@nitsan-ai/ragsuite-test 0.1.2 → 0.1.3

package/README.md

@@ -1,83 +1,100 @@
 # RAGSuite test CLI (`ragsuite-test`)
 
-> **TESTING PACKAGE** — temporary. Final public CLI will be `ragsuite` later.
+> **TESTING PACKAGE** — temporary name before the final `ragsuite` CLI.
 
-**One-command public install** (GitHub repo must be public):
+Two ways to run. Pick one:
+
+| | **A) Git source** | **B) Docker images only** |
+|--|-------------------|---------------------------|
+| Command | `ragsuite-test init` | `ragsuite-test init --from-images` |
+| On disk | Full monorepo clone | Tiny compose bundle only |
+| App code visible? | Yes | **No** (runs in containers) |
+| Needs | git + Node; Docker *or* native Postgres/Redis | Node + **Docker** |
+| Best for | Dev, debugging, native mode, reading code | Testers / “just run the app” |
+| Pros | Native mode; full scripts; offline rebuild from source | No source leak; faster to start; smaller disk |
+| Cons | Source on disk; larger checkout | Needs published GHCR images; Docker required; no native mode |
+
+---
+
+## A) Git source (clone)
 
 ```bash
 npm install -g @nitsan-ai/ragsuite-test
 ragsuite-test init
-ragsuite-test start --repo-root ~/ragsuite-test --detach
+# clones https://github.com/nitsan-ai/RAGSUITE.git → ~/ragsuite-test
+# auto: docker if daemon up, else native
+
+ragsuite-test start --repo-root ~/ragsuite-test --detach   # docker
+# or after init --mode native:
+# ragsuite-test start --repo-root ~/ragsuite-test
+
+# API http://localhost:9090
+# Web http://localhost:9091 (docker) or :9191 (native)
+ragsuite-test stop --repo-root ~/ragsuite-test
 ```
 
-That clones `https://github.com/nitsan-ai/RAGSUITE.git` into `~/ragsuite-test`, writes `.env` (no SMTP/LLM questions), and picks **Docker** if the daemon is up, otherwise **native**.
+### Native (no Docker) — git install only
 
-- API: http://localhost:9090  
-- Web (Docker): http://localhost:9091  
-- Web (native): http://localhost:9191  
+Needs Postgres `:5436` (`ragsuite_v3`) and Redis `:6382`:
 
 ```bash
-ragsuite-test stop --repo-root ~/ragsuite-test
+ragsuite-test init --mode native
+ragsuite-test start --repo-root ~/ragsuite-test
 ```
 
-## Prerequisites
+---
 
-| Need | Required? | How |
-|------|-----------|-----|
-| Node.js 18+ | Yes | https://nodejs.org · `brew install node` |
-| git | Yes | `xcode-select --install` · `brew install git` |
-| Docker | No | Optional; without it init uses native (needs Postgres `:5436` + Redis `:6382`) |
+## B) Docker images (no source on disk)
 
-Real SMTP belongs only in local `.env` (gitignored). Init never asks for it.
+**Maintainer (once):** publish images — Actions → **Publish images (GHCR)**  
+(packages: `ghcr.io/nitsan-ai/ragsuite-backend`, `…/ragsuite-frontend`)
 
-## Advanced (optional)
+**User:**
 
 ```bash
-# Force native / docker
-ragsuite-test init --mode native
-ragsuite-test init --mode docker
+npm install -g @nitsan-ai/ragsuite-test
+ragsuite-test init --from-images
+ragsuite-test start --repo-root ~/ragsuite-test --detach
+# pulls images — does NOT clone app source
+ragsuite-test stop --repo-root ~/ragsuite-test
+```
 
-# Custom install dir
-ragsuite-test init --install-dir ~/my-ragsuite
+Optional pin:
 
-# Existing checkout (CI / developers)
-ragsuite-test init --repo-root /path/to/RAGSUITE
+```bash
+# in ~/ragsuite-test/.env
+IMAGE_TAG=1.0.0
+IMAGE_REGISTRY=ghcr.io/nitsan-ai
 ```
 
+If images are private on GHCR, make packages public or `docker login ghcr.io`.
+
+---
+
+## Prerequisites
+
+| Need | Git install | Images install |
+|------|-------------|----------------|
+| Node 18+ | Yes | Yes |
+| git | Yes | No |
+| Docker | Optional | **Required** |
+| Postgres/Redis on host | Only for `--mode native` | No (in compose) |
+
+SMTP/LLM: no init prompts. Real SMTP only in local `.env` (gitignored).
+
 ## Ports
 
 | Service | Port |
 |---------|------|
 | API | 9090 |
-| Web (Docker) | 9091 |
+| Web (Docker/images) | 9091 |
 | Web (native Expo) | 9191 |
 | Postgres | 5436 |
 | Redis | 6382 |
 
-Busy ports: `ragsuite-test stop --repo-root ~/ragsuite-test` · `lsof -nP -iTCP:9090 -sTCP:LISTEN`
-
-## Commands
-
-| Command | Behavior |
-|---------|----------|
-| `init` | Clone public repo → `.env` + config (default) |
-| `start` / `stop` | Docker or native scripts |
-| `doctor` | Health / prereq hints |
-| `logs` / `update` / `version` | As before |
-
-## Publish
-
-See [PUBLISH.md](./PUBLISH.md).
-
-```bash
-cd cli && npm run prepublish:check
-# Only when approved:
-RAGSUITE_TEST_ALLOW_PUBLISH=1 npm publish --access public
-```
-
-## Windows
+## Publish CLI
 
-Use WSL or Git Bash.
+See [PUBLISH.md](./PUBLISH.md). Version bump then Actions → **CLI publish**.
 
 ## Tests
 

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@nitsan-ai/ragsuite-test",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "private": false,
-  "description": "RAGSuite testing CLI (ragsuite-test) — public install: npm i -g && ragsuite-test init (clones GitHub). Temporary name before public ragsuite release.",
+  "description": "RAGSuite testing CLI — init (git source) or init --from-images (pull-only, no source).",
   "main": "src/index.js",
   "bin": {
     "ragsuite-test": "./bin/ragsuite-test.js"
@@ -10,6 +10,7 @@
   "files": [
     "bin/",
     "src/",
+    "templates/",
     "package.json",
     "README.md",
     "LICENSE"

package/src/commands/doctor.js

@@ -2,22 +2,22 @@
 
 const path = require('path');
 const { resolveMode } = require('../utils/config');
-const { resolveRepoRoot } = require('../utils/paths');
+const { resolveRepoRoot, isImagesInstall } = require('../utils/paths');
 const { runScript } = require('../utils/spawn');
 
 const name = 'doctor';
-const summary = 'Run scripts/doctor.sh prerequisite checks';
+const summary = 'Run doctor checks (git or images install)';
 
 function help() {
   return `Usage: ragsuite-test doctor [options]
 
-Runs scripts/doctor.sh. Mode selects which checklist gates the exit code
-(RAGSUITE_MODE / config / --mode). Both mode sections are still printed.
+Git install: scripts/doctor.sh
+Images install: scripts/docker-doctor-images.sh
 
 Options:
-  --mode <docker|native>   Gate exit on this mode (default: docker)
-  --repo-root <path>       Monorepo root
-  --dry-run                Print the script path and exit 0
+  --mode <docker|native>   Git install gate
+  --repo-root <path>
+  --dry-run
 `;
 }
 
@@ -26,12 +26,16 @@ function run(ctx) {
     cwd: ctx.cwd,
     repoRootFlag: ctx.globals.repoRoot,
   });
-  const mode = resolveMode({
-    flagMode: ctx.globals.mode,
-    repoRoot,
-    env: ctx.env,
-  });
-  return runScript(repoRoot, path.join('scripts', 'doctor.sh'), [], {
+  const images = isImagesInstall(repoRoot);
+  const mode = images
+    ? 'docker'
+    : resolveMode({
+        flagMode: ctx.globals.mode,
+        repoRoot,
+        env: ctx.env,
+      });
+  const script = images ? 'docker-doctor-images.sh' : 'doctor.sh';
+  return runScript(repoRoot, path.join('scripts', script), [], {
     dryRun: ctx.globals.dryRun,
     env: { ...ctx.env, RAGSUITE_MODE: mode },
   });

package/src/commands/init.js

@@ -2,13 +2,18 @@
 
 const path = require('path');
 const { writeConfig, CONFIG_DIR } = require('../utils/config');
-const { ensureRagsuiteDir, resolveRepoRoot } = require('../utils/paths');
+const {
+  ensureRagsuiteDir,
+  resolveRepoRoot,
+  isImagesInstall,
+} = require('../utils/paths');
 const { assertSupportedInstall, installHint } = require('../utils/distribution');
 const {
   DEFAULT_GIT_URL,
   defaultInstallDir,
   cloneGitToInstallDir,
 } = require('../utils/git-install');
+const { materializeImagesInstall } = require('../utils/images-install');
 const { detectOs } = require('../utils/os-detect');
 const {
   printPrereqs,
@@ -23,29 +28,29 @@ const { assertPortsFree } = require('../utils/port');
 const { info, error } = require('../utils/log');
 
 const name = 'init';
-const summary = 'One-command install: clone public GitHub repo → .env + config';
+const summary = 'Install: git clone (source) or pull-only Docker images';
 
-function printSuccess(repoRoot, mode) {
+function printSuccess(repoRoot, mode, source) {
   info('');
   info('=== Install complete ===');
   info(`  Install dir : ${repoRoot}`);
+  info(`  Source      : ${source}`);
   info(`  Mode        : ${mode}`);
   info(`  Config      : ${path.join(repoRoot, CONFIG_DIR, 'config.json')}`);
   info('');
   info('  API  http://localhost:9090');
-  if (mode === 'native') {
+  if (source === 'images') {
+    info('  Web  http://localhost:9091  (images / Docker nginx)');
+  } else if (mode === 'native') {
     info('  Web  http://localhost:9191  (Expo web — native mode)');
   } else {
     info('  Web  http://localhost:9091  (Docker nginx)');
   }
   info('');
   info('Next steps:');
-  info(`  1. ragsuite-test start --repo-root ${repoRoot}${mode === 'docker' ? ' --detach' : ''}`);
-  if (mode === 'native') {
-    info('  2. Open http://localhost:9191 and bootstrap the first admin');
-  } else {
-    info('  2. Open http://localhost:9091 and bootstrap the first admin');
-  }
+  const detach = mode === 'docker' || source === 'images' ? ' --detach' : '';
+  info(`  1. ragsuite-test start --repo-root ${repoRoot}${detach}`);
+  info('  2. Open the Web URL above and bootstrap the first admin');
   info(`  3. ragsuite-test doctor --repo-root ${repoRoot}`);
   info('');
   info(installHint());
@@ -54,23 +59,27 @@ function printSuccess(repoRoot, mode) {
 function help() {
   return `Usage: ragsuite-test init [options]
 
-Simple public install (default — no questions):
-  clones ${DEFAULT_GIT_URL}
-  into ~/ragsuite-test
-  picks docker mode if Docker is running, otherwise native
-  writes .env (JWT auto; SMTP/LLM from .env.example — no prompts)
+Two install styles:
 
-  ragsuite-test init
-  ragsuite-test start --repo-root ~/ragsuite-test --detach
+  A) Source on disk (git) — default
+       ragsuite-test init
+       Clones ${DEFAULT_GIT_URL} → ~/ragsuite-test
+       Supports --mode docker|native
 
-Advanced (optional):
-  --from-git [url]         Clone this URL instead of the default
-  --repo-root <path>       Use an existing checkout (no clone)
-  --install-dir <path>     Clone target (default: ~/ragsuite-test)
-  --mode <docker|native>   Force run mode
+  B) No source (Docker images only)
+       ragsuite-test init --from-images
+       Copies a tiny compose bundle → ~/ragsuite-test
+       Pulls ghcr.io/nitsan-ai/ragsuite-backend|frontend (no git clone of app code)
+
+Options:
+  --from-images            Pull-only images install (no monorepo source)
+  --from-git [url]         Clone this URL (default public repo)
+  --repo-root <path>       Configure an existing git checkout
+  --install-dir <path>     Target dir (default: ~/ragsuite-test)
+  --mode <docker|native>   Git install only (images install is always docker)
   --force                  Overwrite non-empty install dir / existing .env
-  --yes, -y                Same defaults; for scripts/CI
-  --llm-api-key / --smtp-* Optional overrides (usually not needed)
+  --yes, -y                Non-interactive
+  --llm-api-key / --smtp-* Optional overrides
 `;
 }
 
@@ -91,9 +100,10 @@ function resolveLlmOverride(g, env) {
   return null;
 }
 
-function countSources(fromGit, repoRootFlag) {
+function countSources(fromGit, fromImages, repoRootFlag) {
   let n = 0;
   if (fromGit !== null && fromGit !== undefined) n += 1;
+  if (fromImages) n += 1;
   if (repoRootFlag) n += 1;
   return n;
 }
@@ -103,12 +113,12 @@ async function run(ctx) {
   const g = ctx.globals;
 
   if (g.fromRelease) {
-    error('--from-release is not supported. Use default init, --from-git, or --repo-root.');
+    error('--from-release is not supported. Use init, --from-images, --from-git, or --repo-root.');
     return 1;
   }
 
-  if (countSources(g.fromGit, g.repoRoot) > 1) {
-    error('Use only one of --from-git or --repo-root');
+  if (countSources(g.fromGit, g.fromImages, g.repoRoot) > 1) {
+    error('Use only one of --from-images, --from-git, or --repo-root');
     return 1;
   }
 
@@ -116,20 +126,30 @@ async function run(ctx) {
   info(`OS: ${osInfo.label} (${osInfo.platform})`);
 
   let fromGit = g.fromGit;
+  let fromImages = Boolean(g.fromImages);
   let repoRootFlag = g.repoRoot;
   const installDir = g.installDir || defaultInstallDir();
 
-  // Default public path: no menus, no path prompts — clone GitHub → ~/ragsuite-test
-  if (fromGit === null && !repoRootFlag) {
+  if (!fromImages && fromGit === null && !repoRootFlag) {
     fromGit = '';
-    info(`Install: clone ${DEFAULT_GIT_URL}`);
-    info(`Target:  ${path.resolve(installDir)}`);
+    info(`Install style: git clone (source on disk)`);
+    info(`  ${DEFAULT_GIT_URL} → ${path.resolve(installDir)}`);
+  }
+
+  if (fromImages) {
+    info('Install style: Docker images only (no app source on disk)');
+    info(`  Target: ${path.resolve(installDir)}`);
   }
 
-  const mode = g.mode || resolvePreferredMode(null);
-  info(`Run mode: ${mode} (Docker optional — pass --mode docker|native to force)`);
+  let mode;
+  if (fromImages) {
+    mode = 'docker';
+  } else {
+    mode = g.mode || resolvePreferredMode(null);
+  }
+  info(`Run mode: ${mode}`);
 
-  const needGit = fromGit !== null && fromGit !== undefined;
+  const needGit = !fromImages && fromGit !== null && fromGit !== undefined;
   if (!printPrereqs(mode, { needGit })) {
     error('Fix prerequisites above and re-run init');
     return 1;
@@ -155,7 +175,15 @@ async function run(ctx) {
   let source = 'checkout';
 
   try {
-    if (fromGit !== null && fromGit !== undefined) {
+    if (fromImages) {
+      const result = materializeImagesInstall({
+        installDir,
+        force: g.force,
+      });
+      repoRoot = result.repoRoot;
+      source = 'images';
+      info(`Images bundle installed at ${repoRoot}`);
+    } else if (fromGit !== null && fromGit !== undefined) {
       const url = fromGit === '' ? DEFAULT_GIT_URL : fromGit;
       info(`Cloning ${url} → ${path.resolve(installDir)}`);
       const result = cloneGitToInstallDir(url, {
@@ -171,6 +199,7 @@ async function run(ctx) {
         repoRootFlag,
         env: ctx.env,
       });
+      if (isImagesInstall(repoRoot)) source = 'images';
     }
   } catch (err) {
     error(err.message || String(err));
@@ -203,7 +232,7 @@ async function run(ctx) {
 
   info(`Wrote ${path.join(repoRoot, CONFIG_DIR, 'config.json')}`);
   info(`  mode=${cfg.mode} source=${cfg.source}`);
-  printSuccess(repoRoot, mode);
+  printSuccess(repoRoot, mode, source);
   return 0;
 }
 

package/src/commands/start.js

@@ -2,25 +2,25 @@
 
 const path = require('path');
 const { resolveMode } = require('../utils/config');
-const { resolveRepoRoot } = require('../utils/paths');
+const { resolveRepoRoot, isImagesInstall } = require('../utils/paths');
 const { runScript } = require('../utils/spawn');
 const { assertApiPortFree } = require('../utils/port');
 const { error } = require('../utils/log');
 
 const name = 'start';
-const summary = 'Start stack via docker-start.sh or native-start.sh';
+const summary = 'Start stack (git scripts or images pull-only)';
 
 function help() {
-  return `Usage: ragsuite-test start [options] [-- script-args...]
+  return `Usage: ragsuite-test start [options]
 
-Calls scripts/docker-start.sh (mode=docker) or scripts/native-start.sh (mode=native).
-Does not reimplement compose logic. Extra args after -- are forwarded (e.g. --detach).
+Git install: scripts/docker-start.sh or native-start.sh
+Images install (--from-images): scripts/docker-start-images.sh (pull, no build)
 
 Options:
-  --mode <docker|native>   Override config / RAGSUITE_MODE
-  --repo-root <path>       Monorepo root
-  --dry-run                Print the script path and exit 0
-  --detach, -d             Forwarded to docker-start.sh (also accepted without --)
+  --mode <docker|native>   Override (git install; images always docker)
+  --repo-root <path>       Install root
+  --dry-run                Print script path and exit 0
+  --detach, -d             Detached start
 `;
 }
 
@@ -29,14 +29,22 @@ async function run(ctx) {
     cwd: ctx.cwd,
     repoRootFlag: ctx.globals.repoRoot,
   });
-  const mode = resolveMode({
-    flagMode: ctx.globals.mode,
-    repoRoot,
-    env: ctx.env,
-  });
+  const images = isImagesInstall(repoRoot);
+  const mode = images
+    ? 'docker'
+    : resolveMode({
+        flagMode: ctx.globals.mode,
+        repoRoot,
+        env: ctx.env,
+      });
+
+  let scriptName;
+  if (images) {
+    scriptName = 'docker-start-images.sh';
+  } else {
+    scriptName = mode === 'native' ? 'native-start.sh' : 'docker-start.sh';
+  }
 
-  const scriptName = mode === 'native' ? 'native-start.sh' : 'docker-start.sh';
-  const rel = path.join('scripts', scriptName);
   const forward = normalizeStartArgs(ctx.commandArgs);
 
   if (!ctx.globals.dryRun) {
@@ -48,7 +56,7 @@ async function run(ctx) {
     }
   }
 
-  return runScript(repoRoot, rel, forward, {
+  return runScript(repoRoot, path.join('scripts', scriptName), forward, {
     dryRun: ctx.globals.dryRun,
     env: { ...ctx.env, RAGSUITE_MODE: mode },
   });

package/src/commands/stop.js

@@ -2,22 +2,23 @@
 
 const path = require('path');
 const { resolveMode } = require('../utils/config');
-const { resolveRepoRoot } = require('../utils/paths');
+const { resolveRepoRoot, isImagesInstall } = require('../utils/paths');
 const { runScript } = require('../utils/spawn');
 
 const name = 'stop';
-const summary = 'Stop stack via docker-stop.sh or native-stop.sh';
+const summary = 'Stop stack (git scripts or images pull-only)';
 
 function help() {
   return `Usage: ragsuite-test stop [options]
 
-Calls scripts/docker-stop.sh or scripts/native-stop.sh based on mode.
-Never wipes Docker volumes (same as docker-stop.sh).
+Git install: docker-stop.sh / native-stop.sh
+Images install: docker-stop-images.sh
+Never wipes Docker volumes.
 
 Options:
-  --mode <docker|native>   Override config / RAGSUITE_MODE
-  --repo-root <path>       Monorepo root
-  --dry-run                Print the script path and exit 0
+  --mode <docker|native>   Override (git install)
+  --repo-root <path>       Install root
+  --dry-run                Print script path and exit 0
 `;
 }
 
@@ -26,12 +27,21 @@ function run(ctx) {
     cwd: ctx.cwd,
     repoRootFlag: ctx.globals.repoRoot,
   });
-  const mode = resolveMode({
-    flagMode: ctx.globals.mode,
-    repoRoot,
-    env: ctx.env,
-  });
-  const scriptName = mode === 'native' ? 'native-stop.sh' : 'docker-stop.sh';
+  const images = isImagesInstall(repoRoot);
+  const mode = images
+    ? 'docker'
+    : resolveMode({
+        flagMode: ctx.globals.mode,
+        repoRoot,
+        env: ctx.env,
+      });
+
+  const scriptName = images
+    ? 'docker-stop-images.sh'
+    : mode === 'native'
+      ? 'native-stop.sh'
+      : 'docker-stop.sh';
+
   return runScript(repoRoot, path.join('scripts', scriptName), [], {
     dryRun: ctx.globals.dryRun,
     env: { ...ctx.env, RAGSUITE_MODE: mode },

package/src/index.js

@@ -31,8 +31,9 @@ function globalHelp() {
     'Global options:',
     '  --help, -h              Show help',
     '  --repo-root <path>      Monorepo / install root',
-    '  --from-git [url]        init: clone this URL (default: public nitsan-ai/RAGSUITE)',
-    '  --install-dir <path>    init: clone target (default ~/ragsuite-test)',
+    '  --from-git [url]        init: clone source (default public repo)',
+    '  --from-images           init: Docker images only (no app source on disk)',
+    '  --install-dir <path>    init: install target (default ~/ragsuite-test)',
     '  --llm-api-key <key>     init: optional override for CUSTOM_LLM_INTERNAL_API_KEY',
     '  --smtp-host <host>      init: optional SMTP override',
     '  --smtp-user <user>      init: optional SMTP override',

package/src/utils/args.js

@@ -11,6 +11,7 @@ function parseArgv(argv) {
     dryRun: false,
     mode: null,
     fromGit: null,
+    fromImages: false,
     fromRelease: null,
     installDir: null,
     force: false,
@@ -79,6 +80,11 @@ function parseArgv(argv) {
       continue;
     }
 
+    if (t === '--from-images') {
+      globals.fromImages = true;
+      continue;
+    }
+
     if (t === '--from-git' || t.startsWith('--from-git=')) {
       if (t === '--from-git') {
         const next = tokens[i + 1];

package/src/utils/config.js

@@ -21,6 +21,12 @@ function defaultConfig(repoRoot, mode = 'docker') {
   };
 }
 
+function normalizeSource(raw) {
+  const s = String(raw || '').trim();
+  if (s === 'images' || s === 'git' || s === 'zip' || s === 'checkout') return s;
+  return 'checkout';
+}
+
 function readConfig(repoRoot) {
   const file = configPath(repoRoot);
   if (!fs.existsSync(file)) {
@@ -31,11 +37,10 @@ function readConfig(repoRoot) {
     if (!raw || typeof raw !== 'object') {
       return null;
     }
-    const source = raw.source === 'zip' ? 'zip' : 'checkout';
     return {
       version: Number(raw.version) || CONFIG_VERSION,
       mode: raw.mode === 'native' ? 'native' : 'docker',
-      source,
+      source: normalizeSource(raw.source),
       repoRoot: path.resolve(String(raw.repoRoot || repoRoot)),
       installDir: path.resolve(String(raw.installDir || raw.repoRoot || repoRoot)),
     };
@@ -48,10 +53,11 @@ function writeConfig(repoRoot, partial = {}) {
   const dir = path.join(repoRoot, CONFIG_DIR);
   fs.mkdirSync(dir, { recursive: true });
   const existing = readConfig(repoRoot) || defaultConfig(repoRoot);
-  const source =
-    partial.source === 'zip' || partial.source === 'checkout'
+  const source = normalizeSource(
+    partial.source !== undefined && partial.source !== null
       ? partial.source
-      : existing.source || 'checkout';
+      : existing.source || 'checkout',
+  );
   const next = {
     ...existing,
     ...partial,

package/src/utils/distribution.js

@@ -3,19 +3,21 @@
 /**
  * Distribution modes for the testing CLI.
  *
- * - git-clone: default `ragsuite-test init` (public GitHub)
- * - local-checkout: --repo-root (advanced / CI)
+ * - git-clone: `ragsuite-test init` (source on disk)
+ * - images: `ragsuite-test init --from-images` (pull GHCR, no app source)
+ * - local-checkout: --repo-root
  */
 
 const MODE_LOCAL = 'local-checkout';
 const MODE_GIT = 'git-clone';
+const MODE_IMAGES = 'images';
 const MODE_REGISTRY = 'registry-compose';
 
 function assertSupportedInstall() {}
 
 function resolveComposeBundle() {
   const err = new Error(
-    'Registry/compose (GHCR) install is not available yet. Run: ragsuite-test init',
+    'Use: ragsuite-test init --from-images  (pull-only)  OR  ragsuite-test init  (git source)',
   );
   err.code = 'DIST_NOT_READY';
   throw err;
@@ -23,17 +25,17 @@ function resolveComposeBundle() {
 
 function installHint() {
   return [
-    'Simple deploy:',
-    '  npm install -g @nitsan-ai/ragsuite-test',
-    '  ragsuite-test init',
-    '  ragsuite-test start --repo-root ~/ragsuite-test --detach',
-    'Docker is optional — init picks native automatically if Docker is not running.',
+    'Choose an install style:',
+    '  Source on disk:  ragsuite-test init',
+    '  No source:       ragsuite-test init --from-images',
+    'Then:              ragsuite-test start --repo-root ~/ragsuite-test --detach',
   ].join('\n');
 }
 
 module.exports = {
   MODE_LOCAL,
   MODE_GIT,
+  MODE_IMAGES,
   MODE_REGISTRY,
   mode: MODE_GIT,
   assertSupportedInstall,

package/src/utils/images-install.js

@@ -0,0 +1,100 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { defaultInstallDir } = require('./git-install');
+
+function templatesRoot() {
+  return path.join(__dirname, '..', '..', 'templates', 'images');
+}
+
+function isDirEmptyOrMissing(dir) {
+  if (!fs.existsSync(dir)) return true;
+  const items = fs.readdirSync(dir).filter((n) => n !== '.DS_Store');
+  return items.length === 0;
+}
+
+function copyFile(src, dest) {
+  fs.mkdirSync(path.dirname(dest), { recursive: true });
+  fs.copyFileSync(src, dest);
+}
+
+/**
+ * Materialize a pull-only install dir (compose + scripts + .env.example).
+ * No monorepo source.
+ */
+function materializeImagesInstall(options = {}) {
+  const { installDir = defaultInstallDir(), force = false } = options;
+  const srcRoot = templatesRoot();
+  if (!fs.existsSync(path.join(srcRoot, 'docker-compose.yml'))) {
+    const err = new Error(
+      `Images templates missing in CLI package (${srcRoot}). Reinstall @nitsan-ai/ragsuite-test.`,
+    );
+    err.code = 'IMAGES_TEMPLATE_MISSING';
+    throw err;
+  }
+
+  const target = path.resolve(installDir);
+  if (!isDirEmptyOrMissing(target)) {
+    if (!force) {
+      const err = new Error(
+        `Install directory is not empty: ${target}. Pass --force to replace, or choose another --install-dir.`,
+      );
+      err.code = 'INSTALL_DIR_NONEMPTY';
+      throw err;
+    }
+    fs.rmSync(target, { recursive: true, force: true });
+  }
+
+  fs.mkdirSync(target, { recursive: true });
+  copyFile(
+    path.join(srcRoot, 'docker-compose.yml'),
+    path.join(target, 'docker-compose.yml'),
+  );
+  copyFile(
+    path.join(srcRoot, '.env.example'),
+    path.join(target, '.env.example'),
+  );
+  copyFile(
+    path.join(srcRoot, 'scripts', 'docker-start-images.sh'),
+    path.join(target, 'scripts', 'docker-start-images.sh'),
+  );
+  copyFile(
+    path.join(srcRoot, 'scripts', 'docker-stop-images.sh'),
+    path.join(target, 'scripts', 'docker-stop-images.sh'),
+  );
+  copyFile(
+    path.join(srcRoot, 'scripts', 'docker-doctor-images.sh'),
+    path.join(target, 'scripts', 'docker-doctor-images.sh'),
+  );
+  try {
+    fs.chmodSync(path.join(target, 'scripts', 'docker-start-images.sh'), 0o755);
+    fs.chmodSync(path.join(target, 'scripts', 'docker-stop-images.sh'), 0o755);
+    fs.chmodSync(path.join(target, 'scripts', 'docker-doctor-images.sh'), 0o755);
+  } catch {
+    /* windows */
+  }
+
+  // Minimal package.json so tooling can identify the install dir
+  fs.writeFileSync(
+    path.join(target, 'package.json'),
+    `${JSON.stringify(
+      {
+        name: 'ragsuite-images-install',
+        private: true,
+        description: 'RAGSuite pull-only images install (no source tree)',
+      },
+      null,
+      2,
+    )}\n`,
+    'utf8',
+  );
+
+  return { repoRoot: target };
+}
+
+module.exports = {
+  templatesRoot,
+  materializeImagesInstall,
+  defaultInstallDir,
+};

package/src/utils/paths.js

@@ -4,14 +4,35 @@ const fs = require('fs');
 const path = require('path');
 const { readConfig, CONFIG_DIR } = require('./config');
 
-function looksLikeRepoRoot(dir) {
+function looksLikeGitCheckout(dir) {
   const start = path.join(dir, 'scripts', 'docker-start.sh');
   const pkg = path.join(dir, 'package.json');
   return fs.existsSync(start) && fs.existsSync(pkg);
 }
 
+function looksLikeImagesInstall(dir) {
+  const compose = path.join(dir, 'docker-compose.yml');
+  const start = path.join(dir, 'scripts', 'docker-start-images.sh');
+  if (!fs.existsSync(compose) || !fs.existsSync(start)) return false;
+  const cfgPath = path.join(dir, CONFIG_DIR, 'config.json');
+  if (fs.existsSync(cfgPath)) {
+    try {
+      const cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf8'));
+      if (cfg.source === 'images') return true;
+    } catch {
+      /* fall through */
+    }
+  }
+  // Before config is written, or force-detect by scripts present without docker-start.sh
+  return !fs.existsSync(path.join(dir, 'scripts', 'docker-start.sh'));
+}
+
+function looksLikeRepoRoot(dir) {
+  return looksLikeGitCheckout(dir) || looksLikeImagesInstall(dir);
+}
+
 function looksLikeFullBundleRoot(dir) {
-  if (!looksLikeRepoRoot(dir)) return false;
+  if (!looksLikeGitCheckout(dir)) return false;
   const compose = path.join(dir, 'docker-compose.yml');
   return fs.existsSync(compose);
 }
@@ -42,10 +63,6 @@ function envRepoRoot(env = process.env) {
   return null;
 }
 
-/**
- * Resolve monorepo root:
- * --repo-root → RAGSUITE_REPO_ROOT / RAGSUITE_INSTALL_DIR → walk-up / config.
- */
 function resolveRepoRoot({
   cwd = process.cwd(),
   repoRootFlag,
@@ -56,7 +73,7 @@ function resolveRepoRoot({
     const root = path.resolve(repoRootFlag);
     if (!looksLikeRepoRoot(root)) {
       const err = new Error(
-        `Not a RAGSuite repo root (missing scripts/docker-start.sh): ${root}`,
+        `Not a RAGSuite install root: ${root} (need git checkout or images install)`,
       );
       err.code = 'NOT_REPO_ROOT';
       throw err;
@@ -91,7 +108,7 @@ function resolveRepoRoot({
   }
 
   const err = new Error(
-    'Could not find RAGSuite repo root. Pass --repo-root <path>, set RAGSUITE_REPO_ROOT, or run: ragsuite-test init --from-git',
+    'Could not find RAGSuite install. Run: ragsuite-test init   OR   ragsuite-test init --from-images',
   );
   err.code = 'NOT_REPO_ROOT';
   throw err;
@@ -107,13 +124,20 @@ function ensureRagsuiteDir(repoRoot) {
   return dir;
 }
 
-/** Native PID/logs stay under .ragsuite/native (Phase 4 scripts). */
 function nativeLogDir(repoRoot) {
   return path.join(repoRoot, '.ragsuite', 'native');
 }
 
+function isImagesInstall(repoRoot) {
+  const cfg = readConfig(repoRoot);
+  if (cfg && cfg.source === 'images') return true;
+  return looksLikeImagesInstall(repoRoot) && !looksLikeGitCheckout(repoRoot);
+}
+
 module.exports = {
   looksLikeRepoRoot,
+  looksLikeGitCheckout,
+  looksLikeImagesInstall,
   looksLikeFullBundleRoot,
   walkUpForRepoRoot,
   envRepoRoot,
@@ -121,4 +145,5 @@ module.exports = {
   scriptPath,
   ensureRagsuiteDir,
   nativeLogDir,
+  isImagesInstall,
 };

package/templates/images/.env.example

@@ -0,0 +1,76 @@
+# RAGSuite Server — copy to .env:  cp .env.example .env
+# Never commit .env.
+#
+# Used by docker compose (backend + worker env_file) and native-start (host process).
+# Compose injects DATABASE_URL, REDIS_HOST/PORT, CHROMA_* for containers — those override
+# anything duplicated here when using Docker mode.
+# For native mode (npm run start:native), set the Native block below (or rely on script defaults).
+
+# --- Required secrets ---
+# JWT is regenerated by `ragsuite-test init` (do not put real secrets here — use .env).
+JWT_SECRET_KEY=change-me-use-a-long-random-secret-in-production
+# First-run default (not a cloud vendor key). Override in .env anytime.
+CUSTOM_LLM_INTERNAL_API_KEY=ragsuite-default-llm-internal-key
+
+# --- Transactional email (invites, 2FA, password reset) ---
+# Template only — real SMTP_USER / SMTP_PASSWORD / EMAIL_FROM belong in .env (gitignored).
+# `ragsuite-test init` copies this file to .env and does NOT ask for SMTP.
+SMTP_HOST=smtp.gmail.com
+SMTP_PORT=587
+SMTP_USER=your-smtp-user@example.com
+SMTP_PASSWORD=change-me-app-password-or-smtp-secret
+SMTP_USE_TLS=true
+EMAIL_FROM=your-smtp-user@example.com
+
+# --- Frontend Docker build (baked into env.json at image build) ---
+FRONTEND_API_URL=http://localhost:9090
+# Optional: public origin that serves /widget assets (defaults to FRONTEND_API_URL in Dockerfile)
+# WIDGET_ASSET_BASE=
+
+# --- App policy ---
+HF_HUB_OFFLINE=1
+SSO_ENABLED=false
+SSO_REQUIRE_REDIS=true
+
+# --- RAG / ingest (optional) ---
+ENABLE_ASYNC_DOCUMENT_INGEST=true
+EMBEDDING_PREFERRED_SOURCE=chat
+COMPARE_MODEL_CONFIG_SOURCE=chat
+
+# --- Optional: Docker host-port overrides (defaults match npm start) ---
+# API_PORT=9090
+# WEB_PORT=9091
+# POSTGRES_HOST_PORT=5436
+# REDIS_HOST_PORT=6382
+
+# --- Optional: Compose Postgres credentials (defaults: ragsuite / ragsuite / ragsuite_v3) ---
+# POSTGRES_USER=ragsuite
+# POSTGRES_PASSWORD=ragsuite
+# POSTGRES_DB=ragsuite_v3
+
+# --- Optional: App URL / CORS (compose sets local defaults for Docker) ---
+# CORS_ORIGINS=http://localhost:9091
+# FRONTEND_BASE_URL=http://localhost:9091
+# PUBLIC_API_BASE_URL=http://localhost:9090/api/v1
+# SSO_CALLBACK_BASE_URL=http://localhost:9090/api/v1/auth/sso/callback
+
+# --- Native mode (npm run start:native) — host Postgres/Redis/Chroma ---
+# Do not use Docker service DNS names (postgres/redis/chromadb) on the host.
+# DATABASE_URL=postgresql://ragsuite:ragsuite@localhost:5436/ragsuite_v3
+# REDIS_HOST=localhost
+# REDIS_PORT=6382
+# CHROMA_MODE=http
+# CHROMA_HOST=127.0.0.1
+# CHROMA_PORT=8004
+# CHROMA_PERSIST_PATH=data/chroma_db
+# CORS_ORIGINS=http://localhost:9191,http://127.0.0.1:9191,http://localhost:9091
+# FRONTEND_BASE_URL=http://localhost:9191
+# PUBLIC_API_BASE_URL=http://localhost:9090/api/v1
+# EXPO_DEV_SERVER_PORT=9191
+# RAGSUITE_MODE=native
+
+# Advanced tuning: backend/docs/backend/configuration.md
+
+# --- Images install (init --from-images) ---
+# IMAGE_REGISTRY=ghcr.io/nitsan-ai
+# IMAGE_TAG=latest

package/templates/images/docker-compose.yml

@@ -0,0 +1,165 @@
+# Pull-only stack (no monorepo source / no local build).
+# Used by: ragsuite-test init --from-images
+# Images: ghcr.io/nitsan-ai/ragsuite-backend and ragsuite-frontend
+#
+# Override tag: IMAGE_TAG=1.0.0 (default: latest)
+# Registry:     IMAGE_REGISTRY=ghcr.io/nitsan-ai (default)
+
+name: ragsuite-server
+
+networks:
+  ragsuite-server-net:
+    name: ragsuite-server-net
+
+x-backend-image: &backend_image
+  image: ${IMAGE_REGISTRY:-ghcr.io/nitsan-ai}/ragsuite-backend:${IMAGE_TAG:-latest}
+  pull_policy: ${PULL_POLICY:-always}
+
+services:
+  postgres:
+    image: postgres:15-alpine
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-ragsuite}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-ragsuite}
+      POSTGRES_DB: ${POSTGRES_DB:-ragsuite_v3}
+    ports:
+      - "${POSTGRES_HOST_PORT:-5436}:5432"
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    networks:
+      - ragsuite-server-net
+    restart: unless-stopped
+
+  redis:
+    image: redis:7-alpine
+    ports:
+      - "${REDIS_HOST_PORT:-6382}:6379"
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+    networks:
+      - ragsuite-server-net
+    restart: unless-stopped
+
+  chromadb:
+    <<: *backend_image
+    entrypoint: []
+    command:
+      - chroma
+      - run
+      - --host
+      - "0.0.0.0"
+      - --port
+      - "8000"
+      - --path
+      - /data/chroma
+    volumes:
+      - chroma_data:/data/chroma
+    healthcheck:
+      test: ["CMD", "curl", "-sf", "http://localhost:8000/api/v2/heartbeat"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
+    networks:
+      - ragsuite-server-net
+    restart: unless-stopped
+
+  backend:
+    <<: *backend_image
+    env_file:
+      - .env
+    environment:
+      DEBUG: "True"
+      CORS_ORIGINS: "http://localhost:${WEB_PORT:-9091}"
+      ENABLE_SCHEDULER: "true"
+      ENABLE_DURABLE_JOBS: "true"
+      DATABASE_URL: postgresql://${POSTGRES_USER:-ragsuite}:${POSTGRES_PASSWORD:-ragsuite}@postgres:5432/${POSTGRES_DB:-ragsuite_v3}
+      REDIS_HOST: redis
+      REDIS_PORT: "6379"
+      CHROMA_MODE: http
+      CHROMA_HOST: chromadb
+      CHROMA_PORT: "8000"
+      CHROMA_PERSIST_PATH: /data/chroma
+      DOCUMENT_STAGING_DIR: /data/staging
+      RUN_INLINE_WORKER: "false"
+      WEB_CONCURRENCY: "2"
+      FRONTEND_BASE_URL: http://localhost:${WEB_PORT:-9091}
+      PUBLIC_API_BASE_URL: http://localhost:${API_PORT:-9090}/api/v1
+      SSO_CALLBACK_BASE_URL: http://localhost:${API_PORT:-9090}/api/v1/auth/sso/callback
+    ports:
+      - "${API_PORT:-9090}:8000"
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+      chromadb:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "curl", "-sf", "http://localhost:8000/api/v1/health/ready"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 120s
+    volumes:
+      - staging_data:/data/staging
+    networks:
+      - ragsuite-server-net
+    restart: unless-stopped
+
+  worker:
+    <<: *backend_image
+    entrypoint: []
+    command: ["python", "-m", "app.worker"]
+    env_file:
+      - .env
+    environment:
+      DEBUG: "False"
+      CORS_ORIGINS: "http://localhost:${WEB_PORT:-9091}"
+      ENABLE_SCHEDULER: "true"
+      ENABLE_DURABLE_JOBS: "true"
+      DATABASE_URL: postgresql://${POSTGRES_USER:-ragsuite}:${POSTGRES_PASSWORD:-ragsuite}@postgres:5432/${POSTGRES_DB:-ragsuite_v3}
+      REDIS_HOST: redis
+      REDIS_PORT: "6379"
+      CHROMA_MODE: http
+      CHROMA_HOST: chromadb
+      CHROMA_PORT: "8000"
+      CHROMA_PERSIST_PATH: /data/chroma
+      DOCUMENT_STAGING_DIR: /data/staging
+      RUN_INLINE_WORKER: "false"
+    depends_on:
+      backend:
+        condition: service_healthy
+    volumes:
+      - staging_data:/data/staging
+    networks:
+      - ragsuite-server-net
+    restart: unless-stopped
+
+  frontend:
+    image: ${IMAGE_REGISTRY:-ghcr.io/nitsan-ai}/ragsuite-frontend:${IMAGE_TAG:-latest}
+    pull_policy: ${PULL_POLICY:-always}
+    ports:
+      - "${WEB_PORT:-9091}:80"
+    healthcheck:
+      test: ["CMD", "wget", "-q", "--spider", "http://localhost/healthz"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    networks:
+      - ragsuite-server-net
+    restart: unless-stopped
+
+volumes:
+  postgres_data:
+  chroma_data:
+  staging_data:

package/templates/images/scripts/docker-doctor-images.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# Lightweight doctor for images-only installs.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$ROOT"
+
+ok=0
+fail=0
+
+check() {
+  local label="$1"
+  shift
+  if "$@"; then
+    echo "  ✓ $label"
+    ok=$((ok + 1))
+  else
+    echo "  ✗ $label"
+    fail=$((fail + 1))
+  fi
+}
+
+echo "Doctor (images install):"
+check "docker CLI" command -v docker >/dev/null
+check "docker daemon" docker info >/dev/null 2>&1
+check "docker compose" docker compose version >/dev/null 2>&1
+check ".env present" test -f .env
+check "compose file" test -f docker-compose.yml
+
+API_PORT="${API_PORT:-9090}"
+if curl -sf "http://127.0.0.1:${API_PORT}/api/v1/health/ping" >/dev/null 2>&1 \
+  || curl -sf "http://127.0.0.1:${API_PORT}/api/v1/crawl/auth/public-config" >/dev/null 2>&1; then
+  echo "  ✓ API reachable :${API_PORT}"
+  ok=$((ok + 1))
+else
+  echo "  ○ API not up yet on :${API_PORT} (start the stack if needed)"
+fi
+
+echo "Summary: ${ok} ok, ${fail} failed"
+if [[ "$fail" -gt 0 ]]; then
+  echo "How to fix:"
+  echo "  → Install Docker Desktop: https://www.docker.com/products/docker-desktop/"
+  echo "  → Publish images: GitHub Actions → Publish images (GHCR)"
+  echo "  → Start: ragsuite-test start --repo-root $ROOT --detach"
+  exit 1
+fi
+exit 0

package/templates/images/scripts/docker-start-images.sh

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+# Start pull-only images stack (no source build).
+# Exit: 0 ok, 1 prereq, 2 env, 3 compose, 4 health
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$ROOT"
+
+DETACH=1
+for arg in "$@"; do
+  case "$arg" in
+    -d|--detach) DETACH=1 ;;
+    -h|--help)
+      echo "Usage: $0 [--detach|-d]"
+      echo "  docker compose up -d (pull images, no --build)"
+      exit 0
+      ;;
+  esac
+done
+
+if ! command -v docker >/dev/null 2>&1; then
+  echo "error: docker is required for images install" >&2
+  exit 1
+fi
+if ! docker info >/dev/null 2>&1; then
+  echo "error: Docker daemon is not running" >&2
+  exit 1
+fi
+if ! docker compose version >/dev/null 2>&1; then
+  echo "error: docker compose plugin is required" >&2
+  exit 1
+fi
+
+if [[ ! -f .env ]]; then
+  if [[ -f .env.example ]]; then
+    cp .env.example .env
+    echo "warn: created .env from .env.example — edit secrets for production"
+  else
+    echo "error: missing .env" >&2
+    exit 2
+  fi
+fi
+
+# shellcheck disable=SC1091
+set -a
+# shellcheck source=/dev/null
+source .env
+set +a
+
+if [[ -z "${JWT_SECRET_KEY:-}" || "${JWT_SECRET_KEY}" == change-me* ]]; then
+  echo "error: JWT_SECRET_KEY must be set (non placeholder) in .env" >&2
+  exit 2
+fi
+if [[ -z "${CUSTOM_LLM_INTERNAL_API_KEY:-}" || "${CUSTOM_LLM_INTERNAL_API_KEY}" == change-me* ]]; then
+  echo "error: CUSTOM_LLM_INTERNAL_API_KEY must be set (non placeholder) in .env" >&2
+  exit 2
+fi
+
+export IMAGE_REGISTRY="${IMAGE_REGISTRY:-ghcr.io/nitsan-ai}"
+export IMAGE_TAG="${IMAGE_TAG:-latest}"
+export PULL_POLICY="${PULL_POLICY:-always}"
+
+COMPOSE_FILE="${COMPOSE_FILE:-docker-compose.yml}"
+if [[ ! -f "$COMPOSE_FILE" ]]; then
+  echo "error: missing $COMPOSE_FILE (images install)" >&2
+  exit 1
+fi
+
+echo "==> Pulling / starting images (no build) registry=${IMAGE_REGISTRY} tag=${IMAGE_TAG}"
+set +e
+docker compose -f "$COMPOSE_FILE" pull
+docker compose -f "$COMPOSE_FILE" up -d --pull always
+rc=$?
+set -e
+if [[ "$rc" -ne 0 ]]; then
+  echo "error: docker compose failed (exit $rc). Are GHCR images published and public/readable?" >&2
+  echo "  Expected: ${IMAGE_REGISTRY}/ragsuite-backend:${IMAGE_TAG}" >&2
+  echo "  Expected: ${IMAGE_REGISTRY}/ragsuite-frontend:${IMAGE_TAG}" >&2
+  exit 3
+fi
+
+API_PORT="${API_PORT:-9090}"
+echo "==> Waiting for API :${API_PORT}"
+ok=0
+for _ in $(seq 1 60); do
+  if curl -sf "http://127.0.0.1:${API_PORT}/api/v1/crawl/auth/public-config" >/dev/null 2>&1 \
+    || curl -sf "http://127.0.0.1:${API_PORT}/api/v1/health/ping" >/dev/null 2>&1; then
+    ok=1
+    break
+  fi
+  sleep 2
+done
+if [[ "$ok" -ne 1 ]]; then
+  echo "error: API health timed out" >&2
+  docker compose -f "$COMPOSE_FILE" ps -a || true
+  docker compose -f "$COMPOSE_FILE" logs backend --tail 80 || true
+  exit 4
+fi
+
+echo ""
+echo "Stack URLs:"
+echo "  API      http://localhost:${API_PORT}"
+echo "  Web UI   http://localhost:${WEB_PORT:-9091}"
+echo ""
+echo "Images stack is up (no source tree required)."
+exit 0

package/templates/images/scripts/docker-stop-images.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Stop pull-only images stack (volumes preserved).
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$ROOT"
+
+if ! command -v docker >/dev/null 2>&1; then
+  echo "error: docker required" >&2
+  exit 1
+fi
+if ! docker info >/dev/null 2>&1; then
+  echo "error: Docker daemon is not running" >&2
+  exit 1
+fi
+
+COMPOSE_FILE="${COMPOSE_FILE:-docker-compose.yml}"
+echo "==> Stopping images stack (volumes preserved)…"
+docker compose -f "$COMPOSE_FILE" down
+echo "Containers stopped. Volumes kept."
+exit 0