@pleri/olam-cli 0.1.148 → 0.1.150

package/host-cp/k8s/manifests/mcp-auth-service/50-deployment.yaml

@@ -1,12 +1,15 @@
 # Deployment for olam-mcp-auth-service.
 #
 # Image: pinned to sha256 digest (not :latest or named tag) per T4 threat model.
-# Digest resolves to ghcr.io/pleri/olam-mcp-auth-service:0.1.0 (multi-arch index).
+# Digest resolves to ghcr.io/pleri/olam-mcp-auth:latest (multi-arch index).
+# NOTE (B1): image name is olam-mcp-auth (NOT olam-mcp-auth-service) — matches the
+# actual GHCR package name published by release.yml publish-mcp-auth job.
 # To update: resolve the new tag's digest via:
-#   TOKEN=$(curl -s "https://ghcr.io/token?scope=repository:pleri/olam-mcp-auth-service:pull&service=ghcr.io" | jq -r .token)
+#   TOKEN=$(curl -s "https://ghcr.io/token?scope=repository:pleri/olam-mcp-auth:pull&service=ghcr.io" | jq -r .token)
 #   curl -sI -H "Authorization: Bearer $TOKEN" \
 #     -H "Accept: application/vnd.oci.image.index.v1+json,application/vnd.docker.distribution.manifest.list.v2+json" \
-#     https://ghcr.io/v2/pleri/olam-mcp-auth-service/manifests/<tag> | grep docker-content-digest
+#     https://ghcr.io/v2/pleri/olam-mcp-auth/manifests/<tag> | grep docker-content-digest
+# Or use: node scripts/refresh-manifest-digests.mjs
 #
 # securityContext: conservative defaults per T6/T7 threat model (runAsNonRoot,
 # readOnlyRootFilesystem). /tmp backed by emptyDir for transient write needs.
@@ -58,7 +61,7 @@ spec:
               mountPath: /data
       containers:
         - name: olam-mcp-auth-service
-          image: ghcr.io/pleri/olam-mcp-auth-service@sha256:b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3
+          image: ghcr.io/pleri/olam-mcp-auth@sha256:7f5ffeea1a697e43fd1d4569d1e82c78086b80d3f331efa2ea166c0ef4f70826
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/k8s/manifests/memory-service/50-deployment.yaml

@@ -58,7 +58,12 @@ spec:
               mountPath: /data
       containers:
         - name: olam-memory-service
-          image: ghcr.io/pleri/olam-memory-service@sha256:d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5
+          # image first appears on GHCR after Phase B's publish-memory-service
+          # job fires on the first release post-merge. Remove the
+          # bootstrap-placeholder comment + run `npm run refresh:manifest-digests`
+          # once ghcr.io/pleri/olam-memory-service has a real published digest.
+          # bootstrap-placeholder: pre-publish; refresh after first release
+          image: ghcr.io/pleri/olam-memory-service@sha256:b4132f1d43335daaeebda2437e5eb78690ce6ef4accb8a830c92ec7acc6ee593
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/src/agent-runtime-trigger.mjs

@@ -31,11 +31,13 @@ import { spawnSync, spawn } from 'node:child_process';
 
 const SPAWN_TIMEOUT_MS = 10_000;
 
-// Default container-side path for the supervisor binary. The devbox image
-// COPYs `packages/intelligence/dist/agent-stream/` to this location during
-// build (devbox Dockerfile update lands alongside this PR or in a follow-up).
-// Compiled supervisor lives at /opt/olam/agent-stream/dist/agent-stream-launch.js
-// per the devbox runtime Dockerfile build-in-image step (tsc writes dist/).
+// Default container-side path for the supervisor binary.
+// In source-mode (OLAM_DEV=1): the operator's built host dist is bind-mounted
+// read-only at /opt/olam/agent-stream/dist (Phase B1, olam-world-bundle-freshness).
+// The mount overlays the image-baked dist, so this path always resolves to the
+// freshest available binary — no docker cp required.
+// In install-mode / cloud: the image-baked dist (devbox.runtime.glibc.Dockerfile
+// lines 263-287 bake step) is the fallback; the path is the same.
 const DEFAULT_SUPERVISOR_PATH = '/opt/olam/agent-stream/dist/agent-stream-launch.js';
 
 /**

package/host-cp/src/plan-chat-secret.mjs

@@ -5,14 +5,25 @@
 // hex string. Helpers generate, read, and rotate atomically. Rotation
 // writes to a tmpfile and renames; mid-rotation reads see either the old
 // or new value, never a partial write.
+//
+// Inside the Docker container, os.homedir() → /root, but compose.yaml mounts
+// ${HOME}/.olam → /data. Without an env override, the bearer would be written
+// to /root/.olam/plan-chat-secret (container ephemeral layer) and lost on
+// every `docker compose up --force-recreate` (i.e. every `olam upgrade`).
+// OLAM_PLAN_CHAT_SECRET_PATH is set to /data/plan-chat-secret in compose.yaml
+// and k8s/manifests/30-configmap.yaml so all reads/writes land in the
+// bind-mounted host directory. On bare-host installs (no container) the env
+// var is unset and the path falls back to ~/.olam/plan-chat-secret — no
+// behaviour change. Mirrors precedent commit 5b21d1f2 (PR #440) for plan.db.
 
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import crypto from 'node:crypto';
 
-export const SECRET_DIR = path.join(os.homedir(), '.olam');
-export const SECRET_PATH = path.join(SECRET_DIR, 'plan-chat-secret');
+export const SECRET_PATH =
+  process.env.OLAM_PLAN_CHAT_SECRET_PATH ?? path.join(os.homedir(), '.olam', 'plan-chat-secret');
+export const SECRET_DIR = path.dirname(SECRET_PATH);
 const SECRET_BYTES = 32; // 64 hex chars
 const SECRET_MODE = 0o600;
 

package/host-cp/src/plan-chat-service.mjs

@@ -30,6 +30,7 @@
 //   OLAM_PLAN_CHAT_SECRET_PATH   (default ~/.olam/plan-chat-secret)
 
 import http from 'node:http';
+import { performance } from 'node:perf_hooks';
 import { Readable } from 'node:stream';
 import { URL } from 'node:url';
 import pg from 'pg';
@@ -178,13 +179,36 @@ function validateChunkInput(body) {
 /**
  * Build the HTTP request handler. Pure factory — easy to test against a
  * stubbed pool. Production callers pass a real pg.Pool.
+ *
+ * Phase A A2 (olam-spa-electric-subscription-staleness): when `shapeDebug`
+ * is true OR `OLAM_PLAN_CHAT_SHAPE_DEBUG=1` is set in the environment,
+ * `handleGetShape` emits two structured log lines per long-poll cycle —
+ * one BEFORE the upstream fetch (with the rewritten `where` predicate +
+ * forwarded params) and one AFTER (with upstream status + electric-*
+ * response headers). Log lines go to `shapeDebugLog` (default
+ * `console.error`); tests inject a spy. Flag defaults OFF — production
+ * shapes incur a single boolean check per cycle and zero log I/O.
  */
-export function createHandler({ pool, bearer, electricUrl }) {
+export function createHandler({
+  pool,
+  bearer,
+  electricUrl,
+  shapeDebug,
+  shapeDebugLog,
+}) {
   if (!pool) throw new Error('createHandler: { pool } required');
   if (typeof bearer !== 'string' || bearer.length === 0) {
     throw new Error('createHandler: { bearer } required');
   }
   const electricBase = electricUrl ?? DEFAULT_ELECTRIC_URL;
+  const shapeDebugEnabled =
+    typeof shapeDebug === 'boolean'
+      ? shapeDebug
+      : process.env.OLAM_PLAN_CHAT_SHAPE_DEBUG === '1';
+  const shapeLog =
+    typeof shapeDebugLog === 'function'
+      ? shapeDebugLog
+      : (msg, details) => console.error(msg, details);
 
   function checkAuth(req) {
     const header = req.headers.authorization;
@@ -282,29 +306,76 @@ export function createHandler({ pool, bearer, electricUrl }) {
       `session_id='${sessionId}' AND world_id='${worldId}'`,
     );
 
+    // Phase A A2 — log BEFORE upstream fetch. Includes the rewritten
+    // `where` predicate so an operator can correlate client-supplied
+    // offset/handle with the server-derived scope. Cheap when off: one
+    // boolean check.
+    if (shapeDebugEnabled) {
+      shapeLog('[plan-chat-service:shape] → upstream', {
+        upstream: upstream.pathname + upstream.search,
+        offset: url.searchParams.get('offset'),
+        handle: url.searchParams.get('handle'),
+        live: url.searchParams.get('live'),
+        where: upstream.searchParams.get('where'),
+      });
+    }
+
     let upstreamRes;
+    const upstreamStartedAt = shapeDebugEnabled ? performance.now() : 0;
     try {
       upstreamRes = await fetch(upstream, {
         method: 'GET',
         headers: { accept: 'application/json' },
       });
     } catch (err) {
+      if (shapeDebugEnabled) {
+        shapeLog('[plan-chat-service:shape] ✖ upstream-error', {
+          upstream: upstream.pathname + upstream.search,
+          err: String(err?.message ?? err),
+        });
+      }
       return send(res, 502, {
         error: 'shape-upstream-unreachable',
         message: String(err?.message ?? err),
       });
     }
 
-    // Forward upstream electric-* headers BEFORE the stream starts. Once
-    // res.writeHead fires, headers are locked.
-    for (const header of [
-      'electric-handle',
-      'electric-offset',
-      'electric-up-to-date',
-      'electric-schema',
-    ]) {
-      const value = upstreamRes.headers.get(header);
-      if (value) res.setHeader(header, value);
+    // Phase A A2 — log AFTER upstream returns headers but BEFORE
+    // `res.writeHead` fires (Seam: must not touch the body stream;
+    // logging post-pipe risks hanging the response on a sync exception
+    // in the logger). Captures the electric-* response headers to
+    // disambiguate offset-cursor staleness from handle eviction.
+    if (shapeDebugEnabled) {
+      const elapsedMs = Math.round(performance.now() - upstreamStartedAt);
+      shapeLog(
+        `[plan-chat-service:shape] ← upstream ${upstreamRes.status} ${elapsedMs}ms`,
+        {
+          resHandle: upstreamRes.headers.get('electric-handle'),
+          resOffset: upstreamRes.headers.get('electric-offset'),
+          resUpToDate: upstreamRes.headers.get('electric-up-to-date'),
+          resSchema: upstreamRes.headers.get('electric-schema'),
+        },
+      );
+    }
+
+    // Forward every upstream `electric-*` header BEFORE the stream starts.
+    // Once `res.writeHead` fires, headers are locked.
+    //
+    // Phase B B4 (olam-spa-electric-subscription-staleness) — prefix-match
+    // the entire `electric-*` namespace upstream owns instead of a static
+    // four-header whitelist. ElectricSQL 1.6.3 added `electric-cursor` to
+    // the live-mode response contract; the old whitelist dropped it; the
+    // SPA's TanStack Electric collection raised `MissingHeadersError` and
+    // stopped processing the long-poll stream. Mirror-all-electric closes
+    // the class — any future header upstream adds inside this namespace
+    // flows through with zero proxy changes. See plan
+    // `~/.claude/plans/olam-spa-electric-subscription-staleness.md` § Phase B
+    // and Phase A A3 evidence at
+    // `docs/screenshots/olam-spa-electric-subscription-staleness/a3-evidence-2026-05-18/`.
+    for (const [header, value] of upstreamRes.headers) {
+      if (header.toLowerCase().startsWith('electric-')) {
+        res.setHeader(header, value);
+      }
     }
     const upstreamContentType = upstreamRes.headers.get('content-type');
     if (upstreamContentType) res.setHeader('content-type', upstreamContentType);
@@ -362,11 +433,22 @@ export async function startService(opts = {}) {
     opts.databaseUrl ?? process.env.OLAM_PLAN_CHAT_DATABASE_URL ?? DEFAULT_DB_URL;
   const electricUrl =
     opts.electricUrl ?? process.env.OLAM_PLAN_CHAT_ELECTRIC_URL ?? DEFAULT_ELECTRIC_URL;
+  // Layered defense: SECRET_PATH (imported above) is itself env-aware at
+  // module load. Reading OLAM_PLAN_CHAT_SECRET_PATH here too lets explicit
+  // opts.secretPath callers and env-changes-since-import still win. Do not
+  // collapse either layer — direct callers in server.mjs (readPlanChatSecret
+  // with no arg) rely on the module-const path being env-aware.
   const secretPath = opts.secretPath ?? process.env.OLAM_PLAN_CHAT_SECRET_PATH ?? SECRET_PATH;
   const bearer = opts.bearer ?? ensureSecret(secretPath);
 
   const pool = opts.pool ?? new pg.Pool({ connectionString: databaseUrl, max: 8 });
-  const handler = createHandler({ pool, bearer, electricUrl });
+  const handler = createHandler({
+    pool,
+    bearer,
+    electricUrl,
+    shapeDebug: opts.shapeDebug,
+    shapeDebugLog: opts.shapeDebugLog,
+  });
   const server = http.createServer((req, res) => {
     handler(req, res).catch((err) => {
       try {

package/host-cp/src/server.mjs

@@ -95,14 +95,26 @@ const WORLD_HOST = HOST_CP_MODE === 'container' ? 'host.docker.internal' : '127.
 const HOST_CP_ENGINE = resolveHostCpEngine();
 
 const PORT = parseInt(process.env.OLAM_HOST_CP_PORT ?? '19000', 10);
-// In container mode the host-cp talks to the docker daemon via the
-// socket-proxy sidecar (the proxy enforces the read-only API allow-list).
-// In bare-node mode there's no socket-proxy on the host; we shell out to
-// `docker exec` directly via child_process. The sentinel `docker-cli`
-// triggers that path in fetchContainerSecret. (B5 below; closes the
-// secret_fetch_failed bare-node bug class — see ~/.claude/plans/bare-node-mode-safeguards.md.)
+// D1 (Phase 2 Phase D) — substrate-conditional docker socket transport.
+//
+// Compose substrate (HOST_CP_ENGINE === 'docker', container mode):
+//   tcp://docker-socket-proxy:2375 — the compose sidecar enforces the
+//   read-only API allow-list. Zero behavior change from pre-D1.
+//
+// Kubernetes substrate (HOST_CP_ENGINE === 'kubernetes'):
+//   unix:///var/run/docker.sock — direct hostPath bind-mount per Decision #3
+//   (architecture a2). The init container (socket-perm) chmods the socket
+//   to 666 before the main container starts (Decision #15).
+//
+// Bare-node mode (HOST_CP_MODE !== 'container'):
+//   'docker-cli' — sentinel that triggers docker-exec path in
+//   fetchContainerSecret (bare-node safeguard, unchanged).
 const DOCKER_HOST = process.env.DOCKER_HOST
-  ?? (HOST_CP_MODE === 'container' ? 'tcp://docker-socket-proxy:2375' : 'docker-cli');
+  ?? (HOST_CP_MODE !== 'container'
+    ? 'docker-cli'
+    : HOST_CP_ENGINE === 'kubernetes'
+      ? 'unix:///var/run/docker.sock'
+      : 'tcp://docker-socket-proxy:2375');
 const TTL_SEC = parseInt(process.env.OLAM_SECRET_CACHE_TTL_SEC ?? '300', 10);
 const HOST_FOR_WORLD = process.env.OLAM_HOST_FOR_WORLD ?? WORLD_HOST;
 const TOKEN_PATH = process.env.OLAM_HOST_CP_TOKEN_PATH ?? '/data/host-cp.token';

package/host-cp/src/upgrade-spawner.mjs

@@ -145,13 +145,18 @@ export async function spawnUpgraderContainer({
   }
 
   // Bare-node (operator's host docker CLI on PATH) is documented but
-  // out of scope for the trigger feature — single deployment shape
-  // (compose stack) is supported in Phase 1.
+  // out of scope for the trigger feature — container + unix-socket paths
+  // are supported (compose stack and k8s hostPath socket mount).
   if (dockerHost === 'docker-cli') {
-    // The literal `docker-socket-proxy` below is diagnostic text naming
-    // the deployment shape that IS supported, not a hostname.
+    // The literals below (`unix:///var/run/docker.sock` and `tcp://docker-socket-proxy:2375`)
+    // are diagnostic text naming the deployment shapes that ARE supported,
+    // not hostnames being used as transport — error-message-only.
     throw new Error(
-      'upgrade-trigger requires the docker-socket-proxy deployment shape; bare-node not yet supported', // bare-node-allow: diagnostic-text
+      'upgrade-trigger requires a docker socket (unix:///var/run/docker.sock via k8s hostPath mount, ' + // bare-node-allow: diagnostic-text
+      'or tcp://docker-socket-proxy:2375 via compose); bare-node not yet supported. ' + // bare-node-allow: diagnostic-text
+      'For k8s: ensure the cluster was created with ' +
+      '--volume /var/run/docker.sock:/var/run/docker.sock@server:* ' +
+      'and olam doctor reports probeDockerSocketBindMount [PASS].',
     );
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pleri/olam-cli",
-  "version": "0.1.148",
+  "version": "0.1.150",
   "type": "module",
   "bin": {
     "olam": "./bin/olam.cjs"
@@ -32,7 +32,8 @@
     "test:ci": "vitest run --reporter=basic --passWithNoTests",
     "test:docker": "vitest run --config vitest.config.docker.ts",
     "audit:publish-deps": "node scripts/audit-publish-deps.mjs",
-    "audit:cli-bundle-k8s": "node scripts/audit-cli-bundle-k8s.mjs"
+    "audit:cli-bundle-k8s": "node scripts/audit-cli-bundle-k8s.mjs",
+    "audit:cli-package-contents": "node scripts/audit-cli-package-contents.mjs"
   },
   "dependencies": {
     "better-sqlite3": "^12.0.0",
@@ -43,6 +44,7 @@
     "picocolors": "^1.1.0",
     "ssh2": "^1.16.0",
     "yaml": "^2.7.0",
+    "@inquirer/prompts": "^7.0.0",
     "zod-to-json-schema": "^3.24.0",
     "playwright-core": "~1.59.0",
     "@napi-rs/keyring": "^1.1.6",