create-op-node 0.12.3 → 0.13.0

package/README.md

@@ -32,18 +32,21 @@ Configures macOS power settings, installs Homebrew + the CLI tool list, sets up
 
 When you run `bootstrap` interactively (no `-y`, no `--llm-model` flag),
 you'll get a curated picker that **pre-selects** a model based on the
-Studio's detected unified memory:
-
-- `qwen2.5:72b` — 72B, ~50 GB Ollama RAM. Pre-selected on 96 GB+ Studios.
-  Best Spanish + multilingual quality.
-- `qwen2.5:32b` — 32B, ~22 GB Ollama RAM. Pre-selected on 48–95 GB Studios
-  (e.g. 64 GB).
-- `qwen3.5:9b` — 9B, ~8 GB Ollama RAM. Pre-selected on smaller Studios
-  (< 48 GB), and the default for non-interactive `-y` runs (see below).
+node's detected unified memory. Tiers are conservative — the LLM shares
+memory with ~22 containers + Postgres, so they size on *total* footprint,
+not param count:
+
+- `qwen3.6:35b-a3b` — 35B MoE (~3B active, fast on Apple Silicon),
+  ~24 GB footprint. Pre-selected on 64 GB+ nodes. Best Spanish +
+  multilingual quality.
+- `qwen3:14b` — ~9 GB footprint. Pre-selected on 32–64 GB nodes.
+- `qwen2.5:7b` — ~5 GB footprint. Pre-selected on 16–32 GB nodes, and
+  the default for non-interactive `-y` runs (see below).
+- `qwen2.5:3b` — ~2–3 GB footprint. Pre-selected on ≤ 16 GB nodes (Mac Mini).
 - `Other…` — any Ollama model name you specify.
 
-(If memory detection fails, the picker falls back to pre-selecting
-`qwen2.5:72b`.)
+(If memory detection fails, the picker falls back to pre-selecting the
+conservative scripted default, `qwen2.5:7b`.)
 
 The picker is Qwen-only because the Opus Populi platform serves
 Spanish-speaking civic users and Qwen has the strongest Spanish (and
@@ -51,7 +54,7 @@ broader multilingual) capability of the open-weight models in this
 size class. Pick "Other…" for non-Qwen models.
 
 For non-interactive runs (`-y`) or scripted invocations, the LLM
-defaults to `qwen3.5:9b` (small, fast) — pass `--llm-model` to override:
+defaults to `qwen2.5:7b` (small, fast) — pass `--llm-model` to override:
 
 ```bash
 # Just swap the LLM, keep the default embedding model:
@@ -69,29 +72,43 @@ The chosen models flow two places:
 1. **Ollama**: bootstrap pulls + warms them so the daemon has them
    resident before the stack comes up. The embedding model pulls first
    (small, fast feedback); the LLM pulls second (can be tens of GB).
-2. **LaunchAgent**: the plist exports `LLM_MODEL` and `EMBEDDINGS_MODEL`
-   into the launchd session, which Docker Desktop inherits — so compose
-   services read them via env, no `.env.production` edits needed.
-
-> **`--embedding-model` only takes effect when the knowledge service
-> runs with `EMBEDDINGS_PROVIDER=ollama`.** The default provider is
-> `xenova` (in-process), which bundles its own embedding model and
-> ignores both `EMBEDDINGS_MODEL` and the local Ollama model. Setting
-> `EMBEDDINGS_PROVIDER=ollama` is a separate decision (set in your
-> region repo's `.env.production`) — see `docs/provider-pattern.md`.
-
-> **Template contract**: for `--llm-model` to actually change the
-> running model, the region repo's `docker-compose-prod.yml` must use
-> `${LLM_MODEL:-qwen3.5:9b}` (or similar) on the knowledge service's
-> `environment:` block. The current `opuspopuli-node` template does;
-> a fork that hardcodes the value would ignore the flag silently.
+2. **The node `.env`**: bootstrap writes `LLM_MODEL`, `EMBEDDINGS_MODEL`,
+   and `EMBEDDINGS_PROVIDER` into a managed block of the region repo's
+   `.env`, which docker compose auto-loads. This is the **single source of
+   truth** — every service (and every future partial recreate) resolves
+   `${LLM_MODEL:-…}` to the same value, regardless of shell/launchd env.
+   Model config is deliberately *not* exported via the LaunchAgent: a
+   `launchctl setenv` value would shadow `.env` at interpolation time
+   (shell env > `.env`), reintroducing the exact drift the `.env` prevents.
+
+> **Managed block, not full ownership.** bootstrap owns only the region
+> between `# >>> op-node managed >>>` and `# <<< op-node managed <<<` in
+> your `.env` — anything you hand-add outside it is preserved. On first
+> run against a pre-existing `.env`, your existing model values are adopted
+> into the block rather than overwritten; the block is only rewritten when
+> you explicitly (re)select a model. Secrets never go in `.env` — they stay
+> in the macOS Keychain and are hydrated by `bin/op-compose`.
+
+> **`--embeddings-provider` picks where embeddings run.** The default is
+> `xenova` (in-process), which bundles its own embedding model and ignores
+> `EMBEDDINGS_MODEL`. Pass `--embeddings-provider ollama` to use the host
+> daemon with `--embedding-model` — the value is written to `.env` as the
+> single source of truth. See `docs/provider-pattern.md`.
+
+> **Template contract**: for `LLM_MODEL` to actually change the running
+> model, the region repo's `docker-compose-prod.yml` must use
+> `${LLM_MODEL:-…}` on the knowledge service's `environment:` block. The
+> current `opuspopuli-node` template does; a fork that hardcodes the value
+> would ignore the `.env` silently.
 
 For RAM sizing, the [Docker resources doc](https://github.com/OpusPopuli/opuspopuli-node/blob/main/docs/docker-resources.md)
-has a tier table: 9B-class needs ~8 GB Ollama; 70B-class needs ~50 GB;
-frontier MoE needs ~80 GB. Allocate Docker the remainder.
+has a tier table: a 7B-class model needs ~5 GB, the 35B-a3b MoE ~24 GB.
+Allocate Docker the remainder of unified memory.
 
-To switch models post-bootstrap, re-run with the new flag and
-`docker compose down && up -d` to pick up the changed env.
+To switch models post-bootstrap, either re-run bootstrap with the new
+`--llm-model` (rewrites the managed block) or edit `LLM_MODEL` in the
+managed block of your `.env` directly, then `./bin/op-compose -f
+docker-compose-prod.yml up -d` to pick up the change.
 
 ### Local-only mode (no Cloudflare)
 

package/dist/cli.js

@@ -7,7 +7,7 @@ import { Octokit } from '@octokit/rest';
 import _sodium from 'libsodium-wrappers';
 import { randomBytes, createHmac } from 'crypto';
 import { join, resolve, dirname } from 'path';
-import { readFile, mkdir, writeFile, access, chmod, rename, rm } from 'fs/promises';
+import { readFile, mkdir, writeFile, access, chmod, rename, stat, rm } from 'fs/promises';
 import { homedir } from 'os';
 import { readFileSync } from 'fs';
 import * as tls from 'tls';
@@ -1493,6 +1493,7 @@ async function writePgsodiumKeyFile(key, keyFile) {
   try {
     const dir = dirname(keyFile);
     await mkdir(dir, { recursive: true, mode: 448 });
+    await rm(keyFile, { force: true });
     await writeFile(keyFile, key, { mode: 256 });
     await chmod(dir, 448);
     await chmod(keyFile, 256);
@@ -1501,7 +1502,6 @@ async function writePgsodiumKeyFile(key, keyFile) {
     return { ok: false, reason: `writing ${keyFile} failed: ${err.message}` };
   }
 }
-var MODEL_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._:/-]*$/;
 function renderLaunchAgentPlist(input) {
   validatePlistInput(input);
   const command = buildSetenvCommand(input);
@@ -1527,16 +1527,6 @@ function validatePlistInput(input) {
   if (input.tunnelToken !== void 0 && !TUNNEL_TOKEN_RE.test(input.tunnelToken)) {
     throw new Error("Tunnel token contains characters outside the expected base64-url set");
   }
-  if (input.llmModel !== void 0 && !MODEL_NAME_RE.test(input.llmModel)) {
-    throw new Error(
-      `llmModel ${JSON.stringify(input.llmModel)} contains characters not allowed in a launchd setenv value`
-    );
-  }
-  if (input.embeddingModel !== void 0 && !MODEL_NAME_RE.test(input.embeddingModel)) {
-    throw new Error(
-      `embeddingModel ${JSON.stringify(input.embeddingModel)} contains characters not allowed in a launchd setenv value`
-    );
-  }
   if (!SAFE_PATH_RE.test(input.keyFilePath)) {
     throw new Error(
       `keyFilePath ${JSON.stringify(input.keyFilePath)} contains characters not allowed in a launchd path interpolation`
@@ -1570,8 +1560,6 @@ function buildSetenvCommand(input) {
     // of — this is word-split safety, not new injection surface. (#36)
     `launchctl setenv PGSODIUM_ROOT_KEY "$(cat "${input.keyFilePath}")"`,
     ...input.tunnelToken !== void 0 ? [`launchctl setenv TUNNEL_TOKEN "${input.tunnelToken}"`] : [],
-    ...input.llmModel !== void 0 ? [`launchctl setenv LLM_MODEL "${input.llmModel}"`] : [],
-    ...input.embeddingModel !== void 0 ? [`launchctl setenv EMBEDDINGS_MODEL "${input.embeddingModel}"`] : [],
     ...input.postgresPassword !== void 0 ? [`launchctl setenv POSTGRES_PASSWORD "${input.postgresPassword}"`] : [],
     ...input.jwtSecret !== void 0 ? [`launchctl setenv JWT_SECRET "${input.jwtSecret}"`] : [],
     ...input.supabaseAnonKey !== void 0 ? [`launchctl setenv SUPABASE_ANON_KEY "${input.supabaseAnonKey}"`] : [],
@@ -1610,8 +1598,6 @@ function plistInputFromSetup(input, keyFilePath) {
   return {
     keyFilePath,
     ...input.tunnelToken !== void 0 ? { tunnelToken: input.tunnelToken } : {},
-    ...input.llmModel !== void 0 ? { llmModel: input.llmModel } : {},
-    ...input.embeddingModel !== void 0 ? { embeddingModel: input.embeddingModel } : {},
     ...input.postgresPassword !== void 0 ? { postgresPassword: input.postgresPassword } : {},
     ...input.jwtSecret !== void 0 ? { jwtSecret: input.jwtSecret } : {},
     ...input.supabaseAnonKey !== void 0 ? { supabaseAnonKey: input.supabaseAnonKey } : {},
@@ -2073,7 +2059,7 @@ function assessAllRunning(snapshots) {
 
 // src/lib/cosign.ts
 var COSIGN_OIDC_ISSUER = "https://token.actions.githubusercontent.com";
-var DEFAULT_IDENTITY_REGEXP = "^https://github\\.com/OpusPopuli/opuspopuli/\\.github/workflows/release\\.yml@refs/heads/.*$";
+var DEFAULT_IDENTITY_REGEXP = "^https://github\\.com/OpusPopuli/(?:opuspopuli|prompt-service)/\\.github/workflows/release\\.yml@refs/heads/.*$";
 async function cosignVerifyImage(input) {
   const idRegex = input.certificateIdentityRegexp ?? DEFAULT_IDENTITY_REGEXP;
   const issuer = input.certificateOidcIssuer ?? COSIGN_OIDC_ISSUER;
@@ -2106,8 +2092,9 @@ async function cosignVerifyImage(input) {
 var OLLAMA_URL = "http://localhost:11434";
 var OLLAMA_HEALTH_TIMEOUT_MS = 5e3;
 var OLLAMA_WARM_TIMEOUT_MS = 12e4;
-var DEFAULT_LLM_MODEL = "qwen3.5:9b";
+var DEFAULT_LLM_MODEL = "qwen2.5:7b";
 var DEFAULT_EMBEDDING_MODEL = "nomic-embed-text";
+var DEFAULT_EMBEDDINGS_PROVIDER = "xenova";
 var PROBE_ALPINE_TAG = "3.20";
 async function startOllamaService() {
   const res = await safeExeca("brew", ["services", "start", "ollama"]);
@@ -2226,6 +2213,138 @@ async function setupModels(models, onProgress) {
   }
   return report;
 }
+var MANAGED_BEGIN = "# >>> op-node managed >>>";
+var MANAGED_END = "# <<< op-node managed <<<";
+var MANAGED_KEYS = [
+  "LLM_MODEL",
+  "EMBEDDINGS_PROVIDER",
+  "EMBEDDINGS_MODEL",
+  "NODE_ENV"
+];
+var ENV_VALUE_RE = /^[A-Za-z0-9][A-Za-z0-9._:/-]*$/;
+function selectionToPairs(sel) {
+  return [
+    ["LLM_MODEL", sel.llmModel],
+    ["EMBEDDINGS_PROVIDER", sel.embeddingsProvider],
+    ["EMBEDDINGS_MODEL", sel.embeddingModel],
+    ["NODE_ENV", sel.nodeEnv]
+  ];
+}
+function parseEnvContent(content) {
+  const out = /* @__PURE__ */ new Map();
+  for (const raw of content.split("\n")) {
+    const line = raw.trim();
+    if (line.length === 0 || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    out.set(line.slice(0, eq).trim(), line.slice(eq + 1).trim());
+  }
+  return out;
+}
+function splitManaged(content) {
+  const lines = content.split("\n");
+  const beginIdx = lines.findIndex((l) => l.trim() === MANAGED_BEGIN);
+  if (beginIdx === -1) {
+    return { before: lines, after: [], blockValues: /* @__PURE__ */ new Map(), hasBlock: false };
+  }
+  const endIdx = lines.findIndex((l, i) => i > beginIdx && l.trim() === MANAGED_END);
+  if (endIdx === -1) {
+    return {
+      before: lines.slice(0, beginIdx),
+      after: [],
+      blockValues: parseEnvContent(lines.slice(beginIdx + 1).join("\n")),
+      hasBlock: true
+    };
+  }
+  return {
+    before: lines.slice(0, beginIdx),
+    after: lines.slice(endIdx + 1),
+    blockValues: parseEnvContent(lines.slice(beginIdx + 1, endIdx).join("\n")),
+    hasBlock: true
+  };
+}
+function stripManagedKeyLines(region) {
+  return region.filter((raw) => {
+    const line = raw.trim();
+    if (line.length === 0 || line.startsWith("#")) return true;
+    const eq = line.indexOf("=");
+    if (eq <= 0) return true;
+    return !MANAGED_KEYS.includes(line.slice(0, eq).trim());
+  });
+}
+function renderBlock(values) {
+  return [
+    MANAGED_BEGIN,
+    "# Auto-generated by `create-op-node bootstrap`. Non-secret model config,",
+    "# read by docker compose via `.env` auto-load. Edit LLM_MODEL here to",
+    "# change the model for every service; re-running bootstrap preserves your",
+    "# edits unless you explicitly re-select a model. Secrets do NOT live here.",
+    ...values.map(([k, v]) => `${k}=${v}`),
+    MANAGED_END
+  ];
+}
+function buildManagedEnvContent(existing, selection, opts = {}) {
+  const split = splitManaged(existing);
+  const importedBefore = filterManaged(parseEnvContent(split.before.join("\n")));
+  const importedAfter = filterManaged(parseEnvContent(split.after.join("\n")));
+  const resolved = [];
+  for (const [key, selected] of selectionToPairs(selection)) {
+    const existingVal = split.blockValues.get(key) ?? importedBefore.get(key) ?? importedAfter.get(key);
+    const final = opts.overwrite ? selected ?? existingVal : existingVal ?? selected;
+    if (final === void 0) continue;
+    if (!ENV_VALUE_RE.test(final)) {
+      return { error: `${key} value ${JSON.stringify(final)} is not safe for a .env line` };
+    }
+    resolved.push([key, final]);
+  }
+  const before = stripManagedKeyLines(split.before);
+  const after = stripManagedKeyLines(split.after);
+  const block = renderBlock(resolved);
+  const parts = [joinTrimmed(before), block.join("\n"), joinTrimmed(after)].filter(
+    (s) => s.length > 0
+  );
+  return { content: parts.join("\n\n") + "\n" };
+}
+function filterManaged(all) {
+  const out = /* @__PURE__ */ new Map();
+  for (const key of MANAGED_KEYS) {
+    const v = all.get(key);
+    if (v !== void 0) out.set(key, v);
+  }
+  return out;
+}
+function joinTrimmed(region) {
+  const joined = region.join("\n");
+  let start = 0;
+  let end = joined.length;
+  while (start < end && joined[start] === "\n") start++;
+  while (end > start && joined[end - 1] === "\n") end--;
+  return joined.slice(start, end);
+}
+async function writeManagedEnv(repoDir, selection, opts = {}) {
+  const target = join(repoDir, ".env");
+  let existing = "";
+  let existingMode;
+  try {
+    existing = await readFile(target, "utf8");
+    existingMode = (await stat(target)).mode & 511;
+  } catch {
+  }
+  const built = buildManagedEnvContent(existing, selection, opts);
+  if ("error" in built) return { ok: false, reason: built.error };
+  if (built.content === existing) return { ok: true, path: target, unchanged: true };
+  const mode = existingMode ?? 420;
+  const tmp = `${target}.tmp.${process.pid}`;
+  try {
+    await mkdir(dirname(target), { recursive: true });
+    await writeFile(tmp, built.content, { mode });
+    await chmod(tmp, mode);
+    await rename(tmp, target);
+    return { ok: true, path: target };
+  } catch (err) {
+    return { ok: false, reason: `writing ${target} failed: ${err.message}` };
+  }
+}
 var NODE_REPO_MARKERS = [
   "docker-compose-prod.yml",
   "supabase/init/pgsodium_getkey_env.sh"
@@ -2299,6 +2418,11 @@ var bootstrapCommand = new Command("bootstrap").description(
     "--embedding-model <model>",
     `Ollama embedding model. Default: ${DEFAULT_EMBEDDING_MODEL}. Only takes effect when the knowledge service runs with EMBEDDINGS_PROVIDER=ollama (otherwise embeddings are computed in-process via xenova).`
   )
+).addOption(
+  new Option(
+    "--embeddings-provider <provider>",
+    `Where embeddings are computed. Default: ${DEFAULT_EMBEDDINGS_PROVIDER} (in-process). \`ollama\` uses the host daemon with the embedding model. Written to the node's .env as the single source of truth.`
+  ).choices(["xenova", "ollama"])
 ).addOption(
   new Option(
     "--supabase-url <url>",
@@ -2341,6 +2465,7 @@ var bootstrapCommand = new Command("bootstrap").description(
     llmModel: llmModelChoice,
     ...opts.embeddingModel !== void 0 ? { embeddingModel: opts.embeddingModel } : {}
   });
+  const embeddingsProvider = opts.embeddingsProvider ?? DEFAULT_EMBEDDINGS_PROVIDER;
   await runSystemChecksPhase();
   await runBrewPhase(opts);
   await ensureGhAuth();
@@ -2348,11 +2473,18 @@ var bootstrapCommand = new Command("bootstrap").description(
   const repoPath = await locateRegionRepoPhase(opts, owner, repoName);
   await unlockKeychainPhase();
   const secrets = await collectSecretsPhase({ region, nodeType, opts });
-  await runLaunchAgentPhase({ opts, secrets, llmModel, embeddingModel });
+  await runLaunchAgentPhase({ opts, secrets });
   await installWrapperPhase({ repoPath, region, promptServiceUrl: secrets.promptServiceUrl });
   await loginGhcrPhase();
   await runOllamaPhase({ opts, embeddingModel, llmModel });
-  await runStackPhase({ opts, repoPath, region, composeFile, secrets, llmModel, embeddingModel });
+  await runEnvFilePhase({
+    repoPath,
+    llmModel,
+    embeddingModel,
+    embeddingsProvider,
+    localOnly: Boolean(opts.localOnly)
+  });
+  await runStackPhase({ opts, repoPath, region, composeFile, secrets });
 });
 function defaultComposeFiles(opts) {
   return opts.localOnly ? ["docker-compose-prod.yml"] : ["docker-compose-prod.yml", "docker-compose-backup.yml"];
@@ -2716,15 +2848,13 @@ async function collectSecretsPhase(args) {
   return { ...core, ...promptSecrets, promptServiceUrl, supabaseUrl };
 }
 async function runLaunchAgentPhase(args) {
-  const { opts, secrets, llmModel, embeddingModel } = args;
+  const { opts, secrets } = args;
   if (opts.skipLaunchAgent) return;
   const laSpin = p3.spinner();
   laSpin.start("Writing pgsodium key file + LaunchAgent plist\u2026");
   const la = await setupLaunchAgent({
     pgsodiumKey: secrets.pgsodiumKey,
     ...secrets.tunnelToken !== void 0 ? { tunnelToken: secrets.tunnelToken } : {},
-    llmModel,
-    embeddingModel,
     postgresPassword: secrets.postgresPassword,
     jwtSecret: secrets.jwtSecret,
     supabaseAnonKey: secrets.supabaseAnonKey,
@@ -2809,8 +2939,33 @@ async function runOllamaPhase(args) {
     p3.note(`${pc2.yellow("\u26A0")} ${probe.reason}`, "Docker host networking");
   }
 }
+async function runEnvFilePhase(args) {
+  const { repoPath, llmModel, embeddingModel, embeddingsProvider, localOnly } = args;
+  const envSpin = p3.spinner();
+  envSpin.start("Writing model config to the node .env\u2026");
+  const res = await writeManagedEnv(
+    repoPath,
+    {
+      llmModel,
+      embeddingModel,
+      embeddingsProvider,
+      // NODE_ENV=development only for local-dev nodes; production nodes leave
+      // it unset (the compose default / container images decide).
+      ...localOnly ? { nodeEnv: "development" } : {}
+    },
+    { overwrite: true }
+  );
+  if (!res.ok) {
+    envSpin.stop(pc2.red("\u2717 Failed to write the node .env."));
+    p3.cancel(res.reason ?? "writing .env failed.");
+    process.exit(1);
+  }
+  envSpin.stop(
+    res.unchanged ? pc2.green(`\u2713 Model config already current in ${res.path}.`) : pc2.green(`\u2713 Wrote model config to ${res.path} (LLM_MODEL=${llmModel}).`)
+  );
+}
 function buildComposeEnv(args) {
-  const { secrets, llmModel, embeddingModel } = args;
+  const { secrets } = args;
   return {
     PGSODIUM_ROOT_KEY: secrets.pgsodiumKey,
     POSTGRES_PASSWORD: secrets.postgresPassword,
@@ -2838,9 +2993,12 @@ function buildComposeEnv(args) {
     ...secrets.promptsDbPassword !== void 0 ? { PROMPTS_DB_PASSWORD: secrets.promptsDbPassword } : {},
     ...secrets.promptServiceApiKey !== void 0 ? { PROMPT_SERVICE_API_KEY: secrets.promptServiceApiKey } : {},
     ...secrets.promptServiceApiKeys !== void 0 ? { PROMPT_SERVICE_API_KEYS: secrets.promptServiceApiKeys } : {},
-    ...secrets.promptServiceAdminApiKeys !== void 0 ? { PROMPT_SERVICE_ADMIN_API_KEYS: secrets.promptServiceAdminApiKeys } : {},
-    ...llmModel ? { LLM_MODEL: llmModel } : {},
-    ...embeddingModel ? { EMBEDDINGS_MODEL: embeddingModel } : {}
+    ...secrets.promptServiceAdminApiKeys !== void 0 ? { PROMPT_SERVICE_ADMIN_API_KEYS: secrets.promptServiceAdminApiKeys } : {}
+    // Model config (LLM_MODEL / EMBEDDINGS_MODEL / NODE_ENV) is intentionally
+    // NOT injected here — it lives in the node's `.env` (runEnvFilePhase),
+    // which docker compose auto-loads. Injecting it into the subprocess env
+    // would shadow `.env` (shell env > .env) and reintroduce the drift the
+    // single-source `.env` exists to eliminate.
   };
 }
 function checkPublicProfileSecrets(env) {
@@ -2920,7 +3078,7 @@ cosign is required for the fail-closed signature gate \u2014 install it (\`brew
   );
 }
 async function runStackPhase(args) {
-  const { opts, repoPath, region, composeFile, secrets, llmModel, embeddingModel } = args;
+  const { opts, repoPath, region, composeFile, secrets } = args;
   if (opts.skipStack) {
     const profileFlag = opts.localOnly ? "" : "--profile public ";
     p3.outro(
@@ -2931,7 +3089,7 @@ async function runStackPhase(args) {
     return;
   }
   const composeFiles = resolveComposeFiles(repoPath, composeFile);
-  const composeEnv = buildComposeEnv({ secrets, llmModel, embeddingModel });
+  const composeEnv = buildComposeEnv({ secrets });
   const composeOpts = {
     files: composeFiles,
     cwd: repoPath,
@@ -3055,32 +3213,38 @@ function resolveModels(opts) {
 }
 var LLM_MODEL_CHOICES = [
   {
-    value: "qwen2.5:72b",
-    label: "qwen2.5:72b",
-    hint: "72B, ~50 GB Ollama RAM. Pre-selected on 96 GB+ Studios. Best Spanish + multilingual quality. Pull ~40 GB, 30\u201360 min."
+    value: "qwen3.6:35b-a3b",
+    label: "qwen3.6:35b-a3b",
+    hint: "35B MoE, ~3B active \u2014 fast on Apple Silicon. ~24 GB footprint. Pre-selected on 64 GB+ nodes. Best Spanish + multilingual quality. Pull ~24 GB, 30\u201360 min."
+  },
+  {
+    value: "qwen3:14b",
+    label: "qwen3:14b",
+    hint: "14B, ~9 GB footprint. Pre-selected on 32\u201364 GB nodes. Solid Spanish, faster than the 35B MoE. Pull ~9 GB, 10\u201320 min."
   },
   {
-    value: "qwen2.5:32b",
-    label: "qwen2.5:32b",
-    hint: "32B, ~22 GB Ollama RAM. Pre-selected on 48\u201395 GB Studios. Solid Spanish, faster than 72B. Pull ~20 GB, 15\u201330 min."
+    value: "qwen2.5:7b",
+    label: "qwen2.5:7b",
+    hint: "7B, ~5 GB footprint. Pre-selected on 16\u201332 GB nodes; also the -y / scripted default. Pull ~5 GB, 3\u20135 min."
   },
   {
-    value: "qwen3.5:9b",
-    label: "qwen3.5:9b",
-    hint: "9B, ~8 GB Ollama RAM. Pre-selected on smaller Studios (< 48 GB); also the -y / scripted default. Pull ~5 GB, 3\u20135 min."
+    value: "qwen2.5:3b",
+    label: "qwen2.5:3b",
+    hint: "3B, ~2\u20133 GB footprint. Pre-selected on \u2264 16 GB nodes (Mac Mini). Lightest option. Pull ~2 GB, 2\u20133 min."
   }
 ];
 var OTHER_SENTINEL = "__OTHER__";
 function recommendLlmModel(ramGB) {
   if (ramGB === null) return null;
-  if (ramGB >= 96) return "qwen2.5:72b";
-  if (ramGB >= 48) return "qwen2.5:32b";
-  return "qwen3.5:9b";
+  if (ramGB >= 64) return "qwen3.6:35b-a3b";
+  if (ramGB >= 32) return "qwen3:14b";
+  if (ramGB >= 16) return "qwen2.5:7b";
+  return "qwen2.5:3b";
 }
 async function selectLlmModel(opts) {
   if (opts.yes) return DEFAULT_LLM_MODEL;
   const ramGB = await detectUnifiedMemoryGB();
-  const recommended = recommendLlmModel(ramGB) ?? "qwen2.5:72b";
+  const recommended = recommendLlmModel(ramGB) ?? DEFAULT_LLM_MODEL;
   const ramNote = ramGB !== null ? `Detected ${ramGB} GB unified memory \u2014 pre-selecting ${recommended}.` : `Couldn't detect Studio memory \u2014 defaulting to ${recommended} (override if your config differs).`;
   p3.note(ramNote, "Hardware");
   const choice = unwrap(
@@ -5154,7 +5318,7 @@ function withDefaultSubcommand(argv, known) {
 }
 
 // src/cli.ts
-var VERSION = "0.12.3";
+var VERSION = "0.13.0";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."