gitops-ai 1.0.0 → 1.1.0

package/dist/commands/bootstrap.js

@@ -1,17 +1,33 @@
 import { existsSync } from "node:fs";
+import { execSync } from "node:child_process";
 import { resolve } from "node:path";
 import * as p from "@clack/prompts";
 import pc from "picocolors";
 import { header, log, summary, nextSteps, finish, handleCancel, withSpinner, formatError, } from "../utils/log.js";
 import { saveInstallPlan, loadInstallPlan, clearInstallPlan } from "../utils/config.js";
-import { execAsync, exec, commandExists } from "../utils/shell.js";
+import { execAsync, exec, execSafe, commandExists } from "../utils/shell.js";
 import { isMacOS, isCI } from "../utils/platform.js";
 import { ensureAll } from "../core/dependencies.js";
 import { runBootstrap } from "../core/bootstrap-runner.js";
+import * as k8s from "../core/kubernetes.js";
 import * as flux from "../core/flux.js";
-import * as gitlab from "../core/gitlab.js";
-import { COMPONENTS, REQUIRED_COMPONENT_IDS, DNS_TLS_COMPONENT_IDS, OPTIONAL_COMPONENTS, SOURCE_GITLAB_HOST, SOURCE_PROJECT_PATH, } from "../schemas.js";
+import { getProvider, } from "../core/git-provider.js";
+import { COMPONENTS, REQUIRED_COMPONENT_IDS, DNS_TLS_COMPONENT_IDS, MONITORING_COMPONENT_IDS, OPTIONAL_COMPONENTS, SOURCE_GITLAB_HOST, SOURCE_PROJECT_PATH, } from "../schemas.js";
 import { stepWizard, back, maskSecret, } from "../utils/wizard.js";
+import { loginAndCreateCloudflareToken } from "../core/cloudflare-oauth.js";
+// ---------------------------------------------------------------------------
+// Browser opener
+// ---------------------------------------------------------------------------
+function openUrl(url) {
+    const cmd = isMacOS() ? "open" : "xdg-open";
+    try {
+        execSync(`${cmd} '${url}'`, { stdio: "ignore" });
+    }
+    catch {
+        /* user will see the manual URL in the terminal */
+    }
+}
+const OPENAI_API_KEYS_URL = "https://platform.openai.com/api-keys";
 function isNewRepo(state) {
     return state.setupMode === "new";
 }
@@ -24,6 +40,38 @@ function openclawEnabled(state) {
 function componentLabel(id) {
     return COMPONENTS.find((c) => c.id === id)?.label ?? id;
 }
+async function fetchTemplateTags() {
+    const encoded = encodeURIComponent(SOURCE_PROJECT_PATH);
+    const url = `https://${SOURCE_GITLAB_HOST}/api/v4/projects/${encoded}/repository/tags?per_page=50&order_by=version&sort=desc`;
+    try {
+        const res = await fetch(url);
+        if (!res.ok)
+            return [];
+        const tags = (await res.json());
+        return tags.map((t) => t.name);
+    }
+    catch {
+        return [];
+    }
+}
+function providerLabel(type) {
+    return type === "gitlab" ? "GitLab" : "GitHub";
+}
+async function enrichWithUser(state, token, provider) {
+    try {
+        const user = await provider.fetchCurrentUser(token, provider.defaultHost);
+        log.success(`Logged in as ${user.username}`);
+        return {
+            ...state,
+            gitToken: token,
+            repoOwner: state.repoOwner || user.username,
+        };
+    }
+    catch (err) {
+        log.warn(`Could not detect ${providerLabel(state.gitProvider)} user: ${err.message}`);
+        return { ...state, gitToken: token };
+    }
+}
 // ---------------------------------------------------------------------------
 // Wizard field definitions (Esc / Ctrl+C = go back one field)
 // ---------------------------------------------------------------------------
@@ -63,32 +111,140 @@ function buildFields(detectedIp, hasSavedPlan) {
                     : "Use existing repo",
             ],
         },
-        // ── GitLab Repository ───────────────────────────────────────────────
+        // ── Git Provider ────────────────────────────────────────────────────
         {
-            id: "gitlabPat",
-            section: "GitLab Repository",
-            skip: (state) => !!state.gitlabPat,
+            id: "gitProvider",
+            section: "Git Provider",
+            skip: (state) => saved(state, "gitProvider"),
             run: async (state) => {
+                const v = await p.select({
+                    message: pc.bold("Which Git provider do you want to use?"),
+                    options: [
+                        {
+                            value: "github",
+                            label: "GitHub",
+                            hint: "github.com or GitHub Enterprise",
+                        },
+                        {
+                            value: "gitlab",
+                            label: "GitLab",
+                            hint: "gitlab.com or self-hosted",
+                        },
+                    ],
+                    initialValue: state.gitProvider,
+                });
+                if (p.isCancel(v))
+                    return back();
+                return { ...state, gitProvider: v };
+            },
+            review: (state) => ["Provider", providerLabel(state.gitProvider)],
+        },
+        // ── Git Repository ──────────────────────────────────────────────────
+        {
+            id: "gitToken",
+            section: "Git Repository",
+            skip: (state) => !!state.gitToken,
+            run: async (state) => {
+                const provider = await getProvider(state.gitProvider);
+                if (isCI()) {
+                    const v = await p.password({
+                        message: pc.bold(provider.tokenLabel),
+                        validate: (v) => { if (!v)
+                            return "Required"; },
+                    });
+                    if (p.isCancel(v))
+                        return back();
+                    return { ...state, gitToken: v };
+                }
+                const method = await p.select({
+                    message: pc.bold(`How would you like to authenticate with ${providerLabel(state.gitProvider)}?`),
+                    options: [
+                        {
+                            value: "browser",
+                            label: "Login with browser",
+                            hint: `opens ${providerLabel(state.gitProvider)} in your browser — recommended`,
+                        },
+                        {
+                            value: "pat",
+                            label: "Paste a Personal Access Token",
+                            hint: "manual token entry",
+                        },
+                    ],
+                });
+                if (p.isCancel(method))
+                    return back();
+                if (method === "browser") {
+                    try {
+                        const token = await provider.loginWithBrowser(provider.defaultHost);
+                        log.success("Authenticated via browser");
+                        return await enrichWithUser(state, token, provider);
+                    }
+                    catch (err) {
+                        log.warn(`Browser login failed: ${err.message}`);
+                        log.warn("Falling back to manual token entry");
+                    }
+                }
                 const v = await p.password({
-                    message: pc.bold("GitLab Personal Access Token (api, read_repository, write_repository)"),
-                    validate: (v) => {
-                        if (!v)
-                            return "Required";
-                    },
+                    message: pc.bold(provider.tokenLabel),
+                    validate: (v) => { if (!v)
+                        return "Required"; },
                 });
                 if (p.isCancel(v))
                     return back();
-                return { ...state, gitlabPat: v };
+                return await enrichWithUser(state, v, provider);
             },
-            review: (state) => ["PAT", maskSecret(state.gitlabPat)],
+            review: (state) => ["Token", maskSecret(state.gitToken)],
         },
         {
             id: "repoOwner",
-            section: "GitLab Repository",
-            skip: (state) => saved(state, "repoOwner"),
+            section: "Git Repository",
+            skip: (state) => !!state.repoOwner,
             run: async (state) => {
+                const provider = await getProvider(state.gitProvider);
+                const label = providerLabel(state.gitProvider);
+                const orgLabel = state.gitProvider === "gitlab" ? "group" : "org";
+                try {
+                    const user = await provider.fetchCurrentUser(state.gitToken, provider.defaultHost);
+                    let orgs = [];
+                    try {
+                        orgs = await provider.fetchOrganizations(state.gitToken, provider.defaultHost);
+                    }
+                    catch {
+                        /* no orgs or insufficient permissions — continue with personal only */
+                    }
+                    const options = [
+                        {
+                            value: user.username,
+                            label: user.username,
+                            hint: `personal · ${user.name}`,
+                        },
+                        ...orgs.map((g) => ({
+                            value: g.fullPath,
+                            label: g.fullPath,
+                            hint: orgLabel,
+                        })),
+                        {
+                            value: "__manual__",
+                            label: "Enter manually…",
+                            hint: "type a namespace",
+                        },
+                    ];
+                    const v = await p.select({
+                        message: pc.bold(`${label} namespace for the repository`),
+                        options,
+                        initialValue: state.repoOwner || user.username,
+                    });
+                    if (p.isCancel(v))
+                        return back();
+                    if (v !== "__manual__") {
+                        return { ...state, repoOwner: v };
+                    }
+                }
+                catch {
+                    /* API unavailable — fall through to manual input */
+                }
                 const v = await p.text({
-                    message: pc.bold("GitLab repo owner / namespace (without @)"),
+                    message: pc.bold(`${label} repo owner / namespace`),
                     placeholder: "my-username-or-group",
                     initialValue: state.repoOwner || undefined,
                     validate: (v) => {
@@ -104,13 +260,54 @@ function buildFields(detectedIp, hasSavedPlan) {
         },
         {
             id: "repoName",
-            section: "GitLab Repository",
+            section: "Git Repository",
             skip: (state) => saved(state, "repoName"),
             run: async (state) => {
+                if (isNewRepo(state)) {
+                    const v = await p.text({
+                        message: pc.bold("New repository name"),
+                        placeholder: "fluxcd_ai",
+                        defaultValue: state.repoName,
+                    });
+                    if (p.isCancel(v))
+                        return back();
+                    return { ...state, repoName: v };
+                }
+                const provider = await getProvider(state.gitProvider);
+                try {
+                    const projects = await provider.fetchNamespaceProjects(state.gitToken, provider.defaultHost, state.repoOwner);
+                    if (projects.length > 0) {
+                        const options = [
+                            ...projects.map((proj) => ({
+                                value: proj.name,
+                                label: proj.name,
+                                hint: proj.description
+                                    ? proj.description.slice(0, 60)
+                                    : undefined,
+                            })),
+                            {
+                                value: "__manual__",
+                                label: "Enter manually…",
+                                hint: "type a repo name",
+                            },
+                        ];
+                        const v = await p.select({
+                            message: pc.bold("Select repository"),
+                            options,
+                            initialValue: state.repoName || undefined,
+                        });
+                        if (p.isCancel(v))
+                            return back();
+                        if (v !== "__manual__") {
+                            return { ...state, repoName: v };
+                        }
+                    }
+                }
+                catch {
+                    /* fall through to manual input */
+                }
                 const v = await p.text({
-                    message: isNewRepo(state)
-                        ? pc.bold("New repository name")
-                        : pc.bold("Flux GitLab repo name"),
+                    message: pc.bold("Flux repo name"),
                     placeholder: "fluxcd_ai",
                     defaultValue: state.repoName,
                 });
@@ -122,30 +319,48 @@ function buildFields(detectedIp, hasSavedPlan) {
         },
         {
             id: "repoLocalPath",
-            section: "GitLab Repository",
-            hidden: (state) => !isNewRepo(state),
+            section: "Git Repository",
             skip: (state) => saved(state, "repoLocalPath"),
             run: async (state) => {
+                if (isNewRepo(state)) {
+                    const v = await p.text({
+                        message: pc.bold("Local directory to clone into"),
+                        placeholder: `./${state.repoName}  (relative to current directory)`,
+                        defaultValue: state.repoLocalPath || state.repoName,
+                    });
+                    if (p.isCancel(v))
+                        return back();
+                    return { ...state, repoLocalPath: v };
+                }
                 const v = await p.text({
-                    message: pc.bold("Local directory to clone into"),
-                    placeholder: `./${state.repoName}  (relative to current directory)`,
-                    defaultValue: state.repoLocalPath || state.repoName,
+                    message: pc.bold("Path to your local repo checkout"),
+                    placeholder: `./${state.repoName}  (relative or absolute path)`,
+                    defaultValue: state.repoLocalPath || ".",
+                    validate: (val) => {
+                        const target = resolve(val || ".");
+                        if (!existsSync(target))
+                            return "Directory does not exist";
+                        const gitCheck = execSafe("git rev-parse --is-inside-work-tree", { cwd: target });
+                        if (gitCheck.exitCode !== 0)
+                            return "Not a git repository — run git init or clone first";
+                        return undefined;
+                    },
                 });
                 if (p.isCancel(v))
                     return back();
                 return { ...state, repoLocalPath: v };
             },
-            review: (state) => ["Local path", `./${state.repoLocalPath}`],
+            review: (state) => isNewRepo(state)
+                ? ["Local path", `./${state.repoLocalPath}`]
+                : ["Local repo path", resolve(state.repoLocalPath || ".")],
         },
         {
             id: "repoBranch",
-            section: "GitLab Repository",
+            section: "Git Repository",
             skip: (state) => saved(state, "repoBranch"),
             run: async (state) => {
                 const v = await p.text({
-                    message: isNewRepo(state)
-                        ? pc.bold("Template branch name to clone")
-                        : pc.bold("Git branch for Flux"),
+                    message: pc.bold("Git branch for Flux"),
                     placeholder: "main",
                     defaultValue: state.repoBranch,
                 });
@@ -155,6 +370,48 @@ function buildFields(detectedIp, hasSavedPlan) {
             },
             review: (state) => ["Branch", state.repoBranch],
         },
+        {
+            id: "templateTag",
+            section: "Git Repository",
+            hidden: (state) => !isNewRepo(state),
+            skip: (state) => saved(state, "templateTag"),
+            run: async (state) => {
+                const tags = await fetchTemplateTags();
+                if (tags.length > 0) {
+                    const options = [
+                        ...tags.map((tag, i) => ({
+                            value: tag,
+                            label: tag,
+                            hint: i === 0 ? "latest" : undefined,
+                        })),
+                        {
+                            value: "__manual__",
+                            label: "Enter manually…",
+                            hint: "type a tag or branch name",
+                        },
+                    ];
+                    const v = await p.select({
+                        message: pc.bold("Template version (tag) to clone"),
+                        options,
+                        initialValue: state.templateTag || tags[0],
+                    });
+                    if (p.isCancel(v))
+                        return back();
+                    if (v !== "__manual__") {
+                        return { ...state, templateTag: v };
+                    }
+                }
+                const v = await p.text({
+                    message: pc.bold("Template tag or branch to clone"),
+                    placeholder: "main",
+                    defaultValue: state.templateTag || "main",
+                });
+                if (p.isCancel(v))
+                    return back();
+                return { ...state, templateTag: v };
+            },
+            review: (state) => ["Template tag", state.templateTag],
+        },
         // ── DNS & TLS ─────────────────────────────────────────────────────────
         {
             id: "manageDnsAndTls",
@@ -183,25 +440,42 @@ function buildFields(detectedIp, hasSavedPlan) {
             section: "Components",
             skip: (state) => saved(state, "selectedComponents"),
             run: async (state) => {
+                const MONITORING_GROUP_ID = "__monitoring__";
+                const monitoringOption = {
+                    value: MONITORING_GROUP_ID,
+                    label: "Monitoring Stack",
+                    hint: "Victoria Metrics + Grafana Operator (dashboards, alerting, metrics)",
+                };
+                const hasMonitoring = MONITORING_COMPONENT_IDS.every((id) => state.selectedComponents.includes(id));
                 const selected = await p.multiselect({
                     message: pc.bold("Optional components to install"),
-                    options: OPTIONAL_COMPONENTS.map((c) => ({
-                        value: c.id,
-                        label: c.label,
-                        hint: c.hint,
-                    })),
-                    initialValues: state.selectedComponents.filter((id) => OPTIONAL_COMPONENTS.some((c) => c.id === id)),
+                    options: [
+                        monitoringOption,
+                        ...OPTIONAL_COMPONENTS.map((c) => ({
+                            value: c.id,
+                            label: c.label,
+                            hint: c.hint,
+                        })),
+                    ],
+                    initialValues: [
+                        ...(hasMonitoring ? [MONITORING_GROUP_ID] : []),
+                        ...state.selectedComponents.filter((id) => OPTIONAL_COMPONENTS.some((c) => c.id === id)),
+                    ],
                     required: false,
                 });
                 if (p.isCancel(selected))
                     return back();
+                const picks = selected;
+                const monitoringIds = picks.includes(MONITORING_GROUP_ID) ? MONITORING_COMPONENT_IDS : [];
+                const otherIds = picks.filter((id) => id !== MONITORING_GROUP_ID);
                 const dnsTlsIds = state.manageDnsAndTls ? DNS_TLS_COMPONENT_IDS : [];
                 return {
                     ...state,
                     selectedComponents: [
                         ...REQUIRED_COMPONENT_IDS,
                         ...dnsTlsIds,
-                        ...selected,
+                        ...monitoringIds,
+                        ...otherIds,
                     ],
                 };
             },
@@ -274,12 +548,47 @@ function buildFields(detectedIp, hasSavedPlan) {
             hidden: (state) => !dnsAndTlsEnabled(state),
             skip: (state) => !!state.cloudflareApiToken,
             run: async (state) => {
+                if (isCI()) {
+                    const v = await p.password({
+                        message: pc.bold("Cloudflare API Token (DNS zone edit access)"),
+                        validate: (v) => { if (!v)
+                            return "Required"; },
+                    });
+                    if (p.isCancel(v))
+                        return back();
+                    return { ...state, cloudflareApiToken: v };
+                }
+                const method = await p.select({
+                    message: pc.bold("How would you like to authenticate with Cloudflare?"),
+                    options: [
+                        {
+                            value: "browser",
+                            label: "Login with browser",
+                            hint: "OAuth login → auto-creates a scoped DNS token — recommended",
+                        },
+                        {
+                            value: "pat",
+                            label: "Paste an API Token",
+                            hint: "manual token from dash.cloudflare.com",
+                        },
+                    ],
+                });
+                if (p.isCancel(method))
+                    return back();
+                if (method === "browser") {
+                    try {
+                        const token = await loginAndCreateCloudflareToken(state.clusterDomain);
+                        return { ...state, cloudflareApiToken: token };
+                    }
+                    catch (err) {
+                        log.warn(`Browser login failed: ${err.message}`);
+                        log.warn("Falling back to manual token entry");
+                    }
+                }
                 const v = await p.password({
                     message: pc.bold("Cloudflare API Token (DNS zone edit access)"),
-                    validate: (v) => {
-                        if (!v)
-                            return "Required";
-                    },
+                    validate: (v) => { if (!v)
+                        return "Required"; },
                 });
                 if (p.isCancel(v))
                     return back();
@@ -296,12 +605,48 @@ function buildFields(detectedIp, hasSavedPlan) {
             hidden: (state) => !openclawEnabled(state),
             skip: (state) => !!state.openaiApiKey,
             run: async (state) => {
+                if (isCI()) {
+                    const v = await p.password({
+                        message: pc.bold("OpenAI API Key"),
+                        validate: (v) => { if (!v)
+                            return "Required"; },
+                    });
+                    if (p.isCancel(v))
+                        return back();
+                    const openclawGatewayToken = state.openclawGatewayToken || exec("openssl rand -hex 32");
+                    return { ...state, openaiApiKey: v, openclawGatewayToken };
+                }
+                const method = await p.select({
+                    message: pc.bold("How would you like to provide your OpenAI API key?"),
+                    options: [
+                        {
+                            value: "browser",
+                            label: "Open dashboard in browser",
+                            hint: "opens platform.openai.com to create a key — recommended",
+                        },
+                        {
+                            value: "paste",
+                            label: "Paste an API Key",
+                            hint: "manual key entry",
+                        },
+                    ],
+                });
+                if (p.isCancel(method))
+                    return back();
+                if (method === "browser") {
+                    p.note(`${pc.bold("Create an API key with these steps:")}\n\n` +
+                        `  1. Log in to ${pc.cyan("platform.openai.com")}\n` +
+                        `  2. Click ${pc.cyan("+ Create new secret key")}\n` +
+                        `  3. Name it (e.g. ${pc.cyan("gitops-ai")})\n` +
+                        `  4. Copy the key value\n\n` +
+                        pc.dim("The key starts with sk-… and is only shown once."), "OpenAI API Key");
+                    p.log.info(pc.dim("Opening browser…"));
+                    openUrl(OPENAI_API_KEYS_URL);
+                }
                 const v = await p.password({
-                    message: pc.bold("OpenAI API Key (for AI components)"),
-                    validate: (v) => {
-                        if (!v)
-                            return "Required";
-                    },
+                    message: pc.bold("Paste the OpenAI API key"),
+                    validate: (v) => { if (!v)
+                        return "Required"; },
                 });
                 if (p.isCancel(v))
                     return back();
@@ -334,11 +679,11 @@ function buildFields(detectedIp, hasSavedPlan) {
         {
             id: "clusterPublicIp",
             section: "Network",
-            skip: (state) => saved(state, "clusterPublicIp"),
+            skip: (state) => dnsAndTlsEnabled(state) && saved(state, "clusterPublicIp"),
             run: async (state) => {
                 const useLocal = !dnsAndTlsEnabled(state);
                 const fallback = useLocal ? "127.0.0.1" : detectedIp;
-                const defaultIp = state.clusterPublicIp || fallback;
+                const defaultIp = useLocal ? fallback : (state.clusterPublicIp || fallback);
                 const v = await p.text({
                     message: useLocal
                         ? pc.bold("Cluster IP") + pc.dim("  (local because DNS management is disabled. Rewrite if it necessary)")
@@ -361,20 +706,19 @@ function buildFields(detectedIp, hasSavedPlan) {
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
-function resolveRepoRoot() {
-    const scriptDir = new URL(".", import.meta.url).pathname;
-    return resolve(scriptDir, "../../../");
-}
 // ---------------------------------------------------------------------------
 // Repo creation phase (only for "new" mode)
 // ---------------------------------------------------------------------------
 async function createAndCloneRepo(wizard) {
-    log.step("Authenticating with GitLab");
-    await gitlab.authenticate(wizard.gitlabPat, SOURCE_GITLAB_HOST);
+    const provider = await getProvider(wizard.gitProvider);
+    const label = providerLabel(wizard.gitProvider);
+    const host = provider.defaultHost;
+    log.step(`Authenticating with ${label}`);
+    await provider.authenticate(wizard.gitToken, host);
     log.step(`Resolving namespace '${wizard.repoOwner}'`);
-    const namespaceId = await gitlab.resolveNamespaceId(wizard.repoOwner, SOURCE_GITLAB_HOST);
+    const namespaceId = await provider.resolveNamespaceId(wizard.repoOwner, host, wizard.gitToken);
     log.step(`Creating project ${wizard.repoOwner}/${wizard.repoName}`);
-    const existing = await gitlab.getProject(wizard.repoOwner, wizard.repoName, SOURCE_GITLAB_HOST);
+    const existing = await provider.getProject(wizard.repoOwner, wizard.repoName, host, wizard.gitToken);
     let httpUrl;
     let pathWithNs;
     let repoExisted = false;
@@ -394,7 +738,7 @@ async function createAndCloneRepo(wizard) {
         log.success(`Using existing: ${pathWithNs}`);
     }
     else {
-        const created = await withSpinner("Creating GitLab project", () => gitlab.createProject(wizard.repoName, namespaceId, SOURCE_GITLAB_HOST));
+        const created = await withSpinner(`Creating ${label} project`, () => provider.createProject(wizard.repoName, namespaceId, host, wizard.gitToken));
         httpUrl = created.httpUrl;
         pathWithNs = created.pathWithNamespace;
         log.success(`Created: ${pathWithNs}`);
@@ -418,10 +762,22 @@ async function createAndCloneRepo(wizard) {
         }
     }
     else {
-        await withSpinner("Cloning template repository", () => execAsync(`git clone --quiet --branch "${wizard.repoBranch}" "https://${SOURCE_GITLAB_HOST}/${SOURCE_PROJECT_PATH}.git" "${cloneDir}"`));
+        const cloneRef = wizard.templateTag || "main";
+        let clonedRef = cloneRef;
+        try {
+            await withSpinner(`Cloning template (${cloneRef})`, () => execAsync(`git clone --quiet --branch "${cloneRef}" "https://${SOURCE_GITLAB_HOST}/${SOURCE_PROJECT_PATH}.git" "${cloneDir}"`));
+        }
+        catch {
+            log.warn(`Tag/branch '${cloneRef}' not found — falling back to 'main'`);
+            clonedRef = "main";
+            await withSpinner("Cloning template (main)", () => execAsync(`git clone --quiet --branch "main" "https://${SOURCE_GITLAB_HOST}/${SOURCE_PROJECT_PATH}.git" "${cloneDir}"`));
+        }
+        if (clonedRef !== wizard.repoBranch) {
+            exec(`git checkout -B "${wizard.repoBranch}"`, { cwd: cloneDir });
+        }
         exec(`git remote set-url origin "${httpUrl}"`, { cwd: cloneDir });
     }
-    const authRemote = `https://oauth2:${wizard.gitlabPat}@${SOURCE_GITLAB_HOST}/${pathWithNs}.git`;
+    const authRemote = provider.getAuthRemoteUrl(host, pathWithNs, wizard.gitToken);
     await withSpinner(`Pushing to ${pathWithNs}`, () => {
         const forceFlag = repoExisted ? " --force" : "";
         return execAsync(`git push -u "${authRemote}" "${wizard.repoBranch}"${forceFlag} --quiet`, { cwd: cloneDir });
@@ -495,6 +851,34 @@ export async function bootstrap() {
         log.warn("Loading saved inputs from previous run");
     }
     const prev = (saved ?? {});
+    // Backward compat: migrate gitlabPat → gitToken
+    if (prev.gitlabPat && !prev.gitToken) {
+        prev.gitToken = prev.gitlabPat;
+    }
+    // ── Check for existing cluster ──────────────────────────────────────
+    const existing = k8s.detectExistingClusters();
+    if (existing) {
+        const clusterList = existing.names
+            .map((n) => `  ${pc.cyan(n)}`)
+            .join("\n");
+        const deleteHint = existing.type === "k3d"
+            ? `  ${pc.cyan(`k3d cluster delete ${existing.names[0]}`)}`
+            : `  ${pc.cyan("sudo /usr/local/bin/k3s-uninstall.sh")}`;
+        p.log.warn(pc.yellow(`Existing ${existing.type} cluster(s) detected:`));
+        p.note(`${pc.bold("Clusters found:")}\n${clusterList}\n\n` +
+            `Re-bootstrapping may overwrite existing resources.\n` +
+            `To start fresh, delete the cluster first:\n` +
+            deleteHint + `\n\n` +
+            pc.dim("Choose Continue to proceed anyway."), "Cluster Already Exists");
+        const shouldContinue = await p.confirm({
+            message: pc.bold("Continue with the existing cluster?"),
+            initialValue: false,
+        });
+        if (p.isCancel(shouldContinue) || !shouldContinue) {
+            finish("Bootstrap cancelled — existing cluster left untouched");
+            return;
+        }
+    }
     // ── Detect public IP (silent) ────────────────────────────────────────
     let detectedIp = prev.clusterPublicIp ?? "";
     if (!detectedIp) {
@@ -517,6 +901,7 @@ export async function bootstrap() {
             ...OPTIONAL_COMPONENTS.map((c) => c.id),
         ];
     const initialState = {
+        gitProvider: prev.gitProvider ?? "github",
         setupMode: prev.setupMode ?? "new",
         manageDnsAndTls: savedDnsTls,
         selectedComponents: savedComponents,
@@ -526,8 +911,10 @@ export async function bootstrap() {
         repoLocalPath: prev.repoLocalPath ?? "",
         repoOwner: prev.repoOwner ?? "",
         repoBranch: prev.repoBranch ?? "main",
+        templateTag: prev.templateTag ?? "",
         letsencryptEmail: prev.letsencryptEmail ?? "",
-        gitlabPat: prev.gitlabPat ?? "",
+        gitToken: prev.gitToken ?? "",
+        gitFluxToken: prev.gitFluxToken ?? "",
         cloudflareApiToken: prev.cloudflareApiToken ?? "",
         openaiApiKey: prev.openaiApiKey ?? "",
         openclawGatewayToken: prev.openclawGatewayToken ?? "",
@@ -537,6 +924,7 @@ export async function bootstrap() {
     const wizard = await stepWizard(buildFields(detectedIp, !!saved), initialState);
     // ── Save config ─────────────────────────────────────────────────────
     saveInstallPlan({
+        gitProvider: wizard.gitProvider,
         setupMode: wizard.setupMode,
         manageDnsAndTls: String(wizard.manageDnsAndTls),
         clusterName: wizard.clusterName,
@@ -544,11 +932,13 @@ export async function bootstrap() {
         clusterPublicIp: wizard.clusterPublicIp,
         letsencryptEmail: wizard.letsencryptEmail,
         ingressAllowedIps: wizard.ingressAllowedIps,
-        gitlabPat: wizard.gitlabPat,
+        gitToken: wizard.gitToken,
+        gitFluxToken: wizard.gitFluxToken,
         repoName: wizard.repoName,
         repoLocalPath: wizard.repoLocalPath,
         repoOwner: wizard.repoOwner,
         repoBranch: wizard.repoBranch,
+        templateTag: wizard.templateTag,
         cloudflareApiToken: wizard.cloudflareApiToken,
         openaiApiKey: wizard.openaiApiKey ?? "",
         openclawGatewayToken: wizard.openclawGatewayToken ?? "",
@@ -558,11 +948,8 @@ export async function bootstrap() {
     // ── Warn about CLI tools that will be installed ─────────────────────
     const toolDescriptions = [
         ["git", "Version control (repo operations)"],
-        ["jq", "JSON processor (API responses)"],
-        ["glab", "GitLab CLI (repo & auth management)"],
         ["kubectl", "Kubernetes CLI (cluster management)"],
         ["helm", "Kubernetes package manager (chart installs)"],
-        ["k9s", "Terminal UI for Kubernetes (monitoring)"],
         ["flux-operator", "FluxCD Operator CLI (GitOps reconciliation)"],
         ["sops", "Mozilla SOPS (secret encryption)"],
         ["age", "Age encryption (SOPS key backend)"],
@@ -589,12 +976,12 @@ export async function bootstrap() {
         pc.dim("─".repeat(60)) + "\n\n" +
         pc.bold("Why are these needed?\n") +
         pc.dim("These tools are used to create and manage your Kubernetes cluster,\n") +
-        pc.dim("deploy components via Helm/Flux, encrypt secrets, and interact with GitLab.\n\n") +
+        pc.dim(`deploy components via Helm/Flux, encrypt secrets, and interact with ${providerLabel(wizard.gitProvider)}.\n\n`) +
         pc.bold("How to uninstall later:\n") +
         (isMacOS()
             ? `  ${pc.cyan(`brew uninstall ${uninstallMac}`)}\n`
-            : `  ${pc.cyan("sudo rm -f /usr/local/bin/{kubectl,helm,k9s,flux-operator,sops,age,age-keygen}")}\n` +
-                `  ${pc.cyan("sudo apt remove -y glab jq git")}  ${pc.dim("(if installed via apt)")}\n`) +
+            : `  ${pc.cyan("sudo rm -f /usr/local/bin/{kubectl,helm,flux-operator,sops,age,age-keygen}")}\n` +
+                `  ${pc.cyan(`sudo apt remove -y git`)}  ${pc.dim("(if installed via apt)")}\n`) +
         pc.dim("\nAlready-installed tools will be skipped. No system tools will be modified."), "Required CLI Tools");
     const confirmMsg = toBeInstalled.length > 0
         ? `Install ${toBeInstalled.length} missing tool(s) and continue?`
@@ -625,18 +1012,20 @@ export async function bootstrap() {
         }
     }
     else {
-        repoRoot = resolveRepoRoot();
+        repoRoot = resolve(wizard.repoLocalPath || ".");
     }
     // ── Build final config ───────────────────────────────────────────────
     const selectedComponents = wizard.selectedComponents;
     const isOpenclawEnabled = openclawEnabled(wizard);
     const fullConfig = {
+        gitProvider: wizard.gitProvider,
         clusterName: wizard.clusterName,
         clusterDomain: wizard.clusterDomain,
         clusterPublicIp: wizard.clusterPublicIp,
         letsencryptEmail: wizard.letsencryptEmail,
         ingressAllowedIps: wizard.ingressAllowedIps,
-        gitlabPat: wizard.gitlabPat,
+        gitToken: wizard.gitToken,
+        gitFluxToken: wizard.gitFluxToken || undefined,
         repoName: wizard.repoName,
         repoOwner: wizard.repoOwner,
         repoBranch: wizard.repoBranch,
@@ -677,7 +1066,8 @@ export async function bootstrap() {
             p.note(`${pc.dim("Since automatic DNS is disabled, add these to")} ${pc.bold("/etc/hosts")}${pc.dim(":")}\n\n` +
                 hostsEntries.map((e) => pc.cyan(e)).join("\n"), "Local DNS");
             const addHosts = await p.confirm({
-                message: pc.bold("Append these entries to /etc/hosts now?"),
+                message: pc.bold("Append these entries to /etc/hosts now?") +
+                    pc.dim("  (requires sudo — macOS will prompt for your password)"),
                 initialValue: false,
             });
             if (!p.isCancel(addHosts) && addHosts) {
@@ -708,8 +1098,22 @@ export async function bootstrap() {
     summary("Bootstrap Complete", summaryEntries);
     const finalSteps = [
         `All HelmReleases may take ${pc.yellow("~5 minutes")} to become ready.`,
-        `Check status: ${pc.cyan("kubectl get helmreleases -A")} or ${pc.cyan("k9s -A")}`,
+        `Check status: ${pc.cyan("kubectl get helmreleases -A")}`,
     ];
+    if (!commandExists("k9s")) {
+        finalSteps.push(`Install ${pc.bold("k9s")} for a terminal UI to monitor your cluster: ${isMacOS()
+            ? pc.cyan("brew install derailed/k9s/k9s")
+            : pc.cyan("https://k9scli.io/topics/install/")}`);
+    }
+    else {
+        finalSteps.push(`Monitor your cluster: ${pc.cyan("k9s -A")}`);
+    }
+    if (selectedComponents.includes("grafana-operator")) {
+        finalSteps.push(`Grafana dashboard: ${pc.cyan(`https://grafana.${fullConfig.clusterDomain}`)}`);
+    }
+    if (selectedComponents.includes("victoria-metrics-k8s-stack")) {
+        finalSteps.push(`Victoria Metrics: ${pc.cyan(`https://victoria.${fullConfig.clusterDomain}`)}`);
+    }
     if (isOpenclawEnabled) {
         finalSteps.push(`Open OpenClaw at ${pc.cyan(`https://openclaw.${fullConfig.clusterDomain}`)}`, `Pair a device: ${pc.cyan("npx fluxcd-ai-bootstraper openclaw-pair")}`);
     }