create-op-node 0.13.0 → 0.15.0

package/README.md

@@ -238,7 +238,7 @@ npx create-op-node verify --domain your-domain.example
 ```
 
 Off-LAN health probe of a live node, runnable from anywhere with internet
-access. Five phases:
+access. Six phases:
 
 1. **TLS handshake** to `api.<domain>:443` — surfaces cert subject, issuer,
    and days-to-expiry. Warns when the cert is within `--cert-warn-days`
@@ -248,12 +248,22 @@ access. Five phases:
 3. **`POST https://api.<domain>/api`** with `{ __typename }` must return a
    valid GraphQL envelope (catches the "TLS green, but a misconfigured
    proxy returns HTML" case).
-4. **Cloudflare Tunnel status** (optional) — looks up `connections` via
+4. **Ollama model presence** (optional, node-local) — asserts the configured
+   `LLM_MODEL` is actually pulled into the local Ollama, failing loudly with
+   the exact `ollama pull <model>` remedy if not. This catches the
+   config↔runtime drift that otherwise 404s at inference time (a node set to
+   a model that was never downloaded). The model is read from `--llm-model`
+   or, when omitted, the node's `.env` (`--repo-dir`, default cwd) — so
+   running `verify` **on the node** needs no flags. **Skipped** when no model
+   resolves, which keeps an off-LAN `verify --domain …` from tripping it. The
+   embedding model is asserted only under `--embeddings-provider ollama`
+   (xenova computes embeddings in-process).
+5. **Cloudflare Tunnel status** (optional) — looks up `connections` via
    the CF API. Zero connectors registered → warning that cloudflared on
    the Studio is offline. Requires all three of `--cf-token` (or
    `--cf-token-file`), `--cf-account-id`, `--tunnel-id`; partial
    configuration warns + names the missing flag.
-5. **`cosign verify`** (optional, repeatable `--image`) — keyless
+6. **`cosign verify`** (optional, repeatable `--image`) — keyless
    verification against the GitHub Actions OIDC issuer + Fulcio +
    the Rekor transparency log. Silently skipped when `cosign` isn't on
    `PATH` (install with `brew install cosign` to enable).
@@ -281,6 +291,17 @@ invocations — the latter ends up in `ps` output, the former doesn't.
 Use `--api-host <host>` to override the default `api.<domain>`
 construction when your node exposes the API at a different subdomain.
 
+Run it **on the node** (from the region repo dir) to also catch model
+drift with zero extra flags — the Ollama phase reads `LLM_MODEL` from the
+`.env` bootstrap wrote:
+
+```bash
+cd ~/Development/opuspopuli-node-us-ca
+npx create-op-node verify --domain yournode.example.org
+# or pin the model explicitly from anywhere:
+npx create-op-node verify --domain yournode.example.org --llm-model qwen3.6:35b-a3b
+```
+
 ## Bootstrapping a region config
 
 A node serves data; **what** data it serves is defined by a declarative region

package/dist/cli.js

@@ -2122,6 +2122,11 @@ async function checkOllamaHealth(url = OLLAMA_URL) {
     clearTimeout(timer);
   }
 }
+function modelPresent(configured, installed) {
+  const norm = (m) => m.includes(":") ? m : `${m}:latest`;
+  const target = norm(configured);
+  return installed.some((m) => norm(m) === target);
+}
 async function pullModel(name) {
   const res = await safeExeca("ollama", ["pull", name]);
   if (res === null) return { ok: false, reason: "`ollama` not on PATH" };
@@ -2321,6 +2326,25 @@ function joinTrimmed(region) {
   while (end > start && joined[end - 1] === "\n") end--;
   return joined.slice(start, end);
 }
+async function readEnvModelConfig(repoDir) {
+  let content;
+  try {
+    content = await readFile(join(repoDir, ".env"), "utf8");
+  } catch {
+    return {};
+  }
+  const map = parseEnvContent(content);
+  const cfg = {};
+  const llm = map.get("LLM_MODEL");
+  const emb = map.get("EMBEDDINGS_MODEL");
+  const prov = map.get("EMBEDDINGS_PROVIDER");
+  const node = map.get("NODE_ENV");
+  if (llm !== void 0) cfg.llmModel = llm;
+  if (emb !== void 0) cfg.embeddingModel = emb;
+  if (prov !== void 0) cfg.embeddingsProvider = prov;
+  if (node !== void 0) cfg.nodeEnv = node;
+  return cfg;
+}
 async function writeManagedEnv(repoDir, selection, opts = {}) {
   const target = join(repoDir, ".env");
   let existing = "";
@@ -2476,7 +2500,7 @@ var bootstrapCommand = new Command("bootstrap").description(
   await runLaunchAgentPhase({ opts, secrets });
   await installWrapperPhase({ repoPath, region, promptServiceUrl: secrets.promptServiceUrl });
   await loginGhcrPhase();
-  await runOllamaPhase({ opts, embeddingModel, llmModel });
+  await runOllamaPhase({ opts, embeddingModel, llmModel, embeddingsProvider });
   await runEnvFilePhase({
     repoPath,
     llmModel,
@@ -2898,8 +2922,12 @@ async function loginGhcrPhase() {
   }
   ghcrSpin.stop(pc2.green("\u2713 Logged in to ghcr.io."));
 }
+function modelsToPull(args) {
+  const { provider, llmModel, embeddingModel } = args;
+  return provider === "ollama" ? [embeddingModel, llmModel] : [llmModel];
+}
 async function runOllamaPhase(args) {
-  const { opts, embeddingModel, llmModel } = args;
+  const { opts, embeddingModel, llmModel, embeddingsProvider } = args;
   if (opts.skipOllama) return;
   const olSpin = p3.spinner();
   olSpin.start(`Pulling + warming Ollama models\u2026 (${estimatedPullTime(llmModel)})`);
@@ -2926,7 +2954,8 @@ async function runOllamaPhase(args) {
       process.exit(1);
     }
   }
-  const modelReport = await setupModels([embeddingModel, llmModel], (model, status) => {
+  const toPull = modelsToPull({ provider: embeddingsProvider, llmModel, embeddingModel });
+  const modelReport = await setupModels(toPull, (model, status) => {
     olSpin.message(`${status}: ${model}`);
   });
   olSpin.stop(
@@ -2934,6 +2963,12 @@ async function runOllamaPhase(args) {
       `\u2713 ${modelReport.pulled.length} pulled, ${modelReport.alreadyPresent.length} present, ${modelReport.warmed.length} warmed`
     ) : pc2.yellow(`\u26A0 ${modelReport.failed.length} model pull(s) failed`)
   );
+  if (embeddingsProvider !== "ollama") {
+    p3.note(
+      `${pc2.dim("\xB7")} Skipped pulling the embedding model \u2014 EMBEDDINGS_PROVIDER=${embeddingsProvider} computes embeddings in-process (no Ollama model needed).`,
+      "Embeddings"
+    );
+  }
   const probe = await probeHostDockerInternal();
   if (!probe.ok) {
     p3.note(`${pc2.yellow("\u26A0")} ${probe.reason}`, "Docker host networking");
@@ -3962,7 +3997,8 @@ var DEFAULT_DEPS2 = {
   http: httpProbe,
   graphql: graphqlProbe,
   tunnel: tunnelStatus,
-  cosign: cosignVerifyImage
+  cosign: cosignVerifyImage,
+  ollama: checkOllamaHealth
 };
 async function runVerify(input, deps = DEFAULT_DEPS2) {
   const phases = [];
@@ -3973,11 +4009,17 @@ async function runVerify(input, deps = DEFAULT_DEPS2) {
   await verifyTlsPhase(input, deps, push);
   await verifyHealthPhase(input, deps, push);
   await verifyGraphqlPhase(input, deps, push);
+  await verifyOllamaModelsPhase(input, deps, push);
   await verifyCloudflarePhase(input, deps, push);
   await verifyCosignPhase(input, deps, push);
   return { phases };
 }
+function skipLocalOnly(name, detail, push) {
+  push({ name, status: "skipped", detail });
+}
+var LOCAL_ONLY_NO_ENDPOINT = "local-only node \u2014 no public endpoint to probe";
 async function verifyTlsPhase(input, deps, push) {
+  if (input.localOnly) return skipLocalOnly("TLS handshake", LOCAL_ONLY_NO_ENDPOINT, push);
   const tls2 = await deps.tls({ host: input.apiHost });
   if (!tls2.ok) {
     push({ name: "TLS handshake", status: "fail", detail: tls2.reason });
@@ -3995,6 +4037,7 @@ async function verifyTlsPhase(input, deps, push) {
   push({ name: "TLS handshake", status: "ok", detail: line });
 }
 async function verifyHealthPhase(input, deps, push) {
+  if (input.localOnly) return skipLocalOnly("GET /health", LOCAL_ONLY_NO_ENDPOINT, push);
   const health = await deps.http({ url: `https://${input.apiHost}/health` });
   if (health.ok) {
     push({ name: "GET /health", status: "ok", detail: `HTTP ${health.status}` });
@@ -4003,6 +4046,7 @@ async function verifyHealthPhase(input, deps, push) {
   }
 }
 async function verifyGraphqlPhase(input, deps, push) {
+  if (input.localOnly) return skipLocalOnly("GraphQL { __typename }", LOCAL_ONLY_NO_ENDPOINT, push);
   const gql = await deps.graphql({ url: `https://${input.apiHost}/api` });
   if (gql.ok) {
     push({ name: "GraphQL { __typename }", status: "ok", detail: `typename=${gql.typename}` });
@@ -4010,7 +4054,41 @@ async function verifyGraphqlPhase(input, deps, push) {
     push({ name: "GraphQL { __typename }", status: "fail", detail: gql.reason });
   }
 }
+async function verifyOllamaModelsPhase(input, deps, push) {
+  const cfg = input.ollama;
+  if (!cfg?.llmModel) {
+    push({
+      name: "Ollama models",
+      status: "skipped",
+      detail: "pass --llm-model (or run on the node so its .env is read) to enable"
+    });
+    return;
+  }
+  const health = await deps.ollama();
+  if (!health.reachable) {
+    push({
+      name: "Ollama models",
+      status: "fail",
+      detail: "configured model set but the local Ollama daemon is unreachable on :11434 \u2014 start it with `brew services start ollama` (run this check on the node)"
+    });
+    return;
+  }
+  const required = [cfg.llmModel];
+  if (cfg.provider === "ollama" && cfg.embeddingModel) required.push(cfg.embeddingModel);
+  const missing = required.filter((m) => !modelPresent(m, health.models));
+  if (missing.length > 0) {
+    const remedy = missing.map((m) => `ollama pull ${m}`).join(" && ");
+    push({
+      name: "Ollama models",
+      status: "fail",
+      detail: `not installed: ${missing.join(", ")} \u2014 remedy: ${remedy}`
+    });
+    return;
+  }
+  push({ name: "Ollama models", status: "ok", detail: `${required.join(", ")} present` });
+}
 async function verifyCloudflarePhase(input, deps, push) {
+  if (input.localOnly) return skipLocalOnly("Cloudflare Tunnel", "local-only node \u2014 no tunnel", push);
   const cfFields = [
     ["--cf-token", input.cf?.token],
     ["--cf-account-id", input.cf?.accountId],
@@ -4080,6 +4158,9 @@ function readTokenFile(path) {
   if (!raw) throw new Error(`--cf-token-file ${path} was empty`);
   return raw;
 }
+function collectImage(value, previous) {
+  return [...previous ?? [], value];
+}
 var verifyCommand = new Command("verify").description(
   "Off-LAN health probe of a live node \u2014 TLS, Apollo Federation reachability, GraphQL smoke. Run from anywhere with internet access."
 ).addOption(
@@ -4089,28 +4170,46 @@ var verifyCommand = new Command("verify").description(
 ).addOption(new Option("--cf-account-id <id>", "Cloudflare account ID (required with --cf-token)")).addOption(
   new Option("--tunnel-id <id>", "Cloudflare Tunnel ID to query (required with --cf-token)")
 ).addOption(
-  new Option("--image <ref>", "Repeatable. Image to cosign-verify (e.g. ghcr.io/opuspopuli/api:tag)").default(
-    []
-  )
+  new Option("--image <ref>", "Repeatable. Image to cosign-verify (e.g. ghcr.io/opuspopuli/api:tag)").default([]).argParser(collectImage)
 ).addOption(
   new Option("--cert-warn-days <n>", "Warn if cert expires within N days").default("14")
+).addOption(
+  new Option(
+    "--llm-model <model>",
+    "Assert this model is present in the local Ollama (catches config\u2194runtime drift). Defaults to LLM_MODEL from the node .env when run on the node."
+  )
+).addOption(
+  new Option("--embedding-model <model>", "Also assert this embedding model is present (only checked when --embeddings-provider=ollama).")
+).addOption(
+  new Option("--embeddings-provider <provider>", "Embeddings provider the node runs; the embedding model is only asserted for `ollama`.").choices(["xenova", "ollama"])
+).addOption(
+  new Option("--repo-dir <path>", "Node repo dir whose .env supplies the model config when --llm-model is omitted (default: cwd).")
+).addOption(
+  new Option(
+    "--local-only",
+    "Node has no public domain/tunnel \u2014 skip the TLS/health/GraphQL/tunnel probes (no domain prompt) and run only the node-local checks (Ollama model presence, cosign)."
+  ).default(false)
 ).addOption(
   new Option("--show-skipped", "Include skipped phases in the summary").default(false)
 ).action(async (opts) => {
   p3.intro(pc2.bgCyan(pc2.black(" create-op-node verify ")));
-  const domain = await resolveDomain(opts);
+  const localOnly = opts.localOnly ?? false;
+  const domain = localOnly ? void 0 : await resolveDomain(opts);
   const certWarnDays = resolveCertWarnDays(opts);
   const cfToken = resolveCfToken(opts);
-  const apiHost = opts.apiHost ?? `api.${domain}`;
+  const apiHost = localOnly ? "" : opts.apiHost ?? `api.${domain}`;
   const images = opts.image ?? [];
-  const totalPhases = 4 + (images.length === 0 ? 1 : images.length);
+  const ollama = await resolveOllamaVerifyInput(opts);
+  const totalPhases = 5 + (images.length === 0 ? 1 : images.length);
   const report = await runVerifyWithSpinner({
     apiHost,
     certWarnDays,
     cfToken,
     opts,
     images,
-    totalPhases
+    totalPhases,
+    localOnly,
+    ...ollama ? { ollama } : {}
   });
   renderVerifySummary(report, { opts, totalPhases });
   reportVerifyOutcome(report);
@@ -4181,8 +4280,34 @@ function resolveCfToken(opts) {
     process.exit(2);
   }
 }
+function normalizeProvider(v) {
+  return v === "ollama" || v === "xenova" ? v : void 0;
+}
+function mergeOllamaModelConfig(opts, envCfg) {
+  const llmModel = opts.llmModel ?? envCfg.llmModel;
+  if (!llmModel) return void 0;
+  const embeddingModel = opts.embeddingModel ?? envCfg.embeddingModel;
+  const provider = normalizeProvider(opts.embeddingsProvider ?? envCfg.embeddingsProvider);
+  return {
+    llmModel,
+    ...embeddingModel ? { embeddingModel } : {},
+    ...provider ? { provider } : {}
+  };
+}
+async function resolveOllamaVerifyInput(opts) {
+  const explicit = opts.repoDir !== void 0;
+  const dir = opts.repoDir ?? process.cwd();
+  const envCfg = explicit || await looksLikeNodeRepo(dir) ? await readEnvModelConfig(dir) : {};
+  if (opts.embeddingsProvider === void 0 && envCfg.embeddingsProvider !== void 0 && normalizeProvider(envCfg.embeddingsProvider) === void 0) {
+    p3.note(
+      `${pc2.yellow("\u26A0")} Unrecognized EMBEDDINGS_PROVIDER=${envCfg.embeddingsProvider} in .env \u2014 expected xenova|ollama; the embedding-model check is disabled.`,
+      "verify"
+    );
+  }
+  return mergeOllamaModelConfig(opts, envCfg);
+}
 async function runVerifyWithSpinner(args) {
-  const { apiHost, certWarnDays, cfToken, opts, images, totalPhases } = args;
+  const { apiHost, certWarnDays, cfToken, opts, images, totalPhases, localOnly, ollama } = args;
   let phaseIndex = 0;
   let activeSpin = null;
   const renderPhase = (ph) => {
@@ -4203,7 +4328,9 @@ async function runVerifyWithSpinner(args) {
         ...opts.cfAccountId ? { accountId: opts.cfAccountId } : {},
         ...opts.tunnelId ? { tunnelId: opts.tunnelId } : {}
       },
-      images
+      images,
+      localOnly,
+      ...ollama ? { ollama } : {}
     },
     deps
   );
@@ -5318,7 +5445,7 @@ function withDefaultSubcommand(argv, known) {
 }
 
 // src/cli.ts
-var VERSION = "0.13.0";
+var VERSION = "0.15.0";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."