@m8t-stack/cli 0.2.28 → 0.2.29

package/dist/cli.js

@@ -1247,7 +1247,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.28";
+var CLI_VERSION = "0.2.29";
 
 // src/lib/render-error.ts
 init_errors();
@@ -1442,49 +1442,31 @@ var BACKEND_RULES = [
   }
 ];
 var LOCAL_RULES = {
-  // Task 12 — foundry-agent-get
   AGENT_CREATE_VERSION_FAILED: "Re-run with `--verbose` for the full response body.",
   AGENT_CREATE_VERSION_NO_VERSION: "Foundry returned 2xx but no version \u2014 likely an API regression. Re-try; if it persists, file an issue.",
   AGENT_GET_FAILED: "Re-run with `--verbose` for the full response body.",
   AGENT_NOT_FOUND: "Use `m8t brain create <name>` to create the worker first, OR run `m8t deploy <name>` to register an existing agent.",
-  // Task 14 — brain-unlink
   AGENT_REDEPLOY_FAILED: "Re-run with `--verbose` for the full response body.",
   AGENT_REDEPLOY_NO_VERSION: "Foundry returned 2xx but no version. Re-try; if it persists, file an issue.",
-  // Task 10/13/14
   AGENT_YAML_NOT_FOUND: "Deploy the worker via `m8t deploy <name>` or the architect first.",
-  // Task 16 — brain link command
   APP_HEALTH_FAILED: "Run `m8t brain check-app` for details, then re-run this command.",
-  // Task 14 — brain-unlink
   APP_UNINSTALL_FAILED: "GitHub App-uninstall DELETE failed. Re-run with `--keep-app-install` if you want to skip this step.",
-  // Task 13 — brain-link
   ARM_AUTH: "Run `az login` and retry.",
   // F2 smoke fix — m8t brain create: stageAsGitRepo step
   BRAIN_GIT_INIT_FAILED: "If git is not installed, install it. Otherwise re-run with --verbose.",
-  // Task 14 — brain-unlink
   BRAIN_NOT_LINKED: "The worker has no brain link. Use `m8t brain link` or `m8t brain create` first.",
-  // Task 13 — brain-link
   BRAIN_YAML_MIRROR_FAILED: "GitHub Contents API PUT failed. Verify the App has `contents: write` permission on the repo.",
-  // Task 13 — brain-link
   CONN_CREATE_FAILED: "Foundry connection PUT failed. Verify Cognitive Services Contributor role on the project.",
-  // Task 14 — brain-unlink
   CONN_DELETE_FAILED: "Foundry connection DELETE failed. Verify your ARM subscription has Contributor on the project.",
-  // Task 13 — brain-link
   CONN_GET_FAILED: "Foundry connection GET failed. Verify your ARM subscription has access to the project.",
-  // Task 13 — brain-link.ts (rename pending: should be FOUNDRY_AUTH_FAILED)
+  // rename pending: should be FOUNDRY_AUTH_FAILED
   FOUNDRY_AUTH: "Run `az login` and retry.",
-  // Task 12 — foundry-agent-get
   FOUNDRY_AUTH_FAILED: "Run `az login` and retry.",
-  // Task 15+16
   KV_URI_NOT_FOUND: "Pass `--kv-uri` or set `AZURE_KEYVAULT_URI` / `KEYVAULT_URI`.",
-  // Task 13 — brain-link
   LINK_NO_INSTALLATION_ID: "Internal error \u2014 the CLI command must poll for the installation id before calling linkBrain. Report at https://github.com/m8t/m8t/issues.",
-  // Task 16 — brain link command
   M8T_REPO_ROOT_MISSING: "Re-run `m8t install` from a fresh m8t checkout \u2014 the post-install hook writes ~/.m8t/repo-root.",
-  // Task 14 — persona-render
   PERSONA_PATH_NOT_ABSOLUTE: "The persona path in ~/.m8t/foundry/<worker>.yaml must be absolute. Re-deploy the worker via the architect.",
-  // Task 9 — persona-render
   PERSONA_PLACEHOLDER_UNSATISFIED: "Re-deploy the worker via the architect to repopulate fillableFieldValues, OR edit ~/.m8t/foundry/<worker>.yaml manually.",
-  // Task 9 — persona-render
   PERSONA_READ_FAILED: "Verify the persona path in ~/.m8t/foundry/<worker>.yaml; the architect should have populated it at deploy time.",
   // ── pre-existing entries ──────────────────────────────────────────────────
   AUTH_NOT_SIGNED_IN: "you are not signed in to Azure \u2014 run 'az login' first.",
@@ -11524,7 +11506,7 @@ function redactAzArgs(args) {
 }
 function runAz(args) {
   return new Promise((resolve3, reject) => {
-    const proc = spawn("az", args, { stdio: ["ignore", "pipe", "pipe"] });
+    const proc = spawn("az", args, { stdio: ["ignore", "pipe", "pipe"], shell: process.platform === "win32" });
     const out = [];
     const err = [];
     proc.stdout.on("data", (d) => out.push(d));
@@ -13391,9 +13373,9 @@ async function probeAppInstallation(args) {
 ${body.slice(0, 300)}`);
 }
 async function tryOpenUrl(url, exec = defaultGhExec) {
-  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
   try {
-    await exec(cmd, [url]);
+    await exec(cmd, args);
   } catch {
   }
 }
@@ -13825,7 +13807,7 @@ function renderPersonaBody(personaPath, fillableFieldValues, instanceName) {
       message: `Could not read persona file '${personaPath}': ${e.message}`
     });
   }
-  const fmMatch = /^---\n[\s\S]*?\n---\n+/.exec(raw);
+  const fmMatch = /^---\r?\n[\s\S]*?\r?\n---(?:\r?\n)+/.exec(raw);
   const body = fmMatch ? raw.slice(fmMatch[0].length) : raw;
   let rendered = body;
   for (const [name, value] of Object.entries(fillableFieldValues)) {
@@ -15547,7 +15529,7 @@ async function deployPromptAdvisor(args) {
       cause: e
     });
   }
-  const fmMatch = /^---\n([\s\S]*?)\n---/.exec(raw);
+  const fmMatch = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw);
   const fm = fmMatch ? parseYaml6(fmMatch[1]) : {};
   const model = args.model ?? fm.targets?.foundry?.model;
   if (!model) {
@@ -15823,7 +15805,7 @@ function readPersonaA2aCard(personaPath) {
   } catch (e) {
     throw new LocalCliError({ code: "PERSONA_READ_FAILED", message: `Could not read persona '${personaPath}': ${e.message}` });
   }
-  const fm = /^---\n([\s\S]*?)\n---/.exec(raw);
+  const fm = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw);
   if (!fm) throw new LocalCliError({ code: "PERSONA_NO_FRONTMATTER", message: `Persona '${personaPath}' has no frontmatter.` });
   const front = parseYaml7(fm[1]);
   const role = typeof front.role === "string" ? front.role : "";
@@ -16899,7 +16881,7 @@ function resolvePersona(persona, cwd = process.cwd()) {
   } catch {
     return { persona, personaVersion: null };
   }
-  const match = /^---\n([\s\S]*?)\n---/.exec(raw);
+  const match = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw);
   if (!match) return { persona, personaVersion: null };
   let fm = null;
   try {
@@ -18727,7 +18709,7 @@ function declaredFillableFields(personaPath) {
   } catch {
     return [];
   }
-  const fmMatch = /^---\n([\s\S]*?)\n---/.exec(raw);
+  const fmMatch = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw);
   if (!fmMatch) return [];
   try {
     const fm = parseYaml10(fmMatch[1]);
@@ -21635,7 +21617,7 @@ init_errors();
 import { spawn as spawn4 } from "child_process";
 function runAzd(args) {
   return new Promise((resolve3, reject) => {
-    const proc = spawn4("azd", args, { stdio: ["ignore", "pipe", "pipe"] });
+    const proc = spawn4("azd", args, { stdio: ["ignore", "pipe", "pipe"], shell: process.platform === "win32" });
     const out = [];
     const err = [];
     proc.stdout.on("data", (d) => out.push(d));
@@ -25370,6 +25352,32 @@ var FoundryAwaitReadyCommand = class extends M8tCommand {
 
 // src/commands/bootstrap/preflight.ts
 import { Command as Command48, Option as Option45 } from "clipanion";
+
+// ../../packages/telemetry-contract/artifact/tier-map.ts
+var EVENT_TIERS = {
+  "enrolled": 1,
+  "install-started": 1,
+  "install-succeeded": 1,
+  "install-failed": 1,
+  "heartbeat": 1,
+  "update-applied": 1,
+  "update-failed": 1,
+  "consent-changed": 1
+  // extended additively for tier-2 usage events: "usage-rollup": 2
+};
+var EVENT_ENUM = Object.keys(EVENT_TIERS);
+
+// ../../packages/telemetry-contract/src/disclosure.ts
+var DISCLOSURE_TIER1 = "Operational data. To support your installation, m8t receives limited operational data linked to it \u2014 installation and update events, installed versions, and service health signals, along with the company name and contact email you provide. This is service data used only to operate and support the platform; it contains none of your content. Details: TELEMETRY.md.";
+
+// ../../packages/telemetry-contract/src/endpoints.ts
+var INGEST_BASE_URL = (process.env.M8T_INGEST_BASE_URL ?? "").trim() || "https://m8t-admin.wonderfuldesert-721e332f.eastus2.azurecontainerapps.io";
+function ingestUrl(path37) {
+  const base = INGEST_BASE_URL.replace(/\/+$/, "");
+  return `${base}${path37.startsWith("/") ? path37 : `/${path37}`}`;
+}
+
+// src/commands/bootstrap/preflight.ts
 init_errors();
 
 // src/lib/bootstrap-preflight.ts
@@ -25459,6 +25467,9 @@ var BootstrapPreflightCommand = class extends M8tCommand {
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
     const oid = await getCallerObjectId();
     this.context.stdout.write(buildPreflightBanner({ upn: account.upn, tenantId: account.tenantId, subscriptionId }) + "\n");
+    this.context.stdout.write(`
+${colors.dim(DISCLOSURE_TIER1)}
+`);
     this.context.stdout.write("Checking your access\u2026\n");
     const sub = await checkSubScopeAdmin(oid, subscriptionId);
     this.context.stdout.write(line(sub.ok, `${sub.role ?? "Owner/UAA"} at subscription scope`, "resource + role-assignment rights"));
@@ -25610,6 +25621,7 @@ function buildAciCreateArgs(s) {
   ];
   if (s.gatewayImageRef) env.push(`GATEWAY_IMAGE_REF=${s.gatewayImageRef}`);
   if (s.foundryTracing) env.push(`FOUNDRY_TRACING=${s.foundryTracing}`);
+  if (s.enrollContactEmail) env.push(`M8T_ENROLL_CONTACT_EMAIL=${s.enrollContactEmail}`);
   if (s.githubApp) {
     const g = s.githubApp;
     env.push(
@@ -25760,7 +25772,7 @@ async function writeBootstrapState(state, home = os13.homedir()) {
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.33";
+var DEFAULT_INSTALLER_TAG = "v0.1.34";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
@@ -25876,7 +25888,8 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       image: installerImage,
       gatewayImageRef,
       foundryTracing: "skip",
-      githubApp
+      githubApp,
+      enrollContactEmail: account.upn
     });
     this.context.stdout.write(
       `${colors.success("\u2713")} installer launched in ${colors.field(resourceGroup)} (${location}).
@@ -26640,7 +26653,7 @@ import * as fs32 from "fs";
 import * as net from "net";
 import * as os17 from "os";
 import * as path35 from "path";
-import { spawn as spawn7 } from "child_process";
+import { spawn as spawn7, spawnSync as spawnSync6 } from "child_process";
 init_errors();
 init_rbac();
 
@@ -26906,7 +26919,8 @@ async function serveOnboardingUiDetached(args) {
     detached: true,
     stdio: ["ignore", fd, fd],
     env: { ...process.env, PORT: args.port },
-    shell: false
+    // pnpm resolves to pnpm.cmd on Windows, which needs a shell to launch.
+    shell: process.platform === "win32"
   });
   fs32.closeSync(fd);
   if (child.pid == null) {
@@ -26946,7 +26960,8 @@ async function serveOnboardingRelayDetached(args) {
       RELAY_ALLOWED_ORIGINS: "http://localhost:3000",
       RELAY_PORT: "8790"
     },
-    shell: false
+    // pnpm resolves to pnpm.cmd on Windows, which needs a shell to launch.
+    shell: process.platform === "win32"
   });
   fs32.closeSync(fd);
   if (child.pid == null) {
@@ -26985,10 +27000,14 @@ function stopPidFile(pidPath) {
   }
   const pid = Number(pidStr);
   if (!Number.isNaN(pid) && pid > 0) {
-    try {
-      process.kill(-pid, "SIGTERM");
-    } catch (e) {
-      if (e.code !== "ESRCH") throw e;
+    if (process.platform === "win32") {
+      spawnSync6("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore" });
+    } else {
+      try {
+        process.kill(-pid, "SIGTERM");
+      } catch (e) {
+        if (e.code !== "ESRCH") throw e;
+      }
     }
   }
   try {
@@ -27240,6 +27259,112 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
   }
 };
 
+// src/commands/telemetry/enroll.ts
+import { Command as Command55, Option as Option52 } from "clipanion";
+init_errors();
+
+// src/lib/telemetry-enroll.ts
+init_errors();
+async function enroll(args) {
+  const f = args.fetchImpl ?? fetch;
+  const url = args.baseUrl ? `${args.baseUrl.replace(/\/+$/, "")}/api/ingest/enroll` : ingestUrl("/api/ingest/enroll");
+  let res;
+  try {
+    res = await f(url, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ schemaVersion: 1, company: args.company, contactEmail: args.contactEmail, subscriptionId: args.subscriptionId, proof: null })
+    });
+  } catch (e) {
+    throw new LocalCliError({ code: "TELEMETRY_ENROLL_UNREACHABLE", message: `Could not reach the telemetry ingest to enroll: ${e instanceof Error ? e.message : String(e)}` });
+  }
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new LocalCliError({ code: "TELEMETRY_ENROLL_FAILED", message: `Enroll failed (HTTP ${res.status.toString()}): ${body}` });
+  }
+  const json = await res.json();
+  if (!json.instanceId || !json.ingestKey) {
+    throw new LocalCliError({ code: "TELEMETRY_ENROLL_BAD_RESPONSE", message: "Enroll response missing instanceId/ingestKey." });
+  }
+  return { instanceId: json.instanceId, ingestKey: json.ingestKey };
+}
+
+// src/commands/telemetry/enroll.ts
+var INGEST_KEY_SECRET = "m8t-ingest-key";
+async function resolveKeyVaultName(containerAppResourceId) {
+  const kvUri = (await runAz([
+    "containerapp",
+    "show",
+    "--ids",
+    containerAppResourceId,
+    "--query",
+    "properties.template.containers[0].env[?name=='KEY_VAULT_URI'].value | [0]",
+    "-o",
+    "tsv"
+  ])).trim();
+  if (!kvUri) {
+    throw new LocalCliError({
+      code: "TELEMETRY_ENROLL_NO_KV",
+      message: "Could not resolve the platform Key Vault: the gateway Container App has no KEY_VAULT_URI env var.",
+      hint: "Verify the deployment via 'az containerapp show --ids <id> --query properties.template.containers[0].env'."
+    });
+  }
+  const host = new URL(kvUri).hostname;
+  const name = host.split(".")[0];
+  if (!name) {
+    throw new LocalCliError({ code: "TELEMETRY_ENROLL_BAD_KV_URI", message: `Could not parse a Key Vault name from KEY_VAULT_URI '${kvUri}'.` });
+  }
+  return name;
+}
+var TelemetryEnrollCommand = class extends M8tCommand {
+  static paths = [["telemetry", "enroll"]];
+  static usage = Command55.Usage({
+    description: "Enroll this installation for operational telemetry (pre-existing installs).",
+    details: "Mints an instance id + ingest key from the m8t telemetry ingest and stores the key in your platform Key Vault, the same place the installer writes it on a fresh install. Idempotent: refuses if a key already exists unless --force.",
+    examples: [["Enroll", "$0 telemetry enroll"]]
+  });
+  company = Option52.String("--company", { description: "Your company name (optional)." });
+  contactEmail = Option52.String("--contact-email", { description: "Contact email (default: your signed-in az UPN)." });
+  subscription = Option52.String("--subscription", { description: "Azure subscription id (default: your active az subscription)." });
+  resourceGroup = Option52.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
+  force = Option52.Boolean("--force", false, { description: "Re-enroll even if a key is already stored (mints a new instance id)." });
+  async executeCommand() {
+    const account = await getAzAccount();
+    const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
+    const contactEmail = (typeof this.contactEmail === "string" ? this.contactEmail : void 0) ?? account.upn;
+    const company = (typeof this.company === "string" ? this.company : void 0) ?? "";
+    const d = await discoverGateway({
+      subscriptionId,
+      interactive: false,
+      resourceGroup: typeof this.resourceGroup === "string" ? this.resourceGroup : void 0
+    });
+    const kvName = await resolveKeyVaultName(d.containerAppResourceId);
+    if (this.force !== true) {
+      let existing = "";
+      try {
+        existing = await runAz(["keyvault", "secret", "show", "--vault-name", kvName, "--name", INGEST_KEY_SECRET, "--query", "value", "-o", "tsv"]);
+      } catch (e) {
+        rethrowIfAzUnavailable(e);
+        existing = "";
+      }
+      if (existing.trim()) {
+        throw new LocalCliError({
+          code: "TELEMETRY_ALREADY_ENROLLED",
+          message: "This installation is already enrolled.",
+          hint: "Pass --force to re-enroll (mints a new instance id)."
+        });
+      }
+    }
+    const { instanceId, ingestKey } = await enroll({ company, contactEmail, subscriptionId });
+    await runAz(["keyvault", "secret", "set", "--vault-name", kvName, "--name", INGEST_KEY_SECRET, "--value", ingestKey, "--only-show-errors"]);
+    this.context.stdout.write(
+      `${colors.success("\u2713")} enrolled (instance ${instanceId}); ingest key stored in Key Vault ${kvName}. The gateway picks it up on its next cycle.
+`
+    );
+    return 0;
+  }
+};
+
 // src/cli.ts
 var cli = new Cli({
   binaryName: "m8t",
@@ -27300,6 +27425,7 @@ cli.register(BootstrapReapCommand);
 cli.register(BootstrapFinishCommand);
 cli.register(BootstrapUiCommand);
 cli.register(BootstrapSeedProfileCommand);
+cli.register(TelemetryEnrollCommand);
 async function main() {
   try {
     return await cli.run(process.argv.slice(2));