create-op-node 0.12.4 → 0.14.0

package/dist/cli.js

@@ -7,7 +7,7 @@ import { Octokit } from '@octokit/rest';
 import _sodium from 'libsodium-wrappers';
 import { randomBytes, createHmac } from 'crypto';
 import { join, resolve, dirname } from 'path';
-import { readFile, mkdir, writeFile, access, chmod, rename, rm } from 'fs/promises';
+import { readFile, mkdir, writeFile, access, chmod, rename, stat, rm } from 'fs/promises';
 import { homedir } from 'os';
 import { readFileSync } from 'fs';
 import * as tls from 'tls';
@@ -1502,7 +1502,6 @@ async function writePgsodiumKeyFile(key, keyFile) {
     return { ok: false, reason: `writing ${keyFile} failed: ${err.message}` };
   }
 }
-var MODEL_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._:/-]*$/;
 function renderLaunchAgentPlist(input) {
   validatePlistInput(input);
   const command = buildSetenvCommand(input);
@@ -1528,16 +1527,6 @@ function validatePlistInput(input) {
   if (input.tunnelToken !== void 0 && !TUNNEL_TOKEN_RE.test(input.tunnelToken)) {
     throw new Error("Tunnel token contains characters outside the expected base64-url set");
   }
-  if (input.llmModel !== void 0 && !MODEL_NAME_RE.test(input.llmModel)) {
-    throw new Error(
-      `llmModel ${JSON.stringify(input.llmModel)} contains characters not allowed in a launchd setenv value`
-    );
-  }
-  if (input.embeddingModel !== void 0 && !MODEL_NAME_RE.test(input.embeddingModel)) {
-    throw new Error(
-      `embeddingModel ${JSON.stringify(input.embeddingModel)} contains characters not allowed in a launchd setenv value`
-    );
-  }
   if (!SAFE_PATH_RE.test(input.keyFilePath)) {
     throw new Error(
       `keyFilePath ${JSON.stringify(input.keyFilePath)} contains characters not allowed in a launchd path interpolation`
@@ -1571,8 +1560,6 @@ function buildSetenvCommand(input) {
     // of — this is word-split safety, not new injection surface. (#36)
     `launchctl setenv PGSODIUM_ROOT_KEY "$(cat "${input.keyFilePath}")"`,
     ...input.tunnelToken !== void 0 ? [`launchctl setenv TUNNEL_TOKEN "${input.tunnelToken}"`] : [],
-    ...input.llmModel !== void 0 ? [`launchctl setenv LLM_MODEL "${input.llmModel}"`] : [],
-    ...input.embeddingModel !== void 0 ? [`launchctl setenv EMBEDDINGS_MODEL "${input.embeddingModel}"`] : [],
     ...input.postgresPassword !== void 0 ? [`launchctl setenv POSTGRES_PASSWORD "${input.postgresPassword}"`] : [],
     ...input.jwtSecret !== void 0 ? [`launchctl setenv JWT_SECRET "${input.jwtSecret}"`] : [],
     ...input.supabaseAnonKey !== void 0 ? [`launchctl setenv SUPABASE_ANON_KEY "${input.supabaseAnonKey}"`] : [],
@@ -1611,8 +1598,6 @@ function plistInputFromSetup(input, keyFilePath) {
   return {
     keyFilePath,
     ...input.tunnelToken !== void 0 ? { tunnelToken: input.tunnelToken } : {},
-    ...input.llmModel !== void 0 ? { llmModel: input.llmModel } : {},
-    ...input.embeddingModel !== void 0 ? { embeddingModel: input.embeddingModel } : {},
     ...input.postgresPassword !== void 0 ? { postgresPassword: input.postgresPassword } : {},
     ...input.jwtSecret !== void 0 ? { jwtSecret: input.jwtSecret } : {},
     ...input.supabaseAnonKey !== void 0 ? { supabaseAnonKey: input.supabaseAnonKey } : {},
@@ -2107,8 +2092,9 @@ async function cosignVerifyImage(input) {
 var OLLAMA_URL = "http://localhost:11434";
 var OLLAMA_HEALTH_TIMEOUT_MS = 5e3;
 var OLLAMA_WARM_TIMEOUT_MS = 12e4;
-var DEFAULT_LLM_MODEL = "qwen3.5:9b";
+var DEFAULT_LLM_MODEL = "qwen2.5:7b";
 var DEFAULT_EMBEDDING_MODEL = "nomic-embed-text";
+var DEFAULT_EMBEDDINGS_PROVIDER = "xenova";
 var PROBE_ALPINE_TAG = "3.20";
 async function startOllamaService() {
   const res = await safeExeca("brew", ["services", "start", "ollama"]);
@@ -2136,6 +2122,11 @@ async function checkOllamaHealth(url = OLLAMA_URL) {
     clearTimeout(timer);
   }
 }
+function modelPresent(configured, installed) {
+  const norm = (m) => m.includes(":") ? m : `${m}:latest`;
+  const target = norm(configured);
+  return installed.some((m) => norm(m) === target);
+}
 async function pullModel(name) {
   const res = await safeExeca("ollama", ["pull", name]);
   if (res === null) return { ok: false, reason: "`ollama` not on PATH" };
@@ -2227,6 +2218,157 @@ async function setupModels(models, onProgress) {
   }
   return report;
 }
+var MANAGED_BEGIN = "# >>> op-node managed >>>";
+var MANAGED_END = "# <<< op-node managed <<<";
+var MANAGED_KEYS = [
+  "LLM_MODEL",
+  "EMBEDDINGS_PROVIDER",
+  "EMBEDDINGS_MODEL",
+  "NODE_ENV"
+];
+var ENV_VALUE_RE = /^[A-Za-z0-9][A-Za-z0-9._:/-]*$/;
+function selectionToPairs(sel) {
+  return [
+    ["LLM_MODEL", sel.llmModel],
+    ["EMBEDDINGS_PROVIDER", sel.embeddingsProvider],
+    ["EMBEDDINGS_MODEL", sel.embeddingModel],
+    ["NODE_ENV", sel.nodeEnv]
+  ];
+}
+function parseEnvContent(content) {
+  const out = /* @__PURE__ */ new Map();
+  for (const raw of content.split("\n")) {
+    const line = raw.trim();
+    if (line.length === 0 || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    out.set(line.slice(0, eq).trim(), line.slice(eq + 1).trim());
+  }
+  return out;
+}
+function splitManaged(content) {
+  const lines = content.split("\n");
+  const beginIdx = lines.findIndex((l) => l.trim() === MANAGED_BEGIN);
+  if (beginIdx === -1) {
+    return { before: lines, after: [], blockValues: /* @__PURE__ */ new Map(), hasBlock: false };
+  }
+  const endIdx = lines.findIndex((l, i) => i > beginIdx && l.trim() === MANAGED_END);
+  if (endIdx === -1) {
+    return {
+      before: lines.slice(0, beginIdx),
+      after: [],
+      blockValues: parseEnvContent(lines.slice(beginIdx + 1).join("\n")),
+      hasBlock: true
+    };
+  }
+  return {
+    before: lines.slice(0, beginIdx),
+    after: lines.slice(endIdx + 1),
+    blockValues: parseEnvContent(lines.slice(beginIdx + 1, endIdx).join("\n")),
+    hasBlock: true
+  };
+}
+function stripManagedKeyLines(region) {
+  return region.filter((raw) => {
+    const line = raw.trim();
+    if (line.length === 0 || line.startsWith("#")) return true;
+    const eq = line.indexOf("=");
+    if (eq <= 0) return true;
+    return !MANAGED_KEYS.includes(line.slice(0, eq).trim());
+  });
+}
+function renderBlock(values) {
+  return [
+    MANAGED_BEGIN,
+    "# Auto-generated by `create-op-node bootstrap`. Non-secret model config,",
+    "# read by docker compose via `.env` auto-load. Edit LLM_MODEL here to",
+    "# change the model for every service; re-running bootstrap preserves your",
+    "# edits unless you explicitly re-select a model. Secrets do NOT live here.",
+    ...values.map(([k, v]) => `${k}=${v}`),
+    MANAGED_END
+  ];
+}
+function buildManagedEnvContent(existing, selection, opts = {}) {
+  const split = splitManaged(existing);
+  const importedBefore = filterManaged(parseEnvContent(split.before.join("\n")));
+  const importedAfter = filterManaged(parseEnvContent(split.after.join("\n")));
+  const resolved = [];
+  for (const [key, selected] of selectionToPairs(selection)) {
+    const existingVal = split.blockValues.get(key) ?? importedBefore.get(key) ?? importedAfter.get(key);
+    const final = opts.overwrite ? selected ?? existingVal : existingVal ?? selected;
+    if (final === void 0) continue;
+    if (!ENV_VALUE_RE.test(final)) {
+      return { error: `${key} value ${JSON.stringify(final)} is not safe for a .env line` };
+    }
+    resolved.push([key, final]);
+  }
+  const before = stripManagedKeyLines(split.before);
+  const after = stripManagedKeyLines(split.after);
+  const block = renderBlock(resolved);
+  const parts = [joinTrimmed(before), block.join("\n"), joinTrimmed(after)].filter(
+    (s) => s.length > 0
+  );
+  return { content: parts.join("\n\n") + "\n" };
+}
+function filterManaged(all) {
+  const out = /* @__PURE__ */ new Map();
+  for (const key of MANAGED_KEYS) {
+    const v = all.get(key);
+    if (v !== void 0) out.set(key, v);
+  }
+  return out;
+}
+function joinTrimmed(region) {
+  const joined = region.join("\n");
+  let start = 0;
+  let end = joined.length;
+  while (start < end && joined[start] === "\n") start++;
+  while (end > start && joined[end - 1] === "\n") end--;
+  return joined.slice(start, end);
+}
+async function readEnvModelConfig(repoDir) {
+  let content;
+  try {
+    content = await readFile(join(repoDir, ".env"), "utf8");
+  } catch {
+    return {};
+  }
+  const map = parseEnvContent(content);
+  const cfg = {};
+  const llm = map.get("LLM_MODEL");
+  const emb = map.get("EMBEDDINGS_MODEL");
+  const prov = map.get("EMBEDDINGS_PROVIDER");
+  const node = map.get("NODE_ENV");
+  if (llm !== void 0) cfg.llmModel = llm;
+  if (emb !== void 0) cfg.embeddingModel = emb;
+  if (prov !== void 0) cfg.embeddingsProvider = prov;
+  if (node !== void 0) cfg.nodeEnv = node;
+  return cfg;
+}
+async function writeManagedEnv(repoDir, selection, opts = {}) {
+  const target = join(repoDir, ".env");
+  let existing = "";
+  let existingMode;
+  try {
+    existing = await readFile(target, "utf8");
+    existingMode = (await stat(target)).mode & 511;
+  } catch {
+  }
+  const built = buildManagedEnvContent(existing, selection, opts);
+  if ("error" in built) return { ok: false, reason: built.error };
+  if (built.content === existing) return { ok: true, path: target, unchanged: true };
+  const mode = existingMode ?? 420;
+  const tmp = `${target}.tmp.${process.pid}`;
+  try {
+    await mkdir(dirname(target), { recursive: true });
+    await writeFile(tmp, built.content, { mode });
+    await chmod(tmp, mode);
+    await rename(tmp, target);
+    return { ok: true, path: target };
+  } catch (err) {
+    return { ok: false, reason: `writing ${target} failed: ${err.message}` };
+  }
+}
 var NODE_REPO_MARKERS = [
   "docker-compose-prod.yml",
   "supabase/init/pgsodium_getkey_env.sh"
@@ -2300,6 +2442,11 @@ var bootstrapCommand = new Command("bootstrap").description(
     "--embedding-model <model>",
     `Ollama embedding model. Default: ${DEFAULT_EMBEDDING_MODEL}. Only takes effect when the knowledge service runs with EMBEDDINGS_PROVIDER=ollama (otherwise embeddings are computed in-process via xenova).`
   )
+).addOption(
+  new Option(
+    "--embeddings-provider <provider>",
+    `Where embeddings are computed. Default: ${DEFAULT_EMBEDDINGS_PROVIDER} (in-process). \`ollama\` uses the host daemon with the embedding model. Written to the node's .env as the single source of truth.`
+  ).choices(["xenova", "ollama"])
 ).addOption(
   new Option(
     "--supabase-url <url>",
@@ -2342,6 +2489,7 @@ var bootstrapCommand = new Command("bootstrap").description(
     llmModel: llmModelChoice,
     ...opts.embeddingModel !== void 0 ? { embeddingModel: opts.embeddingModel } : {}
   });
+  const embeddingsProvider = opts.embeddingsProvider ?? DEFAULT_EMBEDDINGS_PROVIDER;
   await runSystemChecksPhase();
   await runBrewPhase(opts);
   await ensureGhAuth();
@@ -2349,11 +2497,18 @@ var bootstrapCommand = new Command("bootstrap").description(
   const repoPath = await locateRegionRepoPhase(opts, owner, repoName);
   await unlockKeychainPhase();
   const secrets = await collectSecretsPhase({ region, nodeType, opts });
-  await runLaunchAgentPhase({ opts, secrets, llmModel, embeddingModel });
+  await runLaunchAgentPhase({ opts, secrets });
   await installWrapperPhase({ repoPath, region, promptServiceUrl: secrets.promptServiceUrl });
   await loginGhcrPhase();
-  await runOllamaPhase({ opts, embeddingModel, llmModel });
-  await runStackPhase({ opts, repoPath, region, composeFile, secrets, llmModel, embeddingModel });
+  await runOllamaPhase({ opts, embeddingModel, llmModel, embeddingsProvider });
+  await runEnvFilePhase({
+    repoPath,
+    llmModel,
+    embeddingModel,
+    embeddingsProvider,
+    localOnly: Boolean(opts.localOnly)
+  });
+  await runStackPhase({ opts, repoPath, region, composeFile, secrets });
 });
 function defaultComposeFiles(opts) {
   return opts.localOnly ? ["docker-compose-prod.yml"] : ["docker-compose-prod.yml", "docker-compose-backup.yml"];
@@ -2717,15 +2872,13 @@ async function collectSecretsPhase(args) {
   return { ...core, ...promptSecrets, promptServiceUrl, supabaseUrl };
 }
 async function runLaunchAgentPhase(args) {
-  const { opts, secrets, llmModel, embeddingModel } = args;
+  const { opts, secrets } = args;
   if (opts.skipLaunchAgent) return;
   const laSpin = p3.spinner();
   laSpin.start("Writing pgsodium key file + LaunchAgent plist\u2026");
   const la = await setupLaunchAgent({
     pgsodiumKey: secrets.pgsodiumKey,
     ...secrets.tunnelToken !== void 0 ? { tunnelToken: secrets.tunnelToken } : {},
-    llmModel,
-    embeddingModel,
     postgresPassword: secrets.postgresPassword,
     jwtSecret: secrets.jwtSecret,
     supabaseAnonKey: secrets.supabaseAnonKey,
@@ -2769,8 +2922,12 @@ async function loginGhcrPhase() {
   }
   ghcrSpin.stop(pc2.green("\u2713 Logged in to ghcr.io."));
 }
+function modelsToPull(args) {
+  const { provider, llmModel, embeddingModel } = args;
+  return provider === "ollama" ? [embeddingModel, llmModel] : [llmModel];
+}
 async function runOllamaPhase(args) {
-  const { opts, embeddingModel, llmModel } = args;
+  const { opts, embeddingModel, llmModel, embeddingsProvider } = args;
   if (opts.skipOllama) return;
   const olSpin = p3.spinner();
   olSpin.start(`Pulling + warming Ollama models\u2026 (${estimatedPullTime(llmModel)})`);
@@ -2797,7 +2954,8 @@ async function runOllamaPhase(args) {
       process.exit(1);
     }
   }
-  const modelReport = await setupModels([embeddingModel, llmModel], (model, status) => {
+  const toPull = modelsToPull({ provider: embeddingsProvider, llmModel, embeddingModel });
+  const modelReport = await setupModels(toPull, (model, status) => {
     olSpin.message(`${status}: ${model}`);
   });
   olSpin.stop(
@@ -2805,13 +2963,44 @@ async function runOllamaPhase(args) {
       `\u2713 ${modelReport.pulled.length} pulled, ${modelReport.alreadyPresent.length} present, ${modelReport.warmed.length} warmed`
     ) : pc2.yellow(`\u26A0 ${modelReport.failed.length} model pull(s) failed`)
   );
+  if (embeddingsProvider !== "ollama") {
+    p3.note(
+      `${pc2.dim("\xB7")} Skipped pulling the embedding model \u2014 EMBEDDINGS_PROVIDER=${embeddingsProvider} computes embeddings in-process (no Ollama model needed).`,
+      "Embeddings"
+    );
+  }
   const probe = await probeHostDockerInternal();
   if (!probe.ok) {
     p3.note(`${pc2.yellow("\u26A0")} ${probe.reason}`, "Docker host networking");
   }
 }
+async function runEnvFilePhase(args) {
+  const { repoPath, llmModel, embeddingModel, embeddingsProvider, localOnly } = args;
+  const envSpin = p3.spinner();
+  envSpin.start("Writing model config to the node .env\u2026");
+  const res = await writeManagedEnv(
+    repoPath,
+    {
+      llmModel,
+      embeddingModel,
+      embeddingsProvider,
+      // NODE_ENV=development only for local-dev nodes; production nodes leave
+      // it unset (the compose default / container images decide).
+      ...localOnly ? { nodeEnv: "development" } : {}
+    },
+    { overwrite: true }
+  );
+  if (!res.ok) {
+    envSpin.stop(pc2.red("\u2717 Failed to write the node .env."));
+    p3.cancel(res.reason ?? "writing .env failed.");
+    process.exit(1);
+  }
+  envSpin.stop(
+    res.unchanged ? pc2.green(`\u2713 Model config already current in ${res.path}.`) : pc2.green(`\u2713 Wrote model config to ${res.path} (LLM_MODEL=${llmModel}).`)
+  );
+}
 function buildComposeEnv(args) {
-  const { secrets, llmModel, embeddingModel } = args;
+  const { secrets } = args;
   return {
     PGSODIUM_ROOT_KEY: secrets.pgsodiumKey,
     POSTGRES_PASSWORD: secrets.postgresPassword,
@@ -2839,9 +3028,12 @@ function buildComposeEnv(args) {
     ...secrets.promptsDbPassword !== void 0 ? { PROMPTS_DB_PASSWORD: secrets.promptsDbPassword } : {},
     ...secrets.promptServiceApiKey !== void 0 ? { PROMPT_SERVICE_API_KEY: secrets.promptServiceApiKey } : {},
     ...secrets.promptServiceApiKeys !== void 0 ? { PROMPT_SERVICE_API_KEYS: secrets.promptServiceApiKeys } : {},
-    ...secrets.promptServiceAdminApiKeys !== void 0 ? { PROMPT_SERVICE_ADMIN_API_KEYS: secrets.promptServiceAdminApiKeys } : {},
-    ...llmModel ? { LLM_MODEL: llmModel } : {},
-    ...embeddingModel ? { EMBEDDINGS_MODEL: embeddingModel } : {}
+    ...secrets.promptServiceAdminApiKeys !== void 0 ? { PROMPT_SERVICE_ADMIN_API_KEYS: secrets.promptServiceAdminApiKeys } : {}
+    // Model config (LLM_MODEL / EMBEDDINGS_MODEL / NODE_ENV) is intentionally
+    // NOT injected here — it lives in the node's `.env` (runEnvFilePhase),
+    // which docker compose auto-loads. Injecting it into the subprocess env
+    // would shadow `.env` (shell env > .env) and reintroduce the drift the
+    // single-source `.env` exists to eliminate.
   };
 }
 function checkPublicProfileSecrets(env) {
@@ -2921,7 +3113,7 @@ cosign is required for the fail-closed signature gate \u2014 install it (\`brew
   );
 }
 async function runStackPhase(args) {
-  const { opts, repoPath, region, composeFile, secrets, llmModel, embeddingModel } = args;
+  const { opts, repoPath, region, composeFile, secrets } = args;
   if (opts.skipStack) {
     const profileFlag = opts.localOnly ? "" : "--profile public ";
     p3.outro(
@@ -2932,7 +3124,7 @@ async function runStackPhase(args) {
     return;
   }
   const composeFiles = resolveComposeFiles(repoPath, composeFile);
-  const composeEnv = buildComposeEnv({ secrets, llmModel, embeddingModel });
+  const composeEnv = buildComposeEnv({ secrets });
   const composeOpts = {
     files: composeFiles,
     cwd: repoPath,
@@ -3056,32 +3248,38 @@ function resolveModels(opts) {
 }
 var LLM_MODEL_CHOICES = [
   {
-    value: "qwen2.5:72b",
-    label: "qwen2.5:72b",
-    hint: "72B, ~50 GB Ollama RAM. Pre-selected on 96 GB+ Studios. Best Spanish + multilingual quality. Pull ~40 GB, 30\u201360 min."
+    value: "qwen3.6:35b-a3b",
+    label: "qwen3.6:35b-a3b",
+    hint: "35B MoE, ~3B active \u2014 fast on Apple Silicon. ~24 GB footprint. Pre-selected on 64 GB+ nodes. Best Spanish + multilingual quality. Pull ~24 GB, 30\u201360 min."
   },
   {
-    value: "qwen2.5:32b",
-    label: "qwen2.5:32b",
-    hint: "32B, ~22 GB Ollama RAM. Pre-selected on 48\u201395 GB Studios. Solid Spanish, faster than 72B. Pull ~20 GB, 15\u201330 min."
+    value: "qwen3:14b",
+    label: "qwen3:14b",
+    hint: "14B, ~9 GB footprint. Pre-selected on 32\u201364 GB nodes. Solid Spanish, faster than the 35B MoE. Pull ~9 GB, 10\u201320 min."
   },
   {
-    value: "qwen3.5:9b",
-    label: "qwen3.5:9b",
-    hint: "9B, ~8 GB Ollama RAM. Pre-selected on smaller Studios (< 48 GB); also the -y / scripted default. Pull ~5 GB, 3\u20135 min."
+    value: "qwen2.5:7b",
+    label: "qwen2.5:7b",
+    hint: "7B, ~5 GB footprint. Pre-selected on 16\u201332 GB nodes; also the -y / scripted default. Pull ~5 GB, 3\u20135 min."
+  },
+  {
+    value: "qwen2.5:3b",
+    label: "qwen2.5:3b",
+    hint: "3B, ~2\u20133 GB footprint. Pre-selected on \u2264 16 GB nodes (Mac Mini). Lightest option. Pull ~2 GB, 2\u20133 min."
   }
 ];
 var OTHER_SENTINEL = "__OTHER__";
 function recommendLlmModel(ramGB) {
   if (ramGB === null) return null;
-  if (ramGB >= 96) return "qwen2.5:72b";
-  if (ramGB >= 48) return "qwen2.5:32b";
-  return "qwen3.5:9b";
+  if (ramGB >= 64) return "qwen3.6:35b-a3b";
+  if (ramGB >= 32) return "qwen3:14b";
+  if (ramGB >= 16) return "qwen2.5:7b";
+  return "qwen2.5:3b";
 }
 async function selectLlmModel(opts) {
   if (opts.yes) return DEFAULT_LLM_MODEL;
   const ramGB = await detectUnifiedMemoryGB();
-  const recommended = recommendLlmModel(ramGB) ?? "qwen2.5:72b";
+  const recommended = recommendLlmModel(ramGB) ?? DEFAULT_LLM_MODEL;
   const ramNote = ramGB !== null ? `Detected ${ramGB} GB unified memory \u2014 pre-selecting ${recommended}.` : `Couldn't detect Studio memory \u2014 defaulting to ${recommended} (override if your config differs).`;
   p3.note(ramNote, "Hardware");
   const choice = unwrap(
@@ -3799,7 +3997,8 @@ var DEFAULT_DEPS2 = {
   http: httpProbe,
   graphql: graphqlProbe,
   tunnel: tunnelStatus,
-  cosign: cosignVerifyImage
+  cosign: cosignVerifyImage,
+  ollama: checkOllamaHealth
 };
 async function runVerify(input, deps = DEFAULT_DEPS2) {
   const phases = [];
@@ -3810,6 +4009,7 @@ async function runVerify(input, deps = DEFAULT_DEPS2) {
   await verifyTlsPhase(input, deps, push);
   await verifyHealthPhase(input, deps, push);
   await verifyGraphqlPhase(input, deps, push);
+  await verifyOllamaModelsPhase(input, deps, push);
   await verifyCloudflarePhase(input, deps, push);
   await verifyCosignPhase(input, deps, push);
   return { phases };
@@ -3847,6 +4047,39 @@ async function verifyGraphqlPhase(input, deps, push) {
     push({ name: "GraphQL { __typename }", status: "fail", detail: gql.reason });
   }
 }
+async function verifyOllamaModelsPhase(input, deps, push) {
+  const cfg = input.ollama;
+  if (!cfg?.llmModel) {
+    push({
+      name: "Ollama models",
+      status: "skipped",
+      detail: "pass --llm-model (or run on the node so its .env is read) to enable"
+    });
+    return;
+  }
+  const health = await deps.ollama();
+  if (!health.reachable) {
+    push({
+      name: "Ollama models",
+      status: "fail",
+      detail: "configured model set but the local Ollama daemon is unreachable on :11434 \u2014 start it with `brew services start ollama` (run this check on the node)"
+    });
+    return;
+  }
+  const required = [cfg.llmModel];
+  if (cfg.provider === "ollama" && cfg.embeddingModel) required.push(cfg.embeddingModel);
+  const missing = required.filter((m) => !modelPresent(m, health.models));
+  if (missing.length > 0) {
+    const remedy = missing.map((m) => `ollama pull ${m}`).join(" && ");
+    push({
+      name: "Ollama models",
+      status: "fail",
+      detail: `not installed: ${missing.join(", ")} \u2014 remedy: ${remedy}`
+    });
+    return;
+  }
+  push({ name: "Ollama models", status: "ok", detail: `${required.join(", ")} present` });
+}
 async function verifyCloudflarePhase(input, deps, push) {
   const cfFields = [
     ["--cf-token", input.cf?.token],
@@ -3931,6 +4164,17 @@ var verifyCommand = new Command("verify").description(
   )
 ).addOption(
   new Option("--cert-warn-days <n>", "Warn if cert expires within N days").default("14")
+).addOption(
+  new Option(
+    "--llm-model <model>",
+    "Assert this model is present in the local Ollama (catches config\u2194runtime drift). Defaults to LLM_MODEL from the node .env when run on the node."
+  )
+).addOption(
+  new Option("--embedding-model <model>", "Also assert this embedding model is present (only checked when --embeddings-provider=ollama).")
+).addOption(
+  new Option("--embeddings-provider <provider>", "Embeddings provider the node runs; the embedding model is only asserted for `ollama`.").choices(["xenova", "ollama"])
+).addOption(
+  new Option("--repo-dir <path>", "Node repo dir whose .env supplies the model config when --llm-model is omitted (default: cwd).")
 ).addOption(
   new Option("--show-skipped", "Include skipped phases in the summary").default(false)
 ).action(async (opts) => {
@@ -3940,14 +4184,16 @@ var verifyCommand = new Command("verify").description(
   const cfToken = resolveCfToken(opts);
   const apiHost = opts.apiHost ?? `api.${domain}`;
   const images = opts.image ?? [];
-  const totalPhases = 4 + (images.length === 0 ? 1 : images.length);
+  const ollama = await resolveOllamaVerifyInput(opts);
+  const totalPhases = 5 + (images.length === 0 ? 1 : images.length);
   const report = await runVerifyWithSpinner({
     apiHost,
     certWarnDays,
     cfToken,
     opts,
     images,
-    totalPhases
+    totalPhases,
+    ...ollama ? { ollama } : {}
   });
   renderVerifySummary(report, { opts, totalPhases });
   reportVerifyOutcome(report);
@@ -4018,8 +4264,34 @@ function resolveCfToken(opts) {
     process.exit(2);
   }
 }
+function normalizeProvider(v) {
+  return v === "ollama" || v === "xenova" ? v : void 0;
+}
+function mergeOllamaModelConfig(opts, envCfg) {
+  const llmModel = opts.llmModel ?? envCfg.llmModel;
+  if (!llmModel) return void 0;
+  const embeddingModel = opts.embeddingModel ?? envCfg.embeddingModel;
+  const provider = normalizeProvider(opts.embeddingsProvider ?? envCfg.embeddingsProvider);
+  return {
+    llmModel,
+    ...embeddingModel ? { embeddingModel } : {},
+    ...provider ? { provider } : {}
+  };
+}
+async function resolveOllamaVerifyInput(opts) {
+  const explicit = opts.repoDir !== void 0;
+  const dir = opts.repoDir ?? process.cwd();
+  const envCfg = explicit || await looksLikeNodeRepo(dir) ? await readEnvModelConfig(dir) : {};
+  if (opts.embeddingsProvider === void 0 && envCfg.embeddingsProvider !== void 0 && normalizeProvider(envCfg.embeddingsProvider) === void 0) {
+    p3.note(
+      `${pc2.yellow("\u26A0")} Unrecognized EMBEDDINGS_PROVIDER=${envCfg.embeddingsProvider} in .env \u2014 expected xenova|ollama; the embedding-model check is disabled.`,
+      "verify"
+    );
+  }
+  return mergeOllamaModelConfig(opts, envCfg);
+}
 async function runVerifyWithSpinner(args) {
-  const { apiHost, certWarnDays, cfToken, opts, images, totalPhases } = args;
+  const { apiHost, certWarnDays, cfToken, opts, images, totalPhases, ollama } = args;
   let phaseIndex = 0;
   let activeSpin = null;
   const renderPhase = (ph) => {
@@ -4040,7 +4312,8 @@ async function runVerifyWithSpinner(args) {
         ...opts.cfAccountId ? { accountId: opts.cfAccountId } : {},
         ...opts.tunnelId ? { tunnelId: opts.tunnelId } : {}
       },
-      images
+      images,
+      ...ollama ? { ollama } : {}
     },
     deps
   );
@@ -5155,7 +5428,7 @@ function withDefaultSubcommand(argv, known) {
 }
 
 // src/cli.ts
-var VERSION = "0.12.4";
+var VERSION = "0.14.0";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."