@m8t-stack/cli 0.2.92 → 0.2.95

package/dist/cli.js

@@ -1487,7 +1487,7 @@ function installFoundryDnsShim() {
 }
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.92";
+var CLI_VERSION = "0.2.95";
 
 // src/lib/render-error.ts
 init_errors();
@@ -20983,6 +20983,7 @@ import * as os10 from "os";
 import * as path26 from "path";
 init_errors();
 var FOUNDRY_TRACING_MODES = ["project", "account", "skip"];
+var DEFAULT_FOUNDRY_TRACING = "project";
 function parseFoundryTracingMode(v) {
   if (v === void 0) return void 0;
   if (!FOUNDRY_TRACING_MODES.includes(v)) {
@@ -24270,10 +24271,10 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
     description: "Release-channel URL the updater job polls (bicep default applies when omitted)."
   });
   location = Option40.String("--location", {
-    description: "Region for the updater identity + job. Defaults to the resource group's existing resources."
+    description: "Region for the updater identity + job. Defaults to this install's stamped region, then to the resource group's existing resources."
   });
   foundryTracing = Option40.String("--foundry-tracing", {
-    description: "project | account | skip. Pass the value the install was deployed with \u2014 omitting it lets the bicep default (project) switch tracing on."
+    description: "project | account | skip. Omitting it keeps the value already stamped on this install; only an install with nothing stamped falls through to the default (project)."
   });
   endpoint = Option40.String("--endpoint", {
     description: "Foundry project endpoint URL. Disambiguates the project in a multi-project subscription."
@@ -24344,7 +24345,8 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
       resourceGroup,
       subscriptionId
     });
-    const location = typeof this.location === "string" && this.location.length > 0 ? this.location : (await runAz(["resource", "list", "-g", resourceGroup, "--subscription", subscriptionId, "--query", "[0].location", "-o", "tsv"])).trim();
+    const stampedLocation = stampedParams?.bicep.location;
+    const location = typeof this.location === "string" && this.location.length > 0 ? this.location : stampedLocation !== void 0 && stampedLocation.length > 0 ? stampedLocation : (await runAz(["resource", "list", "-g", resourceGroup, "--subscription", subscriptionId, "--query", "[0].location", "-o", "tsv"])).trim();
     if (!location) {
       throw new LocalCliError({
         code: "PLATFORM_ENABLE_AUTO_UPDATE_NO_LOCATION",
@@ -24352,8 +24354,9 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
       });
     }
     const foundryResourceId = await resolveFoundryResourceId(project.endpoint);
-    const acrPullIdentityResourceId = resolveAcrPullIdentity({});
-    const acrResourceId = acrPullIdentityResourceId ? "" : await resolveAcrResourceId({ imageRef });
+    const resolvedAcrPullIdentity = resolveAcrPullIdentity({});
+    const acrPullIdentityResourceId = resolvedAcrPullIdentity !== "" ? resolvedAcrPullIdentity : stampedParams?.bicep.acrPullIdentityResourceId ?? "";
+    const acrResourceId = await resolveAcrResourceId({ imageRef });
     const recoveredParams = {
       location,
       suffix,
@@ -24364,8 +24367,49 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
       foundryProjectEndpoint: project.endpoint,
       acrPullIdentityResourceId,
       acrResourceId,
-      ...parseFoundryTracingMode(this.foundryTracing) ? { foundryTracingMode: parseFoundryTracingMode(this.foundryTracing) } : {},
-      ...typeof this.channelUrl === "string" && this.channelUrl.length > 0 ? { channelUrl: this.channelUrl } : {}
+      // This row is REPLACED wholesale, so an absent flag must INHERIT the stamped
+      // value rather than drop it. Both optional fields need this, for the same
+      // reason and with the same consequence:
+      //
+      //   foundryTracingMode — dropping it re-applied main.bicep's `project`
+      //     default, so an install that deliberately opted out of tracing had it
+      //     switched back on by an unrelated re-run of this command. That is
+      //     exactly the silent posture change we refuse to make for a customer.
+      //   channelUrl — dropping it re-applied bicep's empty default, so the
+      //     gateway and updater job lost their release channel and the install
+      //     silently stopped polling for updates. The field exists in InfraParams
+      //     precisely so a converge re-emits it; dropping it defeats its purpose.
+      //
+      // The stamped value is re-validated rather than cast: the row is typed
+      // `string` and JSON-parsed unchecked, so a bad value would otherwise reach
+      // ARM and come back as an opaque InvalidTemplate instead of a local refusal.
+      //
+      // An unrecognised stamped mode REFUSES rather than dropping to the bicep
+      // default. Dropping would resolve to `project` and switch tracing ON for an
+      // install whose stored configuration said something else — the silent
+      // posture change this whole block exists to prevent. It also covers the
+      // forward case: a newer CLI stamping a mode this build does not know should
+      // not be clobbered by this build. An explicit flag rescues it either way,
+      // which is why the flag is parsed FIRST and the stamp only read if absent.
+      ...(() => {
+        const explicit = parseFoundryTracingMode(this.foundryTracing);
+        if (explicit) return { foundryTracingMode: explicit };
+        const raw = stampedParams?.bicep.foundryTracingMode;
+        if (raw === void 0) return {};
+        try {
+          return { foundryTracingMode: parseFoundryTracingMode(raw) };
+        } catch {
+          throw new LocalCliError({
+            code: "PLATFORM_ENABLE_AUTO_UPDATE_UNKNOWN_STAMPED_TRACING",
+            message: `This install's stored configuration records a Foundry tracing mode this version does not recognise: '${raw}'.`,
+            hint: "Pass --foundry-tracing project|account|skip to replace it. It is not dropped automatically, because that would re-enable tracing on an install whose configuration says otherwise."
+          });
+        }
+      })(),
+      ...(() => {
+        const url = typeof this.channelUrl === "string" && this.channelUrl.length > 0 ? this.channelUrl : stampedParams?.bicep.channelUrl;
+        return url ? { channelUrl: url } : {};
+      })()
     };
     onProgress("running Bicep deployment to provision the updater (~2-4 min)\u2026");
     const repoRoot = await resolveRepoRoot2();
@@ -24904,6 +24948,16 @@ var KNOWN_NOISE = [
   { resourceType: "Microsoft.App/containerApps", pathPattern: /(^|\.)configuration\.secrets$/, reason: "shared relay secret is regenerated on every deployment \u2014 owned elsewhere" },
   { resourceType: "Microsoft.App/containerApps", pathPattern: /(^|\.)configuration\.secrets\[\d+\]\.value$/, reason: "shared relay secret is regenerated on every deployment \u2014 owned elsewhere" }
 ];
+var PROBE_LEAF = /\.probes\[\d+\]\./;
+var PROBE_TYPE_LEAF = /\.probes\[\d+\]\.type$/;
+function isProbeReordering(leaves) {
+  const types = leaves.filter((l) => PROBE_TYPE_LEAF.test(l.path));
+  if (types.length === 0) return false;
+  const before = types.map((l) => l.before).filter((v) => typeof v === "string").sort();
+  const after = types.map((l) => l.after).filter((v) => typeof v === "string").sort();
+  if (before.length !== types.length || after.length !== types.length) return false;
+  return before.every((v, i) => v === after[i]);
+}
 var shortName = (resourceId) => resourceId.startsWith("[") ? "(role assignment)" : resourceId.split("/").pop() ?? resourceId;
 function isArmExpression(v) {
   return typeof v === "string" && /^\[.*\b(reference|format|guid|subscriptionResourceId|extensionResourceId)\(/.test(v) && v.endsWith("]");
@@ -24934,8 +24988,14 @@ function classifyWhatIf(changes) {
     }
     const resourceType = deriveResourceType(c.resourceId);
     const resourceName = shortName(c.resourceId);
-    for (const leaf of flattenDelta(c.delta ?? [])) {
+    const leaves = flattenDelta(c.delta ?? []);
+    const probesReordered = isProbeReordering(leaves);
+    for (const leaf of leaves) {
       const base = { resourceType, resourceName, path: leaf.path, before: leaf.before, after: leaf.after };
+      if (probesReordered && PROBE_LEAF.test(leaf.path)) {
+        noise.push({ ...base, reason: "probe array reordered by the RP; same probe set \u2014 no apply can reconcile it" });
+        continue;
+      }
       if (leaf.propertyChangeType === "NoEffect") {
         noise.push({ ...base, reason: "NoEffect (no-op)" });
         continue;
@@ -31571,7 +31631,7 @@ ${colors.error("\u2717")} The GitHub App on disk is installed on ${colors.field(
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.63";
+var DEFAULT_INSTALLER_TAG = "v0.1.65";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
@@ -31607,6 +31667,11 @@ var BootstrapLaunchCommand = class extends M8tCommand {
   reinstallInto = Option56.String("--reinstall-into", { description: "Consent to installing into --resource-group even though it already holds resources. Must match the target group's name." });
   org = Option56.String("--org", { description: "Assert the GitHub App on disk is installed on this org; refuses on a mismatch." });
   noBrains = Option56.Boolean("--no-brains", false, { description: "Install without brain-backed workers. For test and CI rigs; the supported install creates brains." });
+  // The opt-out TELEMETRY.md names. Without it there is no way to decline at
+  // install time — the ACI env is built entirely from these options, so a
+  // founder setting FOUNDRY_TRACING in their own shell reaches nothing. A
+  // privacy notice that documents a control has to be a control that exists.
+  foundryTracing = Option56.String("--foundry-tracing", { description: "Where agent traces go: project (default, your own App Insights) | account (legacy shared) | skip (no tracing \u2014 you lose the record of what your agents did)." });
   async executeCommand() {
     const location = typeof this.location === "string" ? this.location : void 0;
     if (!location) {
@@ -31619,6 +31684,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     const installerImageOverride = typeof this.installerImage === "string" ? this.installerImage : void 0;
     const installerImage = installerImageOverride ?? `${DEFAULT_INSTALLER}:${installerTag}`;
     const gatewayImageRef = typeof this.gatewayImageRef === "string" ? this.gatewayImageRef : void 0;
+    const foundryTracing = parseFoundryTracingMode(typeof this.foundryTracing === "string" ? this.foundryTracing : void 0) ?? DEFAULT_FOUNDRY_TRACING;
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
     const out = (m) => this.context.stderr.write(`  ${colors.dim(m)}
@@ -31746,7 +31812,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       appRegClientId: appReg.clientId,
       image: installerImage,
       gatewayImageRef,
-      foundryTracing: "skip",
+      foundryTracing,
       githubApp,
       ...founderObjectId ? { founderObjectId } : {},
       ...skipBrains ? { skipBrains: true } : {},