@m8t-stack/cli 0.2.76 → 0.2.78

package/README.md

@@ -85,7 +85,7 @@ m8t companion uninstall   # remove the app, the login item, and the records
 their own software with their own version: each platform release names the companion build
 it carries, and these commands fetch it, check it against the digest the release pinned,
 and verify every file of what they wrote. See
-[`guides/install/companion.md`](../../guides/install/companion.md).
+[`guides/install/companion.md`](https://github.com/m8t-labs/ezra/blob/main/guides/install/companion.md).
 
 ### `--subscription <id>` flag
 

package/dist/cli.js

@@ -1390,7 +1390,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.76";
+var CLI_VERSION = "0.2.78";
 
 // src/lib/render-error.ts
 init_errors();
@@ -15005,6 +15005,21 @@ function tryResolveRepoRoot() {
   const root = fs5.readFileSync(marker, "utf8").trim();
   return root.length > 0 ? root : null;
 }
+function assertPlatformCheckout(repoRoot, operation, needs = ["personas"]) {
+  const missing = needs.filter((d) => !fs5.existsSync(path6.join(repoRoot, d)));
+  if (missing.length === 0) return;
+  const isAgentRepo = fs5.existsSync(path6.join(repoRoot, "agent", "persona.md"));
+  throw new LocalCliError({
+    code: "PLATFORM_CHECKOUT_REQUIRED",
+    message: `${operation} needs a platform checkout, but ~/.m8t/repo-root points at '${repoRoot}', which has no ${missing.join("/ or ")}/.` + (isAgentRepo ? " That path is the agent repository \u2014 it carries the install runbook, not the platform." : ""),
+    hint: "This operation reads platform content that is not published today, so it is maintainer-side for now. Your installation still updates itself: the auto-update rail applies published releases without needing any checkout."
+  });
+}
+function resolvePlatformRepoRoot(operation, needs) {
+  const root = resolveRepoRoot();
+  assertPlatformCheckout(root, operation, needs);
+  return root;
+}
 function resolveRepoRoot() {
   const root = tryResolveRepoRoot();
   if (root === null) {
@@ -16049,7 +16064,7 @@ async function derivePin(args) {
 
 // src/lib/brain-seed.ts
 function resolveSeed(name) {
-  const root = resolveRepoRoot();
+  const root = resolvePlatformRepoRoot("Seeding a brain", ["brain-seeds"]);
   const dir = path13.join(root, "brain-seeds", name);
   if (!fs13.existsSync(dir)) {
     throw new LocalCliError({
@@ -16651,7 +16666,7 @@ var BrainCreateCommand = class extends M8tCommand {
       endpoint: typeof this.endpoint === "string" ? this.endpoint : void 0,
       agentEndpoint
     });
-    const repoRoot = resolveRepoRoot();
+    const repoRoot = resolvePlatformRepoRoot("'m8t brain create'", ["brain-template"]);
     const templateSrc = path14.join(repoRoot, "brain-template");
     if (!fs14.existsSync(templateSrc)) {
       throw new LocalCliError({
@@ -16953,7 +16968,7 @@ var BrainLinkCommand = class extends M8tCommand {
       agentName: this.worker,
       repo,
       branch,
-      repoRoot: resolveRepoRoot(),
+      repoRoot: resolvePlatformRepoRoot("'m8t brain link'"),
       installationId,
       // Clipanion leaves a truthy Option descriptor here until argv is parsed
       // (tests set the literal boolean). `!== true` keeps the idempotent default
@@ -17722,7 +17737,7 @@ var AgentDeployAdvisorCommand = class extends M8tCommand {
       interactive,
       endpoint: typeof this.endpoint === "string" ? this.endpoint : void 0
     });
-    const repoRoot = (typeof this.repoRootFlag === "string" ? this.repoRootFlag : void 0) ?? resolveRepoRoot();
+    const repoRoot = (typeof this.repoRootFlag === "string" ? this.repoRootFlag : void 0) ?? resolvePlatformRepoRoot("'m8t agent deploy-advisor'");
     onProgress?.(`deploying advisor '${persona}' as '${agentName}'\u2026`);
     const version = await deployPromptAdvisor({
       credential: credential2,
@@ -18448,11 +18463,11 @@ var A2aEnableCommand = class extends M8tCommand {
   resolvePersonaPath() {
     if (typeof this.persona === "string" && this.persona.length > 0) {
       if (this.persona.includes("/") || this.persona.endsWith(".md")) return this.persona;
-      return path18.join(resolveRepoRoot(), "personas", this.persona, "persona.md");
+      return path18.join(resolvePlatformRepoRoot("'m8t a2a enable'"), "personas", this.persona, "persona.md");
     }
     const yaml = readAgentYaml(this.worker);
     if (yaml?.personaPath) {
-      return yaml.personaPath.startsWith("/") ? yaml.personaPath : path18.join(resolveRepoRoot(), yaml.personaPath);
+      return yaml.personaPath.startsWith("/") ? yaml.personaPath : path18.join(resolvePlatformRepoRoot("'m8t a2a enable'"), yaml.personaPath);
     }
     throw new LocalCliError({ code: "A2A_NO_PERSONA", message: `Could not resolve a persona for '${this.worker}'. Pass --persona <name>.` });
   }
@@ -18587,7 +18602,7 @@ function resolveSidecar() {
 }
 function checkArchitectDrift() {
   const sourcePath = path19.join(
-    resolveRepoRoot(),
+    resolvePlatformRepoRoot("Rendering the architect skill"),
     "personas",
     "m8t-architect",
     "persona.md"
@@ -19424,7 +19439,7 @@ var CoderDeployCommand = class extends M8tCommand {
         projectEndpoint: project.endpoint,
         projectArmId: `${project.accountScope}/projects/${project.projectName}`,
         agentName: this.name,
-        personaPath: path23.join(resolveRepoRoot(), "personas", personaName, "persona.md"),
+        personaPath: path23.join(resolvePlatformRepoRoot("'m8t coder deploy'"), "personas", personaName, "persona.md"),
         bridgeUrl,
         onProgress
       });
@@ -19827,7 +19842,7 @@ var AzureExecDeployCommand = class extends M8tCommand {
       kvUri
     });
     onProgress?.("a2a-enabling as a target\u2026");
-    const personaPath = path24.join(resolveRepoRoot(), "personas", "azure-executor", "persona.md");
+    const personaPath = path24.join(resolvePlatformRepoRoot("'m8t azure-exec deploy'"), "personas", "azure-executor", "persona.md");
     const bridgeUrl = resolveBridgeUrl({
       flag: typeof this.gatewayUrl === "string" ? this.gatewayUrl : void 0,
       env: processEnv
@@ -20184,16 +20199,18 @@ function entityToStamp(e) {
 }
 
 // ../../packages/platform-release/dist/esm/channel-url.js
-var CHANNEL_LATEST_URL = "https://github.com/m8t-labs/m8t/releases/latest/download/manifest.json";
+var RELEASES_REPO = "m8t-labs/m8t-releases";
+var RELEASES_BASE = `https://github.com/${RELEASES_REPO}/releases`;
+var CHANNEL_LATEST_URL = `${RELEASES_BASE}/latest/download/manifest.json`;
 function platformTag(version) {
   const bare = version.trim().replace(/^platform-/, "").replace(/^v/, "");
   return `platform-v${bare}`;
 }
 function channelUrlForVersion(version) {
-  return `https://github.com/m8t-labs/m8t/releases/download/${platformTag(version)}/manifest.json`;
+  return `${RELEASES_BASE}/download/${platformTag(version)}/manifest.json`;
 }
 function releaseAssetUrl(tag, asset) {
-  return `https://github.com/m8t-labs/m8t/releases/download/${tag}/${asset}`;
+  return `${RELEASES_BASE}/download/${tag}/${asset}`;
 }
 
 // ../../packages/platform-release/dist/esm/apply-request.js
@@ -20298,6 +20315,11 @@ import * as os9 from "os";
 import * as path25 from "path";
 init_errors();
 var OWNER_REPO = "m8t-labs/m8t";
+function platformRepoUnavailable(what, url, status) {
+  return `${what} needs access to ${OWNER_REPO}, which answered HTTP ${status.toString()} (${url}).
+That repository is private, so this command is maintainer-side for now.
+Your installation still updates itself: the auto-update rail applies published releases from the channel without reading this repository.`;
+}
 function parseTreeResponse(body) {
   const map = /* @__PURE__ */ new Map();
   for (const e of body.tree ?? []) if (e.type === "tree") map.set(e.path, e.sha);
@@ -20317,7 +20339,10 @@ async function fetchRepoTree(commit, deps = {}) {
     headers: { Accept: "application/vnd.github+json", ...token ? { Authorization: `Bearer ${token}` } : {} }
   });
   if (!res.ok) {
-    throw new LocalCliError({ code: "PLATFORM_TREE_FETCH_FAILED", message: `GET ${url} \u2192 HTTP ${res.status.toString()}.` });
+    throw new LocalCliError({
+      code: "PLATFORM_TREE_FETCH_FAILED",
+      message: platformRepoUnavailable("Verifying persona trees", url, res.status)
+    });
   }
   return parseTreeResponse(await res.json());
 }
@@ -20358,7 +20383,10 @@ async function resolveReleaseContent(manifest, opts = {}) {
   const url = `https://api.github.com/repos/${OWNER_REPO}/tarball/${commit}`;
   const res = await fetchImpl(url, { headers: token ? { Authorization: `Bearer ${token}` } : {} });
   if (!res.ok) {
-    throw new LocalCliError({ code: "PLATFORM_TARBALL_FETCH_FAILED", message: `GET ${url} \u2192 HTTP ${res.status.toString()}.` });
+    throw new LocalCliError({
+      code: "PLATFORM_TARBALL_FETCH_FAILED",
+      message: platformRepoUnavailable("Resolving release content", url, res.status)
+    });
   }
   fs24.mkdirSync(cacheRoot, { recursive: true });
   const tmp = fs24.mkdtempSync(path25.join(cacheRoot, `.dl-${commit.slice(0, 8)}-`));
@@ -20601,10 +20629,10 @@ function buildBicepParams(p) {
 }
 async function resolveRepoRoot2(home = os10.homedir()) {
   const marker = path26.join(home, ".m8t", "repo-root");
+  let root;
   try {
-    const root = (await fs25.readFile(marker, "utf8")).trim();
+    root = (await fs25.readFile(marker, "utf8")).trim();
     if (!root) throw new Error("empty");
-    return root;
   } catch {
     throw new LocalCliError({
       code: "DEPLOY_NO_REPO_ROOT",
@@ -20612,6 +20640,8 @@ async function resolveRepoRoot2(home = os10.homedir()) {
       hint: "Run 'm8t install' from an m8t checkout (it writes the marker), or run 'm8t deploy' from the repo."
     });
   }
+  assertPlatformCheckout(root, "'m8t deploy'", ["deploy"]);
+  return root;
 }
 async function resolveFoundryResourceId(endpoint, explicit) {
   if (explicit) return explicit;
@@ -22277,6 +22307,25 @@ async function patchApplyRequest(client, mutate) {
   await client.updateEntity({ ...applyRequestToEntity(next), etag: cur.etag }, "Merge", { etag: cur.etag });
 }
 
+// src/lib/rail-preconditions.ts
+init_errors();
+function assertBakedContentPresent(repoRoot) {
+  if (repoRoot !== null) return;
+  throw new LocalCliError({
+    code: "UPDATER_IMAGE_MALFORMED",
+    message: "the updater job found no ~/.m8t/repo-root marker, so it has no baked release content. Every installer image writes that marker at build time, so this image is malformed.",
+    hint: "Re-pull the updater job's image from the installer reference in the target manifest \u2014 the job self-updates to it on the next tick \u2014 or reinstall the platform. This job never fetches content from the platform repository: that repository is private and the job holds no token."
+  });
+}
+function assertForwardTarget(manifest) {
+  if (typeof manifest.components.infra?.treeSha === "string" && manifest.components.infra.treeSha.length > 0) return;
+  throw new LocalCliError({
+    code: "MANIFEST_NOT_A_FORWARD_TARGET",
+    message: `manifest ${manifest.platform.version} carries no components.infra.treeSha, so the updater job cannot determine the infra target without reading the platform repository.`,
+    hint: "Cuts from 0.7.0 onward always carry infra.treeSha. Target a current release: a manifest this old is not a valid target for an automatic update."
+  });
+}
+
 // src/lib/platform-self-update.ts
 import * as fs30 from "fs";
 import * as path32 from "path";
@@ -22421,10 +22470,12 @@ async function rollbackOrHold(args, notify, error) {
 async function reconvergeToPrevious(args, previousVersion) {
   const fetchManifestImpl = args.fetchManifestImpl ?? fetchManifest;
   const resolveContentImpl = args.resolveReleaseContentImpl ?? resolveReleaseContent;
-  const fetchTreeImpl = args.fetchRepoTreeImpl ?? fetchRepoTree;
   const prevManifest = await fetchManifestImpl(manifestSourceForVersionTag(args.channelUrl ?? "", previousVersion));
-  const contentDir = await resolveContentImpl(prevManifest, args.repoRoot ? { contentDir: args.repoRoot } : {});
-  const tree = prevManifest.components.infra?.treeSha ? { treeShaOf: () => void 0 } : await fetchTreeImpl(prevManifest.platform.commit);
+  const repoRoot = args.repoRoot ?? null;
+  assertBakedContentPresent(repoRoot);
+  assertForwardTarget(prevManifest);
+  const contentDir = await resolveContentImpl(prevManifest, { contentDir: repoRoot });
+  const tree = { treeShaOf: () => void 0 };
   const liveStamp = await args.deps.readStamp();
   const rollbackPlan = diffPlan(prevManifest, liveStamp, tree);
   const rollbackCtx = { ...args.ctx, manifest: prevManifest, contentDir };
@@ -22573,8 +22624,10 @@ var PlatformConvergeCommand = class extends M8tCommand {
         interactive: false,
         endpoint: ctx.endpoint
       });
-      const contentDir = await resolveReleaseContentWithAgents(manifest, repoRoot ? { contentDir: repoRoot } : {});
-      const tree = manifest.components.infra?.treeSha ? { treeShaOf: () => void 0 } : await fetchRepoTree(manifest.platform.commit);
+      assertBakedContentPresent(repoRoot);
+      const contentDir = await resolveReleaseContentWithAgents(manifest, { contentDir: repoRoot });
+      assertForwardTarget(manifest);
+      const tree = { treeShaOf: () => void 0 };
       const suffix = await this.recoverSuffix(ctx);
       const gatewayResourceId = await this.resolveGatewayResourceId(ctx, suffix);
       deps = await buildConvergeDeps({
@@ -30060,7 +30113,7 @@ ${colors.error("\u2717")} The GitHub App on disk is installed on ${colors.field(
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.60";
+var DEFAULT_INSTALLER_TAG = "v0.1.61";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {