create-op-node 0.12.1 → 0.12.3

package/dist/cli.js

@@ -7,7 +7,7 @@ import { Octokit } from '@octokit/rest';
 import _sodium from 'libsodium-wrappers';
 import { randomBytes, createHmac } from 'crypto';
 import { join, resolve, dirname } from 'path';
-import { mkdir, writeFile, access, chmod, rename, rm } from 'fs/promises';
+import { readFile, mkdir, writeFile, access, chmod, rename, rm } from 'fs/promises';
 import { homedir } from 'os';
 import { readFileSync } from 'fs';
 import * as tls from 'tls';
@@ -1335,8 +1335,6 @@ async function waitForApplyAndFetchTunnelToken(input) {
       return null;
   }
 }
-
-// src/lib/homebrew.ts
 var STUDIO_PACKAGES = [
   { name: "git", kind: "formula" },
   { name: "gh", kind: "formula" },
@@ -1347,8 +1345,11 @@ var STUDIO_PACKAGES = [
   { name: "ollama", kind: "formula" },
   // Required for the fail-closed image-signature gate in `bootstrap` (#34).
   { name: "cosign", kind: "formula" },
-  { name: "docker", kind: "cask" },
-  { name: "tailscale", kind: "cask" }
+  // Homebrew renamed the `docker` cask to `docker-desktop`. The appPath skip
+  // means a directly-installed Docker Desktop (the common case) is treated as
+  // present rather than tripping `brew install` on the existing app. (#89)
+  { name: "docker-desktop", kind: "cask", appPath: "/Applications/Docker.app" },
+  { name: "tailscale", kind: "cask", appPath: "/Applications/Tailscale.app" }
 ];
 async function detectBrew() {
   const res = await safeExeca("brew", ["--version"]);
@@ -1359,7 +1360,18 @@ async function detectBrew() {
   return { installed: true, ...version ? { version } : {} };
 }
 var HOMEBREW_INSTALL_COMMAND = '/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"';
+async function pathExists(path) {
+  try {
+    await access(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function isPackageInstalled(pkg) {
+  if (pkg.appPath && await pathExists(pkg.appPath)) {
+    return true;
+  }
   const flag = pkg.kind === "cask" ? "--cask" : "--formula";
   const res = await safeExeca("brew", ["list", flag, pkg.name]);
   return res !== null && res.exitCode === 0;
@@ -2615,15 +2627,18 @@ async function collectCoreSecrets(args) {
 }
 async function collectPromptServiceSecrets(args) {
   const { region, nodeType, opts } = args;
+  let promptsDbPassword;
+  let promptServiceApiKey;
+  let promptServiceAdminApiKeys;
   if (nodeType === "region-with-prompts") {
-    await loadSecret({
+    promptsDbPassword = await loadSecret({
       region,
       account: "prompts-db-password",
       label: "prompt-service Postgres password",
       validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
       generate: generatePostgresPassword
     });
-    await loadSecret({
+    promptServiceApiKey = await loadSecret({
       region,
       account: "prompt-service-api-key",
       label: "prompt-service HMAC API key",
@@ -2632,7 +2647,7 @@ async function collectPromptServiceSecrets(args) {
       validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
       generate: generateHmacApiKey
     });
-    await loadSecret({
+    promptServiceAdminApiKeys = await loadSecret({
       region,
       account: "prompt-service-admin-api-key",
       label: "prompt-service admin API key",
@@ -2640,7 +2655,7 @@ async function collectPromptServiceSecrets(args) {
       generate: generateHmacApiKey
     });
   } else {
-    await loadSecret({
+    promptServiceApiKey = await loadSecret({
       region,
       account: "prompt-service-api-key",
       label: "prompt-service HMAC API key (issued by the prompts team)",
@@ -2658,7 +2673,15 @@ async function collectPromptServiceSecrets(args) {
     );
     process.exit(1);
   }
-  return promptServiceUrl;
+  return {
+    url: promptServiceUrl,
+    ...promptsDbPassword !== void 0 ? { promptsDbPassword } : {},
+    // PROMPT_SERVICE_API_KEY is the raw key; PROMPT_SERVICE_API_KEYS is the
+    // `<region>:<key>` list prompt-service validates against — same derivation
+    // the op-compose wrapper does.
+    ...promptServiceApiKey !== void 0 ? { promptServiceApiKey, promptServiceApiKeys: `${region}:${promptServiceApiKey}` } : {},
+    ...promptServiceAdminApiKeys !== void 0 ? { promptServiceAdminApiKeys } : {}
+  };
 }
 async function resolveSupabaseUrl(opts) {
   let supabaseUrl;
@@ -2688,9 +2711,9 @@ async function resolveSupabaseUrl(opts) {
 }
 async function collectSecretsPhase(args) {
   const core = await collectCoreSecrets({ region: args.region, opts: args.opts });
-  const promptServiceUrl = await collectPromptServiceSecrets(args);
+  const { url: promptServiceUrl, ...promptSecrets } = await collectPromptServiceSecrets(args);
   const supabaseUrl = await resolveSupabaseUrl(args.opts);
-  return { ...core, promptServiceUrl, supabaseUrl };
+  return { ...core, ...promptSecrets, promptServiceUrl, supabaseUrl };
 }
 async function runLaunchAgentPhase(args) {
   const { opts, secrets, llmModel, embeddingModel } = args;
@@ -2806,6 +2829,16 @@ function buildComposeEnv(args) {
     SUPABASE_URL: secrets.supabaseUrl,
     AUTH_JWT_SECRET: process.env["AUTH_JWT_SECRET"] ?? secrets.jwtSecret,
     ...secrets.tunnelToken !== void 0 ? { TUNNEL_TOKEN: secrets.tunnelToken } : {},
+    // prompt-service wiring — mirrors the op-compose wrapper so bootstrap's OWN
+    // compose calls can process the region-with-prompts overlay instead of
+    // aborting on `${PROMPTS_DB_PASSWORD:?}`. PROMPT_SERVICE_URL is always set
+    // (in-network for colocated, remote otherwise); the rest are present only
+    // when the node runs or calls a prompt-service. (#90)
+    PROMPT_SERVICE_URL: secrets.promptServiceUrl,
+    ...secrets.promptsDbPassword !== void 0 ? { PROMPTS_DB_PASSWORD: secrets.promptsDbPassword } : {},
+    ...secrets.promptServiceApiKey !== void 0 ? { PROMPT_SERVICE_API_KEY: secrets.promptServiceApiKey } : {},
+    ...secrets.promptServiceApiKeys !== void 0 ? { PROMPT_SERVICE_API_KEYS: secrets.promptServiceApiKeys } : {},
+    ...secrets.promptServiceAdminApiKeys !== void 0 ? { PROMPT_SERVICE_ADMIN_API_KEYS: secrets.promptServiceAdminApiKeys } : {},
     ...llmModel ? { LLM_MODEL: llmModel } : {},
     ...embeddingModel ? { EMBEDDINGS_MODEL: embeddingModel } : {}
   };
@@ -3259,6 +3292,9 @@ async function resetStopStackPhase(input, deps) {
     files: input.stack.composeFiles,
     cwd: input.stack.repoPath,
     ...input.stack.envFile ? { envFile: input.stack.envFile } : {},
+    // Hydrate placeholder values for the template's `${VAR:?…}` required vars
+    // so interpolation succeeds; `down` doesn't use the values. (#85)
+    ...input.stack.env ? { env: input.stack.env } : {},
     wipeVolumes: input.stack.wipeVolumes,
     removeOrphans: input.stack.removeOrphans,
     ...input.stack.wipeImages ? { removeImages: "all" } : {}
@@ -3398,6 +3434,7 @@ var resetCommand = new Command("reset").description(
     wipeImages
   });
   await confirmReset({ opts, region, wipeData });
+  const teardownEnv = repoPath ? await computeTeardownEnv(resolveComposeFiles(repoPath, opts.composeFile)) : void 0;
   const input = buildResetInput({
     opts,
     repoPath,
@@ -3405,7 +3442,8 @@ var resetCommand = new Command("reset").description(
     launchAgentPaths,
     wipeData,
     wipeImages,
-    removeOrphans
+    removeOrphans,
+    ...teardownEnv ? { teardownEnv } : {}
   });
   await runResetWithSpinners({ opts, region, wipeData, input });
 });
@@ -3514,15 +3552,41 @@ async function confirmReset(args) {
     }
   }
 }
+var TEARDOWN_PLACEHOLDER = "reset-teardown-placeholder";
+var REQUIRED_VAR_RE = /\$\{([A-Za-z_]\w*):?\?/g;
+function buildTeardownEnv(composeFileContents, baseEnv = process.env) {
+  const overlay = {};
+  for (const text6 of composeFileContents) {
+    for (const match of text6.matchAll(REQUIRED_VAR_RE)) {
+      const name = match[1];
+      const existing = baseEnv[name];
+      if (existing === void 0 || existing === "") {
+        overlay[name] = TEARDOWN_PLACEHOLDER;
+      }
+    }
+  }
+  return overlay;
+}
+async function computeTeardownEnv(composeFiles) {
+  const contents = [];
+  for (const file of composeFiles) {
+    try {
+      contents.push(await readFile(file, "utf8"));
+    } catch {
+    }
+  }
+  return buildTeardownEnv(contents);
+}
 function buildResetInput(args) {
-  const { opts, repoPath, plistExists, launchAgentPaths, wipeData, wipeImages, removeOrphans } = args;
+  const { opts, repoPath, plistExists, launchAgentPaths, wipeData, wipeImages, removeOrphans, teardownEnv } = args;
   const stack = repoPath ? {
     repoPath,
     composeFiles: resolveComposeFiles(repoPath, opts.composeFile),
     wipeVolumes: wipeData,
     wipeImages,
     removeOrphans,
-    ...opts.envFile ? { envFile: opts.envFile } : {}
+    ...opts.envFile ? { envFile: opts.envFile } : {},
+    ...teardownEnv ? { env: teardownEnv } : {}
   } : void 0;
   const launchAgent = plistExists && !opts.skipLaunchAgent ? {
     paths: launchAgentPaths,
@@ -5090,7 +5154,7 @@ function withDefaultSubcommand(argv, known) {
 }
 
 // src/cli.ts
-var VERSION = "0.12.1";
+var VERSION = "0.12.3";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."