@openpalm/lib 0.11.2-rc.4 → 0.11.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openpalm/lib",
-  "version": "0.11.2-rc.4",
+  "version": "0.11.2",
   "license": "MPL-2.0",
   "type": "module",
   "description": "Shared control-plane library for OpenPalm — lifecycle, staging, secrets, channels, connections, scheduler",

package/src/control-plane/config-persistence.ts

@@ -25,7 +25,7 @@ import {
 export { sha256, randomHex } from "./crypto.js";
 import { sha256, randomHex } from "./crypto.js";
 
-const DEFAULT_IMAGE_TAG = "latest";
+export const DEFAULT_IMAGE_TAG = "latest";
 
 const logger = createLogger("config-persistence");
 

package/src/control-plane/setup.test.ts

@@ -387,6 +387,41 @@ describe("performSetup", () => {
     expect(result.error).toBeDefined();
   });
 
+  // ── OP_IMAGE_TAG reconcile (A1: stop preserving a stale pinned tag) ──────
+  const stackEnvPath = () => join(homeDir, "knowledge", "env", "stack.env");
+
+  it("blank imageTag RESETS a stale pinned OP_IMAGE_TAG to the platform default (latest)", async () => {
+    // Simulate an old OP_HOME whose stack.env pinned a now-stale version tag.
+    writeFileSync(
+      stackEnvPath(),
+      ["OP_SETUP_COMPLETE=false", "OP_IMAGE_TAG=v0.11.1", ""].join("\n"),
+    );
+    const result = await performSetup(makeValidSpec()); // no imageTag => blank
+    expect(result.ok).toBe(true);
+    const env = readFileSync(stackEnvPath(), "utf-8");
+    expect(env).toMatch(/^OP_IMAGE_TAG=latest$/m);
+    expect(env).not.toMatch(/OP_IMAGE_TAG=v0\.11\.1/);
+  });
+
+  it("a non-empty imageTag pins deliberately (kept verbatim)", async () => {
+    const result = await performSetup(makeValidSpec({ imageTag: "v0.11.1" }));
+    expect(result.ok).toBe(true);
+    expect(readFileSync(stackEnvPath(), "utf-8")).toMatch(/^OP_IMAGE_TAG=v0\.11\.1$/m);
+  });
+
+  it("imageTag is trimmed before writing", async () => {
+    const result = await performSetup(makeValidSpec({ imageTag: "  dev  " }));
+    expect(result.ok).toBe(true);
+    expect(readFileSync(stackEnvPath(), "utf-8")).toMatch(/^OP_IMAGE_TAG=dev$/m);
+  });
+
+  it("fresh install with blank imageTag writes OP_IMAGE_TAG=latest", async () => {
+    // beforeEach's stub stack.env has no OP_IMAGE_TAG.
+    const result = await performSetup(makeValidSpec());
+    expect(result.ok).toBe(true);
+    expect(readFileSync(stackEnvPath(), "utf-8")).toMatch(/^OP_IMAGE_TAG=latest$/m);
+  });
+
   it("writes the UI login password to knowledge/secrets", async () => {
     const result = await performSetup(makeValidSpec());
     expect(result.ok).toBe(true);

package/src/control-plane/setup.ts

@@ -14,6 +14,7 @@ import {
   PROVIDER_KEY_MAP,
 } from "../provider-constants.js";
 import { mergeEnvContent } from "./env.js";
+import { DEFAULT_IMAGE_TAG } from "./config-persistence.js";
 import { ensureHomeDirs } from "./home.js";
 import { acquireInstallLock, releaseInstallLock, type InstallLockHandle } from "./install-lock.js";
 import {
@@ -226,7 +227,14 @@ export async function performSetup(
         ? readFileSync(`${state.stashDir}/env/stack.env`, "utf-8")
         : "";
       const akmUpdates: Record<string, string> = {};
-      if (imageTag) akmUpdates.OP_IMAGE_TAG = imageTag;
+      // Reconcile OP_IMAGE_TAG on EVERY setup run. A non-empty wizard value pins
+      // a tag deliberately; a BLANK field means "track the platform default", so
+      // write `latest` rather than silently preserving a stale pin left in an
+      // existing stack.env. Without this, re-running setup over an OP_HOME whose
+      // OP_IMAGE_TAG was pinned to an old version (e.g. v0.11.1) kept deploying a
+      // months-old image — the akm-0.3.1 surprise. The Advanced image-tag field
+      // still lets a power user pin deliberately by entering a value.
+      akmUpdates.OP_IMAGE_TAG = imageTag && imageTag.trim() ? imageTag.trim() : DEFAULT_IMAGE_TAG;
       // NOTE: host-akm sharing no longer repoints the container's primary stash
       // (the old OP_AKM_STASH/OP_AKM_CONFIG split-brain). The personal ~/akm is
       // wired as a read-write SECONDARY source — see configureHostAkmSharing()