syndes 0.1.0 → 0.3.0

package/runtime/worker.mjs

@@ -27,6 +27,7 @@ import { commitsSince, branchOf, headOf } from '../collect/git.mjs';
 import { updateRollups } from '../analytics/rollup.mjs';
 import { runCoach } from '../practices/engine.mjs';
 import { pollTails } from '../collect/tail.mjs';
+import { isEnabled as sharingOn, syncOnce, loadState as teamState, teamConfig } from '../sync/index.mjs';
 
 /** Events after which the user has paused, so coaching may run. */
 const BREAKPOINTS = new Set(['Stop', 'SessionEnd', 'SubagentStop']);
@@ -92,7 +93,9 @@ async function run() {
   if (appended) await updateRollups();
   if (sawBreakpoint) await runCoach();
 
-  return { appended, tailed: tailed.length };
+  const shared = shareWithPool();
+
+  return { appended, tailed: tailed.length, shared };
 }
 
 /** @returns {{drafts: object[], touched: Map, breakpoint: boolean}} */
@@ -233,6 +236,37 @@ function followOtherAgents() {
   }
 }
 
+/**
+ * Publish to the shared pool, if there is one.
+ *
+ * Throttled hard and deliberately. Without this the pool only ever updates
+ * while somebody has a dashboard open, which makes the feature useless in the
+ * direction that matters: you want to see what the OTHER person used, and they
+ * are not sitting in front of a dashboard — they are working.
+ *
+ * But the worker runs at every breakpoint, and pushing to a remote that often
+ * would be a commit per turn and a network call in a loop nobody asked for. So
+ * it exchanges at most once every `team.syncMinutes`, and a failure is noted
+ * and dropped: a pool that cannot be reached must never hold up the ledger,
+ * which is the only thing here that is actually the record.
+ */
+function shareWithPool() {
+  try {
+    if (!sharingOn()) return false;
+
+    const every = Math.max(1, Number(teamConfig().syncMinutes ?? 10)) * 60_000;
+    const last = teamState().at ?? 0;
+    if (Date.now() - last < every) return false;
+
+    const state = syncOnce();
+    debug('team sync from worker', state);
+    return state.ok;
+  } catch (error) {
+    debug('team sync failed', error?.message);
+    return false;
+  }
+}
+
 /** A session that stopped reporting ended without a hook. Say so, do not guess a clean close. */
 function reap() {
   return sessions.reapStale().map(({ id, session }) => draft(KIND.SESSION_END, {

package/src/briefing.mjs

@@ -9,6 +9,7 @@ import {
   bold, grey, cyan, green, write, pad, stream,
 } from './term.mjs';
 import { loadConfig } from '../runtime/config.mjs';
+import { isEnabled as sharingOn, teamConfig } from '../sync/index.mjs';
 import { existsSync, writeFileSync, rmSync, mkdirSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { dataDir, displayPath, briefingPending } from '../runtime/paths.mjs';
@@ -49,7 +50,19 @@ export async function runBriefing(result) {
   write(`  ${rule}`);
   await stream(`  ${grey('SynDes keeps a tamper-evident ledger of how you work with coding')}`);
   await stream(`  ${grey('agents, scores it, and tells you the few habits worth changing.')}`);
-  await stream(`  ${grey('It runs entirely on this machine. Nothing is sent anywhere.')}`);
+
+  // "Nothing is sent anywhere" is the strongest claim this tool makes, and the
+  // moment sharing is on it is false. Printing it anyway — three lines after the
+  // user watched a push succeed — would teach them that the rest of what this
+  // briefing says cannot be trusted either.
+  if (sharingOn()) {
+    const scope = teamConfig().scope ?? 'summary';
+    await stream(`  ${grey('It runs on this machine. Sharing is')} ${bold('on')}${grey(', so daily counts, tokens')}`);
+    await stream(`  ${grey(`and working hours go to your pool (${scope}). Prompts, file paths and`)}`);
+    await stream(`  ${grey('commands never leave.')} ${cyan('syndes team status')}`);
+  } else {
+    await stream(`  ${grey('It runs entirely on this machine. Nothing is sent anywhere.')}`);
+  }
   write();
 
   await stream(`  ${bold('EVERYDAY')}`);

package/src/doctor.mjs

@@ -24,6 +24,8 @@ import { isHeld } from '../runtime/lock.mjs';
 import { describe as describeAuth } from '../dashboard/auth.mjs';
 import { probe } from '../notify/index.mjs';
 import { readJson, loadConfig } from '../runtime/config.mjs';
+import { isEnabled as sharingOn, teamConfig, loadState as teamState, readPool, poolRoot } from '../sync/index.mjs';
+import { identity } from '../runtime/identity.mjs';
 import { configFile } from '../runtime/paths.mjs';
 
 function versionOf(file) {
@@ -137,6 +139,34 @@ export async function diagnose({ deep = false } = {}) {
     checks.push(note('system unlock', `${lock.system.method} is available here — syndes lock system`));
   }
 
+  // ── Sharing ───────────────────────────────────────────────────────────────
+  if (!sharingOn()) {
+    checks.push(note('sharing', 'off — this machine reports only to itself'));
+  } else {
+    const state = teamState();
+    const peers = readPool();
+    const mine = peers.find((peer) => peer.deviceId === identity().deviceId);
+
+    checks.push(state.ok === false
+      ? fail('pool', `last exchange failed: ${String(state.error ?? 'unknown').slice(0, 80)}`, 'syndes team sync')
+      : pass('pool', `${teamConfig().transport} · ${displayPath(poolRoot())}`));
+
+    checks.push(mine
+      ? pass('your shelf', `${identity().name} · ${mine.rollups.size} day(s) published`)
+      : fail('your shelf', 'nothing of yours is in the pool yet', 'syndes team sync'));
+
+    // A peer whose shelf has gone quiet is the failure people misread as "they
+    // stopped working". Naming it here is cheaper than them guessing.
+    const stale = peers.filter((peer) => !peer.isMe && (!peer.lastSeen || Date.now() - peer.lastSeen > 6 * 3_600_000));
+    checks.push(stale.length
+      ? note('peers', `${peers.length - 1} other machine(s), ${stale.length} not synced in 6h: ${stale.map((p) => p.name).join(', ')}`)
+      : pass('peers', `${peers.length - 1} other machine(s), all current`));
+
+    checks.push(note('sharing scope', teamConfig().scope === 'detailed'
+      ? 'detailed — counts, tokens, hours, project ids and tool mix. Never prompt text.'
+      : 'summary — counts, tokens and hours only. No paths, no project ids, no prompt text.'));
+  }
+
   const config = readJson(configFile);
   if (config.exists && config.error) {
     checks.push(fail('config', `syndes.json does not parse: ${config.error}`, 'fix or delete it; defaults will be used'));

package/src/preflight.mjs

@@ -0,0 +1,174 @@
+/**
+ * Can this machine actually reach the pool — and if not, what fixes it.
+ *
+ * Joining a shared repository fails for a handful of dull reasons that all
+ * surface as the same unhelpful git error, and one of them is genuinely
+ * confusing: accepting a collaborator invite in a browser grants the ACCOUNT
+ * access, while git on the machine still has no idea who you are. GitHub then
+ * returns 404 rather than admit a private repository exists, so the honest
+ * message "you are not signed in" arrives disguised as "no such repo".
+ *
+ * So every check here answers three things: what was tested, what happened, and
+ * the exact next command. A check that cannot answer returns `null` rather than
+ * guessing — same rule the platform probes follow.
+ *
+ * Nothing is installed without being asked. Software installs itself on a
+ * developer's machine only when they say so; the most this does unattended is
+ * teach git to use credentials the user already has.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { which, isMac, isWindows, platformName } from '../runtime/platform.mjs';
+import { debug } from '../runtime/log.mjs';
+
+const TIMEOUT_MS = 20_000;
+
+function run(binary, args, { timeout = TIMEOUT_MS, quiet = true } = {}) {
+  try {
+    const out = execFileSync(binary, args, {
+      encoding: 'utf8',
+      timeout,
+      stdio: quiet ? ['ignore', 'pipe', 'pipe'] : 'inherit',
+      windowsHide: true,
+      env: { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: 'echo' },
+    });
+    return { ok: true, out: (out ?? '').trim(), error: null };
+  } catch (error) {
+    const stderr = String(error.stderr ?? '').trim();
+    return { ok: false, out: '', error: (stderr || error.message).split('\n').slice(-2).join(' ').slice(0, 240) };
+  }
+}
+
+/** How this platform installs the GitHub CLI. */
+export function ghInstallHint() {
+  if (isMac) return which('brew') ? 'brew install gh' : 'see https://cli.github.com (or: brew install gh)';
+  if (isWindows) return 'winget install --id GitHub.cli';
+  return 'see https://cli.github.com — most distros package it as `gh`';
+}
+
+export function gitInstallHint() {
+  if (isMac) return 'xcode-select --install';
+  if (isWindows) return 'winget install --id Git.Git';
+  return 'your package manager, e.g. apt install git';
+}
+
+/** @returns {{installed: boolean, authed: boolean, account: string|null, gitConfigured: boolean}} */
+export function ghState() {
+  const gh = which('gh');
+  if (!gh) return { installed: false, authed: false, account: null, gitConfigured: false };
+
+  const status = run(gh, ['auth', 'status']);
+  const account = /Logged in to \S+ account (\S+)/.exec(`${status.out}\n${status.error ?? ''}`)?.[1] ?? null;
+
+  // `gh auth setup-git` writes a credential helper entry; without it a gh login
+  // authenticates the gh command and nothing else, which is the trap.
+  const helper = run(which('git') ?? 'git', ['config', '--get-regexp', 'credential.*helper']);
+  return {
+    installed: true,
+    authed: Boolean(account),
+    account,
+    gitConfigured: /gh auth git-credential|gh\b/.test(helper.out),
+  };
+}
+
+/**
+ * Everything that must be true before a join can work.
+ *
+ * @param {string|null} repo  the remote to test, or null to skip the reach check
+ * @returns {{ok: boolean, checks: object[], blocking: object|null}}
+ */
+export function diagnose(repo = null) {
+  const checks = [];
+  const git = which('git');
+
+  checks.push(git
+    ? { name: 'git', ok: true, detail: git }
+    : { name: 'git', ok: false, detail: `not installed on this ${platformName}`, fix: gitInstallHint() });
+
+  const gh = ghState();
+  checks.push(gh.installed
+    ? { name: 'gh', ok: true, detail: gh.authed ? `signed in as ${gh.account}` : 'installed, not signed in' }
+    : { name: 'gh', ok: null, detail: 'not installed — optional, but it is the easiest way to authenticate', fix: ghInstallHint() });
+
+  if (git && repo && !repo.startsWith('/') && !repo.startsWith('~')) {
+    const reach = run(git, ['ls-remote', '--heads', repo]);
+    if (reach.ok) {
+      checks.push({ name: 'repository', ok: true, detail: 'reachable, and git can authenticate' });
+    } else {
+      checks.push({
+        name: 'repository',
+        ok: false,
+        detail: explain(reach.error, gh),
+        fix: remedy(gh, repo),
+        raw: reach.error,
+      });
+    }
+  }
+
+  const blocking = checks.find((check) => check.ok === false) ?? null;
+  return { ok: !blocking, checks, blocking, gh };
+}
+
+/**
+ * Turn git's message into the actual problem.
+ *
+ * "Repository not found" on a private repo almost never means the repo is
+ * missing — it means GitHub will not confirm it exists to someone it cannot
+ * identify. Repeating git's wording would send the user to check the URL, which
+ * is the one thing that is usually right.
+ */
+function explain(error, gh) {
+  const text = String(error ?? '');
+  if (/could not read Username|Authentication failed|terminal prompts disabled/i.test(text)) {
+    return gh.authed
+      ? `git has no credentials for this remote, though gh is signed in as ${gh.account}`
+      : 'git has no credentials for this remote';
+  }
+  if (/not found|does not exist/i.test(text)) {
+    return gh.authed
+      ? `not visible to ${gh.account} — either the invite is not accepted, or git is not using that account`
+      : 'private repositories are invisible until git can prove who you are';
+  }
+  if (/Permission denied \(publickey\)/i.test(text)) return 'no SSH key on this machine that GitHub recognises';
+  if (/Could not resolve host|network/i.test(text)) return 'cannot reach the network';
+  return text.slice(0, 160);
+}
+
+function remedy(gh, repo) {
+  const ssh = repo.startsWith('git@') || repo.startsWith('ssh://');
+  if (ssh) return 'add an SSH key to your GitHub account, or use the https:// url instead';
+  if (!gh.installed) return `${ghInstallHint()}, then: gh auth login && gh auth setup-git`;
+  if (!gh.authed) return 'gh auth login';
+  if (!gh.gitConfigured) return 'gh auth setup-git';
+  return 'check the collaborator invite has been accepted for this account';
+}
+
+/**
+ * Fix what can be fixed without installing anything.
+ *
+ * `gh auth login` is interactive by design — it opens a browser and asks the
+ * person to confirm — so it is only attempted when there is a terminal to run
+ * it in, and it inherits stdio so the user sees and answers it themselves.
+ *
+ * @returns {{ran: string[], ok: boolean}}
+ */
+export function repair({ interactive = Boolean(process.stdin.isTTY) } = {}) {
+  const gh = ghState();
+  const ran = [];
+  if (!gh.installed) return { ran, ok: false };
+
+  const binary = which('gh');
+  if (!gh.authed) {
+    if (!interactive) return { ran, ok: false };
+    ran.push('gh auth login');
+    const result = run(binary, ['auth', 'login'], { quiet: false, timeout: 300_000 });
+    if (!result.ok) return { ran, ok: false };
+  }
+
+  if (!ghState().gitConfigured) {
+    ran.push('gh auth setup-git');
+    const result = run(binary, ['auth', 'setup-git']);
+    if (!result.ok) { debug('gh auth setup-git failed', result.error); return { ran, ok: false }; }
+  }
+  return { ran, ok: ghState().authed };
+}

package/src/term.mjs

@@ -207,10 +207,50 @@ export function beat(ms = 90) {
   return new Promise((resolve) => { setTimeout(resolve, ms); });
 }
 
+/**
+ * Ask, and always come back with something.
+ *
+ * Two ways a question never gets answered, both of which used to hang forever:
+ *
+ *   • There is no terminal. Every caller of this function is interactive by
+ *     nature, so with no tty there is nobody to ask — and reading whatever
+ *     happens to be on a pipe as though a person typed it is worse than not
+ *     asking, particularly for the PIN prompt. This follows the rule the rest
+ *     of the codebase already keeps: a probe that cannot answer returns nothing
+ *     and the caller degrades, rather than "unsupported" and "broken" looking
+ *     alike. It is also the only DETERMINISTIC answer available. When stdin is
+ *     /dev/null — which is exactly what npm hands a postinstall — Node emits no
+ *     `end` and no `close` on it at all, so nothing short of a timeout would
+ *     ever notice, and a timeout in a prompt is a guess about how fast someone
+ *     types.
+ *
+ *   • The user pressed ctrl-D at a real prompt. readline's callback never
+ *     fires, so `close` is what settles it.
+ *
+ * Left unhandled, either one leaves the promise pending and Node exits mid
+ * install with "unsettled top-level await", which reads as a crash with no cause.
+ * An unanswered question resolves empty, and every caller already treats empty
+ * as "no answer given".
+ */
 export function ask(question, { silent = false } = {}) {
   return new Promise((resolve) => {
+    if (!process.stdin.isTTY || process.stdin.readableEnded || process.stdin.destroyed) {
+      resolve('');
+      return;
+    }
+
     const rl = createInterface({ input: process.stdin, output: process.stdout, terminal: true });
 
+    let settled = false;
+    const done = (answer) => {
+      if (settled) return;
+      settled = true;
+      try { rl.close(); } catch { /* already closing */ }
+      resolve(answer);
+    };
+    rl.on('close', () => done(''));
+    rl.on('error', () => done(''));
+
     if (silent) {
       // Echo off by hand: readline has no password mode, and a password printed
       // into a terminal that may be scrolled back or recorded is unacceptable.
@@ -220,13 +260,12 @@ export function ask(question, { silent = false } = {}) {
       rl.question('', (answer) => {
         rl.input.off('data', redraw);
         rl.output.write('\n');
-        rl.close();
-        resolve(answer);
+        done(answer);
       });
       return;
     }
 
-    rl.question(question, (answer) => { rl.close(); resolve(answer.trim()); });
+    rl.question(question, (answer) => done(answer.trim()));
   });
 }