@m8t-stack/cli 0.2.91 → 0.2.94

package/dist/cli.js

@@ -1487,7 +1487,7 @@ function installFoundryDnsShim() {
 }
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.91";
+var CLI_VERSION = "0.2.94";
 
 // src/lib/render-error.ts
 init_errors();
@@ -20983,6 +20983,7 @@ import * as os10 from "os";
 import * as path26 from "path";
 init_errors();
 var FOUNDRY_TRACING_MODES = ["project", "account", "skip"];
+var DEFAULT_FOUNDRY_TRACING = "project";
 function parseFoundryTracingMode(v) {
   if (v === void 0) return void 0;
   if (!FOUNDRY_TRACING_MODES.includes(v)) {
@@ -24270,10 +24271,10 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
     description: "Release-channel URL the updater job polls (bicep default applies when omitted)."
   });
   location = Option40.String("--location", {
-    description: "Region for the updater identity + job. Defaults to the resource group's existing resources."
+    description: "Region for the updater identity + job. Defaults to this install's stamped region, then to the resource group's existing resources."
   });
   foundryTracing = Option40.String("--foundry-tracing", {
-    description: "project | account | skip. Pass the value the install was deployed with \u2014 omitting it lets the bicep default (project) switch tracing on."
+    description: "project | account | skip. Omitting it keeps the value already stamped on this install; only an install with nothing stamped falls through to the default (project)."
   });
   endpoint = Option40.String("--endpoint", {
     description: "Foundry project endpoint URL. Disambiguates the project in a multi-project subscription."
@@ -24344,7 +24345,8 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
       resourceGroup,
       subscriptionId
     });
-    const location = typeof this.location === "string" && this.location.length > 0 ? this.location : (await runAz(["resource", "list", "-g", resourceGroup, "--subscription", subscriptionId, "--query", "[0].location", "-o", "tsv"])).trim();
+    const stampedLocation = stampedParams?.bicep.location;
+    const location = typeof this.location === "string" && this.location.length > 0 ? this.location : stampedLocation !== void 0 && stampedLocation.length > 0 ? stampedLocation : (await runAz(["resource", "list", "-g", resourceGroup, "--subscription", subscriptionId, "--query", "[0].location", "-o", "tsv"])).trim();
     if (!location) {
       throw new LocalCliError({
         code: "PLATFORM_ENABLE_AUTO_UPDATE_NO_LOCATION",
@@ -24352,8 +24354,9 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
       });
     }
     const foundryResourceId = await resolveFoundryResourceId(project.endpoint);
-    const acrPullIdentityResourceId = resolveAcrPullIdentity({});
-    const acrResourceId = acrPullIdentityResourceId ? "" : await resolveAcrResourceId({ imageRef });
+    const resolvedAcrPullIdentity = resolveAcrPullIdentity({});
+    const acrPullIdentityResourceId = resolvedAcrPullIdentity !== "" ? resolvedAcrPullIdentity : stampedParams?.bicep.acrPullIdentityResourceId ?? "";
+    const acrResourceId = await resolveAcrResourceId({ imageRef });
     const recoveredParams = {
       location,
       suffix,
@@ -24364,8 +24367,49 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
       foundryProjectEndpoint: project.endpoint,
       acrPullIdentityResourceId,
       acrResourceId,
-      ...parseFoundryTracingMode(this.foundryTracing) ? { foundryTracingMode: parseFoundryTracingMode(this.foundryTracing) } : {},
-      ...typeof this.channelUrl === "string" && this.channelUrl.length > 0 ? { channelUrl: this.channelUrl } : {}
+      // This row is REPLACED wholesale, so an absent flag must INHERIT the stamped
+      // value rather than drop it. Both optional fields need this, for the same
+      // reason and with the same consequence:
+      //
+      //   foundryTracingMode — dropping it re-applied main.bicep's `project`
+      //     default, so an install that deliberately opted out of tracing had it
+      //     switched back on by an unrelated re-run of this command. That is
+      //     exactly the silent posture change we refuse to make for a customer.
+      //   channelUrl — dropping it re-applied bicep's empty default, so the
+      //     gateway and updater job lost their release channel and the install
+      //     silently stopped polling for updates. The field exists in InfraParams
+      //     precisely so a converge re-emits it; dropping it defeats its purpose.
+      //
+      // The stamped value is re-validated rather than cast: the row is typed
+      // `string` and JSON-parsed unchecked, so a bad value would otherwise reach
+      // ARM and come back as an opaque InvalidTemplate instead of a local refusal.
+      //
+      // An unrecognised stamped mode REFUSES rather than dropping to the bicep
+      // default. Dropping would resolve to `project` and switch tracing ON for an
+      // install whose stored configuration said something else — the silent
+      // posture change this whole block exists to prevent. It also covers the
+      // forward case: a newer CLI stamping a mode this build does not know should
+      // not be clobbered by this build. An explicit flag rescues it either way,
+      // which is why the flag is parsed FIRST and the stamp only read if absent.
+      ...(() => {
+        const explicit = parseFoundryTracingMode(this.foundryTracing);
+        if (explicit) return { foundryTracingMode: explicit };
+        const raw = stampedParams?.bicep.foundryTracingMode;
+        if (raw === void 0) return {};
+        try {
+          return { foundryTracingMode: parseFoundryTracingMode(raw) };
+        } catch {
+          throw new LocalCliError({
+            code: "PLATFORM_ENABLE_AUTO_UPDATE_UNKNOWN_STAMPED_TRACING",
+            message: `This install's stored configuration records a Foundry tracing mode this version does not recognise: '${raw}'.`,
+            hint: "Pass --foundry-tracing project|account|skip to replace it. It is not dropped automatically, because that would re-enable tracing on an install whose configuration says otherwise."
+          });
+        }
+      })(),
+      ...(() => {
+        const url = typeof this.channelUrl === "string" && this.channelUrl.length > 0 ? this.channelUrl : stampedParams?.bicep.channelUrl;
+        return url ? { channelUrl: url } : {};
+      })()
     };
     onProgress("running Bicep deployment to provision the updater (~2-4 min)\u2026");
     const repoRoot = await resolveRepoRoot2();
@@ -24829,7 +24873,7 @@ function reportWhatIf(r, opts) {
   const exitCode = r.unexpected.length === 0 ? 0 : 1;
   if (opts.redact) {
     const output = opts.json ? JSON.stringify({ summary: redactForReport(r), exitCode }, null, 2) : redactForLog(r);
-    return { output, exitCode };
+    return { output, exitCode, ...opts.json ? { diagnostic: redactForLog(r) } : {} };
   }
   if (opts.json) {
     return { output: JSON.stringify({ summary: { noise: r.noise.length, pending: r.pending.length, unexpected: r.unexpected.length }, pending: r.pending, unexpected: r.unexpected, exitCode }, null, 2), exitCode };
@@ -25096,8 +25140,9 @@ var DeployCommand = class extends M8tCommand {
         });
         const changes = await runWhatIf({ resourceGroup: this.resourceGroup, repoRoot: repoRoot2, params: params2 });
         const classified = classifyWhatIf(changes);
-        const { output, exitCode } = reportWhatIf(classified, { json: mode === "json", redact: this.redact });
+        const { output, exitCode, diagnostic } = reportWhatIf(classified, { json: mode === "json", redact: this.redact });
         this.context.stdout.write(output + "\n");
+        if (diagnostic) this.context.stderr.write(diagnostic + "\n");
         return exitCode;
       } catch (e) {
         const { output, exitCode } = reportWhatIfFailure(e, { json: mode === "json", redact: this.redact });
@@ -31570,7 +31615,7 @@ ${colors.error("\u2717")} The GitHub App on disk is installed on ${colors.field(
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.63";
+var DEFAULT_INSTALLER_TAG = "v0.1.65";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
@@ -31606,6 +31651,11 @@ var BootstrapLaunchCommand = class extends M8tCommand {
   reinstallInto = Option56.String("--reinstall-into", { description: "Consent to installing into --resource-group even though it already holds resources. Must match the target group's name." });
   org = Option56.String("--org", { description: "Assert the GitHub App on disk is installed on this org; refuses on a mismatch." });
   noBrains = Option56.Boolean("--no-brains", false, { description: "Install without brain-backed workers. For test and CI rigs; the supported install creates brains." });
+  // The opt-out TELEMETRY.md names. Without it there is no way to decline at
+  // install time — the ACI env is built entirely from these options, so a
+  // founder setting FOUNDRY_TRACING in their own shell reaches nothing. A
+  // privacy notice that documents a control has to be a control that exists.
+  foundryTracing = Option56.String("--foundry-tracing", { description: "Where agent traces go: project (default, your own App Insights) | account (legacy shared) | skip (no tracing \u2014 you lose the record of what your agents did)." });
   async executeCommand() {
     const location = typeof this.location === "string" ? this.location : void 0;
     if (!location) {
@@ -31618,6 +31668,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     const installerImageOverride = typeof this.installerImage === "string" ? this.installerImage : void 0;
     const installerImage = installerImageOverride ?? `${DEFAULT_INSTALLER}:${installerTag}`;
     const gatewayImageRef = typeof this.gatewayImageRef === "string" ? this.gatewayImageRef : void 0;
+    const foundryTracing = parseFoundryTracingMode(typeof this.foundryTracing === "string" ? this.foundryTracing : void 0) ?? DEFAULT_FOUNDRY_TRACING;
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
     const out = (m) => this.context.stderr.write(`  ${colors.dim(m)}
@@ -31745,7 +31796,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       appRegClientId: appReg.clientId,
       image: installerImage,
       gatewayImageRef,
-      foundryTracing: "skip",
+      foundryTracing,
       githubApp,
       ...founderObjectId ? { founderObjectId } : {},
       ...skipBrains ? { skipBrains: true } : {},