setup-agent 0.0.3 → 0.0.4

package/src/cli.ts

@@ -1,9 +1,8 @@
-/// <reference types="node" />
 import { connectCheckout } from "./client";
 import type { CheckoutClient } from "./client";
 import { INPUT_PRESETS, isPresetId, presetInput } from "./presets";
 import { spawn } from "node:child_process";
-import { readFile, writeFile } from "node:fs/promises";
+import { open, readFile } from "node:fs/promises";
 import { createInterface } from "node:readline/promises";
 import { resolve } from "node:path";
 import {
@@ -14,7 +13,7 @@ import {
   isAgentPresent,
   isClosed,
   isOptionIcon,
-  parseModelAnswer,
+  isValidModelAnswer,
   parseMultipleAnswer,
   stepProgress,
 } from "./protocol";
@@ -30,7 +29,7 @@ Commands (the url always comes first):
   ask <prompt> [--placeholder <text>] [--optional] [--step <step-id>] [--wait]
                                     Ask the user for a line of text.
   ask [prompt] --preset <framework|llm-provider|project> [--only <id,id>] [--choices <id=description,...>] [--default <id>] [--optional] [--step <step-id>] [--wait]
-                                    Ask a standard question. --only restricts the options (one id locks it in); --default preselects one.
+                                    Ask a standard question. --only restricts the options and leaves out --choices (one id locks it in); --default preselects one.
                                     "framework" answers "<framework>:<language>"; "llm-provider" answers JSON with provider, model and reasoningEffort; the key itself arrives through "env".
                                     "project" lists the React projects you found as --choices "<path>=<what it is>,..." ahead of "New project"; it answers a path, or "new:<next|vite|react-router|tanstack-start|expo>".
   ask <prompt> --choices <id,id,...> --icons <id=icon,...> [--single] [--default <id>] [--optional] [--step <step-id>] [--wait]
@@ -586,18 +585,50 @@ export const askSeed = (
   };
 };
 
+const assertEnvKey = (key: string) => {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+    throw new Error(`"${key}" is not an environment variable name`);
+  }
+};
+
 /** Sets `key=value` in dotenv text, replacing an existing line for the key. */
 export const upsertEnvLine = (content: string, key: string, value: string) => {
+  assertEnvKey(key);
   const line = `${key}=${value}`;
   const lines = content === "" ? [] : content.replace(/\n$/, "").split("\n");
-  const index = lines.findIndex((entry) =>
-    new RegExp(`^(export\\s+)?${key}\\s*=`).test(entry),
+  const index = lines.findIndex(
+    (entry) =>
+      /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(entry)?.[1] === key,
   );
   if (index === -1) lines.push(line);
   else lines[index] = line;
   return `${lines.join("\n")}\n`;
 };
 
+/**
+ * Write the secret `take` returns to `file` under `key`, leaving the file
+ * owner-only. The file is opened before `take` runs, because taking the
+ * secret consumes it and an unwritable destination must fail while it is
+ * still deposited; it is read after, so lines written meanwhile survive.
+ */
+export const writeEnvSecret = async (
+  file: string,
+  key: string,
+  take: () => Promise<string>,
+) => {
+  assertEnvKey(key);
+  const handle = await open(file, "a+", 0o600);
+  try {
+    await handle.chmod(0o600);
+    const value = await take();
+    const current = await handle.readFile("utf8");
+    await handle.truncate(0);
+    await handle.writeFile(upsertEnvLine(current, key, value));
+  } finally {
+    await handle.close();
+  }
+};
+
 const answerFields = (input: Checkout.Input, answer: string) => ({
   answer: (input.multiple && parseMultipleAnswer(answer)) || answer,
   ...(input.note !== undefined && { note: input.note }),
@@ -738,27 +769,36 @@ export const main = async (argv: readonly string[]) => {
         if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(envKey)) {
           fail(`"${envKey}" is not an environment variable name`);
         }
+        const state = requireState(client);
         const input =
-          requireState(client).inputs.find(
-            (candidate) => candidate.id === inputId,
-          ) ?? fail(`no input "${inputId}"`);
+          state.inputs.find((candidate) => candidate.id === inputId) ??
+          fail(`no input "${inputId}"`);
+        const setupId = state.id ?? fail("the setup has not been created yet");
+        if (isClosed(state)) {
+          fail("the setup is not open");
+        }
         if (input.status !== "answered") {
           fail(`input "${inputId}" is ${input.status}`);
         }
-        if (parseModelAnswer(input.answer ?? "") === undefined) {
+        if (
+          input.kind !== "model" ||
+          !isValidModelAnswer(input, input.answer ?? "")
+        ) {
           fail(`input "${inputId}" is not an llm-provider answer`);
         }
         const file = resolve(flagText(flags, "file") ?? ".env.local");
-        const response = await fetch(
-          `${url.replace(/\/$/, "")}/secret/${encodeURIComponent(inputId)}`,
-        );
-        if (response.status === 404) {
-          fail(`the key for "${inputId}" was already taken or never deposited`);
-        }
-        if (!response.ok) fail(`could not fetch the key: ${response.status}`);
-        const value = await response.text();
-        const current = await readFile(file, "utf8").catch(() => "");
-        await writeFile(file, upsertEnvLine(current, envKey, value));
+        await writeEnvSecret(file, envKey, async () => {
+          const response = await fetch(
+            `${url.replace(/\/$/, "")}/secret/${encodeURIComponent(inputId)}?setup=${encodeURIComponent(setupId)}`,
+          );
+          if (response.status === 404) {
+            fail(
+              `the key for "${inputId}" was already taken or never deposited`,
+            );
+          }
+          if (!response.ok) fail(`could not fetch the key: ${response.status}`);
+          return response.text();
+        });
         print({ ok: true, envKey, file });
         break;
       }

package/src/client.test.ts

@@ -0,0 +1,54 @@
+import { describe, expect, it, vi } from "vitest";
+import { connectCheckout } from "./client";
+
+const { created } = vi.hoisted(() => ({
+  created: [] as {
+    options: { onError: (error: unknown) => void };
+    state: unknown;
+    listener: () => void;
+    dispose: ReturnType<typeof vi.fn>;
+    unsubscribe: ReturnType<typeof vi.fn>;
+  }[],
+}));
+
+vi.mock("statewire", async (importOriginal) => ({
+  ...(await importOriginal()),
+  StatewireHttp: () => ({}),
+  StatewireClient: class {
+    state: unknown = undefined;
+    listener = () => {};
+    connection = { status: "connecting" };
+    dispose = vi.fn();
+    unsubscribe = vi.fn();
+    options: { onError: (error: unknown) => void };
+    constructor(options: { onError: (error: unknown) => void }) {
+      this.options = options;
+      created.push(this);
+    }
+    subscribe = (listener: () => void) => {
+      this.listener = listener;
+      return this.unsubscribe;
+    };
+  },
+}));
+
+describe("connectCheckout", () => {
+  it("disposes the client when the first connection fails", async () => {
+    const connecting = connectCheckout("https://checkout.test/session");
+    const client = created.at(-1)!;
+    client.options.onError(new Error("offline"));
+    await expect(connecting).rejects.toThrow("offline");
+    expect(client.unsubscribe).toHaveBeenCalled();
+    expect(client.dispose).toHaveBeenCalled();
+  });
+
+  it("keeps the client it resolved with when a later error arrives", async () => {
+    const connecting = connectCheckout("https://checkout.test/session");
+    const client = created.at(-1)!;
+    client.state = {};
+    client.listener();
+    await expect(connecting).resolves.toBe(client);
+    client.options.onError(new Error("later"));
+    expect(client.dispose).not.toHaveBeenCalled();
+  });
+});

package/src/client.ts

@@ -9,16 +9,23 @@ export type CheckoutClient = StatewireClient<
 /** Attach to a setup by its base URL and resolve once its state has arrived. */
 export const connectCheckout = (url: string): Promise<CheckoutClient> =>
   new Promise((resolve, reject) => {
+    let settled = false;
+    const fail = (error: unknown) => {
+      if (settled) return;
+      settled = true;
+      unsubscribe();
+      client.dispose();
+      reject(error);
+    };
     const client: CheckoutClient = new StatewireClient({
       transport: StatewireHttp({ url }),
-      onError: (error) => reject(error),
+      onError: fail,
     });
     const settle = () => {
+      if (settled) return;
       if (client.state === undefined) {
         if (client.connection.status !== "stopped") return;
-        unsubscribe();
-        client.dispose();
-        reject(
+        fail(
           new Error(
             `setup unreachable: ${client.connection.reason}${
               client.connection.message ? ` (${client.connection.message})` : ""
@@ -27,6 +34,7 @@ export const connectCheckout = (url: string): Promise<CheckoutClient> =>
         );
         return;
       }
+      settled = true;
       unsubscribe();
       resolve(client);
     };