garaje 0.1.3 → 0.1.5

package/dist/host/doctor.js

@@ -5,6 +5,7 @@ import { driverContext, getDriver } from "../driver/index.js";
 import { baysArtifactState, discoverBays, manifestBays } from "../park/index.js";
 import { basePinSource } from "../upgrade/pins.js";
 import { bayStatuses, statusLine } from "./sync.js";
+import { classifyModelList, defaultModelOf, hasInferenceCredential } from "./provider.js";
 /** `garaje doctor` — host-side sanity checks. Exit code = failed-check count. */
 export function runDoctor(root) {
     let fails = 0;
@@ -59,10 +60,33 @@ export function runDoctor(root) {
         else
             fail(`@garaje/base path pin "${source}" missing — no package.json at ${dir}`);
     }
-    if (existsSync(join(root, ".env")))
-        pass(".env present");
-    else
-        warn(".env missing — copy .env.example and add ANTHROPIC_API_KEY (or use /login)");
+    // .env is the garaje's single credential surface (compose forwards it via
+    // env_file). Provider-neutral: any non-empty *_API_KEY counts, so adding a
+    // new provider needs no change here.
+    const envPath = join(root, ".env");
+    if (!existsSync(envPath)) {
+        warn(".env missing — copy .env.example and add a provider key (e.g. MIXLAYER_API_KEY)");
+    }
+    else {
+        // .env could be a directory (stray mkdir, misconfigured tool) or otherwise
+        // unreadable; report that as a failed check rather than crashing (same
+        // contract as the garaje.yaml and recipe checks below).
+        let envText;
+        try {
+            envText = readFileSync(envPath, "utf8");
+        }
+        catch (e) {
+            fail(`.env unreadable — ${e.message}`);
+        }
+        if (envText !== undefined) {
+            if (hasInferenceCredential(envText)) {
+                pass(".env carries an inference credential");
+            }
+            else {
+                warn(".env has no non-empty *_API_KEY — pi will start but cannot answer");
+            }
+        }
+    }
     // --- runtime state ---
     section("runtime");
     if (driver.configOk())
@@ -139,6 +163,49 @@ export function runDoctor(root) {
             pass(`pi binary works: ${piver}`);
         else
             fail("pi --version did not print a version");
+        // A key stored by `/login` outranks .env: model-registry resolves
+        // `apiKeyFromAuthStorage ?? providerConfig.apiKey`. Existence only — doctor
+        // never reads this file.
+        if (driver.execCapture("pi", ["test", "-f", "/root/.pi/agent/auth.json"]).status === 0) {
+            warn("/root/.pi/agent/auth.json exists — a stored `/login` credential OVERRIDES .env");
+        }
+        // Proves the provider extension loaded AND a credential is present. It
+        // does NOT validate the key: pi lists models for a bogus key exactly as it
+        // would for a real one — but with NO credential at all, `pi --list-models`
+        // exits 0 and prints "No models available" instead of a table. That is a
+        // separate condition from a model genuinely missing from a populated
+        // table, so it must warn, not fail (a freshly scaffolded garaje with no
+        // key yet must not report a hard failure here).
+        const model = existsSync(settings)
+            ? defaultModelOf(readFileSync(settings, "utf8"))
+            : undefined;
+        if (!model) {
+            warn("no defaultModel in .pi/settings.json — pi will prompt for a model");
+        }
+        else {
+            const listed = driver.execCapture("pi", ["pi", "--list-models"]);
+            if (listed.status !== 0) {
+                fail(`\`pi --list-models\` exited ${listed.status} — could not check defaultModel`);
+            }
+            else {
+                const verdict = classifyModelList(listed.stdout, model);
+                if (verdict === "no-models") {
+                    // A credential can exist (e.g. a key for a provider this garaje
+                    // isn't configured to use) while no *loaded* provider has a usable
+                    // one — CI's exact case: MIXLAYER_API_KEY set, but this repo's
+                    // settings select anthropic and no mixlayer extension is pinned.
+                    // Naming only "no credential" would misdirect toward the key when
+                    // the real cause may be a missing provider extension instead.
+                    warn(`pi lists no models — no loaded provider has a usable credential (key missing, or its provider extension isn't installed); defaultModel "${model}" cannot be verified`);
+                }
+                else if (verdict === "listed") {
+                    pass(`defaultModel registered: ${model} (extension loaded, credential present; key NOT validated)`);
+                }
+                else {
+                    fail(`defaultModel "${model}" absent from \`pi --list-models\` — provider extension missing or model id wrong`);
+                }
+            }
+        }
     }
     // --- summary ---
     section("summary");

package/dist/host/provider.js

@@ -0,0 +1,43 @@
+/** Pure helpers behind `garaje doctor`'s inference-provider checks. No fs, no
+ *  spawn — doctor's container probes are covered by scripts/ci-smoke instead. */
+/** True when a dotenv body sets any *_API_KEY to a non-empty value. A blank
+ *  assignment doesn't count: a scaffolded `.env.example` copied verbatim has
+ *  `MIXLAYER_API_KEY=` and therefore no credential. Lines may optionally be
+ *  prefixed with `export ` (for shell sourcing compatibility). */
+export function hasInferenceCredential(envText) {
+    for (const raw of envText.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const m = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*_API_KEY)\s*=\s*(.*)$/.exec(line);
+        if (!m)
+            continue;
+        if (m[2].trim().replace(/^["']|["']$/g, "").length > 0)
+            return true;
+    }
+    return false;
+}
+/** The `defaultModel` a garaje's committed pi settings select, if any. */
+export function defaultModelOf(settingsText) {
+    try {
+        const data = JSON.parse(settingsText);
+        return typeof data.defaultModel === "string" && data.defaultModel
+            ? data.defaultModel
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Whether `pi --list-models` output registers the given model id. */
+export function modelListed(listOutput, model) {
+    return listOutput.split(/\r?\n/).some((l) => l.includes(model));
+}
+/** Classify `pi --list-models` output. pi prints "No models available" when no
+ *  provider credential is present — a different condition from a model that is
+ *  genuinely missing from a populated table. */
+export function classifyModelList(listOutput, model) {
+    if (/no models available/i.test(listOutput))
+        return "no-models";
+    return modelListed(listOutput, model) ? "listed" : "absent";
+}

package/dist/host/sync.js

@@ -5,17 +5,34 @@ import { readManifest } from "../manifest.js";
 function git(args) {
     return spawnSync("git", args, { stdio: "inherit" }).status ?? 1;
 }
-/** Cross the manifest with what is actually checked out under bays/. */
-export function bayStatuses(root) {
-    return readManifest(root).map((bay) => {
-        const dest = join(root, "bays", bay.name);
-        if (!existsSync(join(dest, ".git")))
-            return { ...bay, synced: false };
-        const rev = spawnSync("git", ["-C", dest, "rev-parse", "--short", "HEAD"], {
-            encoding: "utf8",
-        });
-        return { ...bay, synced: true, head: rev.status === 0 ? rev.stdout.trim() : "?" };
+/** Read the manifest, reporting a bad one as an error rather than a stack
+ *  trace. A `bays: []` line followed by list items is the common way to get
+ *  here — it looks like an append but is not valid YAML. */
+function readOrReport(root) {
+    try {
+        return readManifest(root);
+    }
+    catch (e) {
+        const first = e.message.split("\n")[0];
+        process.stderr.write(`error: garaje.yaml: ${first}\n`);
+        process.stderr.write("hint: bays must be a YAML list; an empty `bays: []` cannot be followed by `- name:` items\n");
+        return undefined;
+    }
+}
+/** Whether one manifest bay is materialized, and at which commit. */
+function bayStatus(root, bay) {
+    const dest = join(root, "bays", bay.name);
+    if (!existsSync(join(dest, ".git")))
+        return { ...bay, synced: false };
+    const rev = spawnSync("git", ["-C", dest, "rev-parse", "--short", "HEAD"], {
+        encoding: "utf8",
     });
+    return { ...bay, synced: true, head: rev.status === 0 ? rev.stdout.trim() : "?" };
+}
+/** Cross the manifest with what is actually checked out under bays/. Throws on
+ *  a bad manifest; doctor reports that as a failed check. */
+export function bayStatuses(root) {
+    return readManifest(root).map((bay) => bayStatus(root, bay));
 }
 /** One human-readable line per bay. Pure — doctor reuses this. */
 export function statusLine(b) {
@@ -34,7 +51,10 @@ export function renderList(rows) {
 }
 /** `garaje list` — show the manifest and which bays are materialized. */
 export function runList(root) {
-    process.stdout.write(renderList(bayStatuses(root)));
+    const entries = readOrReport(root);
+    if (!entries)
+        return 1;
+    process.stdout.write(renderList(entries.map((b) => bayStatus(root, b))));
     return 0;
 }
 /** `garaje sync [name...]` — clone/update the manifest's bays into bays/. */
@@ -43,7 +63,9 @@ export function runSync(root, names) {
         process.stderr.write("error: git not found in PATH\n");
         return 1;
     }
-    const entries = readManifest(root);
+    const entries = readOrReport(root);
+    if (!entries)
+        return 1;
     const unknown = names.filter((n) => !entries.some((b) => b.name === n));
     if (unknown.length) {
         process.stderr.write(`error: not in garaje.yaml: ${unknown.join(", ")} (declare the bay in the manifest first)\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "garaje",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "license": "MIT",
   "repository": {
     "type": "git",

package/templates/.env.example

@@ -1,3 +1,15 @@
-# Copy to .env and fill in to use API-key auth for the pi container.
-# Alternatively leave blank and run `/login` inside pi (persisted via the pi-config volume).
+# Copy to .env, then fill in one provider key.
+#
+# This file is the garaje's ONLY credential surface: compose forwards .env into
+# the pi container (env_file). A variable exported in your shell does NOT reach
+# the agent.
+
+# The scaffolded provider. Create a key at https://console.mixlayer.com/app/api-keys
+MIXLAYER_API_KEY=
+
+# Only needed if you switch .pi/settings.json back to defaultProvider "anthropic".
 ANTHROPIC_API_KEY=
+
+# NOTE: a key stored by `/login` inside pi is written to ~/.pi/agent/auth.json on
+# the pi-config volume, survives rebuilds, and TAKES PRECEDENCE over this file.
+# `garaje doctor` warns when that file exists.

package/templates/.pi/settings.json

@@ -1,13 +1,14 @@
 {
   "$schema": "https://pi.dev/schemas/settings.json",
-  "defaultProvider": "anthropic",
-  "defaultModel": "claude-opus-4-8",
+  "defaultProvider": "mixlayer",
+  "defaultModel": "qwen/qwen3.5-397b-a17b",
   "defaultThinkingLevel": "medium",
   "theme": "dark",
   "packages": [
     {
       "source": "__BASE_PIN__",
       "extensions": ["extensions/**", "!extensions/session-name.ts"]
-    }
+    },
+    "npm:pi-mixlayer@0.4.0"
   ]
 }

package/templates/compose.framework.yaml

@@ -14,8 +14,18 @@ services:
       - ./:/workspace
       - pi-config:/root/.pi/agent
       - garaje-auth:/root/.garaje-auth
+    # Provider credentials come from .env — a garaje's single credential surface.
+    # Any pi provider extension (pi-mixlayer, pi-openai, …) resolves its key from
+    # the container environment, so adding a provider needs no framework release.
+    # A shell-exported variable does NOT reach the agent; put it in .env.
+    # required:false keeps `garaje up` working before .env exists.
+    env_file:
+      - path: .env
+        required: false
     environment:
-      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
+      # Framework-owned. `environment:` overrides `env_file`, so a stray .env
+      # entry cannot hijack any of these.
+      #
       # The agent's ONLY docker endpoint: the whitelisting proxy below.
       # The raw socket is never mounted here (north-star §5.1 layer 1).
       - DOCKER_HOST=tcp://docker-proxy:2375
@@ -26,6 +36,10 @@ services:
       # bind mounts use ${GARAJE_HOST_ROOT:-.} because bind sources resolve
       # on the daemon (host) side even when compose runs in-container.
       - GARAJE_HOST_ROOT=${PWD:-}
+      # pi/Dockerfile sets this via ENV, which env_file (unlike environment:)
+      # does NOT outrank — restated here so a stray .env line cannot redirect
+      # the agent's gh config directory (and its git/gh credential wiring).
+      - GH_CONFIG_DIR=/root/.garaje-auth/gh
     depends_on:
       - docker-proxy
 

package/templates/gitignore

@@ -24,3 +24,7 @@ bays/*
 
 # Dev-local garaje overrides (per-bay bind-mount paths, personal settings).
 garaje.local.yaml
+
+# Pi packages installed into project scope by `pi install -l`. The package
+# manifest lives in the committed .pi/settings.json; these are its artifacts.
+/.pi/npm/