create-op-node 0.7.0 → 0.9.0

package/README.md

@@ -202,6 +202,11 @@ npx create-op-node reset --region us-ca --dry-run
 
 # Nuke from orbit: containers + volumes + LaunchAgent + ghcr credentials.
 npx create-op-node reset --region us-ca --wipe-data
+
+# Even more: ALSO drop all docker images (forces re-pull on next bootstrap).
+# Use this for the "wipe everything and start over" iteration loop while
+# debugging a fresh bootstrap. Implies --wipe-data.
+npx create-op-node reset --region us-ca --wipe-images
 ```
 
 ## Verifying a live node
@@ -552,6 +557,42 @@ Releases are automated via [release-please](https://github.com/googleapis/releas
 
 No manual version bumps, no manual tagging. To trigger a release with no functional changes (re-publishing after a CI fix, etc.), push a commit with `chore: trigger release` — release-please will skip it but still update the PR.
 
+#### One-time PAT setup
+
+GitHub deliberately doesn't fire workflows on branches or tags pushed by
+`GITHUB_TOKEN`. Without a PAT, two things bite every release:
+
+- The release PR opens but its CI run never starts (sits in
+  *Expected — Waiting for status to be reported*). You can't merge.
+- After you eventually merge, `publish.yml`'s tag-push trigger doesn't
+  fire either, so npm never gets the new version.
+
+Both go away when release-please uses a PAT instead. One-time setup:
+
+1. **Create a fine-grained PAT** at
+   [github.com/settings/personal-access-tokens/new](https://github.com/settings/personal-access-tokens/new):
+   - *Resource owner*: **OpusPopuli** (not your personal account —
+     fine-grained PATs are scoped at creation and can't be moved)
+   - *Expiration*: your call (90 days for safety; you'll be reminded
+     when it's near expiry)
+   - *Repository access*: **Only select repositories** →
+     `create-op-node`
+   - *Repository permissions*:
+     - **Contents**: Read and write
+     - **Pull requests**: Read and write
+     - **Workflows**: Read and write *(release-please updates the
+       version line in `release-please.yml`'s manifest output;
+       without this permission the action fails to write)*
+2. **Add it as a repo secret**: repo → Settings → Secrets and
+   variables → Actions → New repository secret →
+   `RELEASE_PLEASE_TOKEN`, paste the PAT value.
+3. **Done.** Next release-please run uses the PAT, CI runs normally on
+   the release PR, and `publish.yml` fires automatically on the tag.
+
+The workflow falls back to `GITHUB_TOKEN` when the secret isn't
+present, so it doesn't break in repos that haven't done the PAT setup
+yet — it just goes back to needing the manual workarounds.
+
 ## License
 
 [AGPL-3.0-or-later](./LICENSE). The Opus Populi platform code is AGPL-3.0 + dual commercial; this CLI inherits the AGPL-3.0 terms.

package/dist/cli.js

@@ -4,7 +4,7 @@ import pc2 from 'picocolors';
 import * as p3 from '@clack/prompts';
 import { execa } from 'execa';
 import { Octokit } from '@octokit/rest';
-import { randomBytes } from 'crypto';
+import { randomBytes, createHmac } from 'crypto';
 import { join, resolve, dirname } from 'path';
 import { mkdir, writeFile, access, rm, chmod } from 'fs/promises';
 import { homedir } from 'os';
@@ -230,9 +230,17 @@ var SERVICE_PREFIX = "org.opuspopuli";
 function serviceFor(region) {
   return `${SERVICE_PREFIX}.${region}`;
 }
+var FRIENDLY = {
+  "pgsodium-root-key": "pgsodium root key",
+  "tunnel-token": "Cloudflare Tunnel token",
+  "postgres-password": "Postgres password",
+  "jwt-secret": "JWT signing secret",
+  "supabase-anon-key": "Supabase anon key",
+  "supabase-service-role-key": "Supabase service role key",
+  "dashboard-password": "Supabase Studio dashboard password"
+};
 function labelFor(coords) {
-  const friendly = coords.account === "pgsodium-root-key" ? "pgsodium root key" : "Cloudflare Tunnel token";
-  return `Opus Populi (${coords.region}) \u2014 ${friendly}`;
+  return `Opus Populi (${coords.region}) \u2014 ${FRIENDLY[coords.account]}`;
 }
 async function detectKeychain() {
   const res = await safeExeca("security", ["-h"]);
@@ -430,6 +438,50 @@ async function openPullRequest(input) {
 function generatePgsodiumRootKey() {
   return randomBytes(32).toString("hex");
 }
+function base64url(input) {
+  const buf = typeof input === "string" ? Buffer.from(input) : input;
+  return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function generatePostgresPassword() {
+  return base64url(randomBytes(32));
+}
+function generateDashboardPassword() {
+  return base64url(randomBytes(24));
+}
+function generateJwtSecret() {
+  return randomBytes(48).toString("base64");
+}
+function verifySupabaseJwt(token, secret) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return false;
+  const [h, p7, sig] = parts;
+  const expected = base64url(createHmac("sha256", secret).update(`${h}.${p7}`).digest());
+  if (sig.length !== expected.length) return false;
+  let mismatch = 0;
+  for (let i = 0; i < sig.length; i++) {
+    mismatch |= sig.charCodeAt(i) ^ expected.charCodeAt(i);
+  }
+  return mismatch === 0;
+}
+function signSupabaseJwt(input) {
+  const iat = input.issuedAtSeconds ?? 17e8;
+  const ttl = input.ttlSeconds ?? 10 * 365 * 24 * 60 * 60;
+  const issuer = input.issuer ?? "supabase";
+  const header = { alg: "HS256", typ: "JWT" };
+  const payload = {
+    role: input.role,
+    iss: issuer,
+    iat,
+    exp: iat + ttl
+  };
+  const encodedHeader = base64url(JSON.stringify(header));
+  const encodedPayload = base64url(JSON.stringify(payload));
+  const signingInput = `${encodedHeader}.${encodedPayload}`;
+  const signature = base64url(
+    createHmac("sha256", input.secret).update(signingInput).digest()
+  );
+  return `${signingInput}.${signature}`;
+}
 function renderProdTfvars(input) {
   const project = input.project ?? "opuspopuli";
   const api = input.apiSubdomain ?? "api";
@@ -1042,6 +1094,9 @@ async function waitForApplyAndFetchTunnelToken(input) {
 var PGSODIUM_KEY_RE = /^[a-f0-9]{64}$/;
 var TUNNEL_TOKEN_RE = /^[A-Za-z0-9_\-.=]+$/;
 var SAFE_PATH_RE = /^[A-Za-z0-9_\-./ ]+$/;
+var SAFE_LAUNCHCTL_VALUE_RE = /^[A-Za-z0-9+/=._-]+$/;
+var URL_SAFE_PASSWORD_RE = /^[A-Za-z0-9_-]+$/;
+var SAFE_URL_RE = /^[A-Za-z0-9:/_.\-]+$/;
 var VERIFY_NETWORK_TIMEOUT_MS = 1e4;
 var BODY_PREVIEW_MAX = 200;
 
@@ -1151,6 +1206,13 @@ async function enableAutoRestartOnPowerFailure() {
 async function disableDiskSleep() {
   return runSudoPmset(["disksleep", "0"]);
 }
+async function detectUnifiedMemoryGB() {
+  const res = await safeExeca("sysctl", ["-n", "hw.memsize"]);
+  if (res === null || res.exitCode !== 0) return null;
+  const bytes = Number.parseInt(res.stdout.trim(), 10);
+  if (!Number.isFinite(bytes) || bytes <= 0) return null;
+  return Math.round(bytes / 2 ** 30);
+}
 async function runSudoPmset(args) {
   const res = await safeExeca("sudo", ["pmset", "-a", ...args]);
   if (res === null) {
@@ -1209,11 +1271,36 @@ function renderLaunchAgentPlist(input) {
       `keyFilePath ${JSON.stringify(input.keyFilePath)} contains characters not allowed in a launchd path interpolation`
     );
   }
+  const supabaseFields = [
+    ["postgresPassword", input.postgresPassword],
+    ["jwtSecret", input.jwtSecret],
+    ["supabaseAnonKey", input.supabaseAnonKey],
+    ["supabaseServiceRoleKey", input.supabaseServiceRoleKey],
+    ["dashboardPassword", input.dashboardPassword]
+  ];
+  for (const [name, value] of supabaseFields) {
+    if (value !== void 0 && !SAFE_LAUNCHCTL_VALUE_RE.test(value)) {
+      throw new Error(
+        `${String(name)} contains characters not allowed in a launchd setenv value`
+      );
+    }
+  }
+  if (input.supabaseUrl !== void 0 && !SAFE_URL_RE.test(input.supabaseUrl)) {
+    throw new Error(
+      `supabaseUrl ${JSON.stringify(input.supabaseUrl)} contains characters not allowed in a launchd setenv value`
+    );
+  }
   const setenvLines = [
     `launchctl setenv PGSODIUM_ROOT_KEY "$(cat ${input.keyFilePath})"`,
     ...input.tunnelToken !== void 0 ? [`launchctl setenv TUNNEL_TOKEN "${input.tunnelToken}"`] : [],
     ...input.llmModel !== void 0 ? [`launchctl setenv LLM_MODEL "${input.llmModel}"`] : [],
-    ...input.embeddingModel !== void 0 ? [`launchctl setenv EMBEDDINGS_MODEL "${input.embeddingModel}"`] : []
+    ...input.embeddingModel !== void 0 ? [`launchctl setenv EMBEDDINGS_MODEL "${input.embeddingModel}"`] : [],
+    ...input.postgresPassword !== void 0 ? [`launchctl setenv POSTGRES_PASSWORD "${input.postgresPassword}"`] : [],
+    ...input.jwtSecret !== void 0 ? [`launchctl setenv JWT_SECRET "${input.jwtSecret}"`] : [],
+    ...input.supabaseAnonKey !== void 0 ? [`launchctl setenv SUPABASE_ANON_KEY "${input.supabaseAnonKey}"`] : [],
+    ...input.supabaseServiceRoleKey !== void 0 ? [`launchctl setenv SUPABASE_SERVICE_ROLE_KEY "${input.supabaseServiceRoleKey}"`] : [],
+    ...input.dashboardPassword !== void 0 ? [`launchctl setenv DASHBOARD_PASSWORD "${input.dashboardPassword}"`] : [],
+    ...input.supabaseUrl !== void 0 ? [`launchctl setenv SUPABASE_URL "${input.supabaseUrl}"`] : []
   ];
   const command = setenvLines.join("; ");
   return [
@@ -1270,7 +1357,13 @@ async function setupLaunchAgent(input) {
       keyFilePath: paths.keyFile,
       ...input.tunnelToken !== void 0 ? { tunnelToken: input.tunnelToken } : {},
       ...input.llmModel !== void 0 ? { llmModel: input.llmModel } : {},
-      ...input.embeddingModel !== void 0 ? { embeddingModel: input.embeddingModel } : {}
+      ...input.embeddingModel !== void 0 ? { embeddingModel: input.embeddingModel } : {},
+      ...input.postgresPassword !== void 0 ? { postgresPassword: input.postgresPassword } : {},
+      ...input.jwtSecret !== void 0 ? { jwtSecret: input.jwtSecret } : {},
+      ...input.supabaseAnonKey !== void 0 ? { supabaseAnonKey: input.supabaseAnonKey } : {},
+      ...input.supabaseServiceRoleKey !== void 0 ? { supabaseServiceRoleKey: input.supabaseServiceRoleKey } : {},
+      ...input.dashboardPassword !== void 0 ? { dashboardPassword: input.dashboardPassword } : {},
+      ...input.supabaseUrl !== void 0 ? { supabaseUrl: input.supabaseUrl } : {}
     });
   } catch (err) {
     return { ok: false, paths, step: "plist", reason: err.message };
@@ -1372,8 +1465,14 @@ async function composeDown(opts) {
   const flags = ["down"];
   if (opts.wipeVolumes) flags.push("-v");
   if (opts.removeOrphans) flags.push("--remove-orphans");
+  if (opts.removeImages) flags.push("--rmi", opts.removeImages);
+  const label = [
+    "compose down",
+    opts.wipeVolumes ? "-v" : "",
+    opts.removeImages ? `--rmi ${opts.removeImages}` : ""
+  ].filter(Boolean).join(" ");
   const res = await safeExeca("docker", composeArgs(opts, flags));
-  return result(res, opts.wipeVolumes ? "compose down -v" : "compose down");
+  return result(res, label);
 }
 async function dockerLogout(registry = GHCR_REGISTRY) {
   const res = await safeExeca("docker", ["logout", registry]);
@@ -1672,6 +1771,11 @@ var bootstrapCommand = new Command("bootstrap").description(
     "--embedding-model <model>",
     `Ollama embedding model. Default: ${DEFAULT_EMBEDDING_MODEL}. Only takes effect when the knowledge service runs with EMBEDDINGS_PROVIDER=ollama (otherwise embeddings are computed in-process via xenova).`
   )
+).addOption(
+  new Option(
+    "--supabase-url <url>",
+    "Public-facing Supabase URL (what browsers + microservices use). Default: `http://localhost:8000` in --local-only mode, otherwise `https://supabase.<domain>` (which the operator can override)."
+  )
 ).addOption(new Option("--skip-stack", "Stop before `docker compose pull && up`").default(false)).addOption(
   new Option(
     "--local-only",
@@ -1825,6 +1929,65 @@ var bootstrapCommand = new Command("bootstrap").description(
     placeholder: "JWT-style base64url string from `terraform output tunnel_token`",
     validate: (v) => TUNNEL_TOKEN_RE.test(v) ? void 0 : "tunnel token must be a base64-url JWT"
   });
+  const postgresPassword = await loadSecret({
+    region,
+    account: "postgres-password",
+    label: "Postgres password",
+    // URL-safe alphabet required — value lands in postgres:// URIs where
+    // `+`/`/`/`=` cause parser ambiguity in gotrue/postgrest/storage.
+    validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
+    generate: generatePostgresPassword
+  });
+  const jwtSecret = await loadSecret({
+    region,
+    account: "jwt-secret",
+    label: "JWT signing secret",
+    validate: (v) => SAFE_LAUNCHCTL_VALUE_RE.test(v) && v.length >= 32 ? void 0 : "must be \u226532 base64 characters",
+    generate: generateJwtSecret
+  });
+  const supabaseAnonKey = await loadSecret({
+    region,
+    account: "supabase-anon-key",
+    label: "Supabase anon key",
+    validate: (v) => SAFE_LAUNCHCTL_VALUE_RE.test(v) && verifySupabaseJwt(v, jwtSecret) ? void 0 : "must be a base64url JWT signed by the current JWT_SECRET",
+    generate: () => signSupabaseJwt({ role: "anon", secret: jwtSecret })
+  });
+  const supabaseServiceRoleKey = await loadSecret({
+    region,
+    account: "supabase-service-role-key",
+    label: "Supabase service role key",
+    validate: (v) => SAFE_LAUNCHCTL_VALUE_RE.test(v) && verifySupabaseJwt(v, jwtSecret) ? void 0 : "must be a base64url JWT signed by the current JWT_SECRET",
+    generate: () => signSupabaseJwt({ role: "service_role", secret: jwtSecret })
+  });
+  const dashboardPassword = await loadSecret({
+    region,
+    account: "dashboard-password",
+    label: "Supabase Studio dashboard password",
+    // URL-safe alphabet required — value lands in basic-auth headers via
+    // kong's declarative config. Avoid `+`/`/`/`=` for the same reasons.
+    validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
+    generate: generateDashboardPassword
+  });
+  let supabaseUrl;
+  if (opts.supabaseUrl) {
+    supabaseUrl = opts.supabaseUrl;
+  } else if (opts.localOnly) {
+    supabaseUrl = "http://localhost:8000";
+  } else {
+    supabaseUrl = unwrap(
+      await p3.text({
+        message: "Public-facing Supabase URL (what browsers + microservices use to reach kong)?",
+        placeholder: "https://supabase.civicfeed.tx",
+        validate: (v) => !v ? "required" : SAFE_URL_RE.test(v) ? void 0 : "contains characters outside the allowed URL set"
+      })
+    );
+  }
+  if (!SAFE_URL_RE.test(supabaseUrl)) {
+    p3.cancel(
+      `--supabase-url ${JSON.stringify(supabaseUrl)} contains characters outside the allowed URL set`
+    );
+    process.exit(1);
+  }
   if (!opts.skipLaunchAgent) {
     const laSpin = p3.spinner();
     laSpin.start("Writing pgsodium key file + LaunchAgent plist\u2026");
@@ -1832,7 +1995,13 @@ var bootstrapCommand = new Command("bootstrap").description(
       pgsodiumKey,
       ...tunnelToken !== void 0 ? { tunnelToken } : {},
       llmModel,
-      embeddingModel
+      embeddingModel,
+      postgresPassword,
+      jwtSecret,
+      supabaseAnonKey,
+      supabaseServiceRoleKey,
+      dashboardPassword,
+      supabaseUrl
     });
     if (!la.ok) {
       laSpin.stop(pc2.red(`\u2717 LaunchAgent step ${la.step} failed.`));
@@ -2023,12 +2192,22 @@ var LLM_MODEL_CHOICES = [
   }
 ];
 var OTHER_SENTINEL = "__OTHER__";
+function recommendLlmModel(ramGB) {
+  if (ramGB === null) return null;
+  if (ramGB >= 96) return "qwen2.5:72b";
+  if (ramGB >= 48) return "qwen2.5:32b";
+  return "qwen3.5:9b";
+}
 async function selectLlmModel(opts) {
   if (opts.yes) return DEFAULT_LLM_MODEL;
+  const ramGB = await detectUnifiedMemoryGB();
+  const recommended = recommendLlmModel(ramGB) ?? "qwen2.5:72b";
+  const ramNote = ramGB !== null ? `Detected ${ramGB} GB unified memory \u2014 pre-selecting ${recommended}.` : `Couldn't detect Studio memory \u2014 defaulting to ${recommended} (override if your config differs).`;
+  p3.note(ramNote, "Hardware");
   const choice = unwrap(
     await p3.select({
       message: "Choose the LLM model to pull + run",
-      initialValue: "qwen2.5:72b",
+      initialValue: recommended,
       options: [
         ...LLM_MODEL_CHOICES.map((c) => ({ value: c.value, label: c.label, hint: c.hint })),
         {
@@ -2220,7 +2399,7 @@ async function runReset(input, deps = DEFAULT_DEPS) {
     push({
       name: RESET_PHASES.STOP_STACK,
       status: "dry-run",
-      detail: `would run: docker compose -f ${input.stack.composeFiles.join(" -f ")} down${input.stack.wipeVolumes ? " -v" : ""}${input.stack.removeOrphans ? " --remove-orphans" : ""}`
+      detail: `would run: docker compose -f ${input.stack.composeFiles.join(" -f ")} down${input.stack.wipeVolumes ? " -v" : ""}${input.stack.removeOrphans ? " --remove-orphans" : ""}${input.stack.wipeImages ? " --rmi all" : ""}`
     });
   } else {
     const result2 = await deps.composeDown({
@@ -2228,13 +2407,18 @@ async function runReset(input, deps = DEFAULT_DEPS) {
       cwd: input.stack.repoPath,
       ...input.stack.envFile ? { envFile: input.stack.envFile } : {},
       wipeVolumes: input.stack.wipeVolumes,
-      removeOrphans: input.stack.removeOrphans
+      removeOrphans: input.stack.removeOrphans,
+      ...input.stack.wipeImages ? { removeImages: "all" } : {}
     });
     if (result2.ok) {
+      const bits = [
+        input.stack.wipeVolumes ? "volumes destroyed" : "containers stopped, volumes preserved",
+        input.stack.wipeImages ? "images removed (next bootstrap will re-pull)" : null
+      ].filter(Boolean);
       push({
         name: RESET_PHASES.STOP_STACK,
         status: "ok",
-        detail: input.stack.wipeVolumes ? "volumes destroyed" : "containers stopped, volumes preserved"
+        detail: bits.join("; ")
       });
     } else {
       push({ name: RESET_PHASES.STOP_STACK, status: "fail", detail: result2.reason ?? "unknown failure" });
@@ -2321,6 +2505,11 @@ var resetCommand = new Command("reset").description(
     "--wipe-data",
     "DESTROYS docker volumes (adds -v to `compose down`). Requires retyping the region label as confirmation. Default off \u2014 volumes preserved."
   ).default(false)
+).addOption(
+  new Option(
+    "--wipe-images",
+    'ALSO remove all docker images referenced by the compose file (adds --rmi all). Forces a fresh pull on next bootstrap. Implies --wipe-data semantics for the iteration loop ("wipe everything and start over"). Default off.'
+  ).default(false)
 ).addOption(
   new Option(
     "--no-remove-orphans",
@@ -2333,7 +2522,8 @@ var resetCommand = new Command("reset").description(
   ).default(false)
 ).addOption(new Option("--skip-docker-logout", "Don't run `docker logout`").default(false)).addOption(new Option("--registry <registry>", "Registry to log out of").default(GHCR_REGISTRY)).addOption(new Option("--dry-run", "Show what would happen without acting").default(false)).addOption(new Option("-y, --yes", "Skip non-destructive confirmations (wipe still confirms)").default(false)).action(async (opts) => {
   p3.intro(pc2.bgCyan(pc2.black(" create-op-node reset ")));
-  const wipeData = opts.wipeData ?? false;
+  const wipeImages = opts.wipeImages ?? false;
+  const wipeData = (opts.wipeData ?? false) || wipeImages;
   const removeOrphans = opts.removeOrphans ?? true;
   const region = opts.region ? opts.region : unwrap(
     await p3.text({
@@ -2399,6 +2589,7 @@ var resetCommand = new Command("reset").description(
       `pgsodium key file:     ${keyFileExists ? pc2.cyan(launchAgentPaths.keyFile) : pc2.dim("not present")}`,
       `Registry to log out:   ${pc2.cyan(opts.registry ?? GHCR_REGISTRY)}`,
       `Volume policy:         ${wipeData ? pc2.red("WIPE") : pc2.green("preserve (default)")}`,
+      `Image policy:          ${wipeImages ? pc2.red("WIPE (re-pull on next bootstrap)") : pc2.green("keep (default)")}`,
       `Dry run:               ${opts.dryRun ? pc2.yellow("yes") : pc2.dim("no")}`
     ].join("\n"),
     "Snapshot"
@@ -2426,6 +2617,7 @@ var resetCommand = new Command("reset").description(
     repoPath,
     composeFiles: resolveComposeFiles(repoPath, opts.composeFile),
     wipeVolumes: wipeData,
+    wipeImages,
     removeOrphans,
     ...opts.envFile ? { envFile: opts.envFile } : {}
   } : void 0;
@@ -3900,7 +4092,7 @@ async function looksLikeRegionsRepo(dir) {
 }
 
 // src/cli.ts
-var VERSION = "0.7.0";
+var VERSION = "0.9.0";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."