create-op-node 0.10.17 → 0.11.1

package/README.md

@@ -10,7 +10,7 @@ npx create-op-node
 That's it. The wizard walks you through:
 
 1. **Cloudflare** — verifies your API token's 5 scopes (Zone Read, DNS Edit, Tunnel Edit, R2 Storage Edit, Pages Edit). Fails fast with a specific scope name if anything's missing.
-2. **GitHub** — creates your region's node repo from the [`OpusPopuli/opuspopuli-node`](https://github.com/OpusPopuli/opuspopuli-node) template via the GitHub API. Seeds the 5 required GitHub Secrets (Cloudflare token, account ID, zone ID, Terraform Cloud token, TFC org) for you.
+2. **GitHub** — creates your region's node repo from the [`OpusPopuli/opuspopuli-node`](https://github.com/OpusPopuli/opuspopuli-node) template via the GitHub API. Seeds the 5 required GitHub Secrets (Cloudflare token, account ID, zone ID, Terraform Cloud token, TFC org) for you — sealed-box encrypted with the repo's public key and PUT under your own token, never shelled out to `gh`. Your GitHub token therefore needs **Contents: write + Actions Secrets: write + Pull requests: write** (fine-grained), or `repo` scope (classic).
 3. **Terraform Cloud** — verifies your TFC token, prepares the workspace.
 4. **First PR** — writes `environments/prod.tfvars` from your answers, commits, opens the first PR. The node repo's `cloudflare-infra.yml` workflow runs `terraform plan` against the PR; on merge to `main` it applies — Tunnel, DNS, R2 buckets, and Pages project come up automatically.
 5. **pgsodium master key** — generates a fresh 64-hex root key, stores it in your **macOS login Keychain** as `org.opuspopuli.<region>/pgsodium-root-key`. No third-party password manager required.
@@ -26,7 +26,7 @@ Then on the Mac Studio itself:
 npx create-op-node bootstrap
 ```
 
-Configures macOS power settings, installs Homebrew + the CLI tool list, sets up Docker Desktop + Tailscale + Ollama, clones the node repo you created, reads the pgsodium key + Tunnel token from the Studio's Keychain (or prompts you to paste them once, then persists for re-runs), writes the LaunchAgent plist, logs into ghcr.io, pulls + warms the LLM model, and finally `docker compose --profile public pull && up -d` brings the whole stack online. Health-check loop waits until all containers are `(healthy)`.
+Configures macOS power settings, installs Homebrew + the CLI tool list, sets up Docker Desktop + Tailscale + Ollama, clones the node repo you created, reads the pgsodium key + Tunnel token from the Studio's Keychain (or prompts you to paste them once, then persists for re-runs), writes the LaunchAgent plist, logs into ghcr.io, pulls + warms the LLM model, **verifies the cosign signature of every `ghcr.io/opuspopuli/*` image before pulling** (fail-closed — `--skip-signature-check` to bypass), and finally `docker compose --profile public pull && up -d` brings the whole stack online. Health-check loop waits until all containers are `(healthy)`.
 
 ### Choosing the LLM model
 
@@ -510,7 +510,7 @@ The CLI itself never holds any credentials beyond the scope of a single command
 
 **`init` — fully wired.** Full Phase 1 of the runbook: prompts → Cloudflare 5-scope probe → Terraform Cloud verify → GitHub template clone → 5 repo secrets seeded → branch + prod.tfvars committed → PR opened → pgsodium key generated → (after operator merges PR) Terraform apply polled → Tunnel token retrieved + saved to the macOS Keychain.
 
-**`bootstrap` — fully wired.** Phase 2 on the Mac Studio: macOS sanity (auto-restart, disk sleep), Homebrew + tool installs (gh, pnpm, jq, cloudflared, rclone, ollama, docker, tailscale), GitHub + Tailscale signin prompts, pgsodium key + Tunnel token read from the Studio's Keychain (or pasted in once if first run on that machine, then persisted), LaunchAgent written + loaded, ghcr.io login, Ollama models pulled + warmed, region repo located or cloned, `docker compose pull && up -d`, health-check loop until everything reports `(healthy)`.
+**`bootstrap` — fully wired.** Phase 2 on the Mac Studio: macOS sanity (auto-restart, disk sleep), Homebrew + tool installs (gh, pnpm, jq, cloudflared, rclone, ollama, cosign, docker, tailscale), GitHub + Tailscale signin prompts, pgsodium key + Tunnel token read from the Studio's Keychain (or pasted in once if first run on that machine, then persisted), LaunchAgent written + loaded, ghcr.io login, Ollama models pulled + warmed, region repo located or cloned, cosign signature verification of the `ghcr.io/opuspopuli/*` images (fail-closed; `--skip-signature-check` bypasses, `--certificate-identity-regexp` overrides the pinned identity), `docker compose pull && up -d`, health-check loop until everything reports `(healthy)`.
 
 **`verify` — scaffold stub.** Type-safe argument parsing only; prints a roadmap-style message and exits.
 

package/dist/cli.js

@@ -1304,6 +1304,8 @@ var STUDIO_PACKAGES = [
   { name: "cloudflared", kind: "formula" },
   { name: "rclone", kind: "formula" },
   { name: "ollama", kind: "formula" },
+  // Required for the fail-closed image-signature gate in `bootstrap` (#34).
+  { name: "cosign", kind: "formula" },
   { name: "docker", kind: "cask" },
   { name: "tailscale", kind: "cask" }
 ];
@@ -1507,7 +1509,11 @@ function validatePlistInput(input) {
 }
 function buildSetenvCommand(input) {
   return [
-    `launchctl setenv PGSODIUM_ROOT_KEY "$(cat ${input.keyFilePath})"`,
+    // Quote the path inside `cat` so a space-containing keyFilePath (allowed by
+    // SAFE_PATH_RE) doesn't word-split and leave PGSODIUM_ROOT_KEY empty. The
+    // regex rejects `"`/`$`/backticks, so the inner quotes can't be broken out
+    // of — this is word-split safety, not new injection surface. (#36)
+    `launchctl setenv PGSODIUM_ROOT_KEY "$(cat "${input.keyFilePath}")"`,
     ...input.tunnelToken !== void 0 ? [`launchctl setenv TUNNEL_TOKEN "${input.tunnelToken}"`] : [],
     ...input.llmModel !== void 0 ? [`launchctl setenv LLM_MODEL "${input.llmModel}"`] : [],
     ...input.embeddingModel !== void 0 ? [`launchctl setenv EMBEDDINGS_MODEL "${input.embeddingModel}"`] : [],
@@ -1584,7 +1590,7 @@ async function teardownLaunchAgent(paths, opts = {}) {
   const unload = await safeExeca("launchctl", ["unload", paths.plistFile]);
   steps.push({
     step: "unload",
-    ok: true,
+    ok: unload !== null,
     ...unload === null ? { reason: "`launchctl` not on PATH" } : {}
   });
   try {
@@ -1842,6 +1848,15 @@ async function composePull(opts) {
   const res = await safeExeca("docker", composeArgs(opts, ["pull"]), execOpts(opts));
   return result(res, "compose pull");
 }
+var OPUSPOPULI_IMAGE_PREFIX = "ghcr.io/opuspopuli/";
+async function composeConfigImages(opts) {
+  const res = await safeExeca("docker", composeArgs(opts, ["config", "--images"]), execOpts(opts));
+  if (res === null || res.exitCode !== 0) return null;
+  return res.stdout.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+}
+function filterVerifiableImages(images, prefix = OPUSPOPULI_IMAGE_PREFIX) {
+  return images.filter((img) => img.startsWith(prefix));
+}
 async function composeUp(opts) {
   const res = await safeExeca("docker", composeArgs(opts, ["up", "-d", "--remove-orphans"]), execOpts(opts));
   return result(res, "compose up");
@@ -1984,6 +1999,37 @@ function assessAllRunning(snapshots) {
   return { kind: "healthy" };
 }
 
+// src/lib/cosign.ts
+var COSIGN_OIDC_ISSUER = "https://token.actions.githubusercontent.com";
+var DEFAULT_IDENTITY_REGEXP = "^https://github\\.com/OpusPopuli/opuspopuli/\\.github/workflows/release\\.yml@refs/heads/.*$";
+async function cosignVerifyImage(input) {
+  const idRegex = input.certificateIdentityRegexp ?? DEFAULT_IDENTITY_REGEXP;
+  const issuer = input.certificateOidcIssuer ?? COSIGN_OIDC_ISSUER;
+  const res = await safeExeca("cosign", [
+    "verify",
+    "--certificate-identity-regexp",
+    idRegex,
+    "--certificate-oidc-issuer",
+    issuer,
+    input.image
+  ]);
+  if (res === null) {
+    return {
+      ok: false,
+      skipped: true,
+      reason: "`cosign` not on PATH (install with `brew install cosign` and rerun to enable signature checks)"
+    };
+  }
+  if (res.exitCode !== 0) {
+    return {
+      ok: false,
+      skipped: false,
+      reason: `cosign verify ${input.image} failed (${res.exitCode ?? "signal"}): ${res.stderr || res.stdout}`
+    };
+  }
+  return { ok: true, output: res.stdout || res.stderr };
+}
+
 // src/lib/ollama.ts
 var OLLAMA_URL = "http://localhost:11434";
 var OLLAMA_HEALTH_TIMEOUT_MS = 5e3;
@@ -2197,6 +2243,16 @@ var bootstrapCommand = new Command("bootstrap").description(
     "Remote prompt-service URL. Only meaningful for --node-type=region (default: https://prompts.opuspopuli.org). Ignored for --node-type=region-with-prompts (the overlay pins it to http://opuspopuli-prompts:3210)."
   )
 ).addOption(new Option("--skip-stack", "Stop before `docker compose pull && up`").default(false)).addOption(
+  new Option(
+    "--skip-signature-check",
+    "Bypass the fail-closed cosign verification of opuspopuli images before pull (NOT recommended \u2014 trusts the registry unverified)."
+  ).default(false)
+).addOption(
+  new Option(
+    "--certificate-identity-regexp <regexp>",
+    "Override the cosign certificate-identity regexp used to verify images (escape valve for the pinned default)."
+  )
+).addOption(
   new Option(
     "--local-only",
     "Run for local dev / testing: no Tunnel token required, cloudflared stays down. Auto-generates the pgsodium key if not in Keychain (init unnecessary)."
@@ -2666,6 +2722,62 @@ function buildComposeEnv(args) {
     ...embeddingModel ? { EMBEDDINGS_MODEL: embeddingModel } : {}
   };
 }
+function planSignatureGate(allImages, opts) {
+  if (opts.skipSignatureCheck) return { kind: "skip" };
+  if (allImages === null) return { kind: "enumerate-failed" };
+  const images = filterVerifiableImages(allImages);
+  if (images.length === 0) return { kind: "no-images" };
+  return { kind: "verify", images };
+}
+async function verifyImageSignaturesPhase(composeOpts, opts) {
+  const allImages = opts.skipSignatureCheck ? null : await composeConfigImages(composeOpts);
+  const plan = planSignatureGate(allImages, opts);
+  if (plan.kind === "skip") {
+    p3.note(
+      pc2.yellow(
+        "\u26A0 Skipping cosign signature verification (--skip-signature-check). Images will be pulled unverified \u2014 you are trusting the registry contents."
+      ),
+      "Supply chain"
+    );
+    return;
+  }
+  if (plan.kind === "enumerate-failed") {
+    p3.cancel(
+      "`docker compose config --images` failed, so signatures can't be verified. Fix the compose config (or re-run with --skip-signature-check to bypass)."
+    );
+    process.exit(1);
+  }
+  if (plan.kind === "no-images") {
+    p3.note(
+      pc2.yellow(
+        "\u26A0 No `ghcr.io/opuspopuli/*` images in the resolved compose set, so there is nothing to verify. If you did not expect this, inspect your compose files \u2014 this gate verifies the images we publish, not the compose file itself."
+      ),
+      "Supply chain"
+    );
+    return;
+  }
+  const spin = p3.spinner();
+  spin.start("Verifying image signatures with cosign\u2026");
+  for (const image of plan.images) {
+    spin.message(`cosign verify ${image}`);
+    const verdict = await cosignVerifyImage({
+      image,
+      ...opts.certificateIdentityRegexp ? { certificateIdentityRegexp: opts.certificateIdentityRegexp } : {}
+    });
+    if (!verdict.ok) {
+      spin.stop(pc2.red(`\u2717 Signature verification failed for ${image}.`));
+      const detail = verdict.skipped ? `${verdict.reason}
+cosign is required for the fail-closed signature gate \u2014 install it (\`brew install cosign\`, or re-run without --skip-brew) or bypass with --skip-signature-check.` : verdict.reason;
+      p3.cancel(detail);
+      process.exit(1);
+    }
+  }
+  spin.stop(
+    pc2.green(
+      `\u2713 ${plan.images.length} image signature${plan.images.length === 1 ? "" : "s"} verified.`
+    )
+  );
+}
 async function runStackPhase(args) {
   const { opts, repoPath, region, composeFile, secrets, llmModel, embeddingModel } = args;
   if (opts.skipStack) {
@@ -2697,6 +2809,7 @@ async function runStackPhase(args) {
       rm2.ok ? pc2.green("\u2713 cloudflared not present (or removed).") : pc2.yellow(`\u26A0 cloudflared eviction reported: ${rm2.reason ?? "unknown"} \u2014 continuing.`)
     );
   }
+  await verifyImageSignaturesPhase(composeOpts, opts);
   const pullSpin = p3.spinner();
   pullSpin.start("Pulling images from ghcr.io\u2026 (~5\u201315 min first run, < 1 min cached)");
   const pull = await composePull(composeOpts);
@@ -3355,37 +3468,6 @@ function reportResetOutcome(args) {
   );
 }
 
-// src/lib/cosign.ts
-var COSIGN_OIDC_ISSUER = "https://token.actions.githubusercontent.com";
-var DEFAULT_IDENTITY_REGEXP = "^https://github\\.com/OpusPopuli/opuspopuli/\\.github/workflows/release\\.yml@refs/heads/.*$";
-async function cosignVerifyImage(input) {
-  const idRegex = input.certificateIdentityRegexp ?? DEFAULT_IDENTITY_REGEXP;
-  const issuer = input.certificateOidcIssuer ?? COSIGN_OIDC_ISSUER;
-  const res = await safeExeca("cosign", [
-    "verify",
-    "--certificate-identity-regexp",
-    idRegex,
-    "--certificate-oidc-issuer",
-    issuer,
-    input.image
-  ]);
-  if (res === null) {
-    return {
-      ok: false,
-      skipped: true,
-      reason: "`cosign` not on PATH (install with `brew install cosign` and rerun to enable signature checks)"
-    };
-  }
-  if (res.exitCode !== 0) {
-    return {
-      ok: false,
-      skipped: false,
-      reason: `cosign verify ${input.image} failed (${res.exitCode ?? "signal"}): ${res.stderr || res.stdout}`
-    };
-  }
-  return { ok: true, output: res.stdout || res.stderr };
-}
-
 // src/lib/http.ts
 var GRAPHQL_ACCEPT = "application/graphql-response+json, application/json";
 async function readBodyCapped(res) {
@@ -4885,8 +4967,18 @@ async function looksLikeRegionsRepo(dir) {
   return hasSchema && hasRegions;
 }
 
+// src/lib/cli-args.ts
+var GLOBAL_FLAGS = /* @__PURE__ */ new Set(["-v", "--version", "-h", "--help"]);
+function withDefaultSubcommand(argv, known) {
+  const first2 = argv[2];
+  if (first2 !== void 0 && (known.includes(first2) || GLOBAL_FLAGS.has(first2))) {
+    return argv;
+  }
+  return [...argv.slice(0, 2), "init", ...argv.slice(2)];
+}
+
 // src/cli.ts
-var VERSION = "0.10.17";
+var VERSION = "0.11.1";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."
@@ -4896,9 +4988,10 @@ program.addCommand(bootstrapCommand);
 program.addCommand(resetCommand);
 program.addCommand(verifyCommand);
 program.addCommand(regionCommand);
-if (process.argv.length === 2) {
-  process.argv.push("init");
-}
+process.argv = withDefaultSubcommand(
+  process.argv,
+  program.commands.map((c) => c.name())
+);
 await program.parseAsync(process.argv).catch((err) => {
   const msg = err instanceof Error ? err.message : String(err);
   console.error(`