create-op-node 0.8.0 → 0.9.1

package/README.md

@@ -557,6 +557,42 @@ Releases are automated via [release-please](https://github.com/googleapis/releas
 
 No manual version bumps, no manual tagging. To trigger a release with no functional changes (re-publishing after a CI fix, etc.), push a commit with `chore: trigger release` — release-please will skip it but still update the PR.
 
+#### One-time PAT setup
+
+GitHub deliberately doesn't fire workflows on branches or tags pushed by
+`GITHUB_TOKEN`. Without a PAT, two things bite every release:
+
+- The release PR opens but its CI run never starts (sits in
+  *Expected — Waiting for status to be reported*). You can't merge.
+- After you eventually merge, `publish.yml`'s tag-push trigger doesn't
+  fire either, so npm never gets the new version.
+
+Both go away when release-please uses a PAT instead. One-time setup:
+
+1. **Create a fine-grained PAT** at
+   [github.com/settings/personal-access-tokens/new](https://github.com/settings/personal-access-tokens/new):
+   - *Resource owner*: **OpusPopuli** (not your personal account —
+     fine-grained PATs are scoped at creation and can't be moved)
+   - *Expiration*: your call (90 days for safety; you'll be reminded
+     when it's near expiry)
+   - *Repository access*: **Only select repositories** →
+     `create-op-node`
+   - *Repository permissions*:
+     - **Contents**: Read and write
+     - **Pull requests**: Read and write
+     - **Workflows**: Read and write *(release-please updates the
+       version line in `release-please.yml`'s manifest output;
+       without this permission the action fails to write)*
+2. **Add it as a repo secret**: repo → Settings → Secrets and
+   variables → Actions → New repository secret →
+   `RELEASE_PLEASE_TOKEN`, paste the PAT value.
+3. **Done.** Next release-please run uses the PAT, CI runs normally on
+   the release PR, and `publish.yml` fires automatically on the tag.
+
+The workflow falls back to `GITHUB_TOKEN` when the secret isn't
+present, so it doesn't break in repos that haven't done the PAT setup
+yet — it just goes back to needing the manual workarounds.
+
 ## License
 
 [AGPL-3.0-or-later](./LICENSE). The Opus Populi platform code is AGPL-3.0 + dual commercial; this CLI inherits the AGPL-3.0 terms.

package/dist/cli.js

@@ -4,9 +4,9 @@ import pc2 from 'picocolors';
 import * as p3 from '@clack/prompts';
 import { execa } from 'execa';
 import { Octokit } from '@octokit/rest';
-import { randomBytes } from 'crypto';
+import { randomBytes, createHmac } from 'crypto';
 import { join, resolve, dirname } from 'path';
-import { mkdir, writeFile, access, rm, chmod } from 'fs/promises';
+import { mkdir, writeFile, access, chmod, rename, rm } from 'fs/promises';
 import { homedir } from 'os';
 import { readFileSync } from 'fs';
 import * as tls from 'tls';
@@ -230,9 +230,17 @@ var SERVICE_PREFIX = "org.opuspopuli";
 function serviceFor(region) {
   return `${SERVICE_PREFIX}.${region}`;
 }
+var FRIENDLY = {
+  "pgsodium-root-key": "pgsodium root key",
+  "tunnel-token": "Cloudflare Tunnel token",
+  "postgres-password": "Postgres password",
+  "jwt-secret": "JWT signing secret",
+  "supabase-anon-key": "Supabase anon key",
+  "supabase-service-role-key": "Supabase service role key",
+  "dashboard-password": "Supabase Studio dashboard password"
+};
 function labelFor(coords) {
-  const friendly = coords.account === "pgsodium-root-key" ? "pgsodium root key" : "Cloudflare Tunnel token";
-  return `Opus Populi (${coords.region}) \u2014 ${friendly}`;
+  return `Opus Populi (${coords.region}) \u2014 ${FRIENDLY[coords.account]}`;
 }
 async function detectKeychain() {
   const res = await safeExeca("security", ["-h"]);
@@ -430,6 +438,50 @@ async function openPullRequest(input) {
 function generatePgsodiumRootKey() {
   return randomBytes(32).toString("hex");
 }
+function base64url(input) {
+  const buf = typeof input === "string" ? Buffer.from(input) : input;
+  return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function generatePostgresPassword() {
+  return base64url(randomBytes(32));
+}
+function generateDashboardPassword() {
+  return base64url(randomBytes(24));
+}
+function generateJwtSecret() {
+  return randomBytes(48).toString("base64");
+}
+function verifySupabaseJwt(token, secret) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return false;
+  const [h, p7, sig] = parts;
+  const expected = base64url(createHmac("sha256", secret).update(`${h}.${p7}`).digest());
+  if (sig.length !== expected.length) return false;
+  let mismatch = 0;
+  for (let i = 0; i < sig.length; i++) {
+    mismatch |= sig.charCodeAt(i) ^ expected.charCodeAt(i);
+  }
+  return mismatch === 0;
+}
+function signSupabaseJwt(input) {
+  const iat = input.issuedAtSeconds ?? 17e8;
+  const ttl = input.ttlSeconds ?? 10 * 365 * 24 * 60 * 60;
+  const issuer = input.issuer ?? "supabase";
+  const header = { alg: "HS256", typ: "JWT" };
+  const payload = {
+    role: input.role,
+    iss: issuer,
+    iat,
+    exp: iat + ttl
+  };
+  const encodedHeader = base64url(JSON.stringify(header));
+  const encodedPayload = base64url(JSON.stringify(payload));
+  const signingInput = `${encodedHeader}.${encodedPayload}`;
+  const signature = base64url(
+    createHmac("sha256", input.secret).update(signingInput).digest()
+  );
+  return `${signingInput}.${signature}`;
+}
 function renderProdTfvars(input) {
   const project = input.project ?? "opuspopuli";
   const api = input.apiSubdomain ?? "api";
@@ -1042,6 +1094,9 @@ async function waitForApplyAndFetchTunnelToken(input) {
 var PGSODIUM_KEY_RE = /^[a-f0-9]{64}$/;
 var TUNNEL_TOKEN_RE = /^[A-Za-z0-9_\-.=]+$/;
 var SAFE_PATH_RE = /^[A-Za-z0-9_\-./ ]+$/;
+var SAFE_LAUNCHCTL_VALUE_RE = /^[A-Za-z0-9+/=._-]+$/;
+var URL_SAFE_PASSWORD_RE = /^[A-Za-z0-9_-]+$/;
+var SAFE_URL_RE = /^[A-Za-z0-9:/_.\-]+$/;
 var VERIFY_NETWORK_TIMEOUT_MS = 1e4;
 var BODY_PREVIEW_MAX = 200;
 
@@ -1216,11 +1271,36 @@ function renderLaunchAgentPlist(input) {
       `keyFilePath ${JSON.stringify(input.keyFilePath)} contains characters not allowed in a launchd path interpolation`
     );
   }
+  const supabaseFields = [
+    ["postgresPassword", input.postgresPassword],
+    ["jwtSecret", input.jwtSecret],
+    ["supabaseAnonKey", input.supabaseAnonKey],
+    ["supabaseServiceRoleKey", input.supabaseServiceRoleKey],
+    ["dashboardPassword", input.dashboardPassword]
+  ];
+  for (const [name, value] of supabaseFields) {
+    if (value !== void 0 && !SAFE_LAUNCHCTL_VALUE_RE.test(value)) {
+      throw new Error(
+        `${String(name)} contains characters not allowed in a launchd setenv value`
+      );
+    }
+  }
+  if (input.supabaseUrl !== void 0 && !SAFE_URL_RE.test(input.supabaseUrl)) {
+    throw new Error(
+      `supabaseUrl ${JSON.stringify(input.supabaseUrl)} contains characters not allowed in a launchd setenv value`
+    );
+  }
   const setenvLines = [
     `launchctl setenv PGSODIUM_ROOT_KEY "$(cat ${input.keyFilePath})"`,
     ...input.tunnelToken !== void 0 ? [`launchctl setenv TUNNEL_TOKEN "${input.tunnelToken}"`] : [],
     ...input.llmModel !== void 0 ? [`launchctl setenv LLM_MODEL "${input.llmModel}"`] : [],
-    ...input.embeddingModel !== void 0 ? [`launchctl setenv EMBEDDINGS_MODEL "${input.embeddingModel}"`] : []
+    ...input.embeddingModel !== void 0 ? [`launchctl setenv EMBEDDINGS_MODEL "${input.embeddingModel}"`] : [],
+    ...input.postgresPassword !== void 0 ? [`launchctl setenv POSTGRES_PASSWORD "${input.postgresPassword}"`] : [],
+    ...input.jwtSecret !== void 0 ? [`launchctl setenv JWT_SECRET "${input.jwtSecret}"`] : [],
+    ...input.supabaseAnonKey !== void 0 ? [`launchctl setenv SUPABASE_ANON_KEY "${input.supabaseAnonKey}"`] : [],
+    ...input.supabaseServiceRoleKey !== void 0 ? [`launchctl setenv SUPABASE_SERVICE_ROLE_KEY "${input.supabaseServiceRoleKey}"`] : [],
+    ...input.dashboardPassword !== void 0 ? [`launchctl setenv DASHBOARD_PASSWORD "${input.dashboardPassword}"`] : [],
+    ...input.supabaseUrl !== void 0 ? [`launchctl setenv SUPABASE_URL "${input.supabaseUrl}"`] : []
   ];
   const command = setenvLines.join("; ");
   return [
@@ -1277,7 +1357,13 @@ async function setupLaunchAgent(input) {
       keyFilePath: paths.keyFile,
       ...input.tunnelToken !== void 0 ? { tunnelToken: input.tunnelToken } : {},
       ...input.llmModel !== void 0 ? { llmModel: input.llmModel } : {},
-      ...input.embeddingModel !== void 0 ? { embeddingModel: input.embeddingModel } : {}
+      ...input.embeddingModel !== void 0 ? { embeddingModel: input.embeddingModel } : {},
+      ...input.postgresPassword !== void 0 ? { postgresPassword: input.postgresPassword } : {},
+      ...input.jwtSecret !== void 0 ? { jwtSecret: input.jwtSecret } : {},
+      ...input.supabaseAnonKey !== void 0 ? { supabaseAnonKey: input.supabaseAnonKey } : {},
+      ...input.supabaseServiceRoleKey !== void 0 ? { supabaseServiceRoleKey: input.supabaseServiceRoleKey } : {},
+      ...input.dashboardPassword !== void 0 ? { dashboardPassword: input.dashboardPassword } : {},
+      ...input.supabaseUrl !== void 0 ? { supabaseUrl: input.supabaseUrl } : {}
     });
   } catch (err) {
     return { ok: false, paths, step: "plist", reason: err.message };
@@ -1317,6 +1403,99 @@ async function teardownLaunchAgent(paths, opts = {}) {
   return { ok: steps.every((s) => s.ok), steps };
 }
 
+// src/lib/op-compose-script.ts
+var REGION_RE = /^[a-z0-9-]{2,32}$/;
+function renderOpComposeScript(input) {
+  if (!REGION_RE.test(input.region)) {
+    throw new Error(
+      `region ${JSON.stringify(input.region)} contains characters not allowed in a launchd / Keychain service identifier`
+    );
+  }
+  return `#!/bin/bash
+# op-compose \u2014 wrapper that reads region secrets from macOS Keychain just
+# before invoking \`docker compose\`. Auto-generated by
+# \`create-op-node bootstrap --region ${input.region}\`. Do not edit by
+# hand; re-run bootstrap to regenerate.
+#
+# Why: launchctl setenv only propagates to launchd-spawned processes, so
+# SSH shells and pre-existing Terminal.app instances never see the env
+# vars bootstrap exports. This wrapper hydrates the docker compose
+# subprocess directly, so every invocation works regardless of how the
+# operator's shell was started.
+#
+# Usage:
+#   ./bin/op-compose -f docker-compose-prod.yml up -d
+#   ./bin/op-compose -f docker-compose-prod.yml pull
+#   ./bin/op-compose -f docker-compose-prod.yml down
+
+set -euo pipefail
+
+SVC="org.opuspopuli.${input.region}"
+
+require_secret() {
+  local account="$1"
+  local value
+  if ! value=$(security find-generic-password -s "$SVC" -a "$account" -w 2>/dev/null); then
+    echo "op-compose: missing Keychain entry '$account' under service '$SVC'." >&2
+    echo "Run: create-op-node bootstrap --region ${input.region}" >&2
+    exit 1
+  fi
+  printf '%s' "$value"
+}
+
+optional_secret() {
+  local account="$1"
+  security find-generic-password -s "$SVC" -a "$account" -w 2>/dev/null || true
+}
+
+# Bootstrap-critical: Postgres + Supabase admin credentials.
+export PGSODIUM_ROOT_KEY="$(require_secret pgsodium-root-key)"
+export POSTGRES_PASSWORD="$(require_secret postgres-password)"
+export JWT_SECRET="$(require_secret jwt-secret)"
+export SUPABASE_ANON_KEY="$(require_secret supabase-anon-key)"
+export SUPABASE_SERVICE_ROLE_KEY="$(require_secret supabase-service-role-key)"
+export DASHBOARD_PASSWORD="$(require_secret dashboard-password)"
+
+# AUTH_JWT_SECRET historically equals JWT_SECRET in dev/UAT \u2014 supply that
+# default if the operator hasn't set one independently.
+export AUTH_JWT_SECRET="\${AUTH_JWT_SECRET:-$JWT_SECRET}"
+
+# Optional: Cloudflare Tunnel token (only present in non-local-only mode).
+TUNNEL_TOKEN_VAL="$(optional_secret tunnel-token)"
+if [ -n "$TUNNEL_TOKEN_VAL" ]; then
+  export TUNNEL_TOKEN="$TUNNEL_TOKEN_VAL"
+fi
+
+# SUPABASE_URL is not a secret \u2014 read from env if the operator set one,
+# default to localhost for --local-only.
+export SUPABASE_URL="\${SUPABASE_URL:-http://localhost:8000}"
+
+exec docker compose "$@"
+`;
+}
+
+// src/lib/op-compose-install.ts
+async function installOpComposeWrapper(input) {
+  let content;
+  try {
+    content = renderOpComposeScript({ region: input.region });
+  } catch (err) {
+    return { ok: false, reason: err.message };
+  }
+  const binDir = join(input.repoDir, "bin");
+  const target = join(binDir, "op-compose");
+  const tmp = `${target}.tmp.${process.pid}`;
+  try {
+    await mkdir(binDir, { recursive: true });
+    await writeFile(tmp, content, { mode: 493 });
+    await chmod(tmp, 493);
+    await rename(tmp, target);
+    return { ok: true, path: target };
+  } catch (err) {
+    return { ok: false, reason: `writing ${target} failed: ${err.message}` };
+  }
+}
+
 // src/lib/docker.ts
 var GHCR_REGISTRY = "ghcr.io";
 async function loginToGhcr() {
@@ -1363,16 +1542,19 @@ function composeArgs(opts, sub) {
   const profiles = (opts.profiles ?? []).flatMap((pr) => ["--profile", pr]);
   return ["compose", ...files, ...env, ...profiles, ...sub];
 }
+function execOpts(opts) {
+  return opts.env ? { cwd: opts.cwd, env: opts.env } : { cwd: opts.cwd };
+}
 async function composePull(opts) {
-  const res = await safeExeca("docker", composeArgs(opts, ["pull"]));
+  const res = await safeExeca("docker", composeArgs(opts, ["pull"]), execOpts(opts));
   return result(res, "compose pull");
 }
 async function composeUp(opts) {
-  const res = await safeExeca("docker", composeArgs(opts, ["up", "-d", "--remove-orphans"]));
+  const res = await safeExeca("docker", composeArgs(opts, ["up", "-d", "--remove-orphans"]), execOpts(opts));
   return result(res, "compose up");
 }
 async function composeRemoveService(opts, service) {
-  const res = await safeExeca("docker", composeArgs(opts, ["rm", "-sfv", service]));
+  const res = await safeExeca("docker", composeArgs(opts, ["rm", "-sfv", service]), execOpts(opts));
   return result(res, `compose rm ${service}`);
 }
 async function composeDown(opts) {
@@ -1385,7 +1567,7 @@ async function composeDown(opts) {
     opts.wipeVolumes ? "-v" : "",
     opts.removeImages ? `--rmi ${opts.removeImages}` : ""
   ].filter(Boolean).join(" ");
-  const res = await safeExeca("docker", composeArgs(opts, flags));
+  const res = await safeExeca("docker", composeArgs(opts, flags), execOpts(opts));
   return result(res, label);
 }
 async function dockerLogout(registry = GHCR_REGISTRY) {
@@ -1431,7 +1613,7 @@ function normalize(raw) {
   return { name, state, health, exitCode };
 }
 async function composePs(opts) {
-  const res = await safeExeca("docker", composeArgs(opts, ["ps", "--format", "json"]));
+  const res = await safeExeca("docker", composeArgs(opts, ["ps", "--format", "json"]), execOpts(opts));
   if (res === null || res.exitCode !== 0) return null;
   return parseComposePs(res.stdout);
 }
@@ -1685,6 +1867,11 @@ var bootstrapCommand = new Command("bootstrap").description(
     "--embedding-model <model>",
     `Ollama embedding model. Default: ${DEFAULT_EMBEDDING_MODEL}. Only takes effect when the knowledge service runs with EMBEDDINGS_PROVIDER=ollama (otherwise embeddings are computed in-process via xenova).`
   )
+).addOption(
+  new Option(
+    "--supabase-url <url>",
+    "Public-facing Supabase URL (what browsers + microservices use). Default: `http://localhost:8000` in --local-only mode, otherwise `https://supabase.<domain>` (which the operator can override)."
+  )
 ).addOption(new Option("--skip-stack", "Stop before `docker compose pull && up`").default(false)).addOption(
   new Option(
     "--local-only",
@@ -1838,6 +2025,65 @@ var bootstrapCommand = new Command("bootstrap").description(
     placeholder: "JWT-style base64url string from `terraform output tunnel_token`",
     validate: (v) => TUNNEL_TOKEN_RE.test(v) ? void 0 : "tunnel token must be a base64-url JWT"
   });
+  const postgresPassword = await loadSecret({
+    region,
+    account: "postgres-password",
+    label: "Postgres password",
+    // URL-safe alphabet required — value lands in postgres:// URIs where
+    // `+`/`/`/`=` cause parser ambiguity in gotrue/postgrest/storage.
+    validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
+    generate: generatePostgresPassword
+  });
+  const jwtSecret = await loadSecret({
+    region,
+    account: "jwt-secret",
+    label: "JWT signing secret",
+    validate: (v) => SAFE_LAUNCHCTL_VALUE_RE.test(v) && v.length >= 32 ? void 0 : "must be \u226532 base64 characters",
+    generate: generateJwtSecret
+  });
+  const supabaseAnonKey = await loadSecret({
+    region,
+    account: "supabase-anon-key",
+    label: "Supabase anon key",
+    validate: (v) => SAFE_LAUNCHCTL_VALUE_RE.test(v) && verifySupabaseJwt(v, jwtSecret) ? void 0 : "must be a base64url JWT signed by the current JWT_SECRET",
+    generate: () => signSupabaseJwt({ role: "anon", secret: jwtSecret })
+  });
+  const supabaseServiceRoleKey = await loadSecret({
+    region,
+    account: "supabase-service-role-key",
+    label: "Supabase service role key",
+    validate: (v) => SAFE_LAUNCHCTL_VALUE_RE.test(v) && verifySupabaseJwt(v, jwtSecret) ? void 0 : "must be a base64url JWT signed by the current JWT_SECRET",
+    generate: () => signSupabaseJwt({ role: "service_role", secret: jwtSecret })
+  });
+  const dashboardPassword = await loadSecret({
+    region,
+    account: "dashboard-password",
+    label: "Supabase Studio dashboard password",
+    // URL-safe alphabet required — value lands in basic-auth headers via
+    // kong's declarative config. Avoid `+`/`/`/`=` for the same reasons.
+    validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
+    generate: generateDashboardPassword
+  });
+  let supabaseUrl;
+  if (opts.supabaseUrl) {
+    supabaseUrl = opts.supabaseUrl;
+  } else if (opts.localOnly) {
+    supabaseUrl = "http://localhost:8000";
+  } else {
+    supabaseUrl = unwrap(
+      await p3.text({
+        message: "Public-facing Supabase URL (what browsers + microservices use to reach kong)?",
+        placeholder: "https://supabase.civicfeed.tx",
+        validate: (v) => !v ? "required" : SAFE_URL_RE.test(v) ? void 0 : "contains characters outside the allowed URL set"
+      })
+    );
+  }
+  if (!SAFE_URL_RE.test(supabaseUrl)) {
+    p3.cancel(
+      `--supabase-url ${JSON.stringify(supabaseUrl)} contains characters outside the allowed URL set`
+    );
+    process.exit(1);
+  }
   if (!opts.skipLaunchAgent) {
     const laSpin = p3.spinner();
     laSpin.start("Writing pgsodium key file + LaunchAgent plist\u2026");
@@ -1845,7 +2091,13 @@ var bootstrapCommand = new Command("bootstrap").description(
       pgsodiumKey,
       ...tunnelToken !== void 0 ? { tunnelToken } : {},
       llmModel,
-      embeddingModel
+      embeddingModel,
+      postgresPassword,
+      jwtSecret,
+      supabaseAnonKey,
+      supabaseServiceRoleKey,
+      dashboardPassword,
+      supabaseUrl
     });
     if (!la.ok) {
       laSpin.stop(pc2.red(`\u2717 LaunchAgent step ${la.step} failed.`));
@@ -1858,6 +2110,15 @@ var bootstrapCommand = new Command("bootstrap").description(
       )
     );
   }
+  const wrapperSpin = p3.spinner();
+  wrapperSpin.start("Installing bin/op-compose wrapper\u2026");
+  const wrapper = await installOpComposeWrapper({ repoDir: repoPath, region });
+  if (!wrapper.ok) {
+    wrapperSpin.stop(pc2.red("\u2717 op-compose wrapper install failed."));
+    p3.cancel(wrapper.reason ?? "op-compose wrapper install failed.");
+    process.exit(1);
+  }
+  wrapperSpin.stop(pc2.green(`\u2713 Installed ${wrapper.path} (mode 0755).`));
   const ghcrSpin = p3.spinner();
   ghcrSpin.start("Authenticating Docker to ghcr.io\u2026");
   const ghcr = await loginToGhcr();
@@ -1910,17 +2171,31 @@ var bootstrapCommand = new Command("bootstrap").description(
     const profileFlag = opts.localOnly ? "" : "--profile public ";
     p3.outro(
       pc2.cyan(
-        `Stack-up skipped. Run \`docker compose -f ${composeFile.join(" -f ")} ${profileFlag}pull && docker compose -f ${composeFile.join(" -f ")} ${profileFlag}up -d\` from ${repoPath} when ready.`
+        `Stack-up skipped. Run \`./bin/op-compose -f ${composeFile.join(" -f ")} ${profileFlag}pull && ./bin/op-compose -f ${composeFile.join(" -f ")} ${profileFlag}up -d\` from ${repoPath} when ready. (op-compose hydrates Keychain secrets per-invocation; use it instead of raw \`docker compose\`.)`
       )
     );
     return;
   }
   const composeFiles = resolveComposeFiles(repoPath, composeFile);
+  const composeEnv = {
+    PGSODIUM_ROOT_KEY: pgsodiumKey,
+    POSTGRES_PASSWORD: postgresPassword,
+    JWT_SECRET: jwtSecret,
+    SUPABASE_ANON_KEY: supabaseAnonKey,
+    SUPABASE_SERVICE_ROLE_KEY: supabaseServiceRoleKey,
+    DASHBOARD_PASSWORD: dashboardPassword,
+    SUPABASE_URL: supabaseUrl,
+    AUTH_JWT_SECRET: process.env["AUTH_JWT_SECRET"] ?? jwtSecret,
+    ...tunnelToken !== void 0 ? { TUNNEL_TOKEN: tunnelToken } : {},
+    ...llmModel ? { LLM_MODEL: llmModel } : {},
+    ...embeddingModel ? { EMBEDDINGS_MODEL: embeddingModel } : {}
+  };
   const composeOpts = {
     files: composeFiles,
     cwd: repoPath,
     ...opts.envFile ? { envFile: opts.envFile } : {},
-    profiles: opts.localOnly ? LOCAL_PROFILES : PUBLIC_PROFILES
+    profiles: opts.localOnly ? LOCAL_PROFILES : PUBLIC_PROFILES,
+    env: composeEnv
   };
   if (opts.localOnly) {
     const evict = p3.spinner();
@@ -2216,7 +2491,7 @@ async function loadSecret(input) {
   }
   return pasted;
 }
-var REGION_RE = /^[a-z0-9-]{2,32}$/;
+var REGION_RE2 = /^[a-z0-9-]{2,32}$/;
 var RESET_PHASES = {
   STOP_STACK: "Stop stack",
   LAUNCH_AGENT: "LaunchAgent",
@@ -2373,10 +2648,10 @@ var resetCommand = new Command("reset").description(
     await p3.text({
       message: "Region label (the slug used during init \u2014 e.g. us-ca)?",
       placeholder: "us-ca",
-      validate: (v) => REGION_RE.test(v ?? "") ? void 0 : "lowercase letters, digits, hyphens; 2\u201332 chars"
+      validate: (v) => REGION_RE2.test(v ?? "") ? void 0 : "lowercase letters, digits, hyphens; 2\u201332 chars"
     })
   );
-  if (!REGION_RE.test(region)) {
+  if (!REGION_RE2.test(region)) {
     p3.cancel(`--region ${JSON.stringify(region)} is not a valid region slug.`);
     process.exit(2);
   }
@@ -2421,6 +2696,7 @@ var resetCommand = new Command("reset").description(
   if (repoPath) {
     runningContainers = await composePs({
       files: resolveComposeFiles(repoPath, opts.composeFile),
+      cwd: repoPath,
       ...opts.envFile ? { envFile: opts.envFile } : {}
     });
   }
@@ -3936,7 +4212,7 @@ async function looksLikeRegionsRepo(dir) {
 }
 
 // src/cli.ts
-var VERSION = "0.8.0";
+var VERSION = "0.9.1";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."