create-workframe 0.1.6 → 0.1.8

package/workframe-api/stack_config.py

@@ -1,4 +1,8 @@
-"""Stack operator config (SMTP, deployment mode, install state). Env wins over file for VPS."""
+"""Stack operator config (SMTP, deployment mode, install state).
+
+During install window: stack file only (clean install — no compose env ghost creds).
+After install_complete: env wins over file for VPS ops overrides.
+"""
 
 from __future__ import annotations
 
@@ -247,18 +251,18 @@ def patch_stack_config(body: dict[str, Any]) -> dict[str, Any]:
 
 
 def resolve_deployment_mode(env_default: str = "trusted_team") -> str:
-    """Explicit WORKFRAME_DEPLOYMENT_MODE env wins; stack_config applies only when env is unset."""
-    env_raw = (os.environ.get("WORKFRAME_DEPLOYMENT_MODE") or "").strip().lower()
-    if env_raw in DEPLOYMENT_MODES:
-        return env_raw
-    if env_raw:
-        return env_raw
+    """Persisted stack_config deployment_mode wins when set; else WORKFRAME_DEPLOYMENT_MODE env."""
     try:
-        sc_mode = str(get_stack_config().get("deployment_mode") or "").strip().lower()
+        sc_mode = str(_read_raw().get("deployment_mode") or "").strip().lower()
         if sc_mode in DEPLOYMENT_MODES:
             return sc_mode
     except Exception:
         pass
+    env_raw = (os.environ.get("WORKFRAME_DEPLOYMENT_MODE") or "").strip().lower()
+    if env_raw in DEPLOYMENT_MODES:
+        return env_raw
+    if env_raw:
+        return env_raw
     raw = (env_default or "trusted_team").strip().lower()
     return raw if raw in DEPLOYMENT_MODES else "trusted_team"
 
@@ -267,15 +271,19 @@ def effective_deployment_mode(env_default: str) -> str:
     return resolve_deployment_mode(env_default)
 
 
+def _install_window_open() -> bool:
+    return not bool(_read_raw().get("install_complete"))
+
+
 def resolved_smtp() -> dict[str, Any]:
-    """Env wins for host; secrets/from fall back to stack file when env omits them."""
+    """Stack file during install; env overrides only after install_complete."""
     stack = _stack_smtp_raw()
     stack_host = str(stack.get("host") or "").strip()
     stack_user = str(stack.get("user") or "").strip()
     stack_pw = str(stack.get("password") or "").strip().replace(" ", "")
     stack_from = str(stack.get("from") or "").strip()
 
-    env_host = os.environ.get("SMTP_HOST", "").strip()
+    env_host = "" if _install_window_open() else os.environ.get("SMTP_HOST", "").strip()
     if env_host:
         port = int(os.environ.get("SMTP_PORT", "587"))
         secure = normalize_smtp_secure(

package/workframe-api/test_ensure_native_profile.py

@@ -0,0 +1,29 @@
+"""ponytail self-check: empty Hermes data must seed workframe-agent for gateway boot.
+
+Run: python services/workframe-api/test_ensure_native_profile.py
+"""
+import json
+import os
+import sys
+import tempfile
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import server  # noqa: E402
+
+td = Path(tempfile.mkdtemp())
+os.environ["HERMES_DATA"] = str(td)
+server.HERMES_DATA = td
+server.ROUTES_JSON = td / "workframe" / "routes.json"
+
+slug = server._native_profile_slug()
+assert slug == "workframe-agent"
+assert not server._native_profile_present()
+assert server._seed_native_profile_on_disk(slug)
+assert server._native_profile_present()
+assert (td / "profiles" / slug / "config.yaml").is_file()
+routes = json.loads((td / "workframe" / "routes.json").read_text(encoding="utf-8"))
+assert any(row.get("profile") == slug for row in routes.get("routes", []))
+
+print("ensure native profile self-check ok")

package/workframe-api/test_oauth_llm.py

@@ -0,0 +1,58 @@
+"""ponytail self-check: OAuth LLM providers (Codex/Nous) must pass chat gates without API keys.
+
+Run: python services/workframe-api/test_oauth_llm.py
+"""
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import server  # noqa: E402
+
+keys = server._hermes_oauth_auth_keys("openai-codex")
+assert "openai-codex" in keys
+assert "codex" in keys
+assert "openai_codex" in keys
+
+pool_only = {
+    "version": 1,
+    "providers": {},
+    "credential_pool": {"openai-codex": [{"id": "x", "auth_type": "oauth"}]},
+}
+assert server._auth_json_has_oauth_material(pool_only)
+
+# credential_pool-only auth must merge into profile auth
+merged: dict = {"version": 1, "providers": {}, "credential_pool": {}}
+assert server._merge_oauth_auth_into_profile(merged, pool_only, "openai-codex")
+assert merged["credential_pool"].get("openai-codex")
+
+# Without live tokens require path must fail
+try:
+    server._require_runtime_owner_provider("user-1", "ws-1", "codex")
+    raise AssertionError("expected ValueError without oauth tokens")
+except ValueError:
+    pass
+
+_orig = server._hermes_oauth_tokens_present
+
+
+def _fake_present(_user: str, _auth_id: str) -> bool:
+    return True
+
+
+server._hermes_oauth_tokens_present = _fake_present
+try:
+    resolved = server._require_runtime_owner_provider(
+        "550e8400-e29b-41d4-a716-446655440000",
+        "ws-1",
+        "codex",
+    )
+    assert resolved.get("credential_type") == "oauth"
+    assert resolved.get("credential_ref") == "oauth:openai-codex"
+finally:
+    server._hermes_oauth_tokens_present = _orig
+
+mvp = server.PROVIDER_MVP_MODELS["codex"]["primary"]
+assert mvp == "gpt-5.4-medium"
+
+print("oauth llm self-check ok")

package/workframe-api/test_provider_model_surface.py

@@ -0,0 +1,31 @@
+"""ponytail: connected providers → model offers → billing alignment.
+
+Run: python services/workframe-api/test_provider_model_surface.py
+"""
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import server  # noqa: E402
+
+codex_rows = server._model_catalog_rows_for_provider("codex")
+codex_models = {row["model"] for row in codex_rows}
+assert "gpt-5.4-medium" in codex_models, codex_models
+assert "gpt-5.4-mini" in codex_models, codex_models
+assert all("gemini" not in m for m in codex_models)
+
+assert server._resolve_billing_provider_for_model("gpt-5.4-mini", {"codex"}) == "codex"
+assert server._resolve_billing_provider_for_model("google/gemini-2.5-flash", {"codex"}) == ""
+assert server._resolve_billing_provider_for_model(
+    "google/gemini-2.5-flash", {"openrouter"}
+) == "openrouter"
+
+stack = server._suggestions_for_connected_llm_providers({"codex", "openrouter"})
+models = {row["model"] for row in stack}
+assert "gpt-5.4-medium" in models
+assert any(m.startswith("google/") for m in models)
+
+assert server._billing_provider_id_from_hermes_config("openai-codex") == "codex"
+
+print("provider model surface self-check ok")

package/workframe-api/test_stack_config_install_smtp.py

@@ -0,0 +1,56 @@
+"""ponytail: install window must ignore compose SMTP env (clean install, not migration).
+
+Run: python services/workframe-api/test_stack_config_install_smtp.py
+"""
+import os
+import sys
+import tempfile
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import stack_config  # noqa: E402
+
+td = Path(tempfile.mkdtemp())
+stack_config.DATA_DIR = td
+stack_config.CONFIG_PATH = td / "stack_config.json"
+
+os.environ["SMTP_HOST"] = "smtp.ghost.example"
+os.environ["SMTP_USER"] = "ghost@example.com"
+os.environ["SMTP_PASS"] = "secret"
+
+# Fresh install: no stack file, install window open → env ignored
+assert stack_config._install_window_open()
+resolved = stack_config.resolved_smtp()
+assert resolved.get("source") == "none", resolved
+assert not stack_config.smtp_configured()
+
+# Wizard saves SMTP to stack file
+stack_config.patch_stack_config(
+    {
+        "smtp": {
+            "host": "smtp.wizard.example",
+            "port": 587,
+            "user": "admin@wizard.example",
+            "password": "wizard-pass",
+            "from": "admin@wizard.example",
+        }
+    }
+)
+resolved = stack_config.resolved_smtp()
+assert resolved.get("host") == "smtp.wizard.example", resolved
+assert resolved.get("source") == "stack_config", resolved
+
+# After install complete, env wins for ops overrides
+stack_config.patch_stack_config({"install_complete": True})
+assert not stack_config._install_window_open()
+resolved = stack_config.resolved_smtp()
+assert resolved.get("host") == "smtp.ghost.example", resolved
+assert resolved.get("source") == "env", resolved
+
+# Wizard deployment_mode persists over compose .env default
+os.environ["WORKFRAME_DEPLOYMENT_MODE"] = "trusted_team"
+stack_config.patch_stack_config({"deployment_mode": "single_user_local"})
+assert stack_config.resolve_deployment_mode() == "single_user_local"
+
+print("stack_config install-window smtp self-check ok")

package/workframe-ui/public/assets/{arc-DoYr2T5c.js → arc-DjpS9a2b.js}

@@ -1 +1 @@
-import{n as e,t}from"./path-BWPyau1x.js";import{a as n,c as r,d as i,f as a,i as o,l as s,m as c,n as l,o as u,p as d,r as f,u as p}from"./dist-Jk20AnQG.js";function m(e){return e.innerRadius}function h(e){return e.outerRadius}function g(e){return e.startAngle}function _(e){return e.endAngle}function v(e){return e&&e.padAngle}function y(e,t,n,r,i,a,o,s){var c=n-e,l=r-t,u=o-i,d=s-a,f=d*c-u*l;if(!(f*f<1e-12))return f=(u*(t-a)-d*(e-i))/f,[e+f*c,t+f*l]}function b(e,t,n,r,i,a,o){var c=e-n,l=t-r,u=(o?a:-a)/d(c*c+l*l),f=u*l,p=-u*c,m=e+f,h=t+p,g=n+f,_=r+p,v=(m+g)/2,y=(h+_)/2,b=g-m,x=_-h,S=b*b+x*x,C=i-a,w=m*_-g*h,T=(x<0?-1:1)*d(s(0,C*C*S-w*w)),E=(w*x-b*T)/S,D=(-w*b-x*T)/S,O=(w*x+b*T)/S,k=(-w*b+x*T)/S,A=E-v,j=D-y,M=O-v,N=k-y;return A*A+j*j>M*M+N*N&&(E=O,D=k),{cx:E,cy:D,x01:-f,y01:-p,x11:E*(i/C-1),y11:D*(i/C-1)}}function x(){var s=m,x=h,S=e(0),C=null,w=g,T=_,E=v,D=null,O=t(k);function k(){var e,t,m=+s.apply(this,arguments),h=+x.apply(this,arguments),g=w.apply(this,arguments)-r,_=T.apply(this,arguments)-r,v=l(_-g),k=_>g;if(D||=e=O(),h<m&&(t=h,h=m,m=t),!(h>1e-12))D.moveTo(0,0);else if(v>c-1e-12)D.moveTo(h*u(g),h*a(g)),D.arc(0,0,h,g,_,!k),m>1e-12&&(D.moveTo(m*u(_),m*a(_)),D.arc(0,0,m,_,g,k));else{var A=g,j=_,M=g,N=_,P=v,F=v,I=E.apply(this,arguments)/2,L=I>1e-12&&(C?+C.apply(this,arguments):d(m*m+h*h)),R=p(l(h-m)/2,+S.apply(this,arguments)),z=R,B=R,V,H;if(L>1e-12){var U=o(L/m*a(I)),W=o(L/h*a(I));(P-=U*2)>1e-12?(U*=k?1:-1,M+=U,N-=U):(P=0,M=N=(g+_)/2),(F-=W*2)>1e-12?(W*=k?1:-1,A+=W,j-=W):(F=0,A=j=(g+_)/2)}var G=h*u(A),K=h*a(A),q=m*u(N),J=m*a(N);if(R>1e-12){var Y=h*u(j),X=h*a(j),Z=m*u(M),Q=m*a(M),$;if(v<i)if($=y(G,K,Z,Q,Y,X,q,J)){var ee=G-$[0],te=K-$[1],ne=Y-$[0],re=X-$[1],ie=1/a(f((ee*ne+te*re)/(d(ee*ee+te*te)*d(ne*ne+re*re)))/2),ae=d($[0]*$[0]+$[1]*$[1]);z=p(R,(m-ae)/(ie-1)),B=p(R,(h-ae)/(ie+1))}else z=B=0}F>1e-12?B>1e-12?(V=b(Z,Q,G,K,h,B,k),H=b(Y,X,q,J,h,B,k),D.moveTo(V.cx+V.x01,V.cy+V.y01),B<R?D.arc(V.cx,V.cy,B,n(V.y01,V.x01),n(H.y01,H.x01),!k):(D.arc(V.cx,V.cy,B,n(V.y01,V.x01),n(V.y11,V.x11),!k),D.arc(0,0,h,n(V.cy+V.y11,V.cx+V.x11),n(H.cy+H.y11,H.cx+H.x11),!k),D.arc(H.cx,H.cy,B,n(H.y11,H.x11),n(H.y01,H.x01),!k))):(D.moveTo(G,K),D.arc(0,0,h,A,j,!k)):D.moveTo(G,K),!(m>1e-12)||!(P>1e-12)?D.lineTo(q,J):z>1e-12?(V=b(q,J,Y,X,m,-z,k),H=b(G,K,Z,Q,m,-z,k),D.lineTo(V.cx+V.x01,V.cy+V.y01),z<R?D.arc(V.cx,V.cy,z,n(V.y01,V.x01),n(H.y01,H.x01),!k):(D.arc(V.cx,V.cy,z,n(V.y01,V.x01),n(V.y11,V.x11),!k),D.arc(0,0,m,n(V.cy+V.y11,V.cx+V.x11),n(H.cy+H.y11,H.cx+H.x11),k),D.arc(H.cx,H.cy,z,n(H.y11,H.x11),n(H.y01,H.x01),!k))):D.arc(0,0,m,N,M,k)}if(D.closePath(),e)return D=null,e+``||null}return k.centroid=function(){var e=(+s.apply(this,arguments)+ +x.apply(this,arguments))/2,t=(+w.apply(this,arguments)+ +T.apply(this,arguments))/2-i/2;return[u(t)*e,a(t)*e]},k.innerRadius=function(t){return arguments.length?(s=typeof t==`function`?t:e(+t),k):s},k.outerRadius=function(t){return arguments.length?(x=typeof t==`function`?t:e(+t),k):x},k.cornerRadius=function(t){return arguments.length?(S=typeof t==`function`?t:e(+t),k):S},k.padRadius=function(t){return arguments.length?(C=t==null?null:typeof t==`function`?t:e(+t),k):C},k.startAngle=function(t){return arguments.length?(w=typeof t==`function`?t:e(+t),k):w},k.endAngle=function(t){return arguments.length?(T=typeof t==`function`?t:e(+t),k):T},k.padAngle=function(t){return arguments.length?(E=typeof t==`function`?t:e(+t),k):E},k.context=function(e){return arguments.length?(D=e??null,k):D},k}export{x as t};
+import{n as e,t}from"./path-BWPyau1x.js";import{a as n,c as r,d as i,f as a,i as o,l as s,m as c,n as l,o as u,p as d,r as f,u as p}from"./dist-CPbiDkEZ.js";function m(e){return e.innerRadius}function h(e){return e.outerRadius}function g(e){return e.startAngle}function _(e){return e.endAngle}function v(e){return e&&e.padAngle}function y(e,t,n,r,i,a,o,s){var c=n-e,l=r-t,u=o-i,d=s-a,f=d*c-u*l;if(!(f*f<1e-12))return f=(u*(t-a)-d*(e-i))/f,[e+f*c,t+f*l]}function b(e,t,n,r,i,a,o){var c=e-n,l=t-r,u=(o?a:-a)/d(c*c+l*l),f=u*l,p=-u*c,m=e+f,h=t+p,g=n+f,_=r+p,v=(m+g)/2,y=(h+_)/2,b=g-m,x=_-h,S=b*b+x*x,C=i-a,w=m*_-g*h,T=(x<0?-1:1)*d(s(0,C*C*S-w*w)),E=(w*x-b*T)/S,D=(-w*b-x*T)/S,O=(w*x+b*T)/S,k=(-w*b+x*T)/S,A=E-v,j=D-y,M=O-v,N=k-y;return A*A+j*j>M*M+N*N&&(E=O,D=k),{cx:E,cy:D,x01:-f,y01:-p,x11:E*(i/C-1),y11:D*(i/C-1)}}function x(){var s=m,x=h,S=e(0),C=null,w=g,T=_,E=v,D=null,O=t(k);function k(){var e,t,m=+s.apply(this,arguments),h=+x.apply(this,arguments),g=w.apply(this,arguments)-r,_=T.apply(this,arguments)-r,v=l(_-g),k=_>g;if(D||=e=O(),h<m&&(t=h,h=m,m=t),!(h>1e-12))D.moveTo(0,0);else if(v>c-1e-12)D.moveTo(h*u(g),h*a(g)),D.arc(0,0,h,g,_,!k),m>1e-12&&(D.moveTo(m*u(_),m*a(_)),D.arc(0,0,m,_,g,k));else{var A=g,j=_,M=g,N=_,P=v,F=v,I=E.apply(this,arguments)/2,L=I>1e-12&&(C?+C.apply(this,arguments):d(m*m+h*h)),R=p(l(h-m)/2,+S.apply(this,arguments)),z=R,B=R,V,H;if(L>1e-12){var U=o(L/m*a(I)),W=o(L/h*a(I));(P-=U*2)>1e-12?(U*=k?1:-1,M+=U,N-=U):(P=0,M=N=(g+_)/2),(F-=W*2)>1e-12?(W*=k?1:-1,A+=W,j-=W):(F=0,A=j=(g+_)/2)}var G=h*u(A),K=h*a(A),q=m*u(N),J=m*a(N);if(R>1e-12){var Y=h*u(j),X=h*a(j),Z=m*u(M),Q=m*a(M),$;if(v<i)if($=y(G,K,Z,Q,Y,X,q,J)){var ee=G-$[0],te=K-$[1],ne=Y-$[0],re=X-$[1],ie=1/a(f((ee*ne+te*re)/(d(ee*ee+te*te)*d(ne*ne+re*re)))/2),ae=d($[0]*$[0]+$[1]*$[1]);z=p(R,(m-ae)/(ie-1)),B=p(R,(h-ae)/(ie+1))}else z=B=0}F>1e-12?B>1e-12?(V=b(Z,Q,G,K,h,B,k),H=b(Y,X,q,J,h,B,k),D.moveTo(V.cx+V.x01,V.cy+V.y01),B<R?D.arc(V.cx,V.cy,B,n(V.y01,V.x01),n(H.y01,H.x01),!k):(D.arc(V.cx,V.cy,B,n(V.y01,V.x01),n(V.y11,V.x11),!k),D.arc(0,0,h,n(V.cy+V.y11,V.cx+V.x11),n(H.cy+H.y11,H.cx+H.x11),!k),D.arc(H.cx,H.cy,B,n(H.y11,H.x11),n(H.y01,H.x01),!k))):(D.moveTo(G,K),D.arc(0,0,h,A,j,!k)):D.moveTo(G,K),!(m>1e-12)||!(P>1e-12)?D.lineTo(q,J):z>1e-12?(V=b(q,J,Y,X,m,-z,k),H=b(G,K,Z,Q,m,-z,k),D.lineTo(V.cx+V.x01,V.cy+V.y01),z<R?D.arc(V.cx,V.cy,z,n(V.y01,V.x01),n(H.y01,H.x01),!k):(D.arc(V.cx,V.cy,z,n(V.y01,V.x01),n(V.y11,V.x11),!k),D.arc(0,0,m,n(V.cy+V.y11,V.cx+V.x11),n(H.cy+H.y11,H.cx+H.x11),k),D.arc(H.cx,H.cy,z,n(H.y11,H.x11),n(H.y01,H.x01),!k))):D.arc(0,0,m,N,M,k)}if(D.closePath(),e)return D=null,e+``||null}return k.centroid=function(){var e=(+s.apply(this,arguments)+ +x.apply(this,arguments))/2,t=(+w.apply(this,arguments)+ +T.apply(this,arguments))/2-i/2;return[u(t)*e,a(t)*e]},k.innerRadius=function(t){return arguments.length?(s=typeof t==`function`?t:e(+t),k):s},k.outerRadius=function(t){return arguments.length?(x=typeof t==`function`?t:e(+t),k):x},k.cornerRadius=function(t){return arguments.length?(S=typeof t==`function`?t:e(+t),k):S},k.padRadius=function(t){return arguments.length?(C=t==null?null:typeof t==`function`?t:e(+t),k):C},k.startAngle=function(t){return arguments.length?(w=typeof t==`function`?t:e(+t),k):w},k.endAngle=function(t){return arguments.length?(T=typeof t==`function`?t:e(+t),k):T},k.padAngle=function(t){return arguments.length?(E=typeof t==`function`?t:e(+t),k):E},k.context=function(e){return arguments.length?(D=e??null,k):D},k}export{x as t};

package/workframe-ui/public/assets/architecture-7EHR7CIX-CvhbXEvt.js

@@ -0,0 +1 @@
+import"./chunk-NNHCCRGN-DlpIbxXb.js";import{x as e}from"./mermaid-parser.core-Dm2L9Ib_.js";export{e as createArchitectureServices};