function isSlackBotToken(s) {
     return s.startsWith("xoxb-");
 }
-/** Returns true if the token has the `xapp-` prefix. */
 export function isSlackAppToken(s) {
     return s.startsWith("xapp-");
 }
 // ── .env serialization (exported for unit tests) ────────────────────────────
-/** Builds the full .env file content from the collected config. */
 export function buildEnvContent(config) {
     const lines = [
         "# ── Last Light — Environment Variables ─────────────────────",
         "# Generated by: npx lastlight setup",
         "",
+        "# ── Overlay (this deployment's private config + assets) ──",
+        "LASTLIGHT_OVERLAY_DIR=/app/instance",
+        "",
         "# ── GitHub App (required) ────────────────────────────────",
         `GITHUB_APP_ID=${config.GITHUB_APP_ID}`,
-        `GITHUB_APP_PRIVATE_KEY_PATH=./secrets/app.pem`,
+        // PEM lives at instance/secrets/app.pem; the entrypoint symlinks it to /app/app.pem.
+        `GITHUB_APP_PRIVATE_KEY_PATH=./app.pem`,
         `GITHUB_APP_INSTALLATION_ID=${config.GITHUB_APP_INSTALLATION_ID}`,
         "",
         "# ── Webhook (required) ──────────────────────────────────",
@@ -60,12 +92,20 @@ export function buildEnvContent(config) {
         "# ── Domain (used by Caddy for TLS) ─────────────────────────────────────",
         `DOMAIN=${config.DOMAIN}`,
         "",
-        "# ── Claude API ───────────────────────────────────────────",
-        `ANTHROPIC_API_KEY=${config.ANTHROPIC_API_KEY}`,
-        "",
-        "# ── Admin Dashboard ────────────────────────────────────────",
-        `ADMIN_SECRET=${config.ADMIN_SECRET}`,
+        "# ── Model + provider API key ────────────────────────────────",
+        `LASTLIGHT_MODEL=${config.LASTLIGHT_MODEL}`,
+        "# Set whichever matches your LASTLIGHT_MODEL (anthropic/…, openai/…, or openrouter/…).",
     ];
+    if (config.OPENAI_API_KEY) {
+        lines.push(`OPENAI_API_KEY=${config.OPENAI_API_KEY}`);
+    }
+    if (config.ANTHROPIC_API_KEY) {
+        lines.push(`ANTHROPIC_API_KEY=${config.ANTHROPIC_API_KEY}`);
+    }
+    if (config.OPENROUTER_API_KEY) {
+        lines.push(`OPENROUTER_API_KEY=${config.OPENROUTER_API_KEY}`);
+    }
+    lines.push("", "# ── Admin Dashboard ────────────────────────────────────────", `ADMIN_SECRET=${config.ADMIN_SECRET}`);
     if (config.ADMIN_PASSWORD) {
         lines.push(`ADMIN_PASSWORD=${config.ADMIN_PASSWORD}`);
     }
@@ -86,189 +126,500 @@ export function buildEnvContent(config) {
     lines.push("");
     return lines.join("\n");
 }
-async function prompt(rl, question, validator, errorMsg) {
-    while (true) {
-        const answer = (await rl.question(question)).trim();
-        if (!validator || validator(answer))
-            return answer;
-        console.error(`  ${errorMsg ?? "Invalid input. Please try again."}`);
+/** Build the overlay config.yaml (instance/config.yaml) — merged over config/default.yaml. */
+export function buildOverlayConfig(config) {
+    const lines = [
+        "# Last Light — private deployment overlay config",
+        "# Merged over the public config/default.yaml at startup; arrays replace,",
+        "# maps deep-merge, env vars override. Restart the agent to apply:",
+        "#   docker compose restart agent",
+        "",
+        "managedRepos:",
+    ];
+    if (config.managedRepos.length === 0) {
+        lines.push("  []  # add owner/repo entries — the bot ignores repos not listed here");
+    }
+    else {
+        for (const repo of config.managedRepos)
+            lines.push(`  - ${repo}`);
     }
+    lines.push("");
+    return lines.join("\n");
 }
-async function promptYesNo(rl, question, defaultYes = false) {
-    const hint = defaultYes ? "[Y/n]" : "[y/N]";
-    while (true) {
-        const answer = (await rl.question(`${question} ${hint}: `)).trim().toLowerCase();
-        if (answer === "")
-            return defaultYes;
-        if (answer === "y" || answer === "yes")
-            return true;
-        if (answer === "n" || answer === "no")
-            return false;
-        console.error("  Please enter y or n.");
+/** .gitignore for the instance/ overlay so it can be its own private repo without leaking secrets. */
+const OVERLAY_GITIGNORE = [
+    "# Host-only secrets — never commit. Everything under secrets/ is ignored",
+    "# except the template.",
+    "secrets/*",
+    "!secrets/.env.example",
+    ".env",
+    "*.pem",
+    "",
+].join("\n");
+/** Compose override (overlay): disable Caddy when the operator opts out of its TLS. */
+export const CADDY_DISABLED_OVERRIDE = [
+    "# Deployment compose override — version-controlled in the overlay (instance/).",
+    "# Symlinked into the project dir as ./docker-compose.override.yml so",
+    "# `docker compose` auto-loads it on top of the repo's docker-compose.yml.",
+    "# This deployment opted out of Caddy TLS at setup time.",
+    "services:",
+    "  caddy:",
+    "    profiles:",
+    "      - disabled",
+    "",
+].join("\n");
+const OVERRIDE_FILE = "docker-compose.override.yml";
+/**
+ * Symlink the overlay's compose override into the project dir so plain
+ * `docker compose` auto-discovers it (Compose only auto-loads
+ * ./docker-compose.override.yml). No-op if the overlay has no override.
+ * Leaves a pre-existing regular file untouched.
+ */
+export function ensureOverrideSymlink() {
+    const target = join("instance", OVERRIDE_FILE);
+    if (!existsSync(target))
+        return;
+    let existing;
+    try {
+        existing = lstatSync(OVERRIDE_FILE);
     }
+    catch {
+        /* link absent */
+    }
+    if (existing && !existing.isSymbolicLink()) {
+        p.log.warn(`${OVERRIDE_FILE} already exists as a regular file — leaving it; not symlinking the overlay override.`);
+        return;
+    }
+    if (existing)
+        unlinkSync(OVERRIDE_FILE);
+    symlinkSync(target, OVERRIDE_FILE);
+    p.log.success(dim(`${OVERRIDE_FILE}`) + " → " + dim(target));
 }
-// ── Setup steps ─────────────────────────────────────────────────────────────
+// ── Clack helper — bail on cancel ───────────────────────────────────────────
+function required(value) {
+    if (p.isCancel(value)) {
+        p.cancel("Setup cancelled.");
+        process.exit(0);
+    }
+    return value;
+}
+// ── Banner ──────────────────────────────────────────────────────────────────
+function printBanner() {
+    // Inner width = 46 chars between the box-drawing borders
+    const W = 46;
+    const pad = (text, styled) => {
+        const left = Math.floor((W - text.length) / 2);
+        const right = W - text.length - left;
+        return gold("  │") + " ".repeat(left) + styled + " ".repeat(right) + gold("│");
+    };
+    const empty = gold("  │") + " ".repeat(W) + gold("│");
+    const rule = "─".repeat(W);
+    console.log();
+    console.log(gold(`  ╭${rule}╮`));
+    console.log(empty);
+    console.log(pad("✦  L A S T   L I G H T  ✦", bright("✦  L A S T   L I G H T  ✦")));
+    console.log(empty);
+    console.log(pad("GitHub Repository Maintenance Agent", dim("GitHub Repository Maintenance Agent")));
+    console.log(empty);
+    console.log(gold(`  ╰${rule}╯`));
+    console.log();
+}
+// ── Preflight ───────────────────────────────────────────────────────────────
 function preflight() {
-    // Check for docker-compose.yml; clone if not present, then cd into it
     if (!existsSync("docker-compose.yml")) {
-        // Maybe we're one level up and a `lastlight/` clone already exists
         if (existsSync("lastlight/docker-compose.yml")) {
-            console.log("\nFound existing lastlight/ directory — continuing setup there.\n");
+            p.log.info("Found existing lastlight/ directory — continuing setup there.");
             process.chdir("lastlight");
         }
         else {
-            console.log("\nNo docker-compose.yml found in current directory.");
-            console.log("Cloning cliftonc/lastlight into ./lastlight ...\n");
+            const s = p.spinner();
+            s.start("Cloning cliftonc/lastlight ...");
             try {
                 execSync("git clone https://github.com/cliftonc/lastlight.git lastlight", {
-                    stdio: "inherit",
+                    stdio: "pipe",
                 });
+                s.stop("Repository cloned.");
             }
             catch {
-                console.error("Failed to clone repository. Please clone it manually:");
-                console.error("  git clone https://github.com/cliftonc/lastlight.git");
+                s.stop("Clone failed.");
+                p.log.error("Failed to clone. Please clone manually:");
+                p.log.info("  git clone https://github.com/cliftonc/lastlight.git");
                 process.exit(1);
             }
             process.chdir("lastlight");
-            console.log(`\nContinuing setup in ${process.cwd()}\n`);
+            p.log.info(`Working directory: ${dim(process.cwd())}`);
         }
     }
-    // Check Docker is available
     try {
         execSync("docker info", { stdio: "ignore" });
     }
     catch {
-        console.error("\nDocker is not running or not installed.");
-        console.error("Please start Docker and re-run: npx lastlight setup\n");
+        p.log.error("Docker is not running or not installed.");
+        p.log.info("Please start Docker and re-run: " + teal("npx lastlight setup"));
         process.exit(1);
     }
-    // Check .env doesn't already exist
-    if (existsSync(".env")) {
-        console.error("\n.env already exists. To reconfigure, edit it directly.");
-        console.error("If you want to start over, remove it first: rm .env\n");
+    if (existsSync(join("instance", "secrets", ".env"))) {
+        p.log.error("instance/secrets/.env already exists. To reconfigure, remove it first: " +
+            dim("rm instance/secrets/.env"));
         process.exit(1);
     }
 }
-async function collectGitHubApp(rl) {
-    console.log("\n── Step 1: GitHub App ─────────────────────────────────────");
-    console.log("Create a GitHub App at https://github.com/settings/apps/new if you haven't already.\n");
-    const appId = await prompt(rl, "GitHub App ID (numeric): ", isPositiveInt, "Must be a positive integer (e.g. 123456).");
-    const installationId = await prompt(rl, "GitHub App Installation ID (numeric): ", isPositiveInt, "Must be a positive integer (e.g. 789012).");
-    const pemPath = await prompt(rl, "Path to GitHub App private key (.pem): ", (p) => isPemFile(resolve(p)), "File not found or does not look like a PEM private key.");
+// ── Setup steps ─────────────────────────────────────────────────────────────
+async function collectGitHubApp() {
+    p.log.step(gold("GitHub App"));
+    p.log.info(dim("Create one at ") +
+        teal("https://github.com/settings/apps/new") +
+        dim(" if you haven't already."));
+    const appId = required(await p.text({
+        message: "GitHub App ID",
+        placeholder: "123456",
+        validate: (v) => v && isPositiveInt(v) ? undefined : "Must be a positive integer.",
+    }));
+    const installationId = required(await p.text({
+        message: "Installation ID",
+        placeholder: "789012",
+        validate: (v) => v && isPositiveInt(v) ? undefined : "Must be a positive integer.",
+    }));
+    // Search cwd and parent for .pem files to offer as choices
+    const pemCandidates = [];
+    for (const dir of [process.cwd(), resolve("..")]) {
+        try {
+            for (const f of readdirSync(dir)) {
+                if (f.endsWith(".pem")) {
+                    const full = join(dir, f);
+                    if (isPemFile(full))
+                        pemCandidates.push(full);
+                }
+            }
+        }
+        catch { /* unreadable dir */ }
+    }
+    let pemResolved;
+    if (pemCandidates.length > 0) {
+        const choice = required(await p.select({
+            message: "Private key (.pem)",
+            options: [
+                ...pemCandidates.map((f) => ({ value: f, label: f.replace(process.env.HOME || "", "~") })),
+                { value: "__other__", label: dim("Enter a different path...") },
+            ],
+        }));
+        if (choice === "__other__") {
+            const manual = required(await p.text({
+                message: "Path to private key (.pem)",
+                validate: (v) => {
+                    if (!v)
+                        return "Enter a file path.";
+                    return resolvePem(v) ? undefined : "File not found or not a valid PEM.";
+                },
+            }));
+            pemResolved = resolvePem(manual);
+        }
+        else {
+            pemResolved = choice;
+        }
+    }
+    else {
+        const manual = required(await p.text({
+            message: "Path to private key (.pem)",
+            placeholder: "~/downloads/your-app.private-key.pem",
+            validate: (v) => {
+                if (!v)
+                    return "Enter a file path.";
+                return resolvePem(v) ? undefined : "File not found or not a valid PEM.";
+            },
+        }));
+        pemResolved = resolvePem(manual);
+    }
     return {
-        appId,
-        installationId,
-        pemSourcePath: resolve(pemPath),
+        appId: appId,
+        installationId: installationId,
+        pemSourcePath: pemResolved,
     };
 }
-function generateSecrets() {
-    console.log("\n── Step 2: Secrets ────────────────────────────────────────");
-    const webhookSecret = randomBytes(32).toString("hex");
-    const adminSecret = randomBytes(32).toString("hex");
-    console.log("\nAuto-generated WEBHOOK_SECRET (paste this into your GitHub App webhook settings):");
-    console.log(`  ${webhookSecret}\n`);
-    return { webhookSecret, adminSecret };
+async function collectDomain() {
+    p.log.step(gold("Domain & TLS"));
+    const domain = required(await p.text({
+        message: "Your domain",
+        placeholder: "lastlight.example.com",
+        validate: (v) => v && v.length > 0 && v.includes(".")
+            ? undefined
+            : "Enter a valid domain name.",
+    }));
+    const useCaddy = required(await p.confirm({
+        message: "Use Caddy for automatic TLS?",
+        initialValue: true,
+    }));
+    p.log.info(`Webhook URL: ${teal(`https://${domain}/webhook`)}`);
+    return { domain: domain, useCaddy: useCaddy };
 }
-async function collectDomain(rl) {
-    console.log("── Step 3: Domain + TLS ───────────────────────────────────");
-    const domain = await prompt(rl, "Your domain (e.g. lastlight.example.com): ", (d) => d.length > 0 && d.includes("."), "Please enter a valid domain name.");
-    const useCaddy = await promptYesNo(rl, "Use Caddy for automatic TLS (recommended)?", true);
-    console.log(`\nWebhook URL: https://${domain}/webhook`);
-    return { domain, useCaddy };
+/** Parse a free-text list of `owner/repo` entries (comma/space/newline separated). */
+export function parseManagedRepos(input) {
+    const seen = new Set();
+    for (const tok of input.split(/[\s,]+/).map((t) => t.trim()).filter(Boolean)) {
+        if (/^[^/\s]+\/[^/\s]+$/.test(tok))
+            seen.add(tok);
+    }
+    return [...seen];
 }
-async function collectAnthropicKey(rl) {
-    console.log("\n── Step 4: Anthropic API Key ──────────────────────────────");
-    return prompt(rl, "ANTHROPIC_API_KEY (sk-ant-...): ", isAnthropicKey, "Must start with sk-ant-");
+async function collectManagedRepos() {
+    p.log.step(gold("Managed repositories"));
+    p.log.info(dim("Repos the bot will operate on. Install the GitHub App on each. Add more later in instance/config.yaml."));
+    const raw = required(await p.text({
+        message: "Managed repos (owner/repo, space- or comma-separated)",
+        placeholder: "your-org/repo-one your-org/repo-two",
+        validate: (v) => {
+            if (!v || !v.trim())
+                return undefined; // allow empty — can fill in later
+            return parseManagedRepos(v).length > 0 ? undefined : "Use owner/repo form, e.g. acme/widgets.";
+        },
+    }));
+    const repos = parseManagedRepos(raw || "");
+    if (repos.length === 0) {
+        p.log.warn("No managed repos set — the bot won't act until you add some to instance/config.yaml.");
+    }
+    else {
+        p.log.success(`Managing ${repos.length} repo${repos.length === 1 ? "" : "s"}: ${dim(repos.join(", "))}`);
+    }
+    return repos;
 }
-async function collectAdminPassword(rl) {
-    console.log("\n── Step 5: Admin Dashboard Password ──────────────────────");
-    const wantPassword = await promptYesNo(rl, "Set an admin dashboard password?", false);
+async function collectModelAndKey() {
+    p.log.step(gold("Model provider"));
+    p.log.info(dim("agentic-pi (pi-ai) is provider-agnostic. Pick the model you want the agent to use; ") +
+        dim("the wizard will ask for the matching API key."));
+    // Curated short list — extend as new defaults emerge. The custom escape
+    // hatch below lets the user enter any provider/model string pi-ai accepts.
+    const catalog = [
+        DEFAULT_LASTLIGHT_MODEL,
+        "anthropic/claude-sonnet-4-6-20251015",
+        "openai/gpt-5.5",
+        "openrouter/google/gemini-2.5-pro",
+        "openrouter/anthropic/claude-sonnet-4.5",
+    ];
+    // Deduplicate while preserving order (DEFAULT_LASTLIGHT_MODEL first).
+    const seen = new Set();
+    const ordered = [];
+    for (const m of catalog) {
+        if (!seen.has(m)) {
+            seen.add(m);
+            ordered.push(m);
+        }
+    }
+    const choice = required(await p.select({
+        message: `LASTLIGHT_MODEL ${dim("(short list — pick 'other' for a custom value)")}`,
+        initialValue: DEFAULT_LASTLIGHT_MODEL,
+        options: [
+            ...ordered.map((m) => ({
+                value: m,
+                label: m === DEFAULT_LASTLIGHT_MODEL ? `${m} ${dim("(default)")}` : m,
+            })),
+            { value: "__custom__", label: dim("Enter a different provider/model...") },
+        ],
+    }));
+    let model = choice;
+    if (choice === "__custom__") {
+        model = required(await p.text({
+            message: "provider/model",
+            placeholder: "openai/gpt-5.3-codex or anthropic/claude-…",
+            validate: (v) => v && /^[a-z][\w-]*\/[A-Za-z][\w.-]+$/.test(v)
+                ? undefined
+                : "Format must be provider/model (e.g. openai/gpt-5.3-codex).",
+        }));
+    }
+    const provider = model.split("/")[0].toLowerCase();
+    if (provider === "anthropic") {
+        const key = required(await p.text({
+            message: "ANTHROPIC_API_KEY",
+            placeholder: "sk-ant-...",
+            validate: (v) => v && isAnthropicKey(v) ? undefined : "Must start with sk-ant-",
+        }));
+        return { model, anthropicKey: key };
+    }
+    if (provider === "openai") {
+        const key = required(await p.text({
+            message: "OPENAI_API_KEY",
+            placeholder: "sk-...",
+            validate: (v) => v && isOpenaiKey(v) ? undefined : "Must start with sk- (and not sk-ant- or sk-or-)",
+        }));
+        return { model, openaiKey: key };
+    }
+    if (provider === "openrouter") {
+        const key = required(await p.text({
+            message: "OPENROUTER_API_KEY",
+            placeholder: "sk-or-v1-...",
+            validate: (v) => v && isOpenrouterKey(v) ? undefined : "Must start with sk-or-",
+        }));
+        return { model, openrouterKey: key };
+    }
+    // Unknown provider — prompt for any key and route by shape.
+    p.log.warn(`Provider "${provider}" isn't auto-detected. Enter the API key your model needs.`);
+    const key = required(await p.text({
+        message: "API key",
+        validate: (v) => (v && v.length > 0 ? undefined : "Enter a non-empty key."),
+    }));
+    if (isAnthropicKey(key))
+        return { model, anthropicKey: key };
+    if (isOpenrouterKey(key))
+        return { model, openrouterKey: key };
+    return { model, openaiKey: key };
+}
+async function collectAdminPassword() {
+    p.log.step(gold("Admin Dashboard"));
+    const wantPassword = required(await p.confirm({
+        message: "Set an admin dashboard password?",
+        initialValue: false,
+    }));
     if (!wantPassword)
         return undefined;
-    return prompt(rl, "Admin password: ", (p) => p.length >= 8, "Password must be at least 8 characters.");
+    const password = required(await p.password({
+        message: "Admin password",
+        validate: (v) => v && v.length >= 8 ? undefined : "Must be at least 8 characters.",
+    }));
+    return password;
 }
-async function collectSlack(rl) {
-    console.log("\n── Step 6: Slack (optional) ───────────────────────────────");
-    const wantSlack = await promptYesNo(rl, "Enable Slack integration?", false);
+async function collectSlack() {
+    p.log.step(gold("Slack") + dim(" (optional)"));
+    const wantSlack = required(await p.confirm({
+        message: "Enable Slack integration?",
+        initialValue: false,
+    }));
     if (!wantSlack)
         return {};
-    const botToken = await prompt(rl, "SLACK_BOT_TOKEN (xoxb-...): ", isSlackBotToken, "Must start with xoxb-");
-    const appToken = await prompt(rl, "SLACK_APP_TOKEN (xapp-...): ", isSlackAppToken, "Must start with xapp-");
-    const deliveryChannelRaw = (await rl.question("SLACK_DELIVERY_CHANNEL (optional, press Enter to skip): ")).trim();
-    const deliveryChannel = deliveryChannelRaw || undefined;
-    const allowedUsersRaw = (await rl.question("SLACK_ALLOWED_USERS (optional comma-separated user IDs, press Enter to skip): ")).trim();
-    const allowedUsers = allowedUsersRaw || undefined;
-    return { botToken, appToken, deliveryChannel, allowedUsers };
+    const botToken = required(await p.text({
+        message: "SLACK_BOT_TOKEN",
+        placeholder: "xoxb-...",
+        validate: (v) => v && isSlackBotToken(v) ? undefined : "Must start with xoxb-",
+    }));
+    const appToken = required(await p.text({
+        message: "SLACK_APP_TOKEN",
+        placeholder: "xapp-...",
+        validate: (v) => v && isSlackAppToken(v) ? undefined : "Must start with xapp-",
+    }));
+    const deliveryChannel = required(await p.text({
+        message: "Delivery channel ID",
+        placeholder: "C0123456789 (press Enter to skip)",
+        defaultValue: "",
+    }));
+    const allowedUsers = required(await p.text({
+        message: "Allowed user IDs",
+        placeholder: "U0123,U0456 (press Enter to skip)",
+        defaultValue: "",
+    }));
+    return {
+        botToken,
+        appToken,
+        deliveryChannel: deliveryChannel || undefined,
+        allowedUsers: allowedUsers || undefined,
+    };
 }
 function writeConfig(config) {
-    console.log("\n── Step 7: Writing config ─────────────────────────────────");
-    // Create secrets/ directory
+    p.log.step(gold("Writing config"));
+    const secretsDir = join("instance", "secrets");
     try {
-        mkdirSync("secrets", { recursive: true });
+        mkdirSync(secretsDir, { recursive: true });
     }
     catch (err) {
         const e = err;
         if (e.code === "EACCES") {
-            console.error("Permission denied creating secrets/ directory.");
+            p.log.error("Permission denied creating instance/secrets/ directory.");
             process.exit(1);
         }
         throw err;
     }
-    // Copy PEM to secrets/app.pem
-    copyFileSync(config.pemSourcePath, join("secrets", "app.pem"));
-    chmodSync(join("secrets", "app.pem"), 0o600);
-    // Write .env atomically (build in memory then write once)
+    // Secrets → instance/secrets/ (mounted at /app/instance, never committed/baked).
+    copyFileSync(config.pemSourcePath, join(secretsDir, "app.pem"));
+    chmodSync(join(secretsDir, "app.pem"), 0o600);
     const envContent = buildEnvContent(config);
-    writeFileSync(".env", envContent, { encoding: "utf8" });
-    chmodSync(".env", 0o600);
-    console.log("  .env written (mode 600)");
-    console.log("  secrets/app.pem copied (mode 600)");
+    writeFileSync(join(secretsDir, ".env"), envContent, { encoding: "utf8" });
+    chmodSync(join(secretsDir, ".env"), 0o600);
+    // Overlay config + .gitignore so instance/ can become a private repo.
+    writeFileSync(join("instance", "config.yaml"), buildOverlayConfig(config), { encoding: "utf8" });
+    if (!existsSync(join("instance", ".gitignore"))) {
+        writeFileSync(join("instance", ".gitignore"), OVERLAY_GITIGNORE, { encoding: "utf8" });
+    }
+    // Opted out of Caddy → disable it via an overlay compose override.
+    const overlayOverride = join("instance", OVERRIDE_FILE);
+    if (!config.useCaddy && !existsSync(overlayOverride)) {
+        writeFileSync(overlayOverride, CADDY_DISABLED_OVERRIDE, { encoding: "utf8" });
+    }
+    // Symlink the overlay override (generated above, or pre-existing from a
+    // cloned overlay) into the project dir so `docker compose` auto-loads it.
+    ensureOverrideSymlink();
+    p.log.success(dim("instance/secrets/app.pem") + " copied " + dim("(mode 600)") + "\n" +
+        "  " + dim("instance/secrets/.env") + " written " + dim("(mode 600)") + "\n" +
+        "  " + dim("instance/config.yaml") + " written " + dim(`(${config.managedRepos.length} managed repo${config.managedRepos.length === 1 ? "" : "s"})`));
+}
+/** Detect whether to use `docker compose` (v2) or `docker-compose` (v1/colima). */
+function composeCmd() {
+    try {
+        execSync("docker compose version", { stdio: "ignore" });
+        return "docker compose";
+    }
+    catch {
+        try {
+            execSync("docker-compose version", { stdio: "ignore" });
+            return "docker-compose";
+        }
+        catch {
+            return "docker compose"; // fall through — will error with a clear message
+        }
+    }
 }
-async function dockerBuildAndLaunch(rl) {
-    console.log("\n── Step 8: Docker ─────────────────────────────────────────");
-    const wantLaunch = await promptYesNo(rl, "Build and launch Last Light with Docker now?", true);
+async function dockerBuildAndLaunch() {
+    p.log.step(gold("Docker"));
+    const dc = composeCmd();
+    p.log.info(dim(`Using: ${dc}`));
+    const wantLaunch = required(await p.confirm({
+        message: "Build and launch Last Light now?",
+        initialValue: true,
+    }));
     if (!wantLaunch) {
-        console.log("\nWhen ready, run:");
-        console.log("  docker compose --profile build-only build sandbox");
-        console.log("  docker compose up -d");
+        p.log.info("When ready, run:\n" +
+            dim(`  ${dc} --profile build-only build sandbox\n`) +
+            dim(`  ${dc} up -d`));
         return;
     }
-    console.log("\nBuilding sandbox image...");
+    const s = p.spinner();
+    s.start("Building sandbox image...");
     try {
-        execSync("docker compose --profile build-only build sandbox", {
-            stdio: "inherit",
+        execSync(`${dc} --profile build-only build sandbox`, {
+            stdio: "pipe",
         });
+        s.stop("Sandbox image built.");
     }
     catch {
-        console.error("Build failed. Check the output above and ensure Docker Compose v2 is installed.");
+        s.stop("Sandbox build failed.");
+        p.log.error("Check Docker Compose v2 is installed.");
         process.exit(1);
     }
-    console.log("\nStarting services...");
+    s.start("Starting services...");
     try {
-        execSync("docker compose up -d", { stdio: "inherit" });
+        execSync(`${dc} up -d`, { stdio: "pipe" });
+        s.stop("Services started.");
     }
     catch {
-        console.error("docker compose up failed. Check the output above.");
+        s.stop("Failed to start services.");
+        p.log.error("Check docker compose logs for details.");
         process.exit(1);
     }
-    // Check status
-    try {
-        execSync("docker compose ps", { stdio: "inherit" });
-    }
-    catch {
-        // Non-fatal — status check is informational
-    }
 }
 function printSummary(domain, webhookSecret) {
-    console.log("\n── Step 9: Done! ──────────────────────────────────────────");
-    console.log(`\nWebhook URL:   https://${domain}/webhook`);
-    console.log(`Dashboard URL: https://${domain}/admin`);
-    console.log(`\nREMINDER: Paste this WEBHOOK_SECRET into your GitHub App settings:`);
-    console.log(`  ${webhookSecret}`);
-    console.log(`\nNext steps:`);
-    console.log(`  - Read agent-context/rules.md to customise bot behaviour`);
-    console.log(`  - Verify webhook delivery in GitHub App settings`);
-    console.log(`  - Check logs: docker compose logs -f\n`);
+    console.log();
+    console.log(gold("  ┌──────────────────────────────────────────────┐"));
+    console.log(gold("  │") + bright("  Setup complete!                              ") + gold("│"));
+    console.log(gold("  └──────────────────────────────────────────────┘"));
+    console.log();
+    console.log("  " + dim("Webhook URL   ") + teal(`https://${domain}/webhook`));
+    console.log("  " + dim("Dashboard     ") + teal(`https://${domain}/admin`));
+    console.log();
+    console.log("  " + orange("Paste this WEBHOOK_SECRET into your GitHub App settings:"));
+    console.log("  " + bright(webhookSecret));
+    console.log();
+    console.log("  " + dim("Next steps:"));
+    console.log("  " + dim("  • Tune ") + teal("instance/config.yaml") + dim(" (managed repos, models, overrides), then ") + teal("docker compose restart agent"));
+    console.log("  " + dim("  • Optional: version your overlay — ") + teal("git -C instance init && …push to a private repo"));
+    console.log("  " + dim("  • Verify webhook delivery in GitHub App settings"));
+    console.log("  " + dim("  • Check logs: ") + teal("docker compose logs -f") + dim(" (or docker-compose)"));
+    console.log();
 }
 // ── Main entry point ─────────────────────────────────────────────────────────
 export async function runSetup() {
@@ -276,49 +627,40 @@ export async function runSetup() {
         console.error("Error: setup must be run interactively (stdin must be a TTY).");
         process.exit(1);
     }
-    console.log("\nLast Light Setup Wizard");
-    console.log("=======================");
-    console.log("This wizard will configure Last Light on your server.\n");
-    // Step 0 — Pre-flight
+    printBanner();
+    p.intro(dim("This wizard will configure Last Light on your server."));
     preflight();
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    try {
-        // Step 1 — GitHub App
-        const { appId, installationId, pemSourcePath } = await collectGitHubApp(rl);
-        // Step 2 — Secrets
-        const { webhookSecret, adminSecret } = generateSecrets();
-        // Step 3 — Domain + TLS
-        const { domain, useCaddy } = await collectDomain(rl);
-        // Step 4 — Anthropic key
-        const anthropicKey = await collectAnthropicKey(rl);
-        // Step 5 — Admin password
-        const adminPassword = await collectAdminPassword(rl);
-        // Step 6 — Slack
-        const { botToken, appToken, deliveryChannel, allowedUsers } = await collectSlack(rl);
-        // Step 7 — Write config
-        const config = {
-            GITHUB_APP_ID: appId,
-            GITHUB_APP_INSTALLATION_ID: installationId,
-            WEBHOOK_SECRET: webhookSecret,
-            ADMIN_SECRET: adminSecret,
-            DOMAIN: domain,
-            ANTHROPIC_API_KEY: anthropicKey,
-            ADMIN_PASSWORD: adminPassword,
-            SLACK_BOT_TOKEN: botToken,
-            SLACK_APP_TOKEN: appToken,
-            SLACK_DELIVERY_CHANNEL: deliveryChannel,
-            SLACK_ALLOWED_USERS: allowedUsers,
-            useCaddy,
-            pemSourcePath,
-        };
-        writeConfig(config);
-        // Step 8 — Docker
-        await dockerBuildAndLaunch(rl);
-        // Step 9 — Summary
-        printSummary(domain, webhookSecret);
-    }
-    finally {
-        rl.close();
-    }
+    const { appId, installationId, pemSourcePath } = await collectGitHubApp();
+    const webhookSecret = randomBytes(32).toString("hex");
+    const adminSecret = randomBytes(32).toString("hex");
+    p.log.success("Secrets auto-generated " + dim("(WEBHOOK_SECRET + ADMIN_SECRET)"));
+    const { domain, useCaddy } = await collectDomain();
+    const managedRepos = await collectManagedRepos();
+    const { model, openaiKey, anthropicKey, openrouterKey } = await collectModelAndKey();
+    const adminPassword = await collectAdminPassword();
+    const { botToken, appToken, deliveryChannel, allowedUsers } = await collectSlack();
+    const config = {
+        GITHUB_APP_ID: appId,
+        GITHUB_APP_INSTALLATION_ID: installationId,
+        WEBHOOK_SECRET: webhookSecret,
+        ADMIN_SECRET: adminSecret,
+        DOMAIN: domain,
+        LASTLIGHT_MODEL: model,
+        OPENAI_API_KEY: openaiKey,
+        ANTHROPIC_API_KEY: anthropicKey,
+        OPENROUTER_API_KEY: openrouterKey,
+        ADMIN_PASSWORD: adminPassword,
+        SLACK_BOT_TOKEN: botToken,
+        SLACK_APP_TOKEN: appToken,
+        SLACK_DELIVERY_CHANNEL: deliveryChannel,
+        SLACK_ALLOWED_USERS: allowedUsers,
+        useCaddy,
+        pemSourcePath,
+        managedRepos,
+    };
+    writeConfig(config);
+    await dockerBuildAndLaunch();
+    p.outro(gold("Last Light is ready."));
+    printSummary(domain, webhookSecret);
 }
 //# sourceMappingURL=setup.js.map