@arkhera30/cli 0.2.3 → 0.3.0

package/compose/docker-compose.yml

@@ -16,40 +16,6 @@
 
 services:
 
-  # ── QMD Daemon ─────────────────────────────────────────────────────────────
-  # Shared QMD MCP HTTP server. Keeps GGUF models warm in memory so Anvil and
-  # Vault pay the model-load cost only once.
-  #
-  # The qmd-daemon-data volume is also mounted into the Anvil and Vault
-  # containers at their respective ~/.cache/qmd paths. This lets both services
-  # run `qmd collection add` / `qmd update` subprocess calls that write to the
-  # same SQLite database the daemon reads from — keeping the index current.
-  #
-  # start_period covers first-boot GGUF model download (~1-2 GB) + initial embed.
-  qmd-daemon:
-    image: ghcr.io/arjunkhera/horus/qmd-daemon:latest
-    environment:
-      - QMD_DAEMON_PORT=8181
-      - HORUS_RUNTIME=${HORUS_RUNTIME:-docker}
-    volumes:
-      - qmd-daemon-data:/home/qmd/.cache/qmd
-    networks:
-      - horus-net
-    restart: unless-stopped
-    stop_grace_period: 15s
-    deploy:
-      resources:
-        limits:
-          memory: 4g
-        reservations:
-          memory: 512m
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:8181/health"]
-      interval: 30s
-      timeout: 10s
-      start_period: 600s
-      retries: 3
-
   # ── Anvil ──────────────────────────────────────────────────────────────────
   # Notes system and MCP server. Indexes markdown files from the Notes repo.
   anvil:
@@ -59,8 +25,6 @@ services:
     volumes:
       # Notes repo — read/write so Anvil can git-sync or clone on first boot
       - ${HORUS_DATA_PATH}/notes:/data/notes:rw
-      # Shared QMD database + model cache (same volume as qmd-daemon).
-      - qmd-daemon-data:/home/anvil/.cache/qmd
     environment:
       - HORUS_RUNTIME=${HORUS_RUNTIME:-docker}
       - ANVIL_TRANSPORT=http
@@ -68,15 +32,9 @@ services:
       - ANVIL_HOST=0.0.0.0
       - ANVIL_NOTES_PATH=/data/notes
       - ANVIL_REPO_URL=${ANVIL_REPO_URL:-}
-      - ANVIL_QMD_COLLECTION=${ANVIL_QMD_COLLECTION:-anvil}
       - ANVIL_SYNC_INTERVAL=${ANVIL_SYNC_INTERVAL:-300}
       - ANVIL_DEBOUNCE_SECONDS=${ANVIL_DEBOUNCE_SECONDS:-5}
       - GITHUB_TOKEN=${GITHUB_TOKEN:-}
-      # Route search calls to the shared daemon; fall back to subprocess if unset.
-      - QMD_DAEMON_URL=http://qmd-daemon:8181
-    depends_on:
-      qmd-daemon:
-        condition: service_healthy
     networks:
       - horus-net
     restart: unless-stopped
@@ -91,11 +49,11 @@ services:
       test: ["CMD", "curl", "-f", "http://localhost:8100/health"]
       interval: 30s
       timeout: 5s
-      start_period: 600s
+      start_period: 60s
       retries: 3
 
   # ── Vault ──────────────────────────────────────────────────────────────────
-  # Knowledge service. Semantic search over the knowledge-base repo.
+  # Knowledge service. Search over the knowledge-base repo.
   vault:
     image: ghcr.io/arjunkhera/horus/vault:latest
     ports:
@@ -105,25 +63,17 @@ services:
       - ${HORUS_DATA_PATH}/knowledge-base:/data/knowledge-repo:rw
       # Write-path workspace: staging area for draft pages before PR
       - vault-workspace:/data/workspace
-      # Shared QMD database + model cache (same volume as qmd-daemon).
-      - qmd-daemon-data:/home/appuser/.cache/qmd
     environment:
       - HORUS_RUNTIME=${HORUS_RUNTIME:-docker}
       - KNOWLEDGE_REPO_PATH=/data/knowledge-repo
       - WORKSPACE_PATH=/data/workspace
       - VAULT_KNOWLEDGE_REPO_URL=${VAULT_KNOWLEDGE_REPO_URL:-}
-      - QMD_INDEX_NAME=${QMD_INDEX_NAME:-knowledge}
       - SYNC_INTERVAL=${VAULT_SYNC_INTERVAL:-300}
       - VAULT_SYNC_INTERVAL=${VAULT_SYNC_INTERVAL:-300}
       - LOG_LEVEL=${LOG_LEVEL:-info}
       - HOST=0.0.0.0
       - PORT=8000
       - GITHUB_TOKEN=${GITHUB_TOKEN:-}
-      # Route search calls to the shared daemon; fall back to subprocess if unset.
-      - QMD_DAEMON_URL=http://qmd-daemon:8181
-    depends_on:
-      qmd-daemon:
-        condition: service_healthy
     networks:
       - horus-net
     restart: unless-stopped
@@ -138,7 +88,7 @@ services:
       test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
       interval: 30s
       timeout: 10s
-      start_period: 600s
+      start_period: 60s
       retries: 3
 
   # ── Vault MCP ──────────────────────────────────────────────────────────────
@@ -236,9 +186,5 @@ networks:
 
 # ── Volumes ───────────────────────────────────────────────────────────────────
 volumes:
-  # Shared QMD daemon database + GGUF model cache.
-  # Mounted into qmd-daemon, Anvil, and Vault so all three share one SQLite index.
-  # Persists model downloads (~1-2 GB) and index across container rebuilds.
-  qmd-daemon-data:
   # Vault write-path staging workspace
   vault-workspace:

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command10 } from "commander";
-import chalk10 from "chalk";
+import { Command as Command11 } from "commander";
+import chalk11 from "chalk";
 
 // src/commands/setup.ts
 import { Command as Command2 } from "commander";
@@ -52,17 +52,19 @@ var DEFAULT_PORTS = {
   // internal routing layer
   ui: 8400,
   // horus-ui — user-facing web interface
-  forge: 8200
+  forge: 8200,
+  typesense: 8108
+  // Typesense search engine
 };
 var DEFAULT_DATA_DIR = join(homedir(), "Horus", "data");
 var SERVICES = [
-  "qmd-daemon",
   "anvil",
   "vault-router",
   // replaces 'vault'
   "vault-mcp",
   "forge",
-  "horus-ui"
+  "horus-ui",
+  "typesense"
 ];
 var CONFIG_VERSION = "1.0";
 
@@ -77,10 +79,14 @@ function defaultConfig() {
       anvil_notes: "",
       forge_registry: ""
     },
+    search: {
+      api_key: "horus-local-key"
+    },
     vaults: {},
     github_hosts: {},
     host_repos_path: "",
-    host_repos_extra_scan_dirs: []
+    host_repos_extra_scan_dirs: [],
+    enable_ui: true
   };
 }
 function ensureHorusDir() {
@@ -127,16 +133,21 @@ function buildConfigFromParsed(parsed) {
       vault_rest: parsedPorts?.vault_rest ?? defaults.ports.vault_rest,
       vault_mcp: parsedPorts?.vault_mcp ?? defaults.ports.vault_mcp,
       vault_router: parsedPorts?.vault_router ?? defaults.ports.vault_router,
-      forge: parsedPorts?.forge ?? defaults.ports.forge
+      forge: parsedPorts?.forge ?? defaults.ports.forge,
+      typesense: parsedPorts?.typesense ?? defaults.ports.typesense
     },
     repos: {
       anvil_notes: repos?.anvil_notes ?? defaults.repos.anvil_notes,
       forge_registry: repos?.forge_registry ?? defaults.repos.forge_registry
     },
+    search: {
+      api_key: parsed.search?.api_key ?? defaults.search.api_key
+    },
     vaults: parsed.vaults ?? defaults.vaults,
     github_hosts: parsed.github_hosts ?? defaults.github_hosts,
     host_repos_path: parsed.host_repos_path ?? defaults.host_repos_path,
-    host_repos_extra_scan_dirs: parsed.host_repos_extra_scan_dirs ?? defaults.host_repos_extra_scan_dirs
+    host_repos_extra_scan_dirs: parsed.host_repos_extra_scan_dirs ?? defaults.host_repos_extra_scan_dirs,
+    enable_ui: parsed.enable_ui ?? defaults.enable_ui
   };
 }
 function saveConfig(config) {
@@ -223,6 +234,10 @@ function generateEnv(config) {
     `VAULT_MCP_PORT=${config.ports.vault_mcp}`,
     `VAULT_ROUTER_PORT=${config.ports.vault_router}`,
     `FORGE_PORT=${config.ports.forge}`,
+    `TYPESENSE_PORT=${config.ports.typesense}`,
+    "",
+    "# Search",
+    `TYPESENSE_API_KEY=${config.search.api_key}`,
     "",
     "# Repository URLs (must be HTTPS \u2014 container services do not have SSH keys)",
     `ANVIL_REPO_URL=${config.repos.anvil_notes}`,
@@ -246,8 +261,11 @@ var CONFIG_KEYS = [
   "port.vault-mcp",
   "port.vault-router",
   "port.forge",
+  "port.typesense",
   "repo.anvil-notes",
-  "repo.forge-registry"
+  "repo.forge-registry",
+  "search.api-key",
+  "enable-ui"
 ];
 function getConfigValue(config, key) {
   switch (key) {
@@ -269,10 +287,16 @@ function getConfigValue(config, key) {
       return String(config.ports.vault_router);
     case "port.forge":
       return String(config.ports.forge);
+    case "port.typesense":
+      return String(config.ports.typesense);
     case "repo.anvil-notes":
       return config.repos.anvil_notes;
     case "repo.forge-registry":
       return config.repos.forge_registry;
+    case "search.api-key":
+      return config.search.api_key;
+    case "enable-ui":
+      return String(config.enable_ui);
   }
 }
 function setConfigValue(config, key, value) {
@@ -308,12 +332,24 @@ function setConfigValue(config, key, value) {
     case "port.forge":
       updated.ports = { ...updated.ports, forge: parseInt(value, 10) };
       break;
+    case "port.typesense":
+      updated.ports = { ...updated.ports, typesense: parseInt(value, 10) };
+      break;
     case "repo.anvil-notes":
       updated.repos = { ...updated.repos, anvil_notes: value };
       break;
     case "repo.forge-registry":
       updated.repos = { ...updated.repos, forge_registry: value };
       break;
+    case "search.api-key":
+      updated.search = { ...updated.search, api_key: value };
+      break;
+    case "enable-ui":
+      if (value !== "true" && value !== "false") {
+        throw new Error(`Invalid value for enable-ui: ${value}. Must be "true" or "false".`);
+      }
+      updated.enable_ui = value === "true";
+      break;
   }
   return updated;
 }
@@ -534,7 +570,7 @@ Run '${runtime.name} compose logs <service>' from ~/Horus/ to investigate.`
 Run '${runtime.name} compose logs' from ~/Horus/ to investigate.`
       );
     }
-    await new Promise((resolve2) => setTimeout(resolve2, intervalMs));
+    await new Promise((resolve3) => setTimeout(resolve3, intervalMs));
   }
 }
 
@@ -546,32 +582,6 @@ function applyPodmanUserOverride(compose) {
     '$1\n    user: "0:0"'
   );
 }
-var QMD_DAEMON_SERVICE = `  # \u2500\u2500 QMD Daemon \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-  # Shared QMD MCP HTTP server. Keeps GGUF models warm in memory so Anvil and
-  # Vault pay the model-load cost only once.
-  qmd-daemon:
-    image: ghcr.io/arjunkhera/horus/qmd-daemon:latest
-    environment:
-      - QMD_DAEMON_PORT=8181
-      - HORUS_RUNTIME=\${HORUS_RUNTIME:-docker}
-    volumes:
-      - qmd-daemon-data:/home/qmd/.cache/qmd
-    networks:
-      - horus-net
-    restart: unless-stopped
-    stop_grace_period: 15s
-    deploy:
-      resources:
-        limits:
-          memory: 4g
-        reservations:
-          memory: 512m
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:8181/health"]
-      interval: 30s
-      timeout: 10s
-      start_period: 600s
-      retries: 3`;
 var ANVIL_SERVICE = `  # \u2500\u2500 Anvil \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
   # Notes system and MCP server. Indexes markdown files from the Notes repo.
   anvil:
@@ -580,7 +590,6 @@ var ANVIL_SERVICE = `  # \u2500\u2500 Anvil \u2500\u2500\u2500\u2500\u2500\u2500
       - "\${ANVIL_PORT:-8100}:8100"
     volumes:
       - \${HORUS_DATA_PATH}/notes:/data/notes:rw
-      - qmd-daemon-data:/home/anvil/.cache/qmd
     environment:
       - HORUS_RUNTIME=\${HORUS_RUNTIME:-docker}
       - ANVIL_TRANSPORT=http
@@ -588,14 +597,9 @@ var ANVIL_SERVICE = `  # \u2500\u2500 Anvil \u2500\u2500\u2500\u2500\u2500\u2500
       - ANVIL_HOST=0.0.0.0
       - ANVIL_NOTES_PATH=/data/notes
       - ANVIL_REPO_URL=\${ANVIL_REPO_URL:-}
-      - ANVIL_QMD_COLLECTION=\${ANVIL_QMD_COLLECTION:-anvil}
       - ANVIL_SYNC_INTERVAL=\${ANVIL_SYNC_INTERVAL:-300}
       - ANVIL_DEBOUNCE_SECONDS=\${ANVIL_DEBOUNCE_SECONDS:-5}
       - GITHUB_TOKEN=\${GITHUB_TOKEN:-}
-      - QMD_DAEMON_URL=http://qmd-daemon:8181
-    depends_on:
-      qmd-daemon:
-        condition: service_healthy
     networks:
       - horus-net
     restart: unless-stopped
@@ -610,7 +614,7 @@ var ANVIL_SERVICE = `  # \u2500\u2500 Anvil \u2500\u2500\u2500\u2500\u2500\u2500
       test: ["CMD", "curl", "-f", "http://localhost:8100/health"]
       interval: 30s
       timeout: 5s
-      start_period: 600s
+      start_period: 60s
       retries: 3`;
 var FORGE_SERVICE = `  # \u2500\u2500 Forge \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
   # Workspace manager and package registry MCP server.
@@ -660,6 +664,27 @@ var FORGE_SERVICE = `  # \u2500\u2500 Forge \u2500\u2500\u2500\u2500\u2500\u2500
       timeout: 5s
       start_period: 60s
       retries: 3`;
+var TYPESENSE_SERVICE = `  # \u2500\u2500 Typesense \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  # Full-text and vector search engine for unified Horus Search.
+  typesense:
+    image: typesense/typesense:27.1
+    ports:
+      - "\${TYPESENSE_PORT:-8108}:8108"
+    volumes:
+      - \${HORUS_DATA_PATH}/typesense-data:/data
+    command: >
+      --data-dir=/data
+      --api-key=\${TYPESENSE_API_KEY:-horus-local-key}
+      --enable-cors
+    networks:
+      - horus-net
+    healthcheck:
+      test: ["CMD-SHELL", "bash -c 'echo > /dev/tcp/localhost/8108'"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 5s
+    restart: unless-stopped`;
 var HORUS_UI_SERVICE = `  # \u2500\u2500 Horus UI \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
   # Web interface \u2014 React SPA served by Express proxy on port 8400.
   # Proxies /api/anvil, /api/vault, /api/forge to the respective services.
@@ -695,7 +720,7 @@ var HORUS_UI_SERVICE = `  # \u2500\u2500 Horus UI \u2500\u2500\u2500\u2500\u2500
         reservations:
           memory: 64m
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:8400/api/health"]
+      test: ["CMD", "wget", "--spider", "-q", "http://localhost:8400/api/health"]
       interval: 30s
       timeout: 5s
       start_period: 30s
@@ -716,13 +741,11 @@ function generateComposeFile(config, runtime) {
     volumes:
       - \${HORUS_DATA_PATH}/vaults/${name}:/data/knowledge-repo:rw
       - vault-${name}-workspace:/data/workspace
-      - qmd-daemon-data:/home/appuser/.cache/qmd
     environment:
       - HORUS_RUNTIME=\${HORUS_RUNTIME:-docker}
       - KNOWLEDGE_REPO_PATH=/data/knowledge-repo
       - WORKSPACE_PATH=/data/workspace
       - VAULT_KNOWLEDGE_REPO_URL=${vault.repo}
-      - QMD_INDEX_NAME=vault-${name}
       - SYNC_INTERVAL=\${VAULT_SYNC_INTERVAL:-300}
       - VAULT_SYNC_INTERVAL=\${VAULT_SYNC_INTERVAL:-300}
       - LOG_LEVEL=\${LOG_LEVEL:-info}
@@ -730,10 +753,6 @@ function generateComposeFile(config, runtime) {
       - PORT=8000
       - GITHUB_TOKEN=${token}
       - GITHUB_API_HOST=${apiHost}
-      - QMD_DAEMON_URL=http://qmd-daemon:8181
-    depends_on:
-      qmd-daemon:
-        condition: service_healthy
     networks:
       - horus-net
     restart: unless-stopped
@@ -747,7 +766,7 @@ function generateComposeFile(config, runtime) {
       test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
       interval: 30s
       timeout: 10s
-      start_period: 600s
+      start_period: 60s
       retries: 3`;
   });
   const defaultVaultEntry = vaultEntries.find(([, v]) => v.default);
@@ -821,8 +840,6 @@ ${vaultRouterDependsOn}
     "",
     "services:",
     "",
-    QMD_DAEMON_SERVICE,
-    "",
     ANVIL_SERVICE,
     "",
     ...vaultServices.map((s) => s + "\n"),
@@ -832,8 +849,9 @@ ${vaultRouterDependsOn}
     "",
     FORGE_SERVICE,
     "",
-    HORUS_UI_SERVICE,
+    TYPESENSE_SERVICE,
     "",
+    ...config.enable_ui !== false ? [HORUS_UI_SERVICE, ""] : [],
     "# \u2500\u2500 Networks \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
     "networks:",
     "  horus-net:",
@@ -841,7 +859,6 @@ ${vaultRouterDependsOn}
     "",
     "# \u2500\u2500 Volumes \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
     "volumes:",
-    "  qmd-daemon-data:",
     vaultVolumeEntries
   ];
   let content = sections.join("\n");
@@ -1327,7 +1344,8 @@ var setupCommand = new Command2("setup").description("Interactive first-run setu
         vault_rest: vault_rest ?? DEFAULT_PORTS.vault_rest,
         vault_mcp: vault_mcp ?? DEFAULT_PORTS.vault_mcp,
         vault_router: vault_router ?? DEFAULT_PORTS.vault_router,
-        forge: forge ?? DEFAULT_PORTS.forge
+        forge: forge ?? DEFAULT_PORTS.forge,
+        typesense: DEFAULT_PORTS.typesense
       };
     }
     console.log("");
@@ -1632,12 +1650,16 @@ var upCommand = new Command3("up").description("Start the Horus stack").option("
     process.exit(1);
   }
   if (opts.pull) {
-    const pullSpinner = ora3("Pulling latest images...").start();
+    console.log("");
+    console.log(chalk3.bold("Pulling latest images..."));
     try {
-      await composeStreaming(runtime, runtime.name === "podman" ? ["pull"] : ["pull", "--ignore-pull-failures"]);
-      pullSpinner.succeed("Images up to date");
+      await composeStreaming(runtime, ["pull"]);
+      console.log("");
+      console.log(chalk3.green("\u2713 Pull complete"));
     } catch {
-      pullSpinner.warn("Could not pull images, using cached");
+      console.log("");
+      console.log(chalk3.yellow("\u26A0  Warning: failed to pull one or more images \u2014 using cached versions."));
+      console.log(chalk3.dim("   Run `docker compose pull` to see which services failed."));
     }
   }
   console.log("");
@@ -2316,7 +2338,7 @@ function checkDiskSpace(dataDir) {
     return {
       status: "warn",
       label: "Disk space",
-      message: `Disk space low: only ${freeGBStr}GB available (5GB recommended; QMD models take ~2GB)`,
+      message: `Disk space low: only ${freeGBStr}GB available (5GB recommended)`,
       hint: "Free up disk space before running Horus"
     };
   } catch {
@@ -2624,8 +2646,487 @@ backupCommand.command("restore <file>").description("Restore Horus data from a b
   await restoreBackup(file, opts.yes);
 });
 
+// src/commands/test-env.ts
+import { Command as Command10 } from "commander";
+import chalk10 from "chalk";
+import ora8 from "ora";
+import { join as join8 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { dirname as dirname2 } from "path";
+
+// src/lib/test-env.ts
+import {
+  existsSync as existsSync9,
+  mkdirSync as mkdirSync6,
+  readFileSync as readFileSync6,
+  writeFileSync as writeFileSync6,
+  rmSync,
+  readdirSync as readdirSync3,
+  cpSync
+} from "fs";
+import { join as join7 } from "path";
+import { parse as parseYaml3 } from "yaml";
+import { execa as execa3 } from "execa";
+function getTestEnvRoot(dataDir) {
+  return join7(dataDir, "test-env");
+}
+function getLockPath(dataDir, slot) {
+  return join7(getTestEnvRoot(dataDir), `slot-${slot}.lock`);
+}
+function getSlotDataPath(dataDir, slot) {
+  return join7(getTestEnvRoot(dataDir), `slot-${slot}`);
+}
+function getTestEnvConfigPath(dataDir) {
+  return join7(dataDir, "config", "test-env.yaml");
+}
+var DEFAULT_CONFIG = {
+  max_slots: 1,
+  timeout_minutes: 10,
+  base_port: 9100
+};
+var PORT_OFFSETS = {
+  anvil: 0,
+  typesense: 8,
+  vault_svc: 1,
+  vault_router: 50,
+  vault_mcp: 100,
+  forge: 150,
+  ui: 160
+};
+function loadTestEnvConfig(dataDir) {
+  const configPath = getTestEnvConfigPath(dataDir);
+  if (!existsSync9(configPath)) {
+    return { ...DEFAULT_CONFIG };
+  }
+  try {
+    const raw = readFileSync6(configPath, "utf-8");
+    const parsed = parseYaml3(raw);
+    const cfg = parsed?.test_env ?? {};
+    return {
+      max_slots: cfg.max_slots ?? DEFAULT_CONFIG.max_slots,
+      timeout_minutes: cfg.timeout_minutes ?? DEFAULT_CONFIG.timeout_minutes,
+      base_port: cfg.base_port ?? DEFAULT_CONFIG.base_port
+    };
+  } catch {
+    return { ...DEFAULT_CONFIG };
+  }
+}
+function calcPorts(slot, basePort) {
+  const base = basePort + slot * 300;
+  return {
+    anvil: base + PORT_OFFSETS.anvil,
+    typesense: base + PORT_OFFSETS.typesense,
+    vault_svc: base + PORT_OFFSETS.vault_svc,
+    vault_router: base + PORT_OFFSETS.vault_router,
+    vault_mcp: base + PORT_OFFSETS.vault_mcp,
+    forge: base + PORT_OFFSETS.forge,
+    ui: base + PORT_OFFSETS.ui
+  };
+}
+function readLock(dataDir, slot) {
+  const lockPath = getLockPath(dataDir, slot);
+  if (!existsSync9(lockPath)) return null;
+  try {
+    return JSON.parse(readFileSync6(lockPath, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function writeLock(dataDir, lock) {
+  mkdirSync6(getTestEnvRoot(dataDir), { recursive: true });
+  writeFileSync6(getLockPath(dataDir, lock.slot), JSON.stringify(lock, null, 2), "utf-8");
+}
+function removeLock(dataDir, slot) {
+  const lockPath = getLockPath(dataDir, slot);
+  if (existsSync9(lockPath)) {
+    rmSync(lockPath);
+  }
+}
+function isLockExpired(lock, timeoutMinutes) {
+  const acquired = new Date(lock.acquiredAt).getTime();
+  return Date.now() - acquired > timeoutMinutes * 60 * 1e3;
+}
+function getAllSlotStatuses(dataDir, cfg) {
+  return Array.from({ length: cfg.max_slots }, (_, slot) => {
+    const lock = readLock(dataDir, slot);
+    if (!lock) {
+      return { slot, state: "free" };
+    }
+    const expired = isLockExpired(lock, cfg.timeout_minutes);
+    const elapsed = (Date.now() - new Date(lock.acquiredAt).getTime()) / 6e4;
+    return {
+      slot,
+      state: expired ? "expired" : "acquired",
+      lock,
+      ports: lock.ports,
+      dataPath: lock.dataPath,
+      acquiredAt: lock.acquiredAt,
+      elapsedMinutes: Math.round(elapsed)
+    };
+  });
+}
+function findFreeSlot(dataDir, cfg) {
+  for (let slot = 0; slot < cfg.max_slots; slot++) {
+    const lock = readLock(dataDir, slot);
+    if (!lock) return slot;
+    if (isLockExpired(lock, cfg.timeout_minutes)) {
+      removeLock(dataDir, slot);
+      return slot;
+    }
+  }
+  return null;
+}
+function createSlotDirs(slotDataPath) {
+  const dirs = [
+    "notes",
+    join7("vaults", "personal"),
+    "registry",
+    "workspaces",
+    "sessions",
+    "typesense-data"
+  ];
+  for (const dir of dirs) {
+    mkdirSync6(join7(slotDataPath, dir), { recursive: true });
+  }
+}
+function removeSlotDirs(slotDataPath) {
+  if (existsSync9(slotDataPath)) {
+    rmSync(slotDataPath, { recursive: true, force: true });
+  }
+}
+function buildComposeEnv(runtime, ports, slotDataPath) {
+  return {
+    ...process.env,
+    HORUS_RUNTIME: runtime.name,
+    TEST_DATA_PATH: slotDataPath,
+    TEST_PORT_ANVIL: String(ports.anvil),
+    TEST_PORT_TYPESENSE: String(ports.typesense),
+    TEST_PORT_VAULT_SVC: String(ports.vault_svc),
+    TEST_PORT_VAULT_ROUTER: String(ports.vault_router),
+    TEST_PORT_VAULT_MCP: String(ports.vault_mcp),
+    TEST_PORT_FORGE: String(ports.forge),
+    TEST_PORT_UI: String(ports.ui)
+  };
+}
+async function composeUp(runtime, projectName2, ports, slotDataPath) {
+  const env = buildComposeEnv(runtime, ports, slotDataPath);
+  const result = await execa3(
+    runtime.name,
+    [
+      "compose",
+      "-p",
+      projectName2,
+      "-f",
+      join7(HORUS_DIR, "docker-compose.yml"),
+      "-f",
+      join7(HORUS_DIR, "docker-compose.test.yml"),
+      "up",
+      "-d"
+    ],
+    { cwd: HORUS_DIR, env, reject: false }
+  );
+  if (result.exitCode !== 0) {
+    throw new Error(
+      `Failed to start shadow stack (project ${projectName2}):
+${result.stderr}`
+    );
+  }
+}
+async function composeDown(runtime, projectName2, ports, slotDataPath) {
+  const env = buildComposeEnv(runtime, ports, slotDataPath);
+  await execa3(
+    runtime.name,
+    ["compose", "-p", projectName2, "down", "--volumes", "--remove-orphans"],
+    { cwd: HORUS_DIR, env, reject: false }
+  );
+}
+var HEALTH_SERVICES = ["anvil", "forge", "vault-mcp", "typesense"];
+async function checkContainerHealthByProject(runtime, projectName2, service) {
+  const candidates = [
+    `${projectName2}-${service}-1`,
+    `${projectName2}_${service}_1`
+  ];
+  for (const name of candidates) {
+    try {
+      const result = await execa3(
+        runtime.name,
+        ["inspect", "--format", "{{.State.Health.Status}}", name],
+        { reject: false }
+      );
+      if (result.exitCode === 0) {
+        const status = result.stdout.toString().trim().toLowerCase();
+        if (status === "healthy") return "healthy";
+        if (status === "unhealthy") return "unhealthy";
+        return "starting";
+      }
+    } catch {
+      continue;
+    }
+  }
+  return "starting";
+}
+async function waitForShadowStackHealthy(runtime, projectName2, timeoutMs = 12e4, intervalMs = 3e3, onUpdate) {
+  const start = Date.now();
+  while (true) {
+    const statuses = {};
+    await Promise.all(
+      HEALTH_SERVICES.map(async (svc) => {
+        statuses[svc] = await checkContainerHealthByProject(runtime, projectName2, svc);
+      })
+    );
+    if (onUpdate) onUpdate(statuses);
+    const allHealthy = Object.values(statuses).every((s) => s === "healthy");
+    if (allHealthy) return;
+    const anyUnhealthy = Object.values(statuses).some((s) => s === "unhealthy");
+    if (anyUnhealthy) {
+      const failed = Object.entries(statuses).filter(([, s]) => s === "unhealthy").map(([n]) => n).join(", ");
+      throw new Error(`Shadow stack services failed health check: ${failed}`);
+    }
+    if (Date.now() - start >= timeoutMs) {
+      const notReady = Object.entries(statuses).filter(([, s]) => s !== "healthy").map(([n, s]) => `${n}(${s})`).join(", ");
+      throw new Error(`Timed out after ${timeoutMs / 1e3}s waiting for: ${notReady}`);
+    }
+    await new Promise((r) => setTimeout(r, intervalMs));
+  }
+}
+function seedFromFixtures(fixturesPath, slotDataPath) {
+  if (!existsSync9(fixturesPath)) {
+    throw new Error(`Fixtures not found at ${fixturesPath}. Run from the Horus repo root.`);
+  }
+  const dirs = readdirSync3(fixturesPath);
+  for (const dir of dirs) {
+    const src = join7(fixturesPath, dir);
+    const dest = join7(slotDataPath, dir);
+    cpSync(src, dest, { recursive: true });
+  }
+}
+function seedFromLive(dataDir, slotDataPath) {
+  const liveDirs = ["notes", "vaults", "registry"];
+  for (const dir of liveDirs) {
+    const src = join7(dataDir, dir);
+    const dest = join7(slotDataPath, dir);
+    if (existsSync9(src)) {
+      cpSync(src, dest, { recursive: true });
+    }
+  }
+}
+function projectName(slot) {
+  return `horus-test-${slot}`;
+}
+
+// src/commands/test-env.ts
+var testEnvCommand = new Command10("test-env").description("Manage isolated shadow stacks for integration testing");
+testEnvCommand.command("acquire").description("Start a shadow stack on alternate ports with isolated data").option("--timeout <seconds>", "Max wait for health checks (default: 120)", "120").action(async (opts) => {
+  const config = loadConfig();
+  const dataDir = config.data_dir;
+  const testCfg = loadTestEnvConfig(dataDir);
+  const spinner = ora8("Detecting runtime...").start();
+  let runtime;
+  try {
+    runtime = await detectRuntime(config.runtime);
+    spinner.succeed(`Using ${chalk10.cyan(runtime.name)}`);
+  } catch (error) {
+    spinner.fail("No container runtime found");
+    console.error(error.message);
+    process.exit(1);
+  }
+  const slot = findFreeSlot(dataDir, testCfg);
+  if (slot === null) {
+    console.error(chalk10.red(
+      `All ${testCfg.max_slots} slot(s) are in use. Run ${chalk10.bold("horus test-env status")} to see active slots, or ${chalk10.bold("horus test-env release")} to free one.`
+    ));
+    process.exit(1);
+  }
+  const ports = calcPorts(slot, testCfg.base_port);
+  const slotDataPath = getSlotDataPath(dataDir, slot);
+  const project = projectName(slot);
+  const dirSpinner = ora8(`Creating slot-${slot} data directories...`).start();
+  createSlotDirs(slotDataPath);
+  dirSpinner.succeed(`Data directory: ${chalk10.dim(slotDataPath)}`);
+  writeLock(dataDir, {
+    slot,
+    pid: process.pid,
+    acquiredAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ports,
+    dataPath: slotDataPath
+  });
+  const upSpinner = ora8(`Starting shadow stack (project ${chalk10.cyan(project)})...`).start();
+  try {
+    await composeUp(runtime, project, ports, slotDataPath);
+    upSpinner.succeed(`Shadow stack started`);
+  } catch (error) {
+    upSpinner.fail("Failed to start shadow stack");
+    removeLock(dataDir, slot);
+    removeSlotDirs(slotDataPath);
+    console.error(error.message);
+    process.exit(1);
+  }
+  const healthSpinner = ora8("Waiting for services to be healthy...").start();
+  const timeoutMs = parseInt(opts.timeout, 10) * 1e3;
+  try {
+    await waitForShadowStackHealthy(runtime, project, timeoutMs, 3e3, (statuses) => {
+      const parts = Object.entries(statuses).map(([svc, s]) => `${svc}:${s === "healthy" ? chalk10.green(s) : chalk10.yellow(s)}`).join("  ");
+      healthSpinner.text = `Waiting for services... ${parts}`;
+    });
+    healthSpinner.succeed("All services healthy");
+  } catch (error) {
+    healthSpinner.fail("Health check failed");
+    await composeDown(runtime, project, ports, slotDataPath);
+    removeLock(dataDir, slot);
+    removeSlotDirs(slotDataPath);
+    console.error(error.message);
+    process.exit(1);
+  }
+  console.log("");
+  console.log(chalk10.bold.green(`\u2713 Slot ${slot} acquired`));
+  console.log("");
+  console.log(chalk10.bold("Connection info:"));
+  console.log(`  Slot:       ${chalk10.cyan(slot)}`);
+  console.log(`  Project:    ${chalk10.cyan(project)}`);
+  console.log(`  Data:       ${chalk10.dim(slotDataPath)}`);
+  console.log("");
+  console.log(chalk10.bold("Ports:"));
+  console.log(`  Anvil:        http://localhost:${chalk10.cyan(ports.anvil)}`);
+  console.log(`  Forge:        http://localhost:${chalk10.cyan(ports.forge)}`);
+  console.log(`  Vault MCP:    http://localhost:${chalk10.cyan(ports.vault_mcp)}`);
+  console.log(`  Vault Router: http://localhost:${chalk10.cyan(ports.vault_router)}`);
+  console.log(`  Typesense:    http://localhost:${chalk10.cyan(ports.typesense)}`);
+  console.log(`  UI:           http://localhost:${chalk10.cyan(ports.ui)}`);
+  console.log("");
+  console.log(chalk10.bold("Environment:"));
+  console.log(`  export TEST_SLOT=${slot}`);
+  console.log(`  export TEST_ANVIL_URL=http://localhost:${ports.anvil}`);
+  console.log(`  export TEST_FORGE_URL=http://localhost:${ports.forge}`);
+  console.log(`  export TEST_VAULT_MCP_URL=http://localhost:${ports.vault_mcp}`);
+  console.log(`  export TEST_DATA_PATH=${slotDataPath}`);
+  console.log("");
+  console.log(chalk10.dim(`Run ${chalk10.bold(`horus test-env seed --slot ${slot}`)} to populate with fixtures.`));
+  console.log(chalk10.dim(`Run ${chalk10.bold(`horus test-env release --slot ${slot}`)} when done.`));
+});
+testEnvCommand.command("release").description("Tear down a shadow stack and remove its data").option("--slot <n>", "Slot number to release (default: auto-detect acquired slot)").action(async (opts) => {
+  const config = loadConfig();
+  const dataDir = config.data_dir;
+  const testCfg = loadTestEnvConfig(dataDir);
+  let slot;
+  if (opts.slot !== void 0) {
+    slot = parseInt(opts.slot, 10);
+  } else {
+    const statuses = getAllSlotStatuses(dataDir, testCfg);
+    const acquired = statuses.find((s) => s.state === "acquired" || s.state === "expired");
+    if (!acquired) {
+      console.log(chalk10.yellow("No active slots found."));
+      return;
+    }
+    slot = acquired.slot;
+  }
+  const lock = readLock(dataDir, slot);
+  const slotDataPath = getSlotDataPath(dataDir, slot);
+  const project = projectName(slot);
+  const ports = lock?.ports ?? calcPorts(slot, testCfg.base_port);
+  const spinner = ora8("Detecting runtime...").start();
+  let runtime;
+  try {
+    runtime = await detectRuntime(config.runtime);
+    spinner.succeed(`Using ${chalk10.cyan(runtime.name)}`);
+  } catch (error) {
+    spinner.fail("No container runtime found");
+    console.error(error.message);
+    process.exit(1);
+  }
+  const downSpinner = ora8(`Stopping ${chalk10.cyan(project)}...`).start();
+  try {
+    await composeDown(runtime, project, ports, slotDataPath);
+    downSpinner.succeed("Shadow stack stopped");
+  } catch {
+    downSpinner.warn("Failed to stop cleanly (continuing cleanup)");
+  }
+  const cleanSpinner = ora8("Removing test data...").start();
+  removeSlotDirs(slotDataPath);
+  removeLock(dataDir, slot);
+  cleanSpinner.succeed("Test data removed");
+  console.log("");
+  console.log(chalk10.bold.green(`\u2713 Slot ${slot} released`));
+});
+testEnvCommand.command("status").description("Show active shadow stack slots").action(() => {
+  const config = loadConfig();
+  const dataDir = config.data_dir;
+  const testCfg = loadTestEnvConfig(dataDir);
+  const statuses = getAllSlotStatuses(dataDir, testCfg);
+  const acquiredCount = statuses.filter((s) => s.state === "acquired").length;
+  console.log("");
+  console.log(chalk10.bold("Test Environment Status"));
+  console.log(`  Max slots:  ${testCfg.max_slots}`);
+  console.log(`  In use:     ${acquiredCount} / ${testCfg.max_slots}`);
+  console.log(`  Base port:  ${testCfg.base_port}`);
+  console.log("");
+  if (statuses.every((s) => s.state === "free")) {
+    console.log(chalk10.dim("  No active slots."));
+    console.log("");
+    return;
+  }
+  for (const s of statuses) {
+    if (s.state === "free") continue;
+    const stateLabel = s.state === "expired" ? chalk10.yellow("EXPIRED") : chalk10.green("ACTIVE");
+    console.log(`  ${chalk10.bold(`Slot ${s.slot}`)}  ${stateLabel}`);
+    if (s.acquiredAt) {
+      console.log(`    Acquired: ${s.acquiredAt} (${s.elapsedMinutes}m ago)`);
+    }
+    if (s.ports) {
+      console.log(`    Ports:    anvil=${s.ports.anvil}  forge=${s.ports.forge}  vault-mcp=${s.ports.vault_mcp}  typesense=${s.ports.typesense}`);
+    }
+    if (s.dataPath) {
+      console.log(`    Data:     ${chalk10.dim(s.dataPath)}`);
+    }
+    console.log("");
+  }
+});
+testEnvCommand.command("seed").description("Populate a slot with test fixtures (or a snapshot of live data)").option("--slot <n>", "Slot to seed (default: auto-detect)").option("--from-live", "Snapshot live data instead of using fixtures").action(async (opts) => {
+  const config = loadConfig();
+  const dataDir = config.data_dir;
+  const testCfg = loadTestEnvConfig(dataDir);
+  let slot;
+  if (opts.slot !== void 0) {
+    slot = parseInt(opts.slot, 10);
+  } else {
+    const statuses = getAllSlotStatuses(dataDir, testCfg);
+    const acquired = statuses.find((s) => s.state === "acquired");
+    if (!acquired) {
+      console.error(chalk10.red("No active slot found. Run `horus test-env acquire` first."));
+      process.exit(1);
+    }
+    slot = acquired.slot;
+  }
+  const slotDataPath = getSlotDataPath(dataDir, slot);
+  if (opts.fromLive) {
+    const spinner = ora8("Snapshotting live data into slot...").start();
+    try {
+      seedFromLive(dataDir, slotDataPath);
+      spinner.succeed("Live data snapshotted");
+    } catch (error) {
+      spinner.fail("Failed to snapshot live data");
+      console.error(error.message);
+      process.exit(1);
+    }
+  } else {
+    const here = dirname2(fileURLToPath2(import.meta.url));
+    const repoRoot = join8(here, "..", "..", "..", "..", "..");
+    const fixturesPath = join8(repoRoot, "test", "fixtures");
+    const spinner = ora8(`Seeding slot-${slot} from fixtures...`).start();
+    try {
+      seedFromFixtures(fixturesPath, slotDataPath);
+      spinner.succeed(`Slot ${slot} seeded from fixtures`);
+    } catch (error) {
+      spinner.fail("Failed to seed fixtures");
+      console.error(error.message);
+      process.exit(1);
+    }
+  }
+  console.log("");
+  console.log(chalk10.dim("Services will re-index automatically. Allow ~10s before running tests."));
+});
+
 // src/index.ts
-var program = new Command10();
+var program = new Command11();
 program.name("horus").description("CLI for managing the Horus Docker Compose stack").version(CLI_VERSION);
 program.addCommand(setupCommand);
 program.addCommand(upCommand);
@@ -2636,6 +3137,7 @@ program.addCommand(connectCommand);
 program.addCommand(updateCommand);
 program.addCommand(doctorCommand);
 program.addCommand(backupCommand);
+program.addCommand(testEnvCommand);
 program.exitOverride();
 try {
   await program.parseAsync(process.argv);
@@ -2644,9 +3146,9 @@ try {
     process.exit(0);
   }
   if (error instanceof Error) {
-    console.error(chalk10.red(`Error: ${error.message}`));
+    console.error(chalk11.red(`Error: ${error.message}`));
   } else {
-    console.error(chalk10.red("An unexpected error occurred."));
+    console.error(chalk11.red("An unexpected error occurred."));
   }
   process.exit(1);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arkhera30/cli",
-  "version": "0.2.3",
+  "version": "0.3.0",
   "description": "CLI for managing the Horus AI development stack",
   "type": "module",
   "bin": {
@@ -37,7 +37,7 @@
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Arjunkhera/Horus.git",
-    "directory": "cli"
+    "directory": "packages/cli"
   },
   "homepage": "https://github.com/Arjunkhera/Horus#readme",
   "bugs": {