amsd-pipeline 1.9.0 → 1.11.0

package/install.sh

@@ -93,6 +93,16 @@ if [ "$UNINSTALL" = "1" ]; then
             exit 1
         fi
     fi
+    # STOP THE RUNNER HOST FIRST — it is NOT docker-related (a plain host process), so it must not
+    # be skipped by the "no container runtime, nothing to uninstall" exit below.
+    _UN_RH_PIDFILE="$_UN_ROOT/launch-dashboard/.runner-host.pid"
+    _UN_RH_WAS_RUNNING=""
+    [ -f "$_UN_RH_PIDFILE" ] && _UN_RH_WAS_RUNNING="$(cat "$_UN_RH_PIDFILE" 2>/dev/null)"
+    . "$INSTALLER_DIR/lib/runner-host-control.sh"
+    if stop_runner_host "$_UN_ROOT/launch-dashboard" && [ -n "$_UN_RH_WAS_RUNNING" ]; then
+        _ok "stopped runner-host (pid $_UN_RH_WAS_RUNNING)"
+    fi
+
     . "$INSTALLER_DIR/lib/isolated-compose-identity.sh"
     if [ -f "$INSTALLER_DIR/lib/container-runtime.sh" ]; then
         . "$INSTALLER_DIR/lib/container-runtime.sh"
@@ -204,14 +214,33 @@ if [ -n "$DEST" ]; then
             [ -n "$_excl" ] && _RUN_STATE_EXCLUDES+=("$_excl")
         done < <(run_state_exclude_args "$INSTALLER_DIR/run-state-paths.json")
     fi
+
+    # AN UPDATE MUST NEVER OVERWRITE AN OPERATOR'S EXISTING PROJECT CONFIG EITHER — a DIFFERENT
+    # mechanism from the excludes above, deliberately: a blanket exclude would also block a
+    # brand-new project's config.env from ever being extracted the first time a later ref adds
+    # one. Snapshot whatever already exists now, extract, then restore it over what the ref just
+    # wrote — so a first install (or a genuinely new project) is unaffected either way.
+    _OPCFG_TMP=""
+    if [ -f "$INSTALLER_DIR/operator-config-paths.json" ]; then
+        . "$INSTALLER_DIR/lib/preserve-operator-config.sh"
+        _OPCFG_TMP="$(mktemp -d)"
+        snapshot_operator_config "$DEST" "$INSTALLER_DIR/operator-config-paths.json" "$_OPCFG_TMP"
+    fi
+
     # The ${arr[@]+"${arr[@]}"} form, not bare "${arr[@]}": bash <4.4 (macOS ships 3.2 by default,
     # GPLv3 licensing) throws "unbound variable" under `set -u` expanding an empty array the plain
     # way. This form is safe on every bash this installer might run under.
     if ! git -C "$_GIT_ROOT" archive "$_PKG_REF" \
             | tar -x -C "$DEST" "${_RUN_STATE_EXCLUDES[@]+"${_RUN_STATE_EXCLUDES[@]}"}"; then
         _bad "packaging '$_PKG_REF' into $DEST failed"
+        [ -n "$_OPCFG_TMP" ] && rm -rf "$_OPCFG_TMP"
         exit 1
     fi
+
+    if [ -n "$_OPCFG_TMP" ]; then
+        restore_operator_config "$DEST" "$_OPCFG_TMP"
+        rm -rf "$_OPCFG_TMP"
+    fi
     _ok "packaged $_PKG_REF into $DEST"
     ROOT="$DEST"
     CONFIG="$ROOT/orchestrations/config"
@@ -519,6 +548,24 @@ esac
 
 # ── Dashboards: OPTIONAL, and never a reason to fail ────────────────────────
 _head "Dashboards (optional)"
+
+# BUILD BEFORE UP, OR THE HEALTHCHECK FAILS BY CONSTRUCTION. orchestrations/dashboards/live/ is
+# gitignored — eleventy's own build output, never tracked — so on every fresh install it starts
+# EMPTY. agent-monitor's healthcheck probes `/`, nginx has no index and autoindex is off, so a
+# brand-new install was 403-unhealthy FOREVER regardless of docker, subnet or port: found live
+# 2026-09-03, grafana (depends_on agent-monitor: condition service_healthy) never even started —
+# stuck at "Created". Only a completed pipeline run (or this build) ever populated live/ before.
+#
+# Only when there is something to build FROM (src/ present, same test the Build section above
+# uses) — a packaged, src/-less install ships no eleventy at all.
+if [ -d "$ROOT/src" ] && [ -f "$ROOT/package.json" ]; then
+    if (cd "$ROOT" && npm run dashboards:build --silent >/dev/null 2>&1); then
+        _ok "dashboards built — agent-monitor has real content to serve"
+    else
+        _warn "dashboards:build failed — agent-monitor's healthcheck may fail until a run populates it"
+    fi
+fi
+
 # THE PROBE ASKS THE RESOLVED RUNTIME. It said `docker` literally, so on a podman-only machine the
 # installer announced "runtime: podman" and then started nothing — the report and the behaviour
 # disagreeing, which is this file's recurring defect.
@@ -577,6 +624,19 @@ compose_up() {
         rm -f "$_log" 2>/dev/null
         return 1
     fi
+    # PERSISTED so `pipeline-services.sh --start` can bring this exact stack back up later
+    # (after a WSL restart, a deliberate stop) WITHOUT re-rolling a different subnet/port —
+    # `down` (no -v) removes the network, so a later `up` with no env at all would fall back to
+    # the compose file's own default subnet and could collide with the dev stack or another
+    # install. Written fresh on every successful compose_up() — this IS the current identity.
+    {
+        printf 'OBS_PROJECT=%s\n' "$_OBS_PROJECT"
+        printf 'OBS_SUBNET=%s\n' "$_subnet"
+        printf 'OBS_CLICKHOUSE_PORT=%s\n' "$((8123 + _off))"
+        printf 'OBS_LANGFUSE_PORT=%s\n' "$((3100 + _off))"
+        printf 'OBS_DASHBOARD_PORT=%s\n' "$((8092 + _off))"
+        printf 'OBS_GRAFANA_PORT=%s\n' "$((3001 + _off))"
+    } > "$ROOT/.pipeline-services-state.env"
     rm -f "$_log" 2>/dev/null
     return 0
 }
@@ -615,25 +675,69 @@ else
     . "$INSTALLER_DIR/lib/wait-for-health.sh"
     . "$INSTALLER_DIR/lib/isolated-compose-identity.sh"
 
-    # A REAL PASSWORD IS A DECISION ONLY A HUMAN MAKES — never synthesized here. Mirrors the root
-    # .env handling: copy the template so there is something to fill in, never invent a secret.
+    # A VENDOR/API CREDENTIAL IS A DECISION ONLY A HUMAN MAKES — never synthesized (see the root
+    # .env handling: copy the template, never invent a secret). LAUNCH_PASSWORD is a DIFFERENT
+    # risk class: it gates a loopback-only local UI, not a billed vendor account or a shared
+    # system — a blank one previously meant install.sh already knew this stack could not start
+    # (it had just written this exact warning) and then attempted `up -d` anyway, hard-failing on
+    # compose's `${LAUNCH_PASSWORD:?...}` interpolation instead of the warning it already gave.
+    #
+    # Operator decision 2026-09-04, SUPERSEDING the 2026-09-03 random-generation decision: a
+    # RANDOM value made every install's password unknowable without reading the file, and
+    # unrecoverable once a running container had it in memory — copying a newer .env over an
+    # older one (exactly what moving credentials between two installs looks like) silently
+    # desynced the file from the live process, and the only fix was a manual docker restart.
+    # A FIXED, KNOWN default removes the ambiguity entirely: every fresh install starts on the
+    # same well-known password, printed here and in the file either way, and the change-password
+    # flow (Flutter UI, not this script) is how an operator actually secures it afterward.
+    _DEFAULT_LAUNCH_PW="abcd1234"
     if [ ! -f "$LAUNCH_DIR/.env" ]; then
         if [ -f "$LAUNCH_DIR/.env.example" ]; then
             cp "$LAUNCH_DIR/.env.example" "$LAUNCH_DIR/.env"
-            _warn "launch-dashboard/.env created from .env.example — FILL IN LAUNCH_PASSWORD before it can start"
+            # REPLACE the template's blank line in place — never append a second
+            # LAUNCH_PASSWORD= key. Both parse fine (bash sourcing takes the last one) but a
+            # duplicate key is a needless trap for whoever reads this file by hand next.
+            if grep -q '^LAUNCH_PASSWORD=' "$LAUNCH_DIR/.env"; then
+                _LD_TMP="$(mktemp)"
+                sed "s|^LAUNCH_PASSWORD=.*|LAUNCH_PASSWORD=$_DEFAULT_LAUNCH_PW|" "$LAUNCH_DIR/.env" > "$_LD_TMP" \
+                    && mv "$_LD_TMP" "$LAUNCH_DIR/.env"
+            else
+                printf '\nLAUNCH_PASSWORD=%s\n' "$_DEFAULT_LAUNCH_PW" >> "$LAUNCH_DIR/.env"
+            fi
+            _ok "launch-dashboard/.env created with the default LAUNCH_PASSWORD"
+            printf '      LAUNCH_PASSWORD: %s\n' "$_DEFAULT_LAUNCH_PW"
+            printf '      CHANGE THIS after your first login — it is the same on every fresh install.\n'
         else
             _bad "launch-dashboard/.env is missing and there is no .env.example to create one from"
             FAILED=1
         fi
     fi
 
+    # PRE-CREATE THE BIND-MOUNT SOURCES, AS THE HOST USER, BEFORE DOCKER EVER SEES THEM.
+    #
+    # The compose file's own comment above (services.launch-api) already names this exact trap: a
+    # bind mount onto a directory that doesn't exist yet gets auto-created BY DOCKER, as root — and
+    # launch-api's own `user: "${LAUNCH_UID:-1000}:..."` then cannot write to it. Found live
+    # 2026-09-03 against a genuinely fresh install: "unable to open database file", launch-api
+    # crash-looping, nginx's launch-ui reporting "host not found in upstream" as a downstream
+    # symptom of the crash — same bug CLASS as the dashboards live/ directory fixed above, here for
+    # ./data and ./spool specifically.
+    mkdir -p "$LAUNCH_DIR/data" "$LAUNCH_DIR/spool"
+
     _LD_PORT="$(grep -E '^LAUNCH_UI_PORT=' "$LAUNCH_DIR/.env" 2>/dev/null | tail -1 | cut -d= -f2)"
     _LD_PORT="${_LD_PORT:-8099}"
     _LD_PROJECT="$(isolated_project_name "$ROOT" launch)"
     _LD_HEALTH_URL="http://localhost:${_LD_PORT}/api/health"
 
+    _LD_PW="$(grep -E '^LAUNCH_PASSWORD=' "$LAUNCH_DIR/.env" 2>/dev/null | tail -1 | cut -d= -f2-)"
     if [ ! -f "$LAUNCH_DIR/.env" ]; then
         LAUNCH_STATUS=failed
+    elif [ -z "$_LD_PW" ] && [ "$CHECK_ONLY" != "1" ]; then
+        # KNOWN ALREADY, NEVER A SURPRISE CRASH. A .env from before LAUNCH_PASSWORD was
+        # auto-generated (or one an operator deliberately blanked) still fails compose's
+        # `${LAUNCH_PASSWORD:?...}` interpolation — skip the attempt instead of hitting it.
+        LAUNCH_STATUS=failed
+        _warn "launch-dashboard/.env has no LAUNCH_PASSWORD — skipping start; set one and re-run to bring it up"
     elif [ "$CHECK_ONLY" = "1" ]; then
         if wait_for_health "$_LD_HEALTH_URL" 3 1; then
             LAUNCH_STATUS=up
@@ -683,6 +787,13 @@ else
         elif wait_for_health "$_LD_HEALTH_URL" "$LAUNCH_HEALTH_TRIES" "$LAUNCH_HEALTH_INTERVAL"; then
             LAUNCH_STATUS=up
             _ok "up and healthy at $_LD_HEALTH_URL (project: $_LD_PROJECT, subnet: $_LD_SUBNET)"
+            # Same reason as the observability stack's own state file — appended, not truncated:
+            # that one is always written first in a single install.sh run.
+            {
+                printf 'LAUNCH_PROJECT=%s\n' "$_LD_PROJECT"
+                printf 'LAUNCH_SUBNET=%s\n' "$_LD_SUBNET"
+                printf 'LAUNCH_UI_PORT=%s\n' "$_LD_PORT"
+            } >> "$ROOT/.pipeline-services-state.env"
         else
             LAUNCH_STATUS=unhealthy
             _bad "containers started but never answered healthy at $_LD_HEALTH_URL"
@@ -692,6 +803,24 @@ else
     fi
 fi
 
+# ── Runner host: what actually launches a pipeline run from the dashboard ────
+# "the install script must start all services" (operator, 2026-09-04) — a saved launch request
+# sat "pending" forever with nothing polling for it, because nothing ever started this.
+#
+# NOT DOCKERIZED, DELIBERATELY — same as runner-host.js's own header says: "a container cannot
+# exec a host process." It spawns the pipeline's real launcher on the HOST, which needs git access
+# to the codeline root, the claude/codemie-claude CLI's host auth (~/.claude — a container has none
+# of this unless it were bind-mounted in), and host git credentials for anything that pushes.
+# Containerizing the poll loop alone is easy (the spool it watches is already bind-mounted into
+# launch-api); containerizing what it SPAWNS on a hit would mean containerizing the whole pipeline.
+_head "Runner host (launches pipeline runs the dashboard queues)"
+if [ "$LAUNCH_STATUS" = "up" ]; then
+    . "$INSTALLER_DIR/lib/runner-host-control.sh"
+    start_runner_host "$ROOT" "$LAUNCH_DIR" || FAILED=1
+else
+    _ok "skipped — launch dashboard status is '$LAUNCH_STATUS', nothing to poll for"
+fi
+
 # ── The command people will actually type ───────────────────────────────────
 # ── What this install IS ──────────────────────────────────────────────────────
 # An install whose mode can only be inferred from which containers happen to be running is an

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amsd-pipeline",
-  "version": "1.9.0",
+  "version": "1.11.0",
   "description": "Installer for the amsd-pipeline orchestration stack. Clones, packages and provisions the full stack with one command — no separate git clone step.",
   "bin": {
     "amsd-pipeline": "bin/amsd-pipeline.js"