@stackbone/cli 0.5.1 → 0.5.3

package/CHANGELOG.md

@@ -7,6 +7,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.3] - 2026-09-25
+
+### Fixed
+
+- **`stackbone dev` failed at `Starting docker services` with `401 UNAUTHORIZED`
+  from quay.io.** MinIO closed anonymous pulls of `minio/minio` there too, after
+  Docker Hub. The compose files `stackbone dev` and `stackbone package` write now
+  pull the community fork `pgsty/minio:RELEASE.2026-08-04T00-00-00Z`, which needs
+  no account (PLA-1794).
+
+## [0.5.2] - 2026-09-23
+
+### Fixed
+
+- **A fresh `stackbone init` failed `npm install` with `ERESOLVE`.** The scaffold
+  pinned `zod@4.4.3`, while its own `@workflow/world@5.0.0-beta.11` peer-requires
+  exactly `zod@4.3.6`. pnpm only warns about a peer conflict, so it went
+  unnoticed. The shell template, its `workflows` member and the deep-agent
+  dependency map now all pin `4.3.6` (PLA-1653).
+
+- **`init [dir]` help said omitting the positional scaffolds in place.** It
+  creates a subdirectory; pass `.` to scaffold in the current directory.
+
+- **`stackbone dev` re-parsed a url connector spec on every action and every
+  trigger tick.** The parsed spec is now kept in process while its text is
+  unchanged. For Microsoft Graph's 42 MB spec, an introspection drops from about
+  6 s to under 50 ms after the first one (PLA-1714).
+
 ## [0.5.1] - 2026-09-17
 
 ### Fixed

package/main.js

@@ -15739,7 +15739,7 @@ var emulatorCors = (allowlist) => cors({
 var STACKBONE_CLI_BUILD_VERSION, EMULATOR_CAPABILITY_ROUTES, EMULATOR_CAPABILITIES, buildContractResponse;
 var init_contract = __esmMin((() => {
 	init_src$19();
-	STACKBONE_CLI_BUILD_VERSION = "0.5.1";
+	STACKBONE_CLI_BUILD_VERSION = "0.5.3";
 	EMULATOR_CAPABILITY_ROUTES = {
 		"database.postgres_direct": "/api/db",
 		"rag.basic": "/api/rag",
@@ -30698,6 +30698,70 @@ var init_spec_cache_key = __esmMin((() => {
 	SPEC_CACHE_KEY_NAMESPACE = "connect:spec";
 }));
 //#endregion
+//#region ../../libs/runtime/connect-broker/src/lib/cache/spec-digest.ts
+/**
+* The digest a spec document is known by: sha256 of its text, hex. One function
+* for both sides of PLA-1714 — the cache that vouches for a document by its
+* digest and the introspection memo that keys a parse on it — because two
+* spellings of "the hash of the text" is how a vouched digest stops matching.
+*/
+function specTextDigest(text) {
+	return createHash("sha256").update(text).digest("hex");
+}
+var init_spec_digest = __esmMin((() => {}));
+//#endregion
+//#region ../../libs/runtime/connect-broker/src/lib/cache/digest-tracking-spec-cache.ts
+/**
+* Wrap `shared` so it remembers the digest of each document it writes or reads.
+* `now`, `maxAgeMs` and `maxEntries` are injected so the bounds are provable in
+* tests without a real clock or thirty-two documents.
+*/
+function trackSpecDigests(shared, options = {}) {
+	const now = options.now ?? (() => Date.now());
+	const maxAgeMs = options.maxAgeMs ?? 6e5;
+	const maxEntries = options.maxEntries ?? 32;
+	const digests = /* @__PURE__ */ new Map();
+	const remember = (key, text, ttlMs) => {
+		digests.delete(key);
+		digests.set(key, {
+			digest: specTextDigest(text),
+			expiresAt: now() + Math.min(ttlMs, maxAgeMs)
+		});
+		while (digests.size > maxEntries) {
+			const oldest = digests.keys().next();
+			if (oldest.done === true) break;
+			digests.delete(oldest.value);
+		}
+	};
+	return {
+		async digestOf(key) {
+			const held = digests.get(key);
+			if (held === void 0) return null;
+			if (held.expiresAt <= now()) {
+				digests.delete(key);
+				return null;
+			}
+			return held.digest;
+		},
+		async get(key) {
+			const text = await shared.get(key);
+			if (text !== null) remember(key, text, maxAgeMs);
+			return text;
+		},
+		async set(key, value, ttlMs) {
+			await shared.set(key, value, ttlMs);
+			if (ttlMs > 0) remember(key, value, ttlMs);
+		},
+		async evict(key) {
+			digests.delete(key);
+			await shared.evict(key);
+		}
+	};
+}
+var init_digest_tracking_spec_cache = __esmMin((() => {
+	init_spec_digest();
+}));
+//#endregion
 //#region ../../libs/runtime/connect-broker/src/lib/executor/credential-placement.ts
 /**
 * Apply the broker-minted token to EVERY placement the connector declares, all
@@ -36659,10 +36723,17 @@ function redactUrl(raw) {
 async function resolveSpecDocument(specSource, deps = {}) {
 	if (specSource === void 0) throw new Error("connector definition has no specSource to introspect");
 	if (specSource.kind === "inline") return specSource.document;
+	return parseSpecText(await (await fetchSpec(specSource, deps)).text(), specSource.url);
+}
+/** Fetch a `url` specSource through the injected `fetch`, refusing a non-2xx. */
+async function fetchSpec(specSource, deps) {
 	if (deps.fetch === void 0) throw new Error(`connector specSource is a url ("${redactUrl(specSource.url)}") but no fetch was injected to resolve it`);
 	const response = deps.policy !== void 0 ? await deps.fetch(specSource.url, deps.headers, deps.policy) : deps.headers !== void 0 ? await deps.fetch(specSource.url, deps.headers) : await deps.fetch(specSource.url);
 	if (!response.ok) throw new Error(`fetching connector spec from "${redactUrl(specSource.url)}" failed with status ${response.status}`);
-	const body = await response.text();
+	return response;
+}
+/** Parse fetched spec text as JSON, falling back to YAML. `url` only feeds the error. */
+function parseSpecText(body, url) {
 	let doc;
 	try {
 		doc = JSON.parse(body);
@@ -36673,9 +36744,46 @@ async function resolveSpecDocument(specSource, deps = {}) {
 			doc = void 0;
 		}
 	}
-	if (doc === null || typeof doc !== "object") throw new Error(`connector spec fetched from "${redactUrl(specSource.url)}" is not valid JSON or YAML`);
+	if (doc === null || typeof doc !== "object") throw new Error(`connector spec fetched from "${redactUrl(url)}" is not valid JSON or YAML`);
 	return doc;
 }
+/** The protocol introspector's own output for a parsed document, with no extras. */
+function introspectDocument(protocol, document) {
+	if (protocol === "openapi") return Promise.resolve(introspectOpenApi(document));
+	return introspectMcpTools({ listToolsResult: document });
+}
+/** A held parse by memo key, refreshed as most recently used. */
+function heldIntrospection(key) {
+	const held = baseIntrospections.get(key);
+	if (held !== void 0) {
+		baseIntrospections.delete(key);
+		baseIntrospections.set(key, held);
+	}
+	return held;
+}
+async function introspectBase(def, deps) {
+	const source = def.specSource;
+	if (source?.kind !== "url") return introspectDocument(def.protocol, await resolveSpecDocument(source, deps));
+	const response = await fetchSpec(source, deps);
+	if (response.digest !== void 0) {
+		const held = heldIntrospection(`${def.protocol}:${response.digest}`);
+		if (held !== void 0) return held;
+	}
+	const text = await response.text();
+	const key = `${def.protocol}:${specTextDigest(text)}`;
+	const held = heldIntrospection(key);
+	if (held !== void 0) return held;
+	const parsing = Promise.resolve().then(() => introspectDocument(def.protocol, parseSpecText(text, source.url))).catch((err) => {
+		if (baseIntrospections.get(key) === parsing) baseIntrospections.delete(key);
+		throw err;
+	});
+	baseIntrospections.set(key, parsing);
+	if (baseIntrospections.size > 16) {
+		const oldest = baseIntrospections.keys().next().value;
+		if (oldest !== void 0) baseIntrospections.delete(oldest);
+	}
+	return parsing;
+}
 /**
 * Resolve a connector's spec document and dispatch it to the right introspector
 * for its `protocol`. Returns the normalized `IntrospectionResult` —
@@ -36693,17 +36801,19 @@ async function resolveSpecDocument(specSource, deps = {}) {
 * not dropping information silently.
 */
 async function introspectConnector(def, deps = {}) {
-	const document = await resolveSpecDocument(def.specSource, deps);
-	if (def.protocol === "openapi") return appendExtraQueryParams(appendExtraOperations(introspectOpenApi(document), def.extraOperations), def.extraQueryParams);
-	const result = await introspectMcpTools({ listToolsResult: document });
+	const result = await introspectBase(def, deps);
+	if (def.protocol === "openapi") return appendExtraQueryParams(appendExtraOperations(result, def.extraOperations), def.extraQueryParams);
 	if (def.extraOperations === void 0 || def.extraOperations.length === 0) return result;
 	return {
 		...result,
 		warnings: [...result.warnings, `extraOperations: ignored — connector '${def.id}' speaks mcp, whose surface is tools, not operations`]
 	};
 }
+var baseIntrospections;
 var init_spec_introspection = __esmMin((() => {
 	init_src$4();
+	init_spec_digest();
+	baseIntrospections = /* @__PURE__ */ new Map();
 }));
 //#endregion
 //#region ../../libs/runtime/connect-broker/src/lib/executor/spec-request.ts
@@ -36828,6 +36938,26 @@ function createCachingSpecFetch(options) {
 		fetch: async (url, headers, policy) => {
 			fromCache = false;
 			pending = null;
+			const fromNetwork = () => policy !== void 0 ? fetch(url, headers, policy) : headers !== void 0 ? fetch(url, headers) : fetch(url);
+			const digest = cache.digestOf ? await cache.digestOf(key).catch(() => null) : null;
+			if (digest !== null) {
+				fromCache = true;
+				return {
+					ok: true,
+					status: 200,
+					digest,
+					text: async () => {
+						const held = await cache.get(key).catch(() => null);
+						if (held !== null) return held;
+						const response = await fromNetwork();
+						if (!response.ok) throw new Error(`the cached connector spec is gone and re-fetching it failed with status ${response.status}`);
+						const body = await response.text();
+						fromCache = false;
+						pending = body;
+						return body;
+					}
+				};
+			}
 			const hit = await cache.get(key).catch(() => null);
 			if (hit !== null) {
 				fromCache = true;
@@ -36837,7 +36967,7 @@ function createCachingSpecFetch(options) {
 					text: async () => hit
 				};
 			}
-			const response = policy !== void 0 ? await fetch(url, headers, policy) : headers !== void 0 ? await fetch(url, headers) : await fetch(url);
+			const response = await fromNetwork();
 			if (!response.ok) return response;
 			const body = await response.text();
 			pending = body;
@@ -38636,6 +38766,8 @@ var init_src$3 = __esmMin((() => {
 	init_redis_spec_cache();
 	init_in_memory_spec_cache();
 	init_spec_cache_key();
+	init_digest_tracking_spec_cache();
+	init_spec_digest();
 	init_cached_spec_fetch();
 	init_get_token();
 	init_src$20();
@@ -53269,6 +53401,10 @@ var DEV_CONNECT_ENCRYPTION_KEY = "dev-only-encryption-key";
 * branch: a compose with no Redis and a single-process self-host box both land on
 * the Map and must keep behaving exactly as they do today.
 *
+* Both are wrapped in `trackSpecDigests` (PLA-1714): the box remembers the digest
+* of each spec it holds, so a trigger tick reuses the parsed document without
+* pulling it out of Redis — 42 MB per tick for Microsoft Graph.
+*
 * `lazyConnect`, and it matters: a box whose Redis is unreachable must still boot
 * and still serve actions. `createCachingSpecFetch` swallows every cache error, so
 * a dead Redis makes introspection slower — the miss path this cache replaced —
@@ -53276,12 +53412,12 @@ var DEV_CONNECT_ENCRYPTION_KEY = "dev-only-encryption-key";
 */
 var createBoxSpecCache = (redisUrl, deps = {}) => {
 	if (redisUrl === void 0 || redisUrl === "") return {
-		cache: createInMemorySpecCache(),
+		cache: trackSpecDigests(createInMemorySpecCache()),
 		close: async () => void 0
 	};
 	const redis = (deps.connect ?? defaultSpecCacheRedis)(redisUrl);
 	return {
-		cache: new RedisSpecCache(redis),
+		cache: trackSpecDigests(new RedisSpecCache(redis)),
 		close: async () => {
 			await redis.quit().catch(() => void 0);
 		}
@@ -54992,7 +55128,8 @@ var createConnectHandlers = (opts) => {
 	const specCache = {
 		get: async (key) => (await shared()).specCache.get(key),
 		set: async (key, value, ttlMs) => (await shared()).specCache.set(key, value, ttlMs),
-		evict: async (key) => (await shared()).specCache.evict(key)
+		evict: async (key) => (await shared()).specCache.evict(key),
+		digestOf: async (key) => await (await shared()).specCache.digestOf?.(key) ?? null
 	};
 	const registry = opts.registry ?? createRegistryStore();
 	const agentWire = {
@@ -72671,7 +72808,7 @@ var gitignore_raw_default = "# >>> stackbone >>>\n.stackbone/\nnode_modules/\ndi
 var npmrc_raw_default = "# A hoisted (npm-like) node_modules layout so the emulator resolves ONE copy of\n# each externalized runtime dep (@stackbone/sdk, deepagents, @langchain/*) — a\n# second inlined copy would split the SDK's AsyncLocalStorage and empty per-run logs.\nnode-linker=hoisted\n";
 //#endregion
 //#region src/services/scaffold/templates/shell/package.json.tmpl?raw
-var package_json_default$1 = "{\n  \"name\": \"{{name}}\",\n  \"version\": \"0.0.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"description\": \"A Stackbone multi-agent workspace: N in-process deep agents + N Workflow SDK workflows.\",\n  \"scripts\": {\n    \"dev\": \"stackbone dev\",\n    \"build\": \"stackbone build\"\n  },\n  \"dependencies\": {\n    \"@langchain/core\": \"1.2.8\",\n    \"@langchain/langgraph\": \"1.4.7\",\n    \"@langchain/langgraph-checkpoint-postgres\": \"1.0.4\",\n    \"@langchain/openai\": \"1.5.3\",\n    \"@stackbone/sdk\": \"{{sdkVersion}}\",\n    \"@workflow/world\": \"5.0.0-beta.11\",\n    \"deepagents\": \"1.10.5\",\n    \"workflow\": \"5.0.0-beta.19\",\n    \"zod\": \"4.4.3\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"24.x\",\n    \"@typescript/native-preview\": \"7.0.0-dev.20260523.1\"\n  },\n  \"packageManager\": \"pnpm@9.0.0\",\n  \"workspaces\": [\"workflows\"],\n  \"engines\": {\n    \"node\": \"24.x\"\n  }\n}\n";
+var package_json_default$1 = "{\n  \"name\": \"{{name}}\",\n  \"version\": \"0.0.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"description\": \"A Stackbone multi-agent workspace: N in-process deep agents + N Workflow SDK workflows.\",\n  \"scripts\": {\n    \"dev\": \"stackbone dev\",\n    \"build\": \"stackbone build\"\n  },\n  \"dependencies\": {\n    \"@langchain/core\": \"1.2.8\",\n    \"@langchain/langgraph\": \"1.4.7\",\n    \"@langchain/langgraph-checkpoint-postgres\": \"1.0.4\",\n    \"@langchain/openai\": \"1.5.3\",\n    \"@stackbone/sdk\": \"{{sdkVersion}}\",\n    \"@workflow/world\": \"5.0.0-beta.11\",\n    \"deepagents\": \"1.10.5\",\n    \"workflow\": \"5.0.0-beta.19\",\n    \"zod\": \"4.3.6\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"24.x\",\n    \"@typescript/native-preview\": \"7.0.0-dev.20260523.1\"\n  },\n  \"packageManager\": \"pnpm@9.0.0\",\n  \"workspaces\": [\"workflows\"],\n  \"engines\": {\n    \"node\": \"24.x\"\n  }\n}\n";
 //#endregion
 //#region src/services/scaffold/templates/shell/pnpm-workspace.yaml?raw
 var pnpm_workspace_default = "packages:\n  - 'workflows'\n";
@@ -72680,7 +72817,7 @@ var pnpm_workspace_default = "packages:\n  - 'workflows'\n";
 var tsconfig_default$1 = "{\n  \"compilerOptions\": {\n    \"module\": \"nodenext\",\n    \"moduleResolution\": \"nodenext\",\n    \"target\": \"esnext\",\n    \"strict\": true,\n    \"skipLibCheck\": true,\n    \"noEmit\": true,\n    \"types\": [\"node\"]\n  }\n}\n";
 //#endregion
 //#region src/services/scaffold/templates/shell/workflows/package.json.tmpl?raw
-var package_json_default = "{\n  \"name\": \"workflows\",\n  \"version\": \"0.0.0\",\n  \"type\": \"module\",\n  \"private\": true,\n  \"scripts\": {\n    \"typecheck\": \"tsgo\"\n  },\n  \"dependencies\": {\n    \"@stackbone/sdk\": \"{{sdkVersion}}\",\n    \"workflow\": \"5.0.0-beta.19\",\n    \"zod\": \"4.4.3\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"24.x\",\n    \"@typescript/native-preview\": \"7.0.0-dev.20260523.1\"\n  },\n  \"engines\": {\n    \"node\": \"24.x\"\n  }\n}\n";
+var package_json_default = "{\n  \"name\": \"workflows\",\n  \"version\": \"0.0.0\",\n  \"type\": \"module\",\n  \"private\": true,\n  \"scripts\": {\n    \"typecheck\": \"tsgo\"\n  },\n  \"dependencies\": {\n    \"@stackbone/sdk\": \"{{sdkVersion}}\",\n    \"workflow\": \"5.0.0-beta.19\",\n    \"zod\": \"4.3.6\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"24.x\",\n    \"@typescript/native-preview\": \"7.0.0-dev.20260523.1\"\n  },\n  \"engines\": {\n    \"node\": \"24.x\"\n  }\n}\n";
 //#endregion
 //#region src/services/scaffold/templates/shell/workflows/tsconfig.json?raw
 var tsconfig_default = "{\n  \"compilerOptions\": {\n    \"module\": \"esnext\",\n    \"moduleResolution\": \"bundler\",\n    \"target\": \"esnext\",\n    \"strict\": true,\n    \"skipLibCheck\": true,\n    \"noEmit\": true,\n    \"types\": [\"node\"]\n  },\n  \"include\": [\"**/*.ts\", \"../.stackbone/**/*.d.ts\"]\n}\n";
@@ -72748,7 +72885,10 @@ var DEEP_AGENT_GROUP = "deep-agents";
 * resolvable from the workspace root so the host resolves ONE copy alongside the
 * agent's `@langchain/*`. `zod` is usually already pinned by the workspace shell —
 * {@link mergeMissingWorkspaceDeps} never overwrites an existing version, so it is
-* included only as a safety net for a hand-built workspace.
+* included only as a safety net for a hand-built workspace. Its value is not free:
+* the shell's `@workflow/world` peer-requires ONE exact `zod`, and npm refuses to
+* install a workspace that pins another (PLA-1653), so this entry must stay equal to
+* the two `package.json.tmpl` pins. `scaffold.spec.ts` fails if the three drift.
 */
 var DEEP_AGENT_WORKSPACE_DEPS = Object.freeze({
 	"@langchain/core": "1.2.8",
@@ -72756,7 +72896,7 @@ var DEEP_AGENT_WORKSPACE_DEPS = Object.freeze({
 	"@langchain/langgraph-checkpoint-postgres": "1.0.4",
 	"@langchain/openai": "1.5.3",
 	deepagents: "1.10.5",
-	zod: "4.4.3"
+	zod: "4.3.6"
 });
 /**
 * Generate the FilePlan for a deep agent named `name`: just `deep-agents/<name>/
@@ -76663,8 +76803,15 @@ var REDIS_IMAGE$1 = "redis:7-alpine";
 *
 * Same image and pin as `stackbone dev`'s compose, so the emulator and the
 * deliverable run the identical backend.
+*
+* The community fork, not `minio/minio`. MinIO closed anonymous pulls of its own
+* image on Docker Hub (2026-09-12, PLA-1423) and then on quay.io (401 on every
+* tag by 2026-09-25, PLA-1794). A first-run `stackbone dev`, and the operator
+* running a packaged folder, pull with no credentials. `pgsty/minio` publishes
+* amd64 + arm64, keeps the upstream entrypoint and ships `mc` and `sh`, which the
+* healthcheck and the bucket-init container call.
 */
-var MINIO_IMAGE$1 = "quay.io/minio/minio:RELEASE.2025-03-12T18-04-18Z";
+var MINIO_IMAGE = "pgsty/minio:RELEASE.2026-08-04T00-00-00Z";
 /** Access key the bundled MinIO is created with. The secret is generated per package. */
 var MINIO_ACCESS_KEY = "stackbone";
 /** Bucket the init container creates, and the agent's `STACKBONE_S3_BUCKET`. */
@@ -76762,7 +76909,7 @@ var renderInfraServices = () => `  postgres:
   minio:
     # S3-compatible object storage: the agent's own files (\`client.storage\`), the
     # originals managed RAG ingests, and what Studio's file browser lists.
-    image: ${MINIO_IMAGE$1}
+    image: ${MINIO_IMAGE}
     command: ['server', '/data']
     environment:
       MINIO_ROOT_USER: ${MINIO_ACCESS_KEY}
@@ -76805,7 +76952,7 @@ var renderInfraServices = () => `  postgres:
     # alphabet contains \`-\`, so about one packaged folder in 64 minted one. One
     # of them took \`next\` red on 2026-08-31 (run 33430510314) on a
     # comments-only commit.
-    image: ${MINIO_IMAGE$1}
+    image: ${MINIO_IMAGE}
     restart: 'no'
     depends_on:
       minio:
@@ -80033,7 +80180,6 @@ var readStackboneConfig = async (cwd) => readJsonFile(stackboneConfigPath(cwd),
 //#region src/dev/compose-template.ts
 var POSTGRES_IMAGE = "pgvector/pgvector:pg17";
 var REDIS_IMAGE = "redis:7-alpine";
-var MINIO_IMAGE = "quay.io/minio/minio:RELEASE.2025-03-12T18-04-18Z";
 var PGVECTOR_INIT_SQL = `-- Generated by stackbone dev. Runs once on Postgres first boot via
 -- /docker-entrypoint-initdb.d. The queue extension is gone (BullMQ over Redis
 -- is the only job engine); only pgvector is enabled here.
@@ -85456,7 +85602,7 @@ var createInitCommand = (ctx) => defineCommand({
 	args: {
 		dir: {
 			type: "positional",
-			description: "Target subdirectory. Omit to derive it from --name (or the current directory).",
+			description: "Target subdirectory. Pass `.` to scaffold into the current directory; omitted, a new subdirectory is created, named after --name (or after the current directory).",
 			required: false
 		},
 		with: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stackbone/cli",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "license": "UNLICENSED",
   "type": "module",
   "bin": {