@m8t-stack/cli 0.2.23 → 0.2.24

package/dist/cli.js

@@ -1231,7 +1231,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.23";
+var CLI_VERSION = "0.2.24";
 
 // src/lib/render-error.ts
 init_errors();
@@ -14297,6 +14297,14 @@ function run(cmd, cmdArgs, cwd, env) {
     c.stderr.on("data", (d) => {
       err += d.toString();
     });
+    c.on("error", (e) => {
+      reject(
+        new LocalCliError({
+          code: "GH_APP_PUSH_FAILED",
+          message: `${cmd} ${cmdArgs.join(" ")} could not run: ${e.message}`
+        })
+      );
+    });
     c.on("close", (code) => {
       if (code === 0) {
         resolve3();
@@ -14627,6 +14635,19 @@ async function promptCollision(ctx, info) {
     rl.close();
   }
 }
+function resolveScaffoldCommit(repoRoot, env) {
+  const baked = env.M8T_BUILD_SHA?.trim();
+  if (baked) return baked;
+  try {
+    return execFileSync("git", ["rev-parse", "HEAD"], {
+      cwd: repoRoot,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim() || "(scaffold)";
+  } catch {
+    return "(scaffold)";
+  }
+}
 function stageAsGitRepo(dir) {
   const steps = [
     { args: ["init", "-b", "main"], label: "git init" },
@@ -14770,7 +14791,7 @@ var BrainCreateCommand = class extends M8tCommand {
       if (needsPush) {
         materializeBrainTree({ templateSrc, destDir: tmpDir, seedDir });
         if (seedName && seedDir) {
-          const headSha = execFileSync("git", ["rev-parse", "HEAD"], { cwd: repoRoot, encoding: "utf8" }).trim();
+          const headSha = resolveScaffoldCommit(repoRoot, env);
           writeSeedMarker({ destDir: tmpDir, seedName, seedDir, refreshedToCommit: headSha, version: "(scaffold)" });
         }
         this.context.stdout.write(
@@ -25388,6 +25409,7 @@ init_errors();
 
 // src/lib/bootstrap-mi.ts
 var INSTALLER_GRANT_DESCRIPTION = "m8t-installer auto-reap (bootstrap)";
+var GATEWAY_SUBSCOPE_GRANT_DESCRIPTION = "m8t-gateway auto-reap (bootstrap)";
 async function ensureResourceGroup2(opts) {
   const existing = (await runAz(["group", "show", "--name", opts.name, "--subscription", opts.subscriptionId, "-o", "json"]).catch(() => "")).trim();
   if (existing) return;
@@ -25631,7 +25653,7 @@ async function writeBootstrapState(state, home = os13.homedir()) {
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.30";
+var DEFAULT_INSTALLER_TAG = "v0.1.31";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
@@ -25642,8 +25664,8 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     examples: [
       ["Launch in eastus2", "$0 bootstrap launch --location eastus2"],
       ["BYO app registration", "$0 bootstrap launch --location eastus2 --client-id <appId>"],
-      ["Pin a specific installer tag", "$0 bootstrap launch --location eastus2 --installer-tag v0.1.30"],
-      ["Override the full installer image ref", "$0 bootstrap launch --location eastus2 --installer-image ghcr.io/m8t-labs/m8t-installer:v0.1.30"]
+      ["Pin a specific installer tag", "$0 bootstrap launch --location eastus2 --installer-tag v0.1.31"],
+      ["Override the full installer image ref", "$0 bootstrap launch --location eastus2 --installer-image ghcr.io/m8t-labs/m8t-installer:v0.1.31"]
     ]
   });
   location = Option46.String("--location");
@@ -25869,35 +25891,53 @@ init_errors();
 
 // src/lib/bootstrap-reap.ts
 var ROLE_ASSIGNMENT_API = "2022-04-01";
-async function sweepOrphanOwnerAssignments(opts) {
-  const subScope = `/subscriptions/${opts.subscriptionId}`;
-  const all = JSON.parse(
+var GATEWAY_SUBSCOPE_ROLES = ["Cost Management Reader", "Monitoring Reader"];
+async function listSubscriptionAssignments(subscriptionId) {
+  return JSON.parse(
     await runAz([
       "role",
       "assignment",
       "list",
       "--all",
       "--subscription",
-      opts.subscriptionId,
+      subscriptionId,
       "-o",
       "json"
     ]).catch(() => "[]") || "[]"
   );
+}
+async function deleteAssignmentsById(ids) {
+  for (const id of ids) {
+    await runAz([
+      "rest",
+      "--method",
+      "delete",
+      "--url",
+      `https://management.azure.com${id}?api-version=${ROLE_ASSIGNMENT_API}`
+    ]).catch(() => void 0);
+  }
+}
+async function sweepOrphanGatewaySubRoles(opts) {
+  const subScope = `/subscriptions/${opts.subscriptionId}`;
+  const all = await listSubscriptionAssignments(opts.subscriptionId);
+  const matched = all.filter((r) => {
+    if (r.principalName) return false;
+    if (r.principalType !== "ServicePrincipal") return false;
+    if (r.scope !== subScope) return false;
+    if (r.description === GATEWAY_SUBSCOPE_GRANT_DESCRIPTION) return true;
+    return GATEWAY_SUBSCOPE_ROLES.includes(r.roleDefinitionName ?? "");
+  });
+  if (opts.execute) await deleteAssignmentsById(matched.map((r) => r.id));
+  return matched.map((r) => ({ id: r.id, description: r.description, roleDefinitionName: r.roleDefinitionName, createdOn: r.createdOn }));
+}
+async function sweepOrphanOwnerAssignments(opts) {
+  const subScope = `/subscriptions/${opts.subscriptionId}`;
+  const all = await listSubscriptionAssignments(opts.subscriptionId);
   const matched = all.filter((r) => {
     if (r.description === INSTALLER_GRANT_DESCRIPTION) return true;
     return !r.principalName && r.principalType === "ServicePrincipal" && r.roleDefinitionName === "Owner" && r.scope === subScope;
   });
-  if (opts.execute) {
-    for (const r of matched) {
-      await runAz([
-        "rest",
-        "--method",
-        "delete",
-        "--url",
-        `https://management.azure.com${r.id}?api-version=${ROLE_ASSIGNMENT_API}`
-      ]).catch(() => void 0);
-    }
-  }
+  if (opts.execute) await deleteAssignmentsById(matched.map((r) => r.id));
   return matched.map((r) => ({ id: r.id, description: r.description, createdOn: r.createdOn }));
 }
 async function reapInstaller(opts) {
@@ -25954,22 +25994,30 @@ var BootstrapReapCommand = class extends M8tCommand {
       if (!sub) {
         throw new LocalCliError({ code: "BOOTSTRAP_SWEEP_NO_SUB", message: "No active subscription.", hint: "Run 'az account set --subscription <id>'." });
       }
-      const found = await sweepOrphanOwnerAssignments({ subscriptionId: sub, execute: this.yes === true });
-      if (found.length === 0) {
-        this.context.stdout.write(`${colors.success("\u2713")} No orphaned installer Owner@sub assignments found.
+      const execute = this.yes === true;
+      const owner = await sweepOrphanOwnerAssignments({ subscriptionId: sub, execute });
+      const gateway = await sweepOrphanGatewaySubRoles({ subscriptionId: sub, execute });
+      const total = owner.length + gateway.length;
+      if (total === 0) {
+        this.context.stdout.write(`${colors.success("\u2713")} No orphaned installer Owner@sub or gateway sub-scope assignments found.
 `);
         return 0;
       }
-      for (const f of found) {
-        this.context.stdout.write(`  ${f.id}${f.createdOn ? colors.dim(` (created ${f.createdOn})`) : ""}${f.description ? colors.dim(" [tagged]") : ""}
+      for (const f of owner) {
+        this.context.stdout.write(`  ${colors.dim("Owner@sub")}  ${f.id}${f.createdOn ? colors.dim(` (created ${f.createdOn})`) : ""}${f.description ? colors.dim(" [tagged]") : ""}
+`);
+      }
+      for (const f of gateway) {
+        this.context.stdout.write(`  ${colors.dim(f.roleDefinitionName ?? "gateway sub-scope")}  ${f.id}${f.createdOn ? colors.dim(` (created ${f.createdOn})`) : ""}${f.description ? colors.dim(" [tagged]") : ""}
 `);
       }
-      if (this.yes === true) {
-        this.context.stdout.write(`${colors.success("\u2713")} Removed ${String(found.length)} orphaned Owner@sub assignment(s).
+      const breakdown = `${String(owner.length)} Owner@sub, ${String(gateway.length)} gateway sub-scope`;
+      if (execute) {
+        this.context.stdout.write(`${colors.success("\u2713")} Removed ${String(total)} orphaned assignment(s) (${breakdown}).
 `);
       } else {
         this.context.stdout.write(`
-Found ${String(found.length)} orphaned Owner@sub assignment(s) (dry-run). ${colors.hint("Re-run with --sweep-orphans --yes to delete them.")}
+Found ${String(total)} orphaned assignment(s) (${breakdown}) (dry-run). ${colors.hint("Re-run with --sweep-orphans --yes to delete them.")}
 `);
       }
       return 0;
@@ -25981,10 +26029,12 @@ Found ${String(found.length)} orphaned Owner@sub assignment(s) (dry-run). ${colo
         if (!sub) {
           throw new LocalCliError({ code: "BOOTSTRAP_SWEEP_NO_SUB", message: "No active subscription.", hint: "Run 'az account set --subscription <id>'." });
         }
-        const found = await sweepOrphanOwnerAssignments({ subscriptionId: sub, execute: true });
+        const owner = await sweepOrphanOwnerAssignments({ subscriptionId: sub, execute: true });
+        const gateway = await sweepOrphanGatewaySubRoles({ subscriptionId: sub, execute: true });
+        const total = owner.length + gateway.length;
         this.context.stdout.write(
-          found.length === 0 ? `${colors.success("\u2713")} No bootstrap state and no orphaned installer Owner@sub assignments. Nothing to reap.
-` : `${colors.success("\u2713")} No bootstrap state found; swept ${String(found.length)} orphaned installer Owner@sub assignment(s).
+          total === 0 ? `${colors.success("\u2713")} No bootstrap state and no orphaned installer Owner@sub or gateway sub-scope assignments. Nothing to reap.
+` : `${colors.success("\u2713")} No bootstrap state found; swept ${String(total)} orphaned assignment(s) (${String(owner.length)} Owner@sub, ${String(gateway.length)} gateway sub-scope).
 `
         );
         return 0;
@@ -25992,7 +26042,7 @@ Found ${String(found.length)} orphaned Owner@sub assignment(s) (dry-run). ${colo
       throw new LocalCliError({
         code: "BOOTSTRAP_NO_STATE",
         message: "No bootstrap state to reap.",
-        hint: "Nothing to do. If a launch failed early it may have orphaned an installer Owner@sub grant \u2014 run 'm8t bootstrap reap --force' (or 'm8t bootstrap reap --sweep-orphans --yes') to clean it."
+        hint: "Nothing to do. If a launch failed and its RG was deleted it may have orphaned an installer Owner@sub grant or the gateway's sub-scope reader roles \u2014 run 'm8t bootstrap reap --force' (or 'm8t bootstrap reap --sweep-orphans --yes') to clean them."
       });
     }
     if (this.force !== true) {