aidevops 3.13.0 → 3.13.2

package/setup-modules/tool-install.sh

@@ -51,6 +51,7 @@ setup_git_clis() {
 			echo ""
 			setup_prompt install_git_clis "Install Git CLI tools (${missing_packages[*]}) using $pkg_manager? [Y/n]: " "Y"
 
+			# shellcheck disable=SC2154  # set indirectly by setup_prompt via read
 			if [[ "$install_git_clis" =~ ^[Yy]?$ ]]; then
 				print_info "Installing ${missing_packages[*]}..."
 				if install_packages "$pkg_manager" "${missing_packages[@]}"; then
@@ -233,6 +234,7 @@ setup_file_discovery_tools() {
 		if [[ "$pkg_manager" != "unknown" ]]; then
 			setup_prompt install_fd_tools "Install file discovery tools (${missing_packages[*]}) using $pkg_manager? [Y/n]: " "Y"
 
+			# shellcheck disable=SC2154  # set indirectly by setup_prompt via read
 			if [[ "$install_fd_tools" =~ ^[Yy]?$ ]]; then
 				_install_file_discovery_packages "$pkg_manager" "${missing_packages[@]}"
 			else
@@ -272,6 +274,7 @@ setup_rtk() {
 
 		setup_prompt install_rtk "Install rtk for token-optimized CLI output? [y/N]: " "n"
 
+		# shellcheck disable=SC2154  # set indirectly by setup_prompt via read
 		if [[ "$install_rtk" =~ ^[Yy]$ ]]; then
 			VERIFIED_INSTALL_SHELL="sh"
 			if command -v brew >/dev/null 2>&1; then
@@ -1922,6 +1925,7 @@ setup_orbstack_vm() {
 	fi
 
 	setup_prompt install_orb "Install OrbStack? [y/N]: " "n"
+	# shellcheck disable=SC2154  # set indirectly by setup_prompt via read
 	if [[ "$install_orb" =~ ^[Yy]$ ]]; then
 		if run_with_spinner "Installing OrbStack" brew install --cask orbstack; then
 			print_success "OrbStack installed"
@@ -1965,3 +1969,88 @@ setup_ai_orchestration() {
 
 	return 0
 }
+
+# Prompt to install Ollama when the knowledge plane is enabled.
+# Called from _setup_run_interactive when the user opts in.
+# Installs Ollama and pulls the recommended fast model (llama3.1:8b).
+# The reasoning model (llama3.1:70b) and embed model are suggested but not
+# pulled automatically due to their large size (39 GB and 274 MB respectively).
+setup_ollama_for_knowledge() {
+	print_info "Ollama — local LLM for knowledge plane (pii/sensitive/privileged tiers)"
+	print_info "Required for: tier:pii, tier:sensitive, tier:privileged routing."
+
+	# Check if Ollama is already installed
+	if command -v ollama >/dev/null 2>&1; then
+		local version
+		version=$(ollama --version 2>/dev/null | grep -o '[0-9][0-9.]*' | head -1) || version="unknown"
+		print_success "Ollama already installed (version: ${version})"
+	else
+		print_info "Ollama not found."
+		if [[ "$(uname -s)" == "Darwin" ]] && command -v brew >/dev/null 2>&1; then
+			print_info "Installing Ollama via Homebrew..."
+			if brew install ollama 2>/dev/null; then
+				print_success "Ollama installed via Homebrew"
+			else
+				print_warning "Homebrew install failed. Download from https://ollama.com"
+				return 0
+			fi
+		else
+			print_info "Install Ollama manually from https://ollama.com"
+			print_info "Then re-run this setup to pull the recommended models."
+			return 0
+		fi
+	fi
+
+	# Deploy the bundle config template
+	local bundle_dir="$HOME/.aidevops/configs"
+	local bundle_dest="${bundle_dir}/ollama-bundle.json"
+	local bundle_src
+	bundle_src="${BASH_SOURCE[0]%/*}/../.agents/templates/ollama-bundle.json"
+	if [[ ! -f "$bundle_src" ]]; then
+		bundle_src="$HOME/.aidevops/agents/templates/ollama-bundle.json"
+	fi
+	if [[ -f "$bundle_src" ]] && [[ ! -f "$bundle_dest" ]]; then
+		mkdir -p "$bundle_dir"
+		cp "$bundle_src" "$bundle_dest"
+		print_success "Ollama bundle config deployed: ${bundle_dest}"
+	fi
+
+	# Start Ollama service if not running
+	if ! curl -sf "http://localhost:11434/api/tags" >/dev/null 2>&1; then
+		print_info "Starting Ollama service..."
+		ollama serve >/dev/null 2>&1 &
+		local i=0
+		while [[ $i -lt 10 ]]; do
+			if curl -sf "http://localhost:11434/api/tags" >/dev/null 2>&1; then
+				break
+			fi
+			sleep 1
+			i=$((i + 1))
+		done
+	fi
+
+	# Pull the fast model (minimum required for pii/sensitive tiers)
+	print_info "Pulling minimum required model: llama3.1:8b (~4.9 GB)"
+	print_info "This is required for tier:pii and tier:sensitive routing."
+	if ollama pull llama3.1:8b 2>/dev/null; then
+		print_success "llama3.1:8b pulled successfully"
+	else
+		print_warning "Failed to pull llama3.1:8b. Run manually: ollama pull llama3.1:8b"
+	fi
+
+	# Pull the embed model (small — pull automatically)
+	print_info "Pulling embed model: nomic-embed-text (~274 MB)"
+	if ollama pull nomic-embed-text 2>/dev/null; then
+		print_success "nomic-embed-text pulled successfully"
+	else
+		print_warning "Failed to pull nomic-embed-text. Run manually: ollama pull nomic-embed-text"
+	fi
+
+	print_info ""
+	print_info "Optional: pull the reasoning model for tier:privileged (~39 GB, requires 48+ GB RAM):"
+	print_info "  ollama pull llama3.1:70b"
+	print_info ""
+	print_info "Verify: ollama-helper.sh health"
+
+	return 0
+}

package/setup.sh

@@ -12,7 +12,7 @@ shopt -s inherit_errexit 2>/dev/null || true
 # AI Assistant Server Access Framework Setup Script
 # Helps developers set up the framework for their infrastructure
 #
-# Version: 3.13.0
+# Version: 3.13.2
 #
 # Quick Install:
 #   npm install -g aidevops && aidevops update          (recommended)
@@ -142,6 +142,31 @@ _cron_escape() {
 	return 0
 }
 
+# GH#21060 / t2911: Per-stage timing helper for non-interactive setup runs.
+# Wraps a function call, records start/end time, and appends one TSV line to
+# $HOME/.aidevops/logs/setup-stage-timings.log:
+#   iso8601_utc <TAB> stage_name <TAB> duration_seconds <TAB> exit_code
+# Usage: _time_step "stage_name" function_name [args...]
+# ShellCheck: $@ is used deliberately (SC2068 not applicable; no word-splitting
+# issue since we shift the stage-name arg first and pass the rest as a command).
+_time_step() {
+	local _ts_stage="$1"
+	shift
+	local _ts_start _ts_end _ts_duration _ts_exit
+	_ts_start=$(date +%s.%N 2>/dev/null || date +%s)
+	_ts_exit=0
+	"$@" || _ts_exit=$?
+	_ts_end=$(date +%s.%N 2>/dev/null || date +%s)
+	_ts_duration=$(awk -v a="$_ts_start" -v b="$_ts_end" 'BEGIN { printf "%.2f", b - a }')
+	printf '%s\t%s\t%s\t%s\n' \
+		"$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+		"$_ts_stage" \
+		"$_ts_duration" \
+		"$_ts_exit" \
+		>>"$HOME/.aidevops/logs/setup-stage-timings.log" 2>/dev/null || true
+	return "$_ts_exit"
+}
+
 # Resolve the canonical main worktree path for the current repo.
 # When setup.sh is run from a linked worktree, launchd/cron should still point
 # autonomous services at the main repo checkout, not the feature worktree.
@@ -1027,62 +1052,116 @@ setup_knowledge_planes() {
 	return 0
 }
 
+# Provision cases planes for all repos in repos.json where cases != "off".
+# Idempotent: already-provisioned directories are not modified.
+# Called from the non-interactive setup path (update) and after interactive init.
+setup_cases_planes() {
+	local repos_file="$HOME/.config/aidevops/repos.json"
+	local helper
+	helper="${BASH_SOURCE[0]%/*}/.agents/scripts/case-helper.sh"
+	if [[ ! -f "$helper" ]]; then
+		helper="$HOME/.aidevops/agents/scripts/case-helper.sh"
+	fi
+	if [[ ! -f "$helper" ]]; then
+		print_warning "case-helper.sh not found — skipping cases plane provisioning"
+		return 0
+	fi
+	if [[ ! -f "$repos_file" ]]; then
+		return 0
+	fi
+	if ! command -v jq &>/dev/null; then
+		print_warning "jq not installed — skipping cases plane provisioning"
+		return 0
+	fi
+	local repo_path mode
+	while IFS=$'\t' read -r repo_path mode; do
+		[[ -z "$repo_path" || "$mode" == "off" ]] && continue
+		if [[ ! -d "$repo_path" ]]; then
+			print_warning "cases-plane: repo path not found: $repo_path"
+			continue
+		fi
+		bash "$helper" init "$repo_path" || print_warning "cases-plane: init failed for $repo_path"
+	done < <(jq -r '.initialized_repos[] | select(.cases != null and .cases != "off") | [.path, .cases] | @tsv' "$repos_file" 2>/dev/null || true)
+	return 0
+}
+
 # Non-interactive path: deploy agents and run safe migrations only (no prompts).
+# GH#21060 / t2911: Every direct function call is wrapped with _time_step so
+# that a one-line-per-stage TSV timing record is appended to
+# $HOME/.aidevops/logs/setup-stage-timings.log for post-run diagnostics.
 _setup_run_non_interactive() {
 	print_info "Non-interactive mode: deploying agents and running safe migrations only"
-	verify_location
-	check_requirements
+
+	# GH#21060: Initialise per-stage timing log; rotate if over 10K lines / 1MB.
+	local _stl
+	_stl="$HOME/.aidevops/logs/setup-stage-timings.log"
+	mkdir -p "$(dirname "$_stl")" 2>/dev/null || true
+	if [[ -f "$_stl" ]]; then
+		local _stl_lines _stl_bytes
+		_stl_lines=$(wc -l <"$_stl" 2>/dev/null || echo "0")
+		_stl_bytes=$(wc -c <"$_stl" 2>/dev/null || echo "0")
+		# Strip whitespace that wc adds on some platforms
+		_stl_lines="${_stl_lines//[[:space:]]/}"
+		_stl_bytes="${_stl_bytes//[[:space:]]/}"
+		if [[ "${_stl_lines:-0}" -gt 10000 ]] || [[ "${_stl_bytes:-0}" -gt 1048576 ]]; then
+			: >"$_stl" 2>/dev/null || true
+			print_info "setup-stage-timings.log rotated (was ${_stl_lines} lines / ${_stl_bytes} bytes)"
+		fi
+	fi
+
+	_time_step "verify_location" verify_location
+	_time_step "check_requirements" check_requirements
 	# Run quality tool detection in non-interactive mode too (warn-only path).
-	check_quality_tools
+	_time_step "check_quality_tools" check_quality_tools
 	# Check setsid availability; auto-install util-linux on macOS if missing
 	# (GH#21102 / t2926: missing setsid kills workers on every pulse restart).
-	setup_setsid_advisory
-	check_python_upgrade_available
-	set_permissions
-	migrate_old_backups
-	migrate_loop_state_directories
-	migrate_agent_to_agents_folder
-	migrate_mcp_env_to_credentials
-	migrate_pulse_repos_to_repos_json
-	cleanup_deprecated_paths
-	migrate_orphaned_supervisor
-	backfill_issue_relationships
-	cleanup_deprecated_mcps
-	cleanup_stale_bun_opencode
-	cleanup_stale_health_issue_caches
-	cleanup_worktree_entries_in_repos_json
-	_cleanup_legacy_model_config
+	_time_step "setup_setsid_advisory" setup_setsid_advisory
+	_time_step "check_python_upgrade_available" check_python_upgrade_available
+	_time_step "set_permissions" set_permissions
+	_time_step "migrate_old_backups" migrate_old_backups
+	_time_step "migrate_loop_state_directories" migrate_loop_state_directories
+	_time_step "migrate_agent_to_agents_folder" migrate_agent_to_agents_folder
+	_time_step "migrate_mcp_env_to_credentials" migrate_mcp_env_to_credentials
+	_time_step "migrate_pulse_repos_to_repos_json" migrate_pulse_repos_to_repos_json
+	_time_step "cleanup_deprecated_paths" cleanup_deprecated_paths
+	_time_step "migrate_orphaned_supervisor" migrate_orphaned_supervisor
+	_time_step "backfill_issue_relationships" backfill_issue_relationships
+	_time_step "cleanup_deprecated_mcps" cleanup_deprecated_mcps
+	_time_step "cleanup_stale_bun_opencode" cleanup_stale_bun_opencode
+	_time_step "cleanup_stale_health_issue_caches" cleanup_stale_health_issue_caches
+	_time_step "cleanup_worktree_entries_in_repos_json" cleanup_worktree_entries_in_repos_json
+	_time_step "_cleanup_legacy_model_config" _cleanup_legacy_model_config
 	# t2888: install/heal opencode-ai. Companion to t2887's runtime canary
 	# fail-fast -- t2887 detects when $OPENCODE_BIN_DEFAULT is wrong, this
 	# one fixes it by reinstalling opencode-ai@latest (overwriting any bin
 	# collision with @anthropic-ai/claude-code or similar). Skipping this
 	# in non-interactive mode is the bug PR #20189 introduced and what
 	# alex-solovyev's runner spam stemmed from.
-	setup_opencode_cli
-	validate_opencode_config
-	deploy_aidevops_agents
-	_setup_install_pulse_plist_early
-	_deploy_hotfix_config
-	sync_agent_sources
-	install_aidevops_cli
-	setup_shellcheck_wrapper
+	_time_step "setup_opencode_cli" setup_opencode_cli
+	_time_step "validate_opencode_config" validate_opencode_config
+	_time_step "deploy_aidevops_agents" deploy_aidevops_agents
+	_time_step "_setup_install_pulse_plist_early" _setup_install_pulse_plist_early
+	_time_step "_deploy_hotfix_config" _deploy_hotfix_config
+	_time_step "sync_agent_sources" sync_agent_sources
+	_time_step "install_aidevops_cli" install_aidevops_cli
+	_time_step "setup_shellcheck_wrapper" setup_shellcheck_wrapper
 	if is_feature_enabled safety_hooks 2>/dev/null; then
-		setup_safety_hooks
+		_time_step "setup_safety_hooks" setup_safety_hooks
 	fi
-	init_settings_json
+	_time_step "init_settings_json" init_settings_json
 
 	# Parallelise independent skill operations (t1356: ~84s serial -> ~18s parallel)
 	# generate_agent_skills must complete before create_skill_symlinks (symlinks
 	# depend on generated SKILL.md files). scan_imported_skills is independent.
 	local _pid_symlinks=""
-	if generate_agent_skills; then
-		create_skill_symlinks &
+	if _time_step "generate_agent_skills" generate_agent_skills; then
+		_time_step "create_skill_symlinks" create_skill_symlinks &
 		_pid_symlinks=$!
 	else
 		print_warning "Agent skills generation failed — skipping skill symlinks"
 	fi
 
-	scan_imported_skills &
+	_time_step "scan_imported_skills" scan_imported_skills &
 	local _pid_scan=$!
 
 	if [[ -n "$_pid_symlinks" ]]; then
@@ -1090,42 +1169,44 @@ _setup_run_non_interactive() {
 	fi
 	wait "$_pid_scan" 2>/dev/null || print_warning "Skill security scan encountered issues (non-critical)"
 
-	inject_agents_reference
-	deploy_agents_to_runtimes
-	update_opencode_config
-	update_claude_config
-	update_codex_config
-	update_cursor_config
-	disable_ondemand_mcps
+	_time_step "inject_agents_reference" inject_agents_reference
+	_time_step "deploy_agents_to_runtimes" deploy_agents_to_runtimes
+	_time_step "update_opencode_config" update_opencode_config
+	_time_step "update_claude_config" update_claude_config
+	_time_step "update_codex_config" update_codex_config
+	_time_step "update_cursor_config" update_cursor_config
+	_time_step "disable_ondemand_mcps" disable_ondemand_mcps
 	# Scaffold personal routines repo if not already present (idempotent).
 	# Creates local git repo + private GitHub remote for personal repo only.
 	# Org repos require explicit: aidevops init-routines --org <name>
-	setup_routines
+	_time_step "setup_routines" setup_routines
 	# Install/refresh the privacy-guard pre-push hook in every initialized
 	# repo so TODO/todo/README/ISSUE_TEMPLATE pushes to public GitHub repos
 	# are scanned for private slug leaks (t1968).
-	setup_privacy_guard
+	_time_step "setup_privacy_guard" setup_privacy_guard
 	# Install/refresh the complexity-regression pre-push hook in every
 	# initialized repo so pushes that introduce new function-complexity,
 	# nesting-depth, or file-size violations are caught before CI (t2198).
-	setup_complexity_guard
+	_time_step "setup_complexity_guard" setup_complexity_guard
 	# Install/refresh the canonical-on-main post-checkout hook in every
 	# initialized repo so branch switches away from main in the canonical
 	# directory are warned against (t1995). Complements pre-edit-check.sh's
 	# t1990 edit-time check by catching the branch switch itself.
-	setup_canonical_guard
+	_time_step "setup_canonical_guard" setup_canonical_guard
 	# Install/refresh the task-id collision guard commit-msg hook in every
 	# initialized repo so invented t-IDs in commit subjects are rejected
 	# at commit time (t2047). Belt-and-braces with the CI check in
-	# .github/workflows/ta[redacted-credential].yml.
-	setup_task_id_guard
+	# .github/workflows/task-id-collision-check.yml.
+	_time_step "setup_task_id_guard" setup_task_id_guard
 	# Apply Spotlight + Time Machine exclusions to every worktree across
 	# registered repos so the backup/index cascade triggered by node_modules
 	# copies doesn't burn CPU (t2885). Idempotent. macOS only — Linux
 	# indexers tracked separately.
-	setup_worktree_exclusions
+	_time_step "setup_worktree_exclusions" setup_worktree_exclusions
 	# Provision knowledge planes for repos where knowledge != "off" (idempotent).
-	setup_knowledge_planes
+	_time_step "setup_knowledge_planes" setup_knowledge_planes
+	# Provision cases planes for repos where cases != "off" (idempotent).
+	_time_step "setup_cases_planes" setup_cases_planes
 	return 0
 }
 
@@ -1210,6 +1291,7 @@ _setup_run_interactive() {
 	confirm_step "Setup QuickFile MCP (UK accounting)" && setup_quickfile_mcp
 	confirm_step "Setup browser automation tools" && setup_browser_tools
 	confirm_step "Setup AI orchestration frameworks info" && setup_ai_orchestration
+	confirm_step "Setup Ollama (local LLM for knowledge plane pii/sensitive/privileged tiers)" && setup_ollama_for_knowledge
 	confirm_step "Setup Google Workspace CLI (Gmail, Calendar, Drive)" && setup_google_workspace_cli
 	confirm_step "Setup OpenCode CLI (AI coding tool)" && setup_opencode_cli
 	confirm_step "Setup OpenCode plugins" && setup_opencode_plugins
@@ -1350,6 +1432,7 @@ _setup_post_setup_steps() {
 	setup_contribution_watch
 	setup_complexity_scan
 	setup_pulse_merge_routine
+	setup_peer_productivity_monitor
 	setup_draft_responses
 	setup_profile_readme
 	setup_oauth_token_refresh