@pleri/olam-cli 0.1.12 → 0.1.13

package/dist/__tests__/image-presence.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=image-presence.test.d.ts.map

package/dist/__tests__/image-presence.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-presence.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/image-presence.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/image-presence.test.js

@@ -0,0 +1,44 @@
+// C5 (Phase C — fresh-install self-bootstrap): image-presence pre-flight
+// helper. Decision #6 (revised pass 3) — `olam bootstrap` is the SOLE
+// on-ramp; commands that need an image fail-fast with a named remedy
+// instead of auto-pulling.
+import { describe, it, expect } from 'vitest';
+import { checkImagePresent } from '../image-presence.js';
+describe('checkImagePresent', () => {
+    it('returns present:true when docker image inspect exits 0', () => {
+        const inspect = () => ({ exitCode: 0 });
+        const result = checkImagePresent({ imageRef: 'ghcr.io/pleri/olam-devbox:0.2.0', callerCommand: 'olam create' }, inspect);
+        expect(result.present).toBe(true);
+        expect(result.stderrLine).toBe('');
+    });
+    it('returns present:false with named remedy when inspect exits non-zero', () => {
+        const inspect = () => ({ exitCode: 1 });
+        const result = checkImagePresent({ imageRef: 'ghcr.io/pleri/olam-devbox:0.2.0', callerCommand: 'olam create' }, inspect);
+        expect(result.present).toBe(false);
+        expect(result.stderrLine).toContain("'ghcr.io/pleri/olam-devbox:0.2.0' not found locally");
+        expect(result.stderrLine).toContain('olam create does not auto-pull');
+        expect(result.stderrLine).toContain('Remedy: run `olam bootstrap`');
+    });
+    it('names the caller command in the remedy (so operators know which command failed)', () => {
+        const inspect = () => ({ exitCode: 1 });
+        const create = checkImagePresent({ imageRef: 'ghcr.io/pleri/olam-devbox:0.2.0', callerCommand: 'olam create' }, inspect);
+        const hostCp = checkImagePresent({ imageRef: 'ghcr.io/pleri/olam-host-cp:0.2.0', callerCommand: 'olam host-cp start' }, inspect);
+        const authUp = checkImagePresent({ imageRef: 'ghcr.io/pleri/olam-auth:0.2.0', callerCommand: 'olam auth up' }, inspect);
+        expect(create.stderrLine).toContain('olam create');
+        expect(hostCp.stderrLine).toContain('olam host-cp start');
+        expect(authUp.stderrLine).toContain('olam auth up');
+    });
+    it('mentions Decision #6 lineage in the remedy (audit trail for support questions)', () => {
+        const inspect = () => ({ exitCode: 1 });
+        const result = checkImagePresent({ imageRef: 'foo:bar', callerCommand: 'olam x' }, inspect);
+        expect(result.stderrLine).toContain('Decision #6');
+        expect(result.stderrLine).toContain('olam-fresh-install-self-bootstrap');
+    });
+    it('handles inspect timeout / docker daemon down (negative exitCode)', () => {
+        const inspect = () => ({ exitCode: -1 });
+        const result = checkImagePresent({ imageRef: 'foo:bar', callerCommand: 'olam x' }, inspect);
+        expect(result.present).toBe(false);
+        expect(result.stderrLine).toContain('not found locally');
+    });
+});
+//# sourceMappingURL=image-presence.test.js.map

package/dist/__tests__/image-presence.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-presence.test.js","sourceRoot":"","sources":["../../src/__tests__/image-presence.test.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,sEAAsE;AACtE,qEAAqE;AACrE,2BAA2B;AAE3B,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAA6B,MAAM,sBAAsB,CAAC;AAEpF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,OAAO,GAAyB,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,iBAAiB,CAC9B,EAAE,QAAQ,EAAE,iCAAiC,EAAE,aAAa,EAAE,aAAa,EAAE,EAC7E,OAAO,CACR,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,OAAO,GAAyB,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,iBAAiB,CAC9B,EAAE,QAAQ,EAAE,iCAAiC,EAAE,aAAa,EAAE,aAAa,EAAE,EAC7E,OAAO,CACR,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,qDAAqD,CAAC,CAAC;QAC3F,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;QACtE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QACzF,MAAM,OAAO,GAAyB,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,iBAAiB,CAC9B,EAAE,QAAQ,EAAE,iCAAiC,EAAE,aAAa,EAAE,aAAa,EAAE,EAC7E,OAAO,CACR,CAAC;QACF,MAAM,MAAM,GAAG,iBAAiB,CAC9B,EAAE,QAAQ,EAAE,kCAAkC,EAAE,aAAa,EAAE,oBAAoB,EAAE,EACrF,OAAO,CACR,CAAC;QACF,MAAM,MAAM,GAAG,iBAAiB,CAC9B,EAAE,QAAQ,EAAE,+BAA+B,EAAE,aAAa,EAAE,cAAc,EAAE,EAC5E,OAAO,CACR,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,MAAM,OAAO,GAAyB,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,iBAAiB,CAC9B,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,EAChD,OAAO,CACR,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,OAAO,GAAyB,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,iBAAiB,CAC9B,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,EAChD,OAAO,CACR,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/protocol-version.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=protocol-version.test.d.ts.map

package/dist/__tests__/protocol-version.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-version.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/protocol-version.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/protocol-version.test.js

@@ -0,0 +1,170 @@
+// C2 (Phase C — fresh-install self-bootstrap): protocol-version
+// handshake helper. Closes T13 (cross-namespace protocol skew between
+// CLI and overridden devbox image) by giving the CLI a clean way to
+// inspect a pulled image's `olam.protocol.versions` LABEL and refuse
+// when no overlap exists.
+import { describe, it, expect } from 'vitest';
+import { OLAM_PROTOCOL_VERSIONS_SUPPORTED, parseProtocolVersionsLabel, checkProtocolOverlap, inspectImageProtocolVersions, } from '../protocol-version.js';
+describe('parseProtocolVersionsLabel', () => {
+    it('returns empty array for undefined / null / empty string', () => {
+        expect(parseProtocolVersionsLabel(undefined)).toEqual([]);
+        expect(parseProtocolVersionsLabel(null)).toEqual([]);
+        expect(parseProtocolVersionsLabel('')).toEqual([]);
+    });
+    it('parses a single version', () => {
+        expect(parseProtocolVersionsLabel('1')).toEqual([1]);
+    });
+    it('parses comma-separated list', () => {
+        expect(parseProtocolVersionsLabel('1,2,3')).toEqual([1, 2, 3]);
+    });
+    it('tolerates whitespace around entries', () => {
+        expect(parseProtocolVersionsLabel('1, 2 ,  3')).toEqual([1, 2, 3]);
+    });
+    it('deduplicates', () => {
+        expect(parseProtocolVersionsLabel('1,2,1,3,2')).toEqual([1, 2, 3]);
+    });
+    it('sorts ascending', () => {
+        expect(parseProtocolVersionsLabel('3,1,2')).toEqual([1, 2, 3]);
+    });
+    it('skips malformed entries silently', () => {
+        expect(parseProtocolVersionsLabel('1,abc,2,1.5,3')).toEqual([1, 2, 3]);
+    });
+    it('rejects zero and negatives', () => {
+        expect(parseProtocolVersionsLabel('0,-1,2')).toEqual([2]);
+    });
+});
+describe('checkProtocolOverlap', () => {
+    it('returns compatible when image and CLI share at least one version', () => {
+        const result = checkProtocolOverlap([1, 2], [1]);
+        expect(result.compatible).toBe(true);
+        expect(result.overlap).toEqual([1]);
+        expect(result.remedy).toBe('');
+    });
+    it('returns incompatible with empty image versions and surfaces "missing LABEL" remedy', () => {
+        const result = checkProtocolOverlap([], [1]);
+        expect(result.compatible).toBe(false);
+        expect(result.overlap).toEqual([]);
+        expect(result.remedy).toContain('missing the `olam.protocol.versions` LABEL');
+        expect(result.remedy).toContain('docs/architecture/devbox-contract.md');
+    });
+    it('returns incompatible when image is older than CLI supports', () => {
+        const result = checkProtocolOverlap([1], [3, 4]);
+        expect(result.compatible).toBe(false);
+        expect(result.remedy).toContain('older than this CLI supports');
+    });
+    it('returns incompatible when image is newer than CLI supports', () => {
+        const result = checkProtocolOverlap([5, 6], [1]);
+        expect(result.compatible).toBe(false);
+        expect(result.remedy).toContain('newer than this CLI supports');
+        expect(result.remedy).toContain('npm install -g @pleri/olam-cli');
+    });
+    it('returns incompatible with non-overlapping bands', () => {
+        // Image declares [2, 4], CLI supports [1, 3] — no shared major.
+        const result = checkProtocolOverlap([2, 4], [1, 3]);
+        expect(result.compatible).toBe(false);
+        expect(result.overlap).toEqual([]);
+        expect(result.remedy).toContain('Pin a compatible CLI version that overlaps');
+    });
+    it('uses OLAM_PROTOCOL_VERSIONS_SUPPORTED by default when CLI list omitted', () => {
+        const result = checkProtocolOverlap(OLAM_PROTOCOL_VERSIONS_SUPPORTED.slice());
+        expect(result.compatible).toBe(true);
+        expect(result.overlap).toEqual([...OLAM_PROTOCOL_VERSIONS_SUPPORTED]);
+    });
+    it('preserves immutability of input — does not mutate cliVersions', () => {
+        const cli = [1, 2];
+        checkProtocolOverlap([1], cli);
+        expect(cli).toEqual([1, 2]);
+    });
+});
+describe('inspectImageProtocolVersions', () => {
+    it('returns parsed versions when docker inspect succeeds with a LABEL value', () => {
+        const fakeInspect = () => ({
+            exitCode: 0,
+            stdout: '1,2\n',
+            stderr: '',
+        });
+        const result = inspectImageProtocolVersions('ghcr.io/example/img:1.0', fakeInspect);
+        expect(result.versions).toEqual([1, 2]);
+        expect(result.inspectFailed).toBe(false);
+        expect(result.imageRef).toBe('ghcr.io/example/img:1.0');
+    });
+    it('returns empty versions when docker inspect outputs "<no value>" (LABEL absent)', () => {
+        const fakeInspect = () => ({
+            exitCode: 0,
+            stdout: '<no value>\n',
+            stderr: '',
+        });
+        const result = inspectImageProtocolVersions('ghcr.io/example/img:1.0', fakeInspect);
+        expect(result.versions).toEqual([]);
+        expect(result.inspectFailed).toBe(false);
+    });
+    it('returns empty versions when docker inspect outputs empty string', () => {
+        const fakeInspect = () => ({
+            exitCode: 0,
+            stdout: '\n',
+            stderr: '',
+        });
+        const result = inspectImageProtocolVersions('ghcr.io/example/img:1.0', fakeInspect);
+        expect(result.versions).toEqual([]);
+        expect(result.inspectFailed).toBe(false);
+    });
+    it('reports inspect failure when exit code non-zero', () => {
+        const fakeInspect = () => ({
+            exitCode: 1,
+            stdout: '',
+            stderr: 'Error: No such object\n',
+        });
+        const result = inspectImageProtocolVersions('ghcr.io/missing/img:9.9', fakeInspect);
+        expect(result.inspectFailed).toBe(true);
+        expect(result.inspectError).toContain('No such object');
+        expect(result.versions).toEqual([]);
+    });
+    it('reports inspect failure with default message when stderr is empty', () => {
+        const fakeInspect = () => ({
+            exitCode: 125,
+            stdout: '',
+            stderr: '',
+        });
+        const result = inspectImageProtocolVersions('ghcr.io/missing/img:9.9', fakeInspect);
+        expect(result.inspectFailed).toBe(true);
+        expect(result.inspectError).toContain('exited 125');
+    });
+});
+describe('end-to-end handshake against the conformance fixtures (mock-only)', () => {
+    // Mirrors what Phase D's E2E will exercise against the real fixture
+    // images. Here we mock the docker calls so the test runs in any
+    // environment.
+    it('positive fixture (LABEL "1") + CLI v1 → compatible', () => {
+        const fakeInspect = () => ({
+            exitCode: 0,
+            stdout: '1\n',
+            stderr: '',
+        });
+        const inspected = inspectImageProtocolVersions('ghcr.io/pleri/contract-test-image:0.1.0', fakeInspect);
+        const handshake = checkProtocolOverlap(inspected.versions);
+        expect(handshake.compatible).toBe(true);
+    });
+    it('negative fixture (no LABEL) + CLI v1 → incompatible with missing-LABEL remedy', () => {
+        const fakeInspect = () => ({
+            exitCode: 0,
+            stdout: '<no value>\n',
+            stderr: '',
+        });
+        const inspected = inspectImageProtocolVersions('ghcr.io/pleri/non-conformant-image:0.1.0', fakeInspect);
+        const handshake = checkProtocolOverlap(inspected.versions);
+        expect(handshake.compatible).toBe(false);
+        expect(handshake.remedy).toContain('missing the `olam.protocol.versions` LABEL');
+    });
+    it('hypothetical future-CLI-only image (LABEL "2") + current CLI v1 → newer-than-cli remedy', () => {
+        const fakeInspect = () => ({
+            exitCode: 0,
+            stdout: '2\n',
+            stderr: '',
+        });
+        const inspected = inspectImageProtocolVersions('ghcr.io/pleri/future-image:9.9.9', fakeInspect);
+        const handshake = checkProtocolOverlap(inspected.versions);
+        expect(handshake.compatible).toBe(false);
+        expect(handshake.remedy).toContain('newer than this CLI supports');
+    });
+});
+//# sourceMappingURL=protocol-version.test.js.map

package/dist/__tests__/protocol-version.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-version.test.js","sourceRoot":"","sources":["../../src/__tests__/protocol-version.test.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,sEAAsE;AACtE,oEAAoE;AACpE,qEAAqE;AACrE,0BAA0B;AAE1B,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,gCAAgC,EAChC,0BAA0B,EAC1B,oBAAoB,EACpB,4BAA4B,GAE7B,MAAM,wBAAwB,CAAC;AAEhC,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,0BAA0B,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,0BAA0B,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE;QACtB,MAAM,CAAC,0BAA0B,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE;QACzB,MAAM,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,0BAA0B,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,MAAM,GAAG,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,MAAM,MAAM,GAAG,oBAAoB,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,4CAA4C,CAAC,CAAC;QAC9E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,MAAM,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,MAAM,GAAG,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,gEAAgE;QAChE,MAAM,MAAM,GAAG,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,4CAA4C,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,MAAM,GAAG,oBAAoB,CAAC,gCAAgC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,gCAAgC,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnB,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,WAAW,GAAoB,GAAG,EAAE,CAAC,CAAC;YAC1C,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,4BAA4B,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC;QACpF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,MAAM,WAAW,GAAoB,GAAG,EAAE,CAAC,CAAC;YAC1C,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,4BAA4B,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC;QACpF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,WAAW,GAAoB,GAAG,EAAE,CAAC,CAAC;YAC1C,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,4BAA4B,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC;QACpF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,WAAW,GAAoB,GAAG,EAAE,CAAC,CAAC;YAC1C,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,yBAAyB;SAClC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,4BAA4B,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC;QACpF,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,WAAW,GAAoB,GAAG,EAAE,CAAC,CAAC;YAC1C,QAAQ,EAAE,GAAG;YACb,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,4BAA4B,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC;QACpF,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mEAAmE,EAAE,GAAG,EAAE;IACjF,oEAAoE;IACpE,gEAAgE;IAChE,eAAe;IAEf,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,WAAW,GAAoB,GAAG,EAAE,CAAC,CAAC;YAC1C,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,4BAA4B,CAC5C,yCAAyC,EACzC,WAAW,CACZ,CAAC;QACF,MAAM,SAAS,GAAG,oBAAoB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,WAAW,GAAoB,GAAG,EAAE,CAAC,CAAC;YAC1C,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,4BAA4B,CAC5C,0CAA0C,EAC1C,WAAW,CACZ,CAAC;QACF,MAAM,SAAS,GAAG,oBAAoB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,GAAG,EAAE;QACjG,MAAM,WAAW,GAAoB,GAAG,EAAE,CAAC,CAAC;YAC1C,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,4BAA4B,CAC5C,kCAAkC,EAClC,WAAW,CACZ,CAAC;QACF,MAAM,SAAS,GAAG,oBAAoB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/registry-allowlist.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=registry-allowlist.test.d.ts.map

package/dist/__tests__/registry-allowlist.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-allowlist.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/registry-allowlist.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/registry-allowlist.test.js

@@ -0,0 +1,129 @@
+// C4 (Phase C — fresh-install self-bootstrap): registry allowlist for
+// OLAM_DEVBOX_IMAGE overrides. Flag-only override (env-var form was
+// dropped per Decision #19 to avoid ambient bypass via shell inheritance).
+import { describe, it, expect } from 'vitest';
+import { decideAllowlist, resolveDevboxImageOverride } from '../registry-allowlist.js';
+describe('decideAllowlist — default allowlist (ghcr.io/pleri/*)', () => {
+    it('accepts the canonical olam-devbox image with a tag', () => {
+        const d = decideAllowlist({
+            imageRef: 'ghcr.io/pleri/olam-devbox:0.2.0',
+            allowCustomRegistry: false,
+        });
+        expect(d.allowedByDefault).toBe(true);
+        expect(d.accepted).toBe(true);
+        expect(d.stderrLine).toBe('');
+    });
+    it('accepts olam-devbox@sha256: digest references', () => {
+        const d = decideAllowlist({
+            imageRef: 'ghcr.io/pleri/olam-devbox@sha256:abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789',
+            allowCustomRegistry: false,
+        });
+        expect(d.accepted).toBe(true);
+    });
+    it('accepts atlas-devbox under the pleri namespace (Decision #15)', () => {
+        const d = decideAllowlist({
+            imageRef: 'ghcr.io/pleri/olam-devbox-atlas:1.2.3',
+            allowCustomRegistry: false,
+        });
+        expect(d.allowedByDefault).toBe(true);
+        expect(d.accepted).toBe(true);
+    });
+    it('accepts host-cp + auth images for the publish-workflow', () => {
+        expect(decideAllowlist({ imageRef: 'ghcr.io/pleri/olam-host-cp:0.2.0', allowCustomRegistry: false }).accepted).toBe(true);
+        expect(decideAllowlist({ imageRef: 'ghcr.io/pleri/olam-auth:0.2.0', allowCustomRegistry: false }).accepted).toBe(true);
+    });
+});
+describe('decideAllowlist — out-of-allowlist refs', () => {
+    it('rejects a generic Docker Hub ref without the flag', () => {
+        const d = decideAllowlist({
+            imageRef: 'docker.io/library/ubuntu:24.04',
+            allowCustomRegistry: false,
+        });
+        expect(d.accepted).toBe(false);
+        expect(d.stderrLine).toContain('outside allowed registries');
+        expect(d.stderrLine).toContain('--allow-custom-registry');
+    });
+    it('rejects a different ghcr.io org without the flag', () => {
+        const d = decideAllowlist({
+            imageRef: 'ghcr.io/atlas/atlas-devbox:1.2.3',
+            allowCustomRegistry: false,
+        });
+        expect(d.accepted).toBe(false);
+    });
+    it('rejects an attacker-controlled registry without the flag', () => {
+        const d = decideAllowlist({
+            imageRef: 'evil.example/evil-devbox:latest',
+            allowCustomRegistry: false,
+        });
+        expect(d.accepted).toBe(false);
+        expect(d.stderrLine).toContain('outside allowed registries');
+    });
+    it('accepts an out-of-allowlist ref WITH the flag and emits a warning', () => {
+        const d = decideAllowlist({
+            imageRef: 'ghcr.io/atlas/atlas-devbox:1.2.3',
+            allowCustomRegistry: true,
+        });
+        expect(d.accepted).toBe(true);
+        expect(d.allowedByDefault).toBe(false);
+        expect(d.stderrLine).toContain('Warning');
+        expect(d.stderrLine).toContain("'ghcr.io/atlas/atlas-devbox:1.2.3'");
+        expect(d.stderrLine).toContain('--allow-custom-registry was specified');
+    });
+    it('keeps stderr empty for default-allowed refs even when the flag is set', () => {
+        const d = decideAllowlist({
+            imageRef: 'ghcr.io/pleri/olam-devbox:0.2.0',
+            allowCustomRegistry: true,
+        });
+        expect(d.accepted).toBe(true);
+        expect(d.stderrLine).toBe('');
+    });
+});
+describe('decideAllowlist — pattern boundaries', () => {
+    it('rejects look-alike namespace ghcr.io/pleri-evil/...', () => {
+        const d = decideAllowlist({
+            imageRef: 'ghcr.io/pleri-evil/olam-devbox:0.2.0',
+            allowCustomRegistry: false,
+        });
+        expect(d.accepted).toBe(false);
+    });
+    it('rejects look-alike registry ghcr.io.evil.com/pleri/...', () => {
+        const d = decideAllowlist({
+            imageRef: 'ghcr.io.evil.com/pleri/olam-devbox:0.2.0',
+            allowCustomRegistry: false,
+        });
+        expect(d.accepted).toBe(false);
+    });
+    it('rejects nested-namespace ghcr.io/pleri/foo/bar:tag (only one path segment after pleri/ allowed)', () => {
+        const d = decideAllowlist({
+            imageRef: 'ghcr.io/pleri/foo/bar:0.2.0',
+            allowCustomRegistry: false,
+        });
+        expect(d.accepted).toBe(false);
+    });
+});
+describe('resolveDevboxImageOverride — precedence', () => {
+    it('returns undefined when neither flag nor env var is set', () => {
+        expect(resolveDevboxImageOverride(undefined, {})).toBeUndefined();
+    });
+    it('returns the flag value when only the flag is set', () => {
+        expect(resolveDevboxImageOverride('ghcr.io/atlas/foo:1', {})).toBe('ghcr.io/atlas/foo:1');
+    });
+    it('returns the env value when only the env var is set', () => {
+        expect(resolveDevboxImageOverride(undefined, { OLAM_DEVBOX_IMAGE: 'ghcr.io/atlas/foo:1' })).toBe('ghcr.io/atlas/foo:1');
+    });
+    it('flag takes precedence over env var when both are set', () => {
+        expect(resolveDevboxImageOverride('ghcr.io/from-flag/img:1', {
+            OLAM_DEVBOX_IMAGE: 'ghcr.io/from-env/img:1',
+        })).toBe('ghcr.io/from-flag/img:1');
+    });
+    it('treats empty/whitespace flag value as unset and falls back to env', () => {
+        expect(resolveDevboxImageOverride('   ', { OLAM_DEVBOX_IMAGE: 'ghcr.io/from-env/img:1' })).toBe('ghcr.io/from-env/img:1');
+    });
+    it('treats empty/whitespace env value as unset', () => {
+        expect(resolveDevboxImageOverride(undefined, { OLAM_DEVBOX_IMAGE: '   ' })).toBeUndefined();
+    });
+    it('trims trailing whitespace in returned values', () => {
+        expect(resolveDevboxImageOverride('  ghcr.io/atlas/foo:1  ', {})).toBe('ghcr.io/atlas/foo:1');
+    });
+});
+//# sourceMappingURL=registry-allowlist.test.js.map

package/dist/__tests__/registry-allowlist.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-allowlist.test.js","sourceRoot":"","sources":["../../src/__tests__/registry-allowlist.test.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAE3E,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAEvF,QAAQ,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACrE,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,GAAG,eAAe,CAAC;YACxB,QAAQ,EAAE,iCAAiC;YAC3C,mBAAmB,EAAE,KAAK;SAC3B,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,GAAG,eAAe,CAAC;YACxB,QAAQ,EACN,mGAAmG;YACrG,mBAAmB,EAAE,KAAK;SAC3B,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,GAAG,eAAe,CAAC;YACxB,QAAQ,EAAE,uCAAuC;YACjD,mBAAmB,EAAE,KAAK;SAC3B,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,kCAAkC,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1H,MAAM,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACvD,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,GAAG,eAAe,CAAC;YACxB,QAAQ,EAAE,gCAAgC;YAC1C,mBAAmB,EAAE,KAAK;SAC3B,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QAC7D,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,GAAG,eAAe,CAAC;YACxB,QAAQ,EAAE,kCAAkC;YAC5C,mBAAmB,EAAE,KAAK;SAC3B,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,GAAG,eAAe,CAAC;YACxB,QAAQ,EAAE,iCAAiC;YAC3C,mBAAmB,EAAE,KAAK;SAC3B,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,CAAC,GAAG,eAAe,CAAC;YACxB,QAAQ,EAAE,kCAAkC;YAC5C,mBAAmB,EAAE,IAAI;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QACrE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,CAAC,GAAG,eAAe,CAAC;YACxB,QAAQ,EAAE,iCAAiC;YAC3C,mBAAmB,EAAE,IAAI;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,GAAG,eAAe,CAAC;YACxB,QAAQ,EAAE,sCAAsC;YAChD,mBAAmB,EAAE,KAAK;SAC3B,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,GAAG,eAAe,CAAC;YACxB,QAAQ,EAAE,0CAA0C;YACpD,mBAAmB,EAAE,KAAK;SAC3B,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iGAAiG,EAAE,GAAG,EAAE;QACzG,MAAM,CAAC,GAAG,eAAe,CAAC;YACxB,QAAQ,EAAE,6BAA6B;YACvC,mBAAmB,EAAE,KAAK;SAC3B,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACvD,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,0BAA0B,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CACJ,0BAA0B,CAAC,qBAAqB,EAAE,EAAE,CAAC,CACtD,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CACJ,0BAA0B,CAAC,SAAS,EAAE,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,CAAC,CACpF,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CACJ,0BAA0B,CAAC,yBAAyB,EAAE;YACpD,iBAAiB,EAAE,wBAAwB;SAC5C,CAAC,CACH,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,CACJ,0BAA0B,CAAC,KAAK,EAAE,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,CAAC,CACnF,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CACJ,0BAA0B,CAAC,SAAS,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CACpE,CAAC,aAAa,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CACJ,0BAA0B,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAC1D,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/__tests__/upgrade.all-three.test.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Verifies Phase 2a A4 sequential build orchestration: `olam upgrade` invokes
+ * `bash build-auth.sh` → `bash build-devbox.sh` → `bash build-host-cp.sh` in
+ * that order with `OLAM_TAG=olam-next` env, and the devbox step uses inherit
+ * stdio (live tee) for cold-cache visibility.
+ *
+ * The CLI source is read as text and parsed for the load-bearing invariants:
+ *   - Build scripts listed in correct order
+ *   - OLAM_TAG=olam-next env propagated
+ *   - Devbox uses tee (inherit stdio) per F13 audit fix
+ *   - Other two use silent runStep capture
+ *
+ * Direct integration testing (spawning real `bash build-*.sh`) lives at
+ * tests/integration/build-scripts-olam-tag.sh — manual smoke; not in CI.
+ *
+ * Run: `cd packages/cli && npx vitest run src/commands/__tests__/upgrade.all-three.test.ts`
+ */
+export {};
+//# sourceMappingURL=upgrade.all-three.test.d.ts.map

package/dist/commands/__tests__/upgrade.all-three.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade.all-three.test.d.ts","sourceRoot":"","sources":["../../../src/commands/__tests__/upgrade.all-three.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG"}

package/dist/commands/__tests__/upgrade.all-three.test.js

@@ -0,0 +1,92 @@
+/**
+ * Verifies Phase 2a A4 sequential build orchestration: `olam upgrade` invokes
+ * `bash build-auth.sh` → `bash build-devbox.sh` → `bash build-host-cp.sh` in
+ * that order with `OLAM_TAG=olam-next` env, and the devbox step uses inherit
+ * stdio (live tee) for cold-cache visibility.
+ *
+ * The CLI source is read as text and parsed for the load-bearing invariants:
+ *   - Build scripts listed in correct order
+ *   - OLAM_TAG=olam-next env propagated
+ *   - Devbox uses tee (inherit stdio) per F13 audit fix
+ *   - Other two use silent runStep capture
+ *
+ * Direct integration testing (spawning real `bash build-*.sh`) lives at
+ * tests/integration/build-scripts-olam-tag.sh — manual smoke; not in CI.
+ *
+ * Run: `cd packages/cli && npx vitest run src/commands/__tests__/upgrade.all-three.test.ts`
+ */
+import { describe, it, expect } from 'vitest';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+function findRepoRoot(start) {
+    let dir = start;
+    for (let i = 0; i < 10; i++) {
+        if (fs.existsSync(path.join(dir, 'packages', 'host-cp', 'compose.yaml')))
+            return dir;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    throw new Error(`Could not find repo root from ${start}`);
+}
+const REPO_ROOT = findRepoRoot(process.cwd());
+const UPGRADE_TS = path.join(REPO_ROOT, 'packages', 'cli', 'src', 'commands', 'upgrade.ts');
+describe('Phase 2a A4 — sequential build orchestration', () => {
+    let body;
+    it('reads the upgrade.ts source', () => {
+        body = fs.readFileSync(UPGRADE_TS, 'utf-8');
+        expect(body.length).toBeGreaterThan(1000);
+    });
+    it('declares OLAM_TAG=olam-next env for the build steps', () => {
+        body ??= fs.readFileSync(UPGRADE_TS, 'utf-8');
+        expect(body).toMatch(/OLAM_TAG:\s*['"]olam-next['"]/);
+    });
+    it('lists the three build scripts in correct order (auth → devbox → host-cp) inside buildScripts[]', () => {
+        body ??= fs.readFileSync(UPGRADE_TS, 'utf-8');
+        // Scope the order check to the buildScripts array literal (other mentions
+        // of build-host-cp.sh exist in the file's doc comment + the printed plan).
+        const arrayMatch = body.match(/buildScripts:[\s\S]*?=\s*\[[\s\S]*?\];/);
+        expect(arrayMatch).not.toBeNull();
+        const arrayBody = arrayMatch[0];
+        const authIdx = arrayBody.indexOf('build-auth.sh');
+        const devboxIdx = arrayBody.indexOf('build-devbox.sh');
+        const hostCpIdx = arrayBody.indexOf('build-host-cp.sh');
+        expect(authIdx).toBeGreaterThan(0);
+        expect(devboxIdx).toBeGreaterThan(authIdx);
+        expect(hostCpIdx).toBeGreaterThan(devboxIdx);
+    });
+    it('marks the devbox step as tee:true (inherit stdio) for cold-cache visibility (F13 fix)', () => {
+        body ??= fs.readFileSync(UPGRADE_TS, 'utf-8');
+        // The devbox entry in the buildScripts array should have tee: true.
+        // Look for the literal "build-devbox.sh" entry and verify the same line
+        // (or nearby) sets tee: true.
+        const devboxLine = body
+            .split('\n')
+            .find((line) => line.includes('build-devbox.sh') && line.includes('tee'));
+        expect(devboxLine).toBeDefined();
+        expect(devboxLine).toMatch(/tee:\s*true/);
+    });
+    it('marks auth + host-cp steps as tee:false (silent runStep)', () => {
+        body ??= fs.readFileSync(UPGRADE_TS, 'utf-8');
+        const lines = body.split('\n');
+        const authLine = lines.find((line) => line.includes('build-auth.sh') && line.includes('tee'));
+        const hostCpLine = lines.find((line) => line.includes('build-host-cp.sh') && line.includes('tee'));
+        expect(authLine).toMatch(/tee:\s*false/);
+        expect(hostCpLine).toMatch(/tee:\s*false/);
+    });
+    it('uses spawnSync with stdio: inherit for the tee branch', () => {
+        body ??= fs.readFileSync(UPGRADE_TS, 'utf-8');
+        // The tee branch should call spawnSync with stdio: 'inherit'.
+        expect(body).toMatch(/spawnSync\([\s\S]*?stdio:\s*['"]inherit['"]/);
+    });
+    it('failure path exits with code 1 on any build script failure', () => {
+        body ??= fs.readFileSync(UPGRADE_TS, 'utf-8');
+        // The orchestration loop should set process.exitCode = 1 on failure.
+        // Look for the buildScripts loop body containing the exitCode = 1 pattern.
+        const loopMatch = body.match(/for\s*\(\s*const\s+step\s+of\s+buildScripts[\s\S]*?\n\s*\}\n/);
+        expect(loopMatch).not.toBeNull();
+        expect(loopMatch[0]).toMatch(/process\.exitCode\s*=\s*1/);
+    });
+});
+//# sourceMappingURL=upgrade.all-three.test.js.map

package/dist/commands/__tests__/upgrade.all-three.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade.all-three.test.js","sourceRoot":"","sources":["../../../src/commands/__tests__/upgrade.all-three.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QACrF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;AAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;AAE5F,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,IAAI,IAAY,CAAC;IAEjB,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,IAAI,KAAK,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gGAAgG,EAAE,GAAG,EAAE;QACxG,IAAI,KAAK,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC9C,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACxE,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,UAAW,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACxD,MAAM,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAC/F,IAAI,KAAK,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC9C,oEAAoE;QACpE,wEAAwE;QACxE,8BAA8B;QAC9B,MAAM,UAAU,GAAG,IAAI;aACpB,KAAK,CAAC,IAAI,CAAC;aACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,IAAI,KAAK,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9F,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACnG,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACzC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,IAAI,KAAK,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC9C,8DAA8D;QAC9D,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,IAAI,KAAK,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC9C,qEAAqE;QACrE,2EAA2E;QAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAC7F,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,SAAU,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/__tests__/upgrade.history.test.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Phase 2c — verifies C1 (~/.olam/upgrade.log JSONL writer) + C2 (--history flag).
+ *
+ * Tests:
+ *   - appendUpgradeLog: open-per-write, mkdir defensively
+ *   - readUpgradeLog: ENOENT → empty; corrupt JSON skipped + stderr warn
+ *   - formatHistoryTable / formatHistoryJson: render shape
+ *   - formatDuration: ms / s / m / h
+ *   - parseHistoryOpts: --history -n <N> --json
+ *   - handleHistory wired from upgrade.ts
+ *
+ * Run: `cd packages/cli && npx vitest run src/commands/__tests__/upgrade.history.test.ts`
+ */
+export {};
+//# sourceMappingURL=upgrade.history.test.d.ts.map

package/dist/commands/__tests__/upgrade.history.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade.history.test.d.ts","sourceRoot":"","sources":["../../../src/commands/__tests__/upgrade.history.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}