@openpalm/lib 0.11.0-beta.6 → 0.11.0-beta.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openpalm/lib",
-  "version": "0.11.0-beta.6",
+  "version": "0.11.0-beta.8",
   "license": "MPL-2.0",
   "type": "module",
   "description": "Shared control-plane library for OpenPalm — lifecycle, staging, secrets, channels, connections, scheduler",
@@ -10,6 +10,7 @@
   "scripts": {
     "test": "bun test"
   },
+  "types": "./src/index.ts",
   "exports": {
     ".": "./src/index.ts",
     "./provider-constants": "./src/provider-constants.ts",

package/src/control-plane/config-persistence.ts

@@ -87,7 +87,8 @@ export function writeSystemEnv(state: ControlPlaneState): void {
     sectionHeader: "# ── Admin-managed ──────────────────────────────────────────────────"
   });
 
-  writeFileSync(systemEnvPath, content);
+  writeFileSync(systemEnvPath, content, { mode: 0o600 });
+  chmodSync(systemEnvPath, 0o600);
 }
 
 function generateFallbackSystemEnv(state: ControlPlaneState): string {

package/src/control-plane/core-assets.ts

@@ -95,11 +95,16 @@ function resolveAssetVersion(): string {
 }
 const VERSION = resolveAssetVersion();
 
-// Persona files (openpalm.md, system.md) and stash seeds are intentionally NOT
-// in this list — they are user-customizable and use seedAssistantPersonaFiles()
-// / seedStashAssets() which never overwrite existing files (user edits win).
+// Persona files (openpalm.md, system.md), stash seeds, and user-editable config
+// files are intentionally NOT in this list. They are seeded once (never
+// overwritten) via seedOpenPalmDir (skipExisting) or SEEDED_ASSETS below.
 const MANAGED_ASSETS: { relPath: string; githubFilename: string }[] = [
-  { relPath: "config/stack/core.compose.yml",   githubFilename: ".openpalm/config/stack/core.compose.yml" },
+  { relPath: "config/stack/core.compose.yml", githubFilename: ".openpalm/config/stack/core.compose.yml" },
+];
+
+// Seeded once — written only when the file does not exist yet.
+// User edits always win; upgrade never touches these files.
+const SEEDED_ASSETS: { relPath: string; githubFilename: string }[] = [
   { relPath: "config/assistant/opencode.jsonc", githubFilename: ".openpalm/config/assistant/opencode.jsonc" },
 ];
 
@@ -149,6 +154,16 @@ export async function refreshCoreAssets(): Promise<{
     updated.push(asset.relPath);
   }
 
+  // Seed user-editable assets only when missing — never overwrite.
+  for (const asset of SEEDED_ASSETS) {
+    const targetPath = join(homeDir, asset.relPath);
+    if (existsSync(targetPath)) continue;
+    const freshContent = await downloadAsset(asset.githubFilename);
+    mkdirSync(dirname(targetPath), { recursive: true });
+    writeFileSync(targetPath, freshContent);
+    updated.push(asset.relPath);
+  }
+
   return { backupDir, updated };
 }
 

package/src/control-plane/env.ts

@@ -1,5 +1,5 @@
 import { parse as dotenvParse } from 'dotenv';
-import { readFileSync, existsSync } from 'node:fs';
+import { readFileSync, existsSync, copyFileSync } from 'node:fs';
 
 export function parseEnvContent(content: string): Record<string, string> {
   return dotenvParse(content);
@@ -10,6 +10,9 @@ export function parseEnvFile(filePath: string): Record<string, string> {
   try {
     return dotenvParse(readFileSync(filePath, 'utf-8'));
   } catch {
+    // File is unreadable or malformed — back it up before returning empty so
+    // the next write doesn't silently discard all existing values.
+    try { copyFileSync(filePath, `${filePath}.corrupt-${Date.now()}`); } catch { /* best-effort */ }
     return {};
   }
 }

package/src/control-plane/lifecycle.ts

@@ -300,6 +300,24 @@ export async function performUpgrade(state: ControlPlaneState): Promise<UpgradeR
   };
 }
 
+/**
+ * Set a specific image tag in stack.env then pull images and restart containers.
+ * Used by the admin "set version" action — skips the auto-detect step in performUpgrade.
+ */
+export async function applyTagChange(state: ControlPlaneState, tag: string): Promise<UpgradeResult> {
+  const stackEnvPath = `${state.stackDir}/stack.env`;
+  const currentContent = existsSync(stackEnvPath) ? readFileSync(stackEnvPath, "utf-8") : "";
+  writeFileSync(stackEnvPath, mergeEnvContent(currentContent, { OP_IMAGE_TAG: tag }, { uncomment: true }));
+  const upgradeResult = await applyUpgrade(state);
+  return {
+    imageTag: tag,
+    namespace: "openpalm",
+    backupDir: upgradeResult.backupDir,
+    assetsUpdated: upgradeResult.updated,
+    restarted: upgradeResult.restarted,
+  };
+}
+
 export function buildComposeFileList(state: ControlPlaneState): string[] {
   return discoverStackOverlays(state.stackDir);
 }

package/src/control-plane/ui-assets.ts

@@ -241,11 +241,17 @@ function parseChecksumsFile(content: string): Map<string, string> {
   return map;
 }
 
-export async function seedUiBuild(repoRef: string, stateDir: string): Promise<void> {
+export function readCurrentUiBuildVersion(stateDir: string): string | null {
+  const versionFile = join(stateDir, 'ui', 'version.txt');
+  if (!existsSync(versionFile)) return null;
+  return readFileSync(versionFile, 'utf-8').trim() || null;
+}
+
+export async function seedUiBuild(repoRef: string, stateDir: string, options?: { forceRemote?: boolean }): Promise<void> {
   const uiDir = join(stateDir, 'ui');
   mkdirSync(uiDir, { recursive: true });
 
-  const local = resolveLocalUiBuild();
+  const local = options?.forceRemote ? null : resolveLocalUiBuild();
   if (local) {
     logger.debug('seeding UI build from local source', { src: local });
     copyTree(local, uiDir);
@@ -284,6 +290,9 @@ export async function seedUiBuild(repoRef: string, stateDir: string): Promise<vo
 
     writeFileSync(tmpTar, tarData);
 
+    // Clear stale files before extracting so old build files don't persist
+    rmSync(uiDir, { recursive: true, force: true });
+    mkdirSync(uiDir, { recursive: true });
     // Cross-platform extraction via the `tar` npm package — no shell dependency
     await tarExtract({ file: tmpTar, cwd: uiDir, strip: 1 });
     writeFileSync(join(uiDir, 'version.txt'), repoRef.replace(/^v/, ''));

package/src/index.ts

@@ -181,6 +181,7 @@ export {
   applyUninstall,
   applyUpgrade,
   performUpgrade,
+  applyTagChange,
   updateStackEnvToLatestImageTag,
   buildComposeFileList,
   buildManagedServices,
@@ -308,4 +309,5 @@ export {
   resolveUiBuildDir,
   seedUiBuild,
   checkAndUpdateUiBuild,
+  readCurrentUiBuildVersion,
 } from "./control-plane/ui-assets.js";