create-op-node 0.4.0 → 0.6.0

package/README.md

@@ -16,6 +16,10 @@ That's it. The wizard walks you through:
 5. **pgsodium master key** — generates a fresh 64-hex root key, stores it in your **macOS login Keychain** as `org.opuspopuli.<region>/pgsodium-root-key`. No third-party password manager required.
 6. **Tunnel token retrieval** — after `terraform apply` lands, fetches the Tunnel token from Terraform Cloud outputs and stores it alongside the pgsodium key in your Keychain.
 
+> Doing **local dev / testing first** (no public exposure yet)?
+> See [Local-only mode](#local-only-mode-no-cloudflare) — `init --local-only`
+> skips the Cloudflare/TFC/PR phases entirely.
+
 Then on the Mac Studio itself:
 
 ```bash
@@ -24,18 +28,79 @@ npx create-op-node bootstrap
 
 Configures macOS power settings, installs Homebrew + the CLI tool list, sets up Docker Desktop + Tailscale + Ollama, clones the node repo you created, reads the pgsodium key + Tunnel token from the Studio's Keychain (or prompts you to paste them once, then persists for re-runs), writes the LaunchAgent plist, logs into ghcr.io, pulls + warms the LLM model, and finally `docker compose --profile public pull && up -d` brings the whole stack online. Health-check loop waits until all containers are `(healthy)`.
 
+### Choosing the LLM model
+
+By default bootstrap pulls `qwen3.5:9b` (LLM) and `nomic-embed-text`
+(embeddings) — small enough to validate the inference path on first
+run. Override with flags:
+
+```bash
+# Just swap the LLM, keep the default embedding model:
+npx create-op-node bootstrap --region us-ca --llm-model llama3.3:70b
+
+# Override both:
+npx create-op-node bootstrap \
+  --region us-ca \
+  --llm-model llama3.3:70b \
+  --embedding-model mxbai-embed-large
+```
+
+The chosen models flow two places:
+
+1. **Ollama**: bootstrap pulls + warms them so the daemon has them
+   resident before the stack comes up. The embedding model pulls first
+   (small, fast feedback); the LLM pulls second (can be tens of GB).
+2. **LaunchAgent**: the plist exports `LLM_MODEL` and `EMBEDDINGS_MODEL`
+   into the launchd session, which Docker Desktop inherits — so compose
+   services read them via env, no `.env.production` edits needed.
+
+> **`--embedding-model` only takes effect when the knowledge service
+> runs with `EMBEDDINGS_PROVIDER=ollama`.** The default provider is
+> `xenova` (in-process), which bundles its own embedding model and
+> ignores both `EMBEDDINGS_MODEL` and the local Ollama model. Setting
+> `EMBEDDINGS_PROVIDER=ollama` is a separate decision (set in your
+> region repo's `.env.production`) — see `docs/provider-pattern.md`.
+
+> **Template contract**: for `--llm-model` to actually change the
+> running model, the region repo's `docker-compose-prod.yml` must use
+> `${LLM_MODEL:-qwen3.5:9b}` (or similar) on the knowledge service's
+> `environment:` block. The current `opuspopuli-node` template does;
+> a fork that hardcodes the value would ignore the flag silently.
+
+For RAM sizing, the [Docker resources doc](https://github.com/OpusPopuli/opuspopuli-node/blob/main/docs/docker-resources.md)
+has a tier table: 9B-class needs ~8 GB Ollama; 70B-class needs ~50 GB;
+frontier MoE needs ~80 GB. Allocate Docker the remainder.
+
+To switch models post-bootstrap, re-run with the new flag and
+`docker compose down && up -d` to pick up the changed env.
+
 ### Local-only mode (no Cloudflare)
 
+For local dev / testing — frontend on your laptop, backend on the Studio
+over Tailscale, no public exposure. The flow mirrors production-init →
+production-bootstrap, just with the Cloudflare half cut out on both
+sides.
+
+**On the laptop:**
+
+```bash
+npx create-op-node init --region us-ca --local-only
+```
+
+This creates the region repo from the `OpusPopuli/opuspopuli-node`
+template (private, no public exposure), generates the pgsodium master
+key, and saves it to Keychain. No Cloudflare, no Terraform Cloud, no PR
+to merge.
+
+**On the Studio:**
+
 ```bash
 npx create-op-node bootstrap --region us-ca --local-only
 ```
 
-Brings the Studio up for local dev / testing — frontend on your laptop
-hits the Studio over Tailscale, no public exposure. Differences from
-the standard run:
+Differences from production bootstrap:
 
-- **No Tunnel token required.** `init` is unnecessary; if the pgsodium
-  key isn't in Keychain, bootstrap generates one inline and persists it.
+- **No Tunnel token required.** `init --local-only` skipped that phase.
 - **`cloudflared` stays down.** It's gated behind the `public` compose
   profile, which `--local-only` doesn't activate. Bootstrap also evicts
   any leftover cloudflared from a prior public run so it doesn't strand
@@ -47,8 +112,9 @@ the standard run:
   exported into the launchd session.
 - **Outro tells you to use Tailscale**, not `npx create-op-node verify`.
 
-When you're ready to go public, re-run `bootstrap` without `--local-only`
-and the same Studio promotes to the full production-shaped deploy.
+When you're ready to expose publicly, re-run **both** commands without
+`--local-only`. Same region repo, same pgsodium key — promotes
+cleanly to the production-shaped deploy.
 
 > **Template version**: this mode depends on the `opuspopuli-node`
 > template having `profiles: [public]` on its cloudflared service. If

package/dist/cli.js

@@ -536,10 +536,23 @@ var initCommand = new Command("init").description(
     "--use-existing-repo",
     "Continue using a previously-created node repo (don't fail on 'already exists')"
   ).default(false)
-).addOption(new Option("--skip-wait", "Don't poll for Terraform apply; exit after PR open").default(false)).addOption(new Option("-y, --yes", "Skip the final confirmation").default(false)).action(async (opts) => {
+).addOption(new Option("--skip-wait", "Don't poll for Terraform apply; exit after PR open").default(false)).addOption(
+  new Option(
+    "--local-only",
+    "Skip the Cloudflare/TFC/PR/tunnel phases. Creates the region repo from template + stores a pgsodium key \u2014 enough for `bootstrap --local-only` to work."
+  ).default(false)
+).addOption(new Option("-y, --yes", "Skip the final confirmation").default(false)).action(async (opts) => {
   p3.intro(pc2.bgCyan(pc2.black(" create-op-node init ")));
   p3.note(
-    [
+    opts.localOnly ? [
+      "Local-only setup \u2014 creates the region repo from template + a pgsodium key.",
+      "No Cloudflare, no Terraform Cloud, no public exposure.",
+      "",
+      pc2.dim("Phase 1: laptop side (now) \u2014 GitHub repo from template + Keychain."),
+      pc2.dim("Phase 2: Studio side \u2014 `create-op-node bootstrap --local-only`."),
+      "",
+      pc2.dim("When you're ready to expose publicly, re-run `init` without --local-only.")
+    ].join("\n") : [
       "This walks you from a sealed Mac Studio + a Cloudflare account to a",
       "live federation node serving traffic at api.<your-domain>.",
       "",
@@ -555,62 +568,25 @@ var initCommand = new Command("init").description(
       validate: (v) => /^[a-z0-9-]{2,32}$/.test(v ?? "") ? void 0 : "lowercase letters, digits, hyphens; 2\u201332 chars"
     })
   );
-  const domain = opts.domain ? opts.domain : unwrap(
-    await p3.text({
-      message: "Domain registered in Cloudflare?",
-      placeholder: "example.org",
-      validate: (v) => !v ? "Required" : v.includes(".") ? void 0 : "Missing a TLD?"
-    })
-  );
   const owner = opts.owner ?? "OpusPopuli";
   const newRepoName = `opuspopuli-node-${region}`;
   const newRepoFull = `${owner}/${newRepoName}`;
-  const cfToken = await collectSecret(
-    opts.cfToken,
-    "Cloudflare Account API token (input hidden)",
-    "cloudflare"
-  );
-  const cfAccount = await collectId(opts.cfAccount, "Cloudflare account ID");
-  const cfZone = await collectId(opts.cfZone, `Cloudflare zone ID for ${domain}`);
-  const cfSpin = p3.spinner();
-  cfSpin.start("Verifying Cloudflare token + 5 scopes\u2026");
-  const cfProbe = await probeCloudflareToken({
-    token: cfToken,
-    accountId: cfAccount,
-    zoneId: cfZone
-  });
-  if (!cfProbe.ok) {
-    cfSpin.stop(pc2.red("\u2717 Cloudflare token check failed."));
-    for (const issue of cfProbe.issues) console.error(`  - ${issue}`);
-    p3.cancel("Fix the token in the Cloudflare dashboard, then re-run.");
-    process.exit(1);
-  }
-  cfSpin.stop(pc2.green("\u2713 Cloudflare token valid, 5 scopes present."));
-  const tfToken = await collectSecret(
-    opts.tfToken,
-    "Terraform Cloud user/team API token",
-    "tfc"
-  );
-  const tfOrg = opts.tfOrg ? opts.tfOrg : unwrap(
-    await p3.text({
-      message: "Terraform Cloud organization name?",
-      placeholder: "op-region-ca"
-    })
-  );
-  const tfSpin = p3.spinner();
-  tfSpin.start("Verifying Terraform Cloud token + organization\u2026");
-  const tfProbe = await probeTfcToken({ token: tfToken, organization: tfOrg });
-  if (!tfProbe.ok) {
-    tfSpin.stop(pc2.red("\u2717 Terraform Cloud check failed."));
-    for (const issue of tfProbe.issues) console.error(`  - ${issue}`);
-    p3.cancel("Fix the token / org, then re-run.");
-    process.exit(1);
+  if (opts.localOnly) {
+    const ignored = listIgnoredLocalOnlyFlags(opts);
+    if (ignored.length > 0) {
+      p3.note(
+        pc2.yellow(
+          `\u26A0 The following ${ignored.length === 1 ? "flag is" : "flags are"} ignored with --local-only:
+  ${ignored.join(", ")}
+` + pc2.dim(
+            "These configure Cloudflare / TFC / PR-merge flow, which --local-only skips."
+          )
+        ),
+        "Notice"
+      );
+    }
   }
-  tfSpin.stop(
-    pc2.green(
-      `\u2713 TFC token valid${tfProbe.userName ? ` (as ${tfProbe.userName})` : ""}, org "${tfOrg}" reachable.`
-    )
-  );
+  const publicConfig = opts.localOnly ? null : await collectPublicConfig(opts);
   let ghToken = opts.ghToken;
   if (!ghToken) {
     const fromCli = await ghTokenFromCli();
@@ -636,12 +612,23 @@ var initCommand = new Command("init").description(
 ` + pc2.dim("Note: items don't sync to iCloud Keychain via the security CLI.\n") + pc2.dim("On the Studio, bootstrap will read locally and prompt you to paste if missing.") : `\u26A0 ${keychain.reason ?? "Keychain unavailable"}. Secrets will be printed for manual stash.`;
   p3.note(kcNote, "Secret store");
   p3.note(
-    [
+    opts.localOnly ? [
       `Region label:        ${pc2.cyan(region)}`,
-      `Domain:              ${pc2.cyan(domain)}`,
       `New node repo:       ${pc2.cyan(newRepoFull)}`,
       `Template:            ${pc2.dim(opts.template ?? "OpusPopuli/opuspopuli-node")}`,
-      `TFC organization:    ${pc2.cyan(tfOrg)}`,
+      `GH org write access: ${pc2.dim(`required for ${owner}`)}`,
+      ``,
+      `Will create the repo from template (private, no Cloudflare),`,
+      `and store a fresh pgsodium key in Keychain. That's it \u2014 no PR,`,
+      `no terraform, no tunnel token. Bootstrap on the Studio with`,
+      `\`bootstrap --local-only --region ${region}\` next.`
+    ].join("\n") : [
+      `Region label:        ${pc2.cyan(region)}`,
+      `Domain:              ${pc2.cyan(publicConfig?.domain ?? "")}`,
+      `New node repo:       ${pc2.cyan(newRepoFull)}`,
+      `Template:            ${pc2.dim(opts.template ?? "OpusPopuli/opuspopuli-node")}`,
+      `TFC organization:    ${pc2.cyan(publicConfig?.tfOrg ?? "")}`,
+      `GH org write access: ${pc2.dim(`required for ${owner}`)}`,
       ``,
       `Will create the repo, seed 5 secrets, write prod.tfvars on a branch,`,
       `open a PR, generate a fresh pgsodium key, and (after you merge) wait`,
@@ -697,90 +684,94 @@ var initCommand = new Command("init").description(
       defaultBranch: "main"
     };
   }
-  const secrets = [
-    { name: "CLOUDFLARE_API_TOKEN", value: cfToken },
-    { name: "CLOUDFLARE_ACCOUNT_ID", value: cfAccount },
-    { name: "CLOUDFLARE_ZONE_ID", value: cfZone },
-    { name: "TF_API_TOKEN", value: tfToken },
-    { name: "TF_CLOUD_ORGANIZATION", value: tfOrg }
-  ];
-  const secSpin = p3.spinner();
-  secSpin.start(`Seeding ${secrets.length} repo secrets\u2026`);
-  const seeded = [];
-  for (const s of secrets) {
-    const r = await setRepoSecret({ repo: newRepoFull, name: s.name, value: s.value });
-    if (!r.written) {
-      secSpin.stop(pc2.red(`\u2717 Failed to set ${s.name}: ${r.reason ?? "unknown"}`));
-      const remaining = secrets.slice(secrets.findIndex((x) => x.name === s.name)).map((x) => x.name);
-      p3.cancel(
-        [
-          seeded.length > 0 ? `Already seeded on ${newRepoFull}: ${seeded.join(", ")}.` : `Nothing seeded yet on ${newRepoFull}.`,
-          `Still pending: ${remaining.join(", ")}.`,
+  if (publicConfig) {
+    const secrets = [
+      { name: "CLOUDFLARE_API_TOKEN", value: publicConfig.cfToken },
+      { name: "CLOUDFLARE_ACCOUNT_ID", value: publicConfig.cfAccount },
+      { name: "CLOUDFLARE_ZONE_ID", value: publicConfig.cfZone },
+      { name: "TF_API_TOKEN", value: publicConfig.tfToken },
+      { name: "TF_CLOUD_ORGANIZATION", value: publicConfig.tfOrg }
+    ];
+    const secSpin = p3.spinner();
+    secSpin.start(`Seeding ${secrets.length} repo secrets\u2026`);
+    const seeded = [];
+    for (const s of secrets) {
+      const r = await setRepoSecret({ repo: newRepoFull, name: s.name, value: s.value });
+      if (!r.written) {
+        secSpin.stop(pc2.red(`\u2717 Failed to set ${s.name}: ${r.reason ?? "unknown"}`));
+        const remaining = secrets.slice(secrets.findIndex((x) => x.name === s.name)).map((x) => x.name);
+        p3.cancel(
+          [
+            seeded.length > 0 ? `Already seeded on ${newRepoFull}: ${seeded.join(", ")}.` : `Nothing seeded yet on ${newRepoFull}.`,
+            `Still pending: ${remaining.join(", ")}.`,
+            "",
+            `Make sure \`gh\` is installed and signed in (\`gh auth login\`).`,
+            `Re-run with --use-existing-repo to retry (GitHub will overwrite the already-set secrets idempotently).`
+          ].join("\n")
+        );
+        process.exit(1);
+      }
+      seeded.push(s.name);
+    }
+    secSpin.stop(pc2.green(`\u2713 Seeded ${secrets.length} secrets on ${newRepoFull}`));
+  }
+  let pr = null;
+  if (publicConfig) {
+    const branch = `init/region-${region}-${isoStampUtc(/* @__PURE__ */ new Date())}`;
+    const setupSpin = p3.spinner();
+    setupSpin.start(`Writing prod.tfvars on branch ${branch}\u2026`);
+    try {
+      await createBranch({
+        token: ghToken,
+        repo: newRepoFull,
+        branch,
+        fromBranch: created.defaultBranch
+      });
+      const tfvars = renderProdTfvars({
+        project: opts.project ?? "opuspopuli",
+        domain: publicConfig.domain
+      });
+      await commitFile({
+        token: ghToken,
+        repo: newRepoFull,
+        branch,
+        path: "infra/cloudflare/environments/prod.tfvars",
+        content: tfvars,
+        message: `init: prod.tfvars for ${region}`
+      });
+    } catch (err) {
+      setupSpin.stop(pc2.red(`\u2717 Couldn't write tfvars: ${err.message}`));
+      p3.cancel("The repo exists but the branch / commit failed. Open it on GitHub and inspect.");
+      process.exit(1);
+    }
+    setupSpin.stop(pc2.green("\u2713 Wrote prod.tfvars"));
+    const prSpin = p3.spinner();
+    prSpin.start("Opening pull request\u2026");
+    try {
+      pr = await openPullRequest({
+        token: ghToken,
+        repo: newRepoFull,
+        head: branch,
+        base: created.defaultBranch,
+        title: `init: bring up region ${region}`,
+        body: [
+          `Initial region deployment for **${region}** (${publicConfig.domain}).`,
+          "",
+          "Adds `infra/cloudflare/environments/prod.tfvars`. Merging this PR triggers",
+          "`cloudflare-infra.yml` which runs `terraform apply` against the",
+          `\`${publicConfig.tfOrg}\` Terraform Cloud organization, provisioning the Cloudflare`,
+          "Tunnel, DNS records, R2 buckets, and Pages project.",
           "",
-          `Make sure \`gh\` is installed and signed in (\`gh auth login\`).`,
-          `Re-run with --use-existing-repo to retry (GitHub will overwrite the already-set secrets idempotently).`
+          `Generated by \`create-op-node init\`.`
         ].join("\n")
-      );
+      });
+    } catch (err) {
+      prSpin.stop(pc2.red(`\u2717 Couldn't open PR: ${err.message}`));
+      p3.cancel("Branch + tfvars are committed; open the PR by hand on GitHub.");
       process.exit(1);
     }
-    seeded.push(s.name);
+    prSpin.stop(pc2.green(`\u2713 Opened PR #${pr.number}`));
   }
-  secSpin.stop(pc2.green(`\u2713 Seeded ${secrets.length} secrets on ${newRepoFull}`));
-  const branch = `init/region-${region}-${isoStampUtc(/* @__PURE__ */ new Date())}`;
-  const setupSpin = p3.spinner();
-  setupSpin.start(`Writing prod.tfvars on branch ${branch}\u2026`);
-  try {
-    await createBranch({
-      token: ghToken,
-      repo: newRepoFull,
-      branch,
-      fromBranch: created.defaultBranch
-    });
-    const tfvars = renderProdTfvars({
-      project: opts.project ?? "opuspopuli",
-      domain
-    });
-    await commitFile({
-      token: ghToken,
-      repo: newRepoFull,
-      branch,
-      path: "infra/cloudflare/environments/prod.tfvars",
-      content: tfvars,
-      message: `init: prod.tfvars for ${region}`
-    });
-  } catch (err) {
-    setupSpin.stop(pc2.red(`\u2717 Couldn't write tfvars: ${err.message}`));
-    p3.cancel("The repo exists but the branch / commit failed. Open it on GitHub and inspect.");
-    process.exit(1);
-  }
-  setupSpin.stop(pc2.green("\u2713 Wrote prod.tfvars"));
-  const prSpin = p3.spinner();
-  prSpin.start("Opening pull request\u2026");
-  let pr;
-  try {
-    pr = await openPullRequest({
-      token: ghToken,
-      repo: newRepoFull,
-      head: branch,
-      base: created.defaultBranch,
-      title: `init: bring up region ${region}`,
-      body: [
-        `Initial region deployment for **${region}** (${domain}).`,
-        "",
-        "Adds `infra/cloudflare/environments/prod.tfvars`. Merging this PR triggers",
-        "`cloudflare-infra.yml` which runs `terraform apply` against the",
-        `\`${tfOrg}\` Terraform Cloud organization, provisioning the Cloudflare`,
-        "Tunnel, DNS records, R2 buckets, and Pages project.",
-        "",
-        `Generated by \`create-op-node init\`.`
-      ].join("\n")
-    });
-  } catch (err) {
-    prSpin.stop(pc2.red(`\u2717 Couldn't open PR: ${err.message}`));
-    p3.cancel("Branch + tfvars are committed; open the PR by hand on GitHub.");
-    process.exit(1);
-  }
-  prSpin.stop(pc2.green(`\u2713 Opened PR #${pr.number}`));
   const pgsodiumCoords = { region, account: "pgsodium-root-key" };
   const keyLabel = `org.opuspopuli.${region}/pgsodium-root-key`;
   if (keychain.available) {
@@ -806,6 +797,28 @@ var initCommand = new Command("init").description(
     const fresh = generatePgsodiumRootKey();
     await printKeyForManualSave(fresh, keyLabel);
   }
+  if (!publicConfig) {
+    p3.outro(
+      pc2.cyan(
+        [
+          `Region ${region} provisioned for local-only mode.`,
+          `Repo: https://github.com/${newRepoFull}`,
+          ``,
+          `Next: on the Studio (fresh or otherwise \u2014 bootstrap installs`,
+          `brew packages it needs), run:`,
+          `  npx create-op-node bootstrap --region ${region} --local-only`,
+          ``,
+          `When you're ready to expose publicly, re-run BOTH \`init\` and`,
+          `\`bootstrap\` without --local-only. Same region repo + pgsodium key`,
+          `promote cleanly to the production-shaped deploy.`
+        ].join("\n")
+      )
+    );
+    return;
+  }
+  if (!pr) {
+    throw new Error("init: PR creation step did not run despite publicConfig present");
+  }
   if (opts.skipWait) {
     p3.outro(
       pc2.cyan(
@@ -833,19 +846,19 @@ var initCommand = new Command("init").description(
     return;
   }
   const ws = await findWorkspace({
-    token: tfToken,
-    organization: tfOrg,
+    token: publicConfig.tfToken,
+    organization: publicConfig.tfOrg,
     tags: ["opuspopuli", "cloudflare"]
   });
   if (!ws) {
     p3.cancel(
-      `Couldn't find a TFC workspace tagged opuspopuli + cloudflare in ${tfOrg}. Check the workflow's run log; the workspace is created on first apply.`
+      `Couldn't find a TFC workspace tagged opuspopuli + cloudflare in ${publicConfig.tfOrg}. Check the workflow's run log; the workspace is created on first apply.`
     );
     process.exit(1);
   }
   const tunnelToken = await waitForApplyAndFetchTunnelToken({
-    token: tfToken,
-    organization: tfOrg,
+    token: publicConfig.tfToken,
+    organization: publicConfig.tfOrg,
     workspaceId: ws.id,
     runId: ws.currentRunId
   });
@@ -882,6 +895,73 @@ var MIN_TOKEN_LENGTH = {
   github: 40,
   generic: 20
 };
+function listIgnoredLocalOnlyFlags(opts) {
+  const ignored = [];
+  if (opts.domain) ignored.push("--domain");
+  if (opts.cfToken) ignored.push("--cf-token");
+  if (opts.cfAccount) ignored.push("--cf-account");
+  if (opts.cfZone) ignored.push("--cf-zone");
+  if (opts.tfToken) ignored.push("--tf-token");
+  if (opts.tfOrg) ignored.push("--tf-org");
+  if (opts.skipWait) ignored.push("--skip-wait");
+  return ignored;
+}
+async function collectPublicConfig(opts) {
+  const domain = opts.domain ? opts.domain : unwrap(
+    await p3.text({
+      message: "Domain registered in Cloudflare?",
+      placeholder: "example.org",
+      validate: (v) => !v ? "Required" : v.includes(".") ? void 0 : "Missing a TLD?"
+    })
+  );
+  const cfToken = await collectSecret(
+    opts.cfToken,
+    "Cloudflare Account API token (input hidden)",
+    "cloudflare"
+  );
+  const cfAccount = await collectId(opts.cfAccount, "Cloudflare account ID");
+  const cfZone = await collectId(opts.cfZone, `Cloudflare zone ID for ${domain}`);
+  const cfSpin = p3.spinner();
+  cfSpin.start("Verifying Cloudflare token + 5 scopes\u2026");
+  const cfProbe = await probeCloudflareToken({
+    token: cfToken,
+    accountId: cfAccount,
+    zoneId: cfZone
+  });
+  if (!cfProbe.ok) {
+    cfSpin.stop(pc2.red("\u2717 Cloudflare token check failed."));
+    for (const issue of cfProbe.issues) console.error(`  - ${issue}`);
+    p3.cancel("Fix the token in the Cloudflare dashboard, then re-run.");
+    process.exit(1);
+  }
+  cfSpin.stop(pc2.green("\u2713 Cloudflare token valid, 5 scopes present."));
+  const tfToken = await collectSecret(
+    opts.tfToken,
+    "Terraform Cloud user/team API token",
+    "tfc"
+  );
+  const tfOrg = opts.tfOrg ? opts.tfOrg : unwrap(
+    await p3.text({
+      message: "Terraform Cloud organization name?",
+      placeholder: "op-region-ca"
+    })
+  );
+  const tfSpin = p3.spinner();
+  tfSpin.start("Verifying Terraform Cloud token + organization\u2026");
+  const tfProbe = await probeTfcToken({ token: tfToken, organization: tfOrg });
+  if (!tfProbe.ok) {
+    tfSpin.stop(pc2.red("\u2717 Terraform Cloud check failed."));
+    for (const issue of tfProbe.issues) console.error(`  - ${issue}`);
+    p3.cancel("Fix the token / org, then re-run.");
+    process.exit(1);
+  }
+  tfSpin.stop(
+    pc2.green(
+      `\u2713 TFC token valid${tfProbe.userName ? ` (as ${tfProbe.userName})` : ""}, org "${tfOrg}" reachable.`
+    )
+  );
+  return { domain, cfToken, cfAccount, cfZone, tfToken, tfOrg };
+}
 async function collectSecret(preset, message, kind = "generic") {
   if (preset) return preset;
   const min = MIN_TOKEN_LENGTH[kind];
@@ -1109,10 +1189,21 @@ async function writePgsodiumKeyFile(key, keyFile) {
     return { ok: false, reason: `writing ${keyFile} failed: ${err.message}` };
   }
 }
+var MODEL_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._:/-]*$/;
 function renderLaunchAgentPlist(input) {
   if (input.tunnelToken !== void 0 && !TUNNEL_TOKEN_RE.test(input.tunnelToken)) {
     throw new Error("Tunnel token contains characters outside the expected base64-url set");
   }
+  if (input.llmModel !== void 0 && !MODEL_NAME_RE.test(input.llmModel)) {
+    throw new Error(
+      `llmModel ${JSON.stringify(input.llmModel)} contains characters not allowed in a launchd setenv value`
+    );
+  }
+  if (input.embeddingModel !== void 0 && !MODEL_NAME_RE.test(input.embeddingModel)) {
+    throw new Error(
+      `embeddingModel ${JSON.stringify(input.embeddingModel)} contains characters not allowed in a launchd setenv value`
+    );
+  }
   if (!SAFE_PATH_RE.test(input.keyFilePath)) {
     throw new Error(
       `keyFilePath ${JSON.stringify(input.keyFilePath)} contains characters not allowed in a launchd path interpolation`
@@ -1120,7 +1211,9 @@ function renderLaunchAgentPlist(input) {
   }
   const setenvLines = [
     `launchctl setenv PGSODIUM_ROOT_KEY "$(cat ${input.keyFilePath})"`,
-    ...input.tunnelToken !== void 0 ? [`launchctl setenv TUNNEL_TOKEN "${input.tunnelToken}"`] : []
+    ...input.tunnelToken !== void 0 ? [`launchctl setenv TUNNEL_TOKEN "${input.tunnelToken}"`] : [],
+    ...input.llmModel !== void 0 ? [`launchctl setenv LLM_MODEL "${input.llmModel}"`] : [],
+    ...input.embeddingModel !== void 0 ? [`launchctl setenv EMBEDDINGS_MODEL "${input.embeddingModel}"`] : []
   ];
   const command = setenvLines.join("; ");
   return [
@@ -1175,7 +1268,9 @@ async function setupLaunchAgent(input) {
   try {
     plistContent = renderLaunchAgentPlist({
       keyFilePath: paths.keyFile,
-      ...input.tunnelToken !== void 0 ? { tunnelToken: input.tunnelToken } : {}
+      ...input.tunnelToken !== void 0 ? { tunnelToken: input.tunnelToken } : {},
+      ...input.llmModel !== void 0 ? { llmModel: input.llmModel } : {},
+      ...input.embeddingModel !== void 0 ? { embeddingModel: input.embeddingModel } : {}
     });
   } catch (err) {
     return { ok: false, paths, step: "plist", reason: err.message };
@@ -1395,7 +1490,8 @@ function assessHealth(snapshots, requireHealthy) {
 
 // src/lib/ollama.ts
 var OLLAMA_URL = "http://localhost:11434";
-var DEFAULT_MODELS = ["qwen3.5:9b", "nomic-embed-text"];
+var DEFAULT_LLM_MODEL = "qwen3.5:9b";
+var DEFAULT_EMBEDDING_MODEL = "nomic-embed-text";
 var PROBE_ALPINE_TAG = "3.20";
 async function startOllamaService() {
   const res = await safeExeca("brew", ["services", "start", "ollama"]);
@@ -1566,7 +1662,17 @@ var bootstrapCommand = new Command("bootstrap").description(
     "--skip-launch-agent",
     "Skip the LaunchAgent setup (assumes one is already in place)"
   ).default(false)
-).addOption(new Option("--skip-ollama", "Skip the Ollama model pull + warm").default(false)).addOption(new Option("--skip-stack", "Stop before `docker compose pull && up`").default(false)).addOption(
+).addOption(new Option("--skip-ollama", "Skip the Ollama model pull + warm").default(false)).addOption(
+  new Option(
+    "--llm-model <model>",
+    `Ollama LLM model to pull and warm. Default: ${DEFAULT_LLM_MODEL}. Examples: \`llama3.3:70b\`, \`qwen2.5:72b\`. Memory sizing table: docs/docker-resources.md in the opuspopuli-node template (or your region repo's checkout).`
+  )
+).addOption(
+  new Option(
+    "--embedding-model <model>",
+    `Ollama embedding model. Default: ${DEFAULT_EMBEDDING_MODEL}. Only takes effect when the knowledge service runs with EMBEDDINGS_PROVIDER=ollama (otherwise embeddings are computed in-process via xenova).`
+  )
+).addOption(new Option("--skip-stack", "Stop before `docker compose pull && up`").default(false)).addOption(
   new Option(
     "--local-only",
     "Run for local dev / testing: no Tunnel token required, cloudflared stays down. Auto-generates the pgsodium key if not in Keychain (init unnecessary)."
@@ -1584,6 +1690,7 @@ var bootstrapCommand = new Command("bootstrap").description(
   const repoName = `opuspopuli-node-${region}`;
   const composeFileDefault = opts.localOnly ? ["docker-compose-prod.yml"] : ["docker-compose-prod.yml", "docker-compose-backup.yml"];
   const composeFile = opts.composeFile ?? composeFileDefault;
+  const [embeddingModel, llmModel] = resolveModels(opts);
   const sysSpin = p3.spinner();
   sysSpin.start("Inspecting macOS\u2026");
   const snap = await inspectSystem();
@@ -1719,7 +1826,9 @@ var bootstrapCommand = new Command("bootstrap").description(
     laSpin.start("Writing pgsodium key file + LaunchAgent plist\u2026");
     const la = await setupLaunchAgent({
       pgsodiumKey,
-      ...tunnelToken !== void 0 ? { tunnelToken } : {}
+      ...tunnelToken !== void 0 ? { tunnelToken } : {},
+      llmModel,
+      embeddingModel
     });
     if (!la.ok) {
       laSpin.stop(pc2.red(`\u2717 LaunchAgent step ${la.step} failed.`));
@@ -1767,7 +1876,7 @@ var bootstrapCommand = new Command("bootstrap").description(
         process.exit(1);
       }
     }
-    const modelReport = await setupModels(DEFAULT_MODELS, (model, status) => {
+    const modelReport = await setupModels([embeddingModel, llmModel], (model, status) => {
       olSpin.message(`${status}: ${model}`);
     });
     olSpin.stop(
@@ -1886,6 +1995,12 @@ function resolveComposeFiles(repoPath, composeFile) {
   const inputs = composeFile ?? ["docker-compose-prod.yml"];
   return inputs.map((f) => f.startsWith("/") ? f : join(repoPath, f));
 }
+function resolveModels(opts) {
+  return [
+    opts.embeddingModel ?? DEFAULT_EMBEDDING_MODEL,
+    opts.llmModel ?? DEFAULT_LLM_MODEL
+  ];
+}
 function kvBool(b) {
   return b ? pc2.green("on") : pc2.yellow("off");
 }
@@ -3728,7 +3843,7 @@ async function looksLikeRegionsRepo(dir) {
 }
 
 // src/cli.ts
-var VERSION = "0.4.0";
+var VERSION = "0.6.0";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."