@m6d/cortex-cli 0.19.0 → 0.21.0

package/src/scaffold/files.ts

@@ -2,13 +2,12 @@
  * Every file `cortex new` writes, as one pure function. Files with nothing to
  * fill in are verbatim text under templates/; the ones that vary with the
  * project are assembled here. The tooling configs are inlined rather than
- * pulled from `@m6d/eslint-config`, `@m6d/prettier-config` and `@m6d/tsconfig`:
- * those are `private: true` at `0.0.0` and resolvable only through this
- * workspace, and a standalone scaffold has no workspace.
+ * pulled from `@m6d/prettier-config`, `@m6d/tsconfig` and the root
+ * `.oxlintrc.json`: those are `private: true` at `0.0.0` (the lint config
+ * loads `@m6d/oxlint-plugin`) and resolvable only through this workspace, and
+ * a standalone scaffold has no workspace.
  */
 
-import { NAME_MAX_LENGTH } from "@cortex/contracts/manifest";
-
 import pkg from "../../package.json";
 import serverTs from "@/scaffold/templates/server.ts.txt";
 import setupTs from "@/scaffold/templates/setup.ts.txt";
@@ -16,11 +15,11 @@ import datasetsTs from "@/scaffold/templates/datasets.ts.txt";
 import tsconfigJson from "@/scaffold/templates/tsconfig.json.txt";
 import gitignoreText from "@/scaffold/templates/gitignore.txt";
 import dockerignoreText from "@/scaffold/templates/dockerignore.txt";
-import eslintConfig from "@/scaffold/templates/eslint.config.mjs.txt";
+import oxlintrc from "@/scaffold/templates/oxlintrc.json.txt";
 import prettierConfig from "@/scaffold/templates/prettier.config.mjs.txt";
 import fallowrc from "@/scaffold/templates/fallowrc.jsonc.txt";
-// Project jargon is the project's to add. Only `mprocs`, which its own
-// package.json names, is seeded: a stranger's vocabulary is noise in a repo.
+// Project jargon is the project's to add. Only the tool names its own
+// package.json carries are seeded: a stranger's vocabulary is noise in a repo.
 import cspellJson from "@/scaffold/templates/cspell.json.txt";
 import { applyPorts, type Ports } from "@/scaffold/ports";
 
@@ -29,7 +28,7 @@ import { applyPorts, type Ports } from "@/scaffold/ports";
  * `@m6d/cortex` range below are stamped by scripts/sync-package-versions.ts
  * before the CLI publishes, so a scaffold pins what was current then.
  */
-const CORTEX_VERSION = "0.18.0";
+const CORTEX_VERSION = "0.20.0";
 
 /** This machine as Cortex's containers name it: the one private host the stack's egress policy admits. */
 export const DOCKER_HOST = "host.docker.internal";
@@ -39,9 +38,9 @@ const SERVER_URL = `http://${DOCKER_HOST}:{{port.server}}`;
 
 /**
  * The agent the manifest declares and the README sends you to chat with.
- * Not `assistant`: Cortex holds that slug for its console's own assistant.
+ * Not `assistant`: Cortex holds that name for its console's own assistant.
  */
-export const AGENT_SLUG = "helper";
+export const AGENT_NAME = "helper";
 
 /**
  * The embedding model the stack asks for, and the dimension the image's
@@ -54,18 +53,16 @@ export const EMBEDDING = { model: "text-embedding-3-small", dimension: 768 } as
 const DEV_DEPENDENCIES = {
     // `cortex apply`, `cortex setup` and the management commands, at the release that wrote the project.
     "@m6d/cortex-cli": `~${pkg.version}`,
-    "@types/bun": "1.3.14",
+    "@types/bun": "1.4.4",
     // The two runners of `bun run dev` and `bun run dev:agent`.
     concurrently: "^10.0.6",
     cspell: "^9.6.4",
-    eslint: "^9",
-    "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-prettier": "^5.5.5",
     fallow: "^3.9.1",
     mprocs: "^0.9.6",
+    oxlint: "^1.90.0",
+    "oxlint-tsgolint": "^7.0.2005",
     prettier: "^3.8.1",
-    typescript: "~6.0.3",
-    "typescript-eslint": "^8.65.0",
+    typescript: "^7.0.2",
 };
 
 /**
@@ -112,7 +109,7 @@ function runAll(runner: "mprocs" | "concurrently", processes: Record<string, str
     return `${runner} --names ${Object.keys(processes).join(",")} ${commands.join(" ")}`;
 }
 
-/** The name as the manifest `id` takes it: lowercase words and hyphens. */
+/** The name as the manifest `id` and the server's name take it: lowercase words and hyphens. */
 export function manifestIdOf(name: string) {
     return name
         .replace(/[^a-z0-9]+/g, "-")
@@ -145,12 +142,12 @@ function packageJson({ name, datasets, setup }: Project) {
                 postinstall: "bun run --if-present setup.ts",
                 format: "prettier --write .",
                 "format:check": "prettier --check .",
-                lint: "eslint",
+                lint: "oxlint",
                 spellcheck: 'cspell "**/*.{ts,mjs,json,md}"',
                 verify: "bun run format:check && bun run lint && bun run spellcheck && bun run check && bun run audit",
             },
             dependencies: {
-                "@m6d/cortex": "~0.6.0",
+                "@m6d/cortex": "~0.8.0",
                 // drizzle 1.0 is in beta; this is the build `@m6d/cortex/drizzle` is tested against.
                 ...(datasets ? { "drizzle-orm": "1.0.0-beta.15-859cf75" } : {}),
                 hono: "^4.12.3",
@@ -219,8 +216,8 @@ export default defineManifest({
     id: ${JSON.stringify(manifestIdOf(name))},
     agents: [
         {
-            slug: "${AGENT_SLUG}",
-            name: "Helper",
+            name: "${AGENT_NAME}",
+            displayName: { en: "Helper" },
             server,
             prompt: "You are a helpful assistant. Address the user as {{userName}}.",
             // No identity provider yet: each browser is a visitor of its own.
@@ -249,9 +246,11 @@ COMPOSE_PROJECT_NAME=
 DEFAULT_ADMIN_EMAIL=admin@example.com
 DEFAULT_ADMIN_PASSWORD=
 BOOTSTRAP_MANAGEMENT_KEY=
-# Session signing, and the key the secrets store is encrypted with.
+# Session signing, the key the secrets store is encrypted with, and object
+# storage's password (storage is published on this machine for uploads).
 BETTER_AUTH_SECRET=
 SECRETS_MASTER_KEY=
+S3_SECRET_ACCESS_KEY=
 # Any OpenAI-compatible embeddings endpoint and model. Tool search and
 # knowledge collections embed with it, and stay off while the key is blank.
 EMBEDDING_BASE_URL=https://api.openai.com/v1
@@ -288,17 +287,14 @@ MODEL_PROVIDER_MODEL=
 function dockerCompose() {
     return `# Cortex, for this project's agents to run on: the console at
 # http://localhost:{{port.cortex}}, the engine widgets and trigger callers reach at
-# http://localhost:{{port.engine}}, and the stores they keep state in. \`bun run dev\`
-# starts it; .env holds its secrets.
+# http://localhost:{{port.engine}}, storage the console uploads to at
+# http://localhost:{{port.storage}}, and the stores they keep state in.
+# \`bun run dev\` starts it; .env holds its secrets.
 #
 # The host ports were picked at scaffold time from what was free on this
 # machine. Move one and the URLs that name it here, in .env and in README.md
 # follow.
 # CORTEX_VERSION, set in the shell, runs another release of the image.
-#
-# The console's browser uploads (knowledge documents) go straight to
-# S3_ENDPOINT, which only this stack resolves. Point it at storage the
-# browser reaches too before relying on them.
 
 # The stack runs as .env's COMPOSE_PROJECT_NAME, drawn for each checkout by
 # setup.ts, so no two checkouts share containers or volumes, whatever their
@@ -316,9 +312,13 @@ x-cortex: &cortex
         DATABASE_URL: postgres://postgres:postgres@postgres:5432/cortex
         REDIS_URL: redis://redis:6379
         S3_ENDPOINT: http://minio:9000
+        # The console's uploads go straight to storage, from the browser.
+        S3_PUBLIC_ENDPOINT: http://localhost:{{port.storage}}
         S3_REGION: us-east-1
         S3_ACCESS_KEY_ID: minio
-        S3_SECRET_ACCESS_KEY: minio-secret-key
+        # Interpolated like storage's own, so both read the one value even when the
+        # shell exports another.
+        S3_SECRET_ACCESS_KEY: \${S3_SECRET_ACCESS_KEY:?run bun install to generate .env}
         S3_BUCKET: cortex
         BETTER_AUTH_ALLOWED_HOSTS: localhost:{{port.cortex}},127.0.0.1:{{port.cortex}}
         # The dimension the image's migrations give the vector columns.
@@ -366,9 +366,13 @@ services:
         command: server /data
         environment:
             MINIO_ROOT_USER: minio
-            MINIO_ROOT_PASSWORD: minio-secret-key
+            MINIO_ROOT_PASSWORD: \${S3_SECRET_ACCESS_KEY:?run bun install to generate .env}
+            # The console's uploads come from its origin alone.
+            MINIO_API_CORS_ALLOW_ORIGIN: http://localhost:{{port.cortex}},http://127.0.0.1:{{port.cortex}}
         volumes:
             - minio-data:/data
+        ports:
+            - "127.0.0.1:{{port.storage}}:9000"
         healthcheck:
             test: ["CMD", "bash", "-c", "</dev/tcp/127.0.0.1/9000"]
             interval: 5s
@@ -381,7 +385,7 @@ services:
             minio:
                 condition: service_healthy
         environment:
-            MC_HOST_local: http://minio:minio-secret-key@minio:9000
+            MC_HOST_local: http://minio:\${S3_SECRET_ACCESS_KEY:?run bun install to generate .env}@minio:9000
         command: ["mb", "--ignore-existing", "local/cortex"]
 
     # One-shot: migrate the database, then create the first admin and its key.
@@ -454,7 +458,7 @@ function readme({ name, server, datasets, setup }: Project) {
     const gettingStarted = setup
         ? `That starts Cortex (\`docker compose up\`), this backend, and \`cortex setup\` in one dashboard.
 Setup waits for Cortex, registers this backend as the server \`${server}\`, adds the model provider
-in \`.env\`, and applies the manifest. Then it prints where to chat with \`${AGENT_SLUG}\`, and the first
+in \`.env\`, and applies the manifest. Then it prints where to chat with \`${AGENT_NAME}\`, and the first
 time, how to sign in. It adds only what is missing, so every \`bun run dev\` runs it again.
 
 While \`MODEL_PROVIDER_*\` in \`.env\` is blank, setup registers the server and applies nothing:
@@ -481,7 +485,7 @@ A backend for Cortex agents, and Cortex itself to run them on.
           ? "\n- `datasets.ts` serves an `orders` table as a dataset host, for agents to ask grouped\n  questions of."
           : ""
   }
-- \`cortex.manifest.ts\` declares the \`${AGENT_SLUG}\` agent on this server${
+- \`cortex.manifest.ts\` declares the \`${AGENT_NAME}\` agent on this server${
         datasets ? " and the dataset host" : ""
     }. \`cortex apply\` makes Cortex match it.
 - \`docker-compose.yml\` runs Cortex: its app, worker and engine, and the stores they use.
@@ -501,7 +505,7 @@ bun run dev
 
 ${gettingStarted}
 
-Then chat with \`${AGENT_SLUG}\` on the console's **Playground** page. Edit \`cortex.manifest.ts\` and run
+Then chat with \`${AGENT_NAME}\` on the console's **Playground** page. Edit \`cortex.manifest.ts\` and run
 \`bun cortex apply\` to change it; an apply changes only what the edit changed. The CLI reaches this
 checkout's Cortex through \`CORTEX_URL\` and \`CORTEX_KEY\` in \`.env\`, so it needs no login, and
 \`-p <profile>\` picks a saved one instead.
@@ -532,7 +536,7 @@ pre-commit hook or CI job should run. Each is also available on its own: \`forma
  * are drawn by the caller.
  */
 export function scaffoldFiles(input: Input) {
-    const project = { ...input, server: input.name.slice(0, NAME_MAX_LENGTH) };
+    const project = { ...input, server: manifestIdOf(input.name) };
     const files = {
         "server.ts": serverTs,
         "setup.ts": setupTs,
@@ -547,7 +551,7 @@ export function scaffoldFiles(input: Input) {
         ".gitignore": gitignoreText,
         ".dockerignore": dockerignoreText,
         "README.md": readme(project),
-        "eslint.config.mjs": eslintConfig,
+        ".oxlintrc.json": oxlintrc,
         "prettier.config.mjs": prettierConfig,
         "cspell.json": cspellJson,
         ".fallowrc.jsonc": fallowrc,

package/src/scaffold/ports.ts

@@ -2,9 +2,10 @@
  * Host ports for the Cortex stack a generated project runs, chosen once at
  * scaffold time.
  *
- * Only the app and the engine are published: the browser and this
- * project's callers reach them, and nothing outside the stack reaches its
- * databases. The backend listens on the third. Fixed ports would collide with
+ * The app, the engine and storage are published: the browser and this
+ * project's callers reach them (storage through the upload links Cortex
+ * signs), and nothing outside the stack reaches its databases. The backend
+ * listens on the fourth. Fixed ports would collide with
  * the next project scaffolded on the same machine, so each project draws its
  * own. Container ports stay canonical.
  *
@@ -60,7 +61,7 @@ export function allocatePorts() {
         return port;
     }
 
-    return { cortex: next(), engine: next(), server: next() };
+    return { cortex: next(), engine: next(), storage: next(), server: next() };
 }
 
 export type Ports = ReturnType<typeof allocatePorts>;

package/src/scaffold/templates/cspell.json.txt

@@ -1,7 +1,7 @@
 {
     "version": "0.2",
     "language": "en",
-    "words": ["mprocs"],
+    "words": ["mprocs", "oxlint", "tsgolint"],
     "ignorePaths": [
         "node_modules/**",
         "out/**",

package/src/scaffold/templates/oxlintrc.json.txt

@@ -0,0 +1,67 @@
+{
+    "$schema": "./node_modules/oxlint/configuration_schema.json",
+    // typescript-eslint's recommended type-checked set; nothing else runs.
+    "categories": {
+        "correctness": "off"
+    },
+    "options": {
+        "typeAware": true,
+        "reportUnusedDisableDirectives": "warn"
+    },
+    "ignorePatterns": ["**/node_modules/**", "**/dist/**", "**/.fallow/**"],
+    "overrides": [
+        {
+            "files": ["**/*.ts"],
+            "plugins": ["typescript"],
+            "rules": {
+                "no-var": "error",
+                "prefer-const": "error",
+                "prefer-rest-params": "error",
+                "prefer-spread": "error",
+                "no-array-constructor": "error",
+                "no-unused-expressions": "error",
+                "no-unused-vars": "error",
+                "typescript/await-thenable": "error",
+                "typescript/ban-ts-comment": "error",
+                "typescript/no-array-delete": "error",
+                "typescript/no-base-to-string": "error",
+                "typescript/no-duplicate-enum-values": "error",
+                "typescript/no-duplicate-type-constituents": "error",
+                "typescript/no-empty-object-type": "error",
+                "typescript/no-explicit-any": "error",
+                "typescript/no-extra-non-null-assertion": "error",
+                "typescript/no-floating-promises": "error",
+                "typescript/no-for-in-array": "error",
+                "typescript/no-implied-eval": "error",
+                "typescript/no-misused-new": "error",
+                "typescript/no-misused-promises": "error",
+                "typescript/no-namespace": "error",
+                "typescript/no-non-null-asserted-optional-chain": "error",
+                "typescript/no-redundant-type-constituents": "error",
+                "typescript/no-require-imports": "error",
+                "typescript/no-this-alias": "error",
+                "typescript/no-unnecessary-type-assertion": "error",
+                "typescript/no-unnecessary-type-constraint": "error",
+                "typescript/no-unsafe-argument": "error",
+                "typescript/no-unsafe-assignment": "error",
+                "typescript/no-unsafe-call": "error",
+                "typescript/no-unsafe-declaration-merging": "error",
+                "typescript/no-unsafe-enum-comparison": "error",
+                "typescript/no-unsafe-function-type": "error",
+                "typescript/no-unsafe-member-access": "error",
+                "typescript/no-unsafe-return": "error",
+                "typescript/no-unsafe-unary-minus": "error",
+                "typescript/no-wrapper-object-types": "error",
+                "typescript/only-throw-error": "error",
+                "typescript/prefer-as-const": "error",
+                "typescript/prefer-namespace-keyword": "error",
+                "typescript/prefer-promise-reject-errors": "error",
+                "typescript/require-await": "error",
+                "typescript/restrict-plus-operands": "error",
+                "typescript/restrict-template-expressions": "error",
+                "typescript/triple-slash-reference": "error",
+                "typescript/unbound-method": "error"
+            }
+        }
+    ]
+}

package/src/scaffold/templates/setup.ts.txt

@@ -30,6 +30,7 @@ const GENERATED = [
     ["BOOTSTRAP_MANAGEMENT_KEY", () => `cortex_mgmt_${token()}`],
     ["BETTER_AUTH_SECRET", key],
     ["SECRETS_MASTER_KEY", key],
+    ["S3_SECRET_ACCESS_KEY", token],
 ] as const;
 
 const source = existsSync(".env") ? ".env" : ".env.example";

package/src/scaffold/templates/eslint.config.mjs.txt

@@ -1,20 +0,0 @@
-import { defineConfig, globalIgnores } from "eslint/config";
-import prettierConfig from "eslint-config-prettier";
-import prettierPlugin from "eslint-plugin-prettier";
-import tseslint from "typescript-eslint";
-
-export default defineConfig([
-    globalIgnores(["**/node_modules/**", "**/dist/**", "**/.fallow/**"]),
-    prettierConfig,
-    {
-        plugins: { prettier: prettierPlugin },
-        rules: { "prettier/prettier": "error" },
-    },
-    {
-        files: ["**/*.ts"],
-        extends: [tseslint.configs.recommendedTypeChecked],
-        languageOptions: {
-            parserOptions: { projectService: true, tsconfigRootDir: import.meta.dirname },
-        },
-    },
-]);