@m8t-stack/cli 0.2.22 → 0.2.23

package/README.md

@@ -17,10 +17,10 @@ It's the operator's day-2 tool for the cloud platform — the successor to the o
 npm install -g @m8t-stack/cli
 
 # Homebrew (macOS / Linux)
-brew install m8t-run/tap/m8t
+brew install m8t-labs/tap/m8t
 
 # Scoop (Windows)
-scoop bucket add m8t https://github.com/m8t-run/scoop-bucket
+scoop bucket add m8t https://github.com/m8t-labs/scoop-bucket
 scoop install m8t
 
 # Verify
@@ -115,7 +115,7 @@ Provisions (or updates) the gateway/webapp stack via Bicep — the successor to
 m8t deploy --client-id <appId> --image-ref <acr-or-ghcr-ref> --location <region>
 ```
 
-Key flags: `--client-id <appId>` (reuse an existing app reg + skip **all** Microsoft Graph writes), `--image-ref <ref>` (full image ref; default `ghcr.io/m8t-run/m8t:latest` — pass an `*.azurecr.io/...` ref for ACR images), `--resource-group` (default `rg-m8t-stack`), `--location`, `--suffix`, `--foundry-endpoint`, `--foundry-resource-id`.
+Key flags: `--client-id <appId>` (reuse an existing app reg + skip **all** Microsoft Graph writes), `--image-ref <ref>` (full image ref; default `ghcr.io/m8t-labs/m8t:latest` — pass an `*.azurecr.io/...` ref for ACR images), `--resource-group` (default `rg-m8t-stack`), `--location`, `--suffix`, `--foundry-endpoint`, `--foundry-resource-id`.
 
 > ⚠️ `m8t deploy` is **declarative** — it makes the live stack match the Bicep template. If a deployment was hand-modified after provisioning (e.g. switched to a private-ACR image with a UserAssigned pull identity), re-running the bicep can revert those changes. **Preview with `az deployment group create --what-if` before applying against a live stack.**
 

package/dist/cli.js

@@ -1231,7 +1231,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.22";
+var CLI_VERSION = "0.2.23";
 
 // src/lib/render-error.ts
 init_errors();
@@ -11481,6 +11481,31 @@ import { DefaultAzureCredential } from "@azure/identity";
 // src/lib/az.ts
 init_errors();
 import { spawn } from "child_process";
+var SECRET_VALUE_FLAGS = /* @__PURE__ */ new Set(["--secure-environment-variables"]);
+var SECRET_KEY_RE = /(pem|secret|token|password|passwd|pwd|credential|private[-_]?key)/i;
+function redactAzArgs(args) {
+  const out = [];
+  let secretFlagActive = false;
+  for (const arg of args) {
+    if (arg.startsWith("-")) {
+      secretFlagActive = SECRET_VALUE_FLAGS.has(arg);
+      out.push(arg);
+      continue;
+    }
+    const eq = arg.indexOf("=");
+    const key2 = eq > 0 ? arg.slice(0, eq) : "";
+    if (secretFlagActive) {
+      out.push(key2 ? `${key2}=[REDACTED]` : "[REDACTED]");
+      continue;
+    }
+    if (key2 && SECRET_KEY_RE.test(key2)) {
+      out.push(`${key2}=[REDACTED]`);
+      continue;
+    }
+    out.push(arg);
+  }
+  return out;
+}
 function runAz(args) {
   return new Promise((resolve3, reject) => {
     const proc = spawn("az", args, { stdio: ["ignore", "pipe", "pipe"] });
@@ -11517,7 +11542,7 @@ function runAz(args) {
         reject(
           new LocalCliError({
             code: "AZ_COMMAND_FAILED",
-            message: `'az ${args.join(" ")}' failed: ${errString.trim()}`
+            message: `'az ${redactAzArgs(args).join(" ")}' failed: ${errString.trim()}`
           })
         );
         return;
@@ -16900,7 +16925,7 @@ var SIZE_PRESETS = {
   medium: { cpu: "1", memory: "2Gi" },
   large: { cpu: "2", memory: "4Gi" }
 };
-var DEFAULT_REGISTRY = "ghcr.io/m8t-run";
+var DEFAULT_REGISTRY = "ghcr.io/m8t-labs";
 var DEFAULT_IMAGE = "m8t-coding-agent";
 var DEFAULT_TAG = "v0.1.0";
 var DEFAULT_MODEL = "gpt-4.1-mini";
@@ -16909,7 +16934,7 @@ var CoderDeployCommand = class extends M8tCommand {
   static paths = [["coder", "deploy"]];
   static usage = Command28.Usage({
     description: "Deploy the curated coding agent as a hosted Foundry worker.",
-    details: "Creates a hosted agent version from a container image (defaults to the public GHCR image ghcr.io/m8t-run/m8t-coding-agent). Post-2026-06-25 Foundry projects require an authenticated pull, so a public image is staged into the customer's Azure Container Registry first (created if missing, then `az acr import` \u2014 a server-side copy, no local build) and the agent is deployed from that ACR ref. Re-running with a newer --image-tag imports the new tag and rolls out a new agent version \u2014 that is how you update a worker's image. Override --image with a private ACR ref to bring your own registry.",
+    details: "Creates a hosted agent version from a container image (defaults to the public GHCR image ghcr.io/m8t-labs/m8t-coding-agent). Post-2026-06-25 Foundry projects require an authenticated pull, so a public image is staged into the customer's Azure Container Registry first (created if missing, then `az acr import` \u2014 a server-side copy, no local build) and the agent is deployed from that ACR ref. Re-running with a newer --image-tag imports the new tag and rolls out a new agent version \u2014 that is how you update a worker's image. Override --image with a private ACR ref to bring your own registry.",
     examples: [
       ["Deploy a coder with defaults", "$0 coder deploy my-coder"],
       ["Larger sandbox + a custom model", "$0 coder deploy my-coder --size large --model-deployment gpt-4.1"],
@@ -17296,7 +17321,7 @@ var SIZE_PRESETS2 = {
   medium: { cpu: "1", memory: "2Gi" },
   large: { cpu: "2", memory: "4Gi" }
 };
-var DEFAULT_REGISTRY2 = "ghcr.io/m8t-run";
+var DEFAULT_REGISTRY2 = "ghcr.io/m8t-labs";
 var DEFAULT_IMAGE2 = "m8t-azure-executor";
 var DEFAULT_TAG2 = "v0.1.0";
 var DEFAULT_MODEL2 = "gpt-5-mini";
@@ -17305,11 +17330,11 @@ var AzureExecDeployCommand = class extends M8tCommand {
   static paths = [["azure-exec", "deploy"]];
   static usage = Command30.Usage({
     description: "Deploy the Azure executor as a hosted Foundry worker (az CLI + tiered ops).",
-    details: "Creates a hosted agent version from a container image (defaults to the public GHCR image ghcr.io/m8t-run/m8t-azure-executor \u2014 no local build needed), grants its identity Foundry User + Contributor (at --scope) + Key Vault Secrets User (brain KV), polls to active, and a2a-enables it as a target. Override with --image/--image-tag for a bring-your-own-registry image (e.g. a private ACR ref, which must be pushed first). Contributor scope is REQUIRED \u2014 pass --scope or --resource-group. Pass --grant-access-admin to additionally grant User Access Administrator (enables human-approved Tier-2 role/delete ops). Post-2026-06-25 Foundry projects require an authenticated pull, so the public image (default ghcr.io/m8t-run/m8t-azure-executor) is staged into the customer's Azure Container Registry first (created if missing, then `az acr import` \u2014 server-side, no local build) and deployed from that ACR ref; re-running with a newer --image-tag updates the image.",
+    details: "Creates a hosted agent version from a container image (defaults to the public GHCR image ghcr.io/m8t-labs/m8t-azure-executor \u2014 no local build needed), grants its identity Foundry User + Contributor (at --scope) + Key Vault Secrets User (brain KV), polls to active, and a2a-enables it as a target. Override with --image/--image-tag for a bring-your-own-registry image (e.g. a private ACR ref, which must be pushed first). Contributor scope is REQUIRED \u2014 pass --scope or --resource-group. Pass --grant-access-admin to additionally grant User Access Administrator (enables human-approved Tier-2 role/delete ops). Post-2026-06-25 Foundry projects require an authenticated pull, so the public image (default ghcr.io/m8t-labs/m8t-azure-executor) is staged into the customer's Azure Container Registry first (created if missing, then `az acr import` \u2014 server-side, no local build) and deployed from that ACR ref; re-running with a newer --image-tag updates the image.",
     examples: [
       [
         "Deploy scoped to a resource group",
-        "$0 azure-exec deploy azexec --resource-group rg-test --brain m8t-run/azure-exec-smoke-brain --gateway-url https://<gw>/api/a2a/mcp"
+        "$0 azure-exec deploy azexec --resource-group rg-test --brain m8t-labs/azure-exec-smoke-brain --gateway-url https://<gw>/api/a2a/mcp"
       ]
     ]
   });
@@ -17341,7 +17366,7 @@ var AzureExecDeployCommand = class extends M8tCommand {
       throw new LocalCliError({
         code: "USAGE",
         message: "--brain owner/repo is required (the executor delivers proof to a brain).",
-        hint: "Example: --brain m8t-run/azure-exec-smoke-brain"
+        hint: "Example: --brain m8t-labs/azure-exec-smoke-brain"
       });
     }
     const size = (this.size ?? "large").toLowerCase();
@@ -17573,7 +17598,7 @@ import { DefaultAzureCredential as DefaultAzureCredential16 } from "@azure/ident
 
 // src/lib/platform-update.ts
 init_errors();
-var DEFAULT_IMAGE_REPO = "ghcr.io/m8t-run/m8t";
+var DEFAULT_IMAGE_REPO = "ghcr.io/m8t-labs/m8t";
 function parseImageRef2(ref) {
   const lastColon = ref.lastIndexOf(":");
   const lastSlash = ref.lastIndexOf("/");
@@ -17806,13 +17831,13 @@ function entityToStamp(e) {
 }
 
 // ../../packages/platform-release/dist/esm/channel-url.js
-var CHANNEL_LATEST_URL = "https://github.com/m8t-run/m8t/releases/latest/download/manifest.json";
+var CHANNEL_LATEST_URL = "https://github.com/m8t-labs/m8t/releases/latest/download/manifest.json";
 function platformTag(version) {
   const bare = version.trim().replace(/^platform-/, "").replace(/^v/, "");
   return `platform-v${bare}`;
 }
 function channelUrlForVersion(version) {
-  return `https://github.com/m8t-run/m8t/releases/download/${platformTag(version)}/manifest.json`;
+  return `https://github.com/m8t-labs/m8t/releases/download/${platformTag(version)}/manifest.json`;
 }
 
 // ../../packages/platform-release/dist/esm/apply-request.js
@@ -17902,7 +17927,7 @@ import * as os8 from "os";
 import * as path19 from "path";
 import { execFileSync as execFileSync2 } from "child_process";
 init_errors();
-var OWNER_REPO = "m8t-run/m8t";
+var OWNER_REPO = "m8t-labs/m8t";
 function parseTreeResponse(body) {
   const map = /* @__PURE__ */ new Map();
   for (const e of body.tree ?? []) if (e.type === "tree") map.set(e.path, e.sha);
@@ -20750,7 +20775,7 @@ function classifyWhatIf(changes) {
 }
 
 // src/commands/deploy.ts
-var DEFAULT_IMAGE_REF = "ghcr.io/m8t-run/m8t:latest";
+var DEFAULT_IMAGE_REF = "ghcr.io/m8t-labs/m8t:latest";
 var DeployCommand = class extends M8tCommand {
   static paths = [["deploy"]];
   static usage = Command36.Usage({
@@ -21151,7 +21176,7 @@ function resolveJudgeDeployment(flag, env) {
     warning: "no --deployment and no $EXAM_JUDGE_DEPLOYMENT \u2014 falling back to gpt-5-mini as the judge. Name the DISTINCT judge deployment before any blessing/calibration run (DESIGN \xA75.5)."
   };
 }
-var BRAIN_REPO_MARKERS = ["m8t-run/", "/azure-advisor-brain", "/stacey-brain", "exam-arm-"];
+var BRAIN_REPO_MARKERS = ["m8t-labs/", "/azure-advisor-brain", "/stacey-brain", "exam-arm-"];
 function assertOutNotInBrainRepo(out) {
   if (BRAIN_REPO_MARKERS.some((m) => out.includes(m))) {
     throw new LocalCliError({
@@ -25605,8 +25630,8 @@ async function writeBootstrapState(state, home = os13.homedir()) {
 
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
-var DEFAULT_INSTALLER = "ghcr.io/m8t-run/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.0";
+var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
+var DEFAULT_INSTALLER_TAG = "v0.1.30";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
@@ -25617,7 +25642,8 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     examples: [
       ["Launch in eastus2", "$0 bootstrap launch --location eastus2"],
       ["BYO app registration", "$0 bootstrap launch --location eastus2 --client-id <appId>"],
-      ["Pin a specific installer tag", "$0 bootstrap launch --location eastus2 --installer-tag v0.1.0"]
+      ["Pin a specific installer tag", "$0 bootstrap launch --location eastus2 --installer-tag v0.1.30"],
+      ["Override the full installer image ref", "$0 bootstrap launch --location eastus2 --installer-image ghcr.io/m8t-labs/m8t-installer:v0.1.30"]
     ]
   });
   location = Option46.String("--location");
@@ -25625,6 +25651,10 @@ var BootstrapLaunchCommand = class extends M8tCommand {
   clientId = Option46.String("--client-id");
   subscription = Option46.String("--subscription");
   installerTag = Option46.String("--installer-tag");
+  // Full image ref override (registry + repo + tag) — an escape hatch when the
+  // default org/tag is wrong for the current CLI (e.g. a stale published build).
+  // Wins over --installer-tag / the pinned default.
+  installerImage = Option46.String("--installer-image");
   gatewayImageRef = Option46.String("--gateway-image-ref");
   githubAppCreds = Option46.String("--github-app-creds");
   async executeCommand() {
@@ -25635,6 +25665,8 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     const resourceGroup = (typeof this.resourceGroup === "string" ? this.resourceGroup : void 0) ?? DEFAULT_RG;
     const clientIdOpt = typeof this.clientId === "string" ? this.clientId : void 0;
     const installerTag = (typeof this.installerTag === "string" ? this.installerTag : void 0) ?? DEFAULT_INSTALLER_TAG;
+    const installerImageOverride = typeof this.installerImage === "string" ? this.installerImage : void 0;
+    const installerImage = installerImageOverride ?? `${DEFAULT_INSTALLER}:${installerTag}`;
     const gatewayImageRef = typeof this.gatewayImageRef === "string" ? this.gatewayImageRef : void 0;
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
@@ -25685,10 +25717,24 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     out("granting Owner at subscription scope\u2026");
     await grantOwnerAtSubscription({ principalId: mi.principalId, subscriptionId });
     const roleAssignmentIds = await listAssignmentIds({ principalId: mi.principalId, subscriptionId });
+    const saName = deriveStatusSaName(resourceGroup, subscriptionId);
+    await writeBootstrapState({
+      subscriptionId,
+      resourceGroup,
+      location,
+      aciName: ACI_NAME,
+      miName: MI_NAME,
+      miClientId: mi.clientId,
+      miPrincipalId: mi.principalId,
+      roleAssignmentIds,
+      appRegClientId: appReg.clientId,
+      statusSaName: saName,
+      statusBlobUrl: statusBlobUrl(saName),
+      installerTag
+    });
     out("waiting for the installer identity to be usable (role propagation)\u2026");
     const miReady = await waitForMiToken({ clientId: mi.clientId, subscriptionId, onProgress: out });
     if (!miReady) out("identity not confirmed yet \u2014 launching anyway (the installer retries its own login)");
-    const saName = deriveStatusSaName(resourceGroup, subscriptionId);
     out("launching the cloud installer (ACI)\u2026");
     await kickInstaller({
       aciName: ACI_NAME,
@@ -25698,25 +25744,11 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       miResourceId: mi.resourceId,
       miClientId: mi.clientId,
       appRegClientId: appReg.clientId,
-      image: `${DEFAULT_INSTALLER}:${installerTag}`,
+      image: installerImage,
       gatewayImageRef,
       foundryTracing: "skip",
       githubApp
     });
-    await writeBootstrapState({
-      subscriptionId,
-      resourceGroup,
-      location,
-      aciName: ACI_NAME,
-      miName: MI_NAME,
-      miClientId: mi.clientId,
-      miPrincipalId: mi.principalId,
-      roleAssignmentIds,
-      appRegClientId: appReg.clientId,
-      statusSaName: saName,
-      statusBlobUrl: statusBlobUrl(saName),
-      installerTag
-    });
     this.context.stdout.write(
       `${colors.success("\u2713")} installer launched in ${colors.field(resourceGroup)} (${location}).
   ${colors.hint("next:")} m8t bootstrap status --watch   ${colors.dim("# watch the install to done")}
@@ -25944,24 +25976,43 @@ Found ${String(found.length)} orphaned Owner@sub assignment(s) (dry-run). ${colo
     }
     const state = await readBootstrapState();
     if (!state) {
-      throw new LocalCliError({ code: "BOOTSTRAP_NO_STATE", message: "No bootstrap state to reap.", hint: "Nothing to do." });
+      if (this.force === true) {
+        const { subscriptionId: sub } = await getAzAccount();
+        if (!sub) {
+          throw new LocalCliError({ code: "BOOTSTRAP_SWEEP_NO_SUB", message: "No active subscription.", hint: "Run 'az account set --subscription <id>'." });
+        }
+        const found = await sweepOrphanOwnerAssignments({ subscriptionId: sub, execute: true });
+        this.context.stdout.write(
+          found.length === 0 ? `${colors.success("\u2713")} No bootstrap state and no orphaned installer Owner@sub assignments. Nothing to reap.
+` : `${colors.success("\u2713")} No bootstrap state found; swept ${String(found.length)} orphaned installer Owner@sub assignment(s).
+`
+        );
+        return 0;
+      }
+      throw new LocalCliError({
+        code: "BOOTSTRAP_NO_STATE",
+        message: "No bootstrap state to reap.",
+        hint: "Nothing to do. If a launch failed early it may have orphaned an installer Owner@sub grant \u2014 run 'm8t bootstrap reap --force' (or 'm8t bootstrap reap --sweep-orphans --yes') to clean it."
+      });
     }
-    const doc = await readStatusBlob({ saName: state.statusSaName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId });
-    if (doc.status !== "done" && !(this.force === true)) {
-      if (doc.status === "failed") {
+    if (this.force !== true) {
+      const doc = await readStatusBlob({ saName: state.statusSaName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId });
+      if (doc.status !== "done") {
+        if (doc.status === "failed") {
+          throw new LocalCliError({
+            code: "BOOTSTRAP_REAP_FAILED_INSTALL",
+            message: `The install failed at '${doc.error?.phase ?? doc.phase}'. Leaving the installer up for diagnosis.`,
+            hint: `Inspect: az container logs -n ${state.aciName} -g ${state.resourceGroup}. Reap anyway with --force.`
+          });
+        }
+        const aci = await getAciState({ aciName: state.aciName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId }).catch(() => null);
+        const deadHint = aci?.terminated ? `The installer container has terminated (exit ${String(aci.exitCode ?? "?")}) without reaching done \u2014 reap with --force.` : `Wait for 'm8t bootstrap status --watch' to reach done, or reap with --force if the install is stuck.`;
         throw new LocalCliError({
-          code: "BOOTSTRAP_REAP_FAILED_INSTALL",
-          message: `The install failed at '${doc.error?.phase ?? doc.phase}'. Leaving the installer up for diagnosis.`,
-          hint: `Inspect: az container logs -n ${state.aciName} -g ${state.resourceGroup}. Reap anyway with --force.`
+          code: "BOOTSTRAP_REAP_NOT_DONE",
+          message: `The install is not done yet (status: ${doc.status}, phase: ${doc.phase}).`,
+          hint: deadHint
         });
       }
-      const aci = await getAciState({ aciName: state.aciName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId }).catch(() => null);
-      const deadHint = aci?.terminated ? `The installer container has terminated (exit ${String(aci.exitCode ?? "?")}) without reaching done \u2014 reap with --force.` : `Wait for 'm8t bootstrap status --watch' to reach done, or reap with --force if the install is stuck.`;
-      throw new LocalCliError({
-        code: "BOOTSTRAP_REAP_NOT_DONE",
-        message: `The install is not done yet (status: ${doc.status}, phase: ${doc.phase}).`,
-        hint: deadHint
-      });
     }
     await reapInstaller({
       subscriptionId: state.subscriptionId,