gitops-ai 1.0.0 → 1.2.0

package/dist/commands/bootstrap.js

@@ -1,17 +1,35 @@
 import { existsSync } from "node:fs";
+import { execSync } from "node:child_process";
+import { networkInterfaces } from "node:os";
 import { resolve } from "node:path";
 import * as p from "@clack/prompts";
 import pc from "picocolors";
 import { header, log, summary, nextSteps, finish, handleCancel, withSpinner, formatError, } from "../utils/log.js";
 import { saveInstallPlan, loadInstallPlan, clearInstallPlan } from "../utils/config.js";
-import { execAsync, exec, commandExists } from "../utils/shell.js";
+import { execAsync, exec, execSafe, commandExists } from "../utils/shell.js";
 import { isMacOS, isCI } from "../utils/platform.js";
 import { ensureAll } from "../core/dependencies.js";
 import { runBootstrap } from "../core/bootstrap-runner.js";
+import * as k8s from "../core/kubernetes.js";
 import * as flux from "../core/flux.js";
-import * as gitlab from "../core/gitlab.js";
-import { COMPONENTS, REQUIRED_COMPONENT_IDS, DNS_TLS_COMPONENT_IDS, OPTIONAL_COMPONENTS, SOURCE_GITLAB_HOST, SOURCE_PROJECT_PATH, } from "../schemas.js";
+import { getProvider, } from "../core/git-provider.js";
+import { COMPONENTS, REQUIRED_COMPONENT_IDS, DNS_TLS_COMPONENT_IDS, MONITORING_COMPONENT_IDS, OPTIONAL_COMPONENTS, SOURCE_GITLAB_HOST, SOURCE_PROJECT_PATH, } from "../schemas.js";
+import { fetchTemplateTags, readPackageVersion } from "../core/template-sync.js";
 import { stepWizard, back, maskSecret, } from "../utils/wizard.js";
+import { loginAndCreateCloudflareToken } from "../core/cloudflare-oauth.js";
+// ---------------------------------------------------------------------------
+// Browser opener
+// ---------------------------------------------------------------------------
+function openUrl(url) {
+    const cmd = isMacOS() ? "open" : "xdg-open";
+    try {
+        execSync(`${cmd} '${url}'`, { stdio: "ignore" });
+    }
+    catch {
+        /* user will see the manual URL in the terminal */
+    }
+}
+const OPENAI_API_KEYS_URL = "https://platform.openai.com/api-keys";
 function isNewRepo(state) {
     return state.setupMode === "new";
 }
@@ -24,6 +42,25 @@ function openclawEnabled(state) {
 function componentLabel(id) {
     return COMPONENTS.find((c) => c.id === id)?.label ?? id;
 }
+// fetchTemplateTags is imported from core/template-sync.ts
+function providerLabel(type) {
+    return type === "gitlab" ? "GitLab" : "GitHub";
+}
+async function enrichWithUser(state, token, provider) {
+    try {
+        const user = await provider.fetchCurrentUser(token, provider.defaultHost);
+        log.success(`Logged in as ${user.username}`);
+        return {
+            ...state,
+            gitToken: token,
+            repoOwner: state.repoOwner || user.username,
+        };
+    }
+    catch (err) {
+        log.warn(`Could not detect ${providerLabel(state.gitProvider)} user: ${err.message}`);
+        return { ...state, gitToken: token };
+    }
+}
 // ---------------------------------------------------------------------------
 // Wizard field definitions (Esc / Ctrl+C = go back one field)
 // ---------------------------------------------------------------------------
@@ -63,32 +100,140 @@ function buildFields(detectedIp, hasSavedPlan) {
                     : "Use existing repo",
             ],
         },
-        // ── GitLab Repository ───────────────────────────────────────────────
+        // ── Git Provider ────────────────────────────────────────────────────
         {
-            id: "gitlabPat",
-            section: "GitLab Repository",
-            skip: (state) => !!state.gitlabPat,
+            id: "gitProvider",
+            section: "Git Provider",
+            skip: (state) => saved(state, "gitProvider"),
             run: async (state) => {
+                const v = await p.select({
+                    message: pc.bold("Which Git provider do you want to use?"),
+                    options: [
+                        {
+                            value: "github",
+                            label: "GitHub",
+                            hint: "github.com or GitHub Enterprise",
+                        },
+                        {
+                            value: "gitlab",
+                            label: "GitLab",
+                            hint: "gitlab.com or self-hosted",
+                        },
+                    ],
+                    initialValue: state.gitProvider,
+                });
+                if (p.isCancel(v))
+                    return back();
+                return { ...state, gitProvider: v };
+            },
+            review: (state) => ["Provider", providerLabel(state.gitProvider)],
+        },
+        // ── Git Repository ──────────────────────────────────────────────────
+        {
+            id: "gitToken",
+            section: "Git Repository",
+            skip: (state) => !!state.gitToken,
+            run: async (state) => {
+                const provider = await getProvider(state.gitProvider);
+                if (isCI()) {
+                    const v = await p.password({
+                        message: pc.bold(provider.tokenLabel),
+                        validate: (v) => { if (!v)
+                            return "Required"; },
+                    });
+                    if (p.isCancel(v))
+                        return back();
+                    return { ...state, gitToken: v };
+                }
+                const method = await p.select({
+                    message: pc.bold(`How would you like to authenticate with ${providerLabel(state.gitProvider)}?`),
+                    options: [
+                        {
+                            value: "browser",
+                            label: "Login with browser",
+                            hint: `opens ${providerLabel(state.gitProvider)} in your browser — recommended`,
+                        },
+                        {
+                            value: "pat",
+                            label: "Paste a Personal Access Token",
+                            hint: "manual token entry",
+                        },
+                    ],
+                });
+                if (p.isCancel(method))
+                    return back();
+                if (method === "browser") {
+                    try {
+                        const token = await provider.loginWithBrowser(provider.defaultHost);
+                        log.success("Authenticated via browser");
+                        return await enrichWithUser(state, token, provider);
+                    }
+                    catch (err) {
+                        log.warn(`Browser login failed: ${err.message}`);
+                        log.warn("Falling back to manual token entry");
+                    }
+                }
                 const v = await p.password({
-                    message: pc.bold("GitLab Personal Access Token (api, read_repository, write_repository)"),
-                    validate: (v) => {
-                        if (!v)
-                            return "Required";
-                    },
+                    message: pc.bold(provider.tokenLabel),
+                    validate: (v) => { if (!v)
+                        return "Required"; },
                 });
                 if (p.isCancel(v))
                     return back();
-                return { ...state, gitlabPat: v };
+                return await enrichWithUser(state, v, provider);
             },
-            review: (state) => ["PAT", maskSecret(state.gitlabPat)],
+            review: (state) => ["Token", maskSecret(state.gitToken)],
         },
         {
             id: "repoOwner",
-            section: "GitLab Repository",
-            skip: (state) => saved(state, "repoOwner"),
+            section: "Git Repository",
+            skip: (state) => !!state.repoOwner,
             run: async (state) => {
+                const provider = await getProvider(state.gitProvider);
+                const label = providerLabel(state.gitProvider);
+                const orgLabel = state.gitProvider === "gitlab" ? "group" : "org";
+                try {
+                    const user = await provider.fetchCurrentUser(state.gitToken, provider.defaultHost);
+                    let orgs = [];
+                    try {
+                        orgs = await provider.fetchOrganizations(state.gitToken, provider.defaultHost);
+                    }
+                    catch {
+                        /* no orgs or insufficient permissions — continue with personal only */
+                    }
+                    const options = [
+                        {
+                            value: user.username,
+                            label: user.username,
+                            hint: `personal · ${user.name}`,
+                        },
+                        ...orgs.map((g) => ({
+                            value: g.fullPath,
+                            label: g.fullPath,
+                            hint: orgLabel,
+                        })),
+                        {
+                            value: "__manual__",
+                            label: "Enter manually…",
+                            hint: "type a namespace",
+                        },
+                    ];
+                    const v = await p.select({
+                        message: pc.bold(`${label} namespace for the repository`),
+                        options,
+                        initialValue: state.repoOwner || user.username,
+                    });
+                    if (p.isCancel(v))
+                        return back();
+                    if (v !== "__manual__") {
+                        return { ...state, repoOwner: v };
+                    }
+                }
+                catch {
+                    /* API unavailable — fall through to manual input */
+                }
                 const v = await p.text({
-                    message: pc.bold("GitLab repo owner / namespace (without @)"),
+                    message: pc.bold(`${label} repo owner / namespace`),
                     placeholder: "my-username-or-group",
                     initialValue: state.repoOwner || undefined,
                     validate: (v) => {
@@ -104,13 +249,54 @@ function buildFields(detectedIp, hasSavedPlan) {
         },
         {
             id: "repoName",
-            section: "GitLab Repository",
+            section: "Git Repository",
             skip: (state) => saved(state, "repoName"),
             run: async (state) => {
+                if (isNewRepo(state)) {
+                    const v = await p.text({
+                        message: pc.bold("New repository name"),
+                        placeholder: "fluxcd_ai",
+                        defaultValue: state.repoName,
+                    });
+                    if (p.isCancel(v))
+                        return back();
+                    return { ...state, repoName: v };
+                }
+                const provider = await getProvider(state.gitProvider);
+                try {
+                    const projects = await provider.fetchNamespaceProjects(state.gitToken, provider.defaultHost, state.repoOwner);
+                    if (projects.length > 0) {
+                        const options = [
+                            ...projects.map((proj) => ({
+                                value: proj.name,
+                                label: proj.name,
+                                hint: proj.description
+                                    ? proj.description.slice(0, 60)
+                                    : undefined,
+                            })),
+                            {
+                                value: "__manual__",
+                                label: "Enter manually…",
+                                hint: "type a repo name",
+                            },
+                        ];
+                        const v = await p.select({
+                            message: pc.bold("Select repository"),
+                            options,
+                            initialValue: state.repoName || undefined,
+                        });
+                        if (p.isCancel(v))
+                            return back();
+                        if (v !== "__manual__") {
+                            return { ...state, repoName: v };
+                        }
+                    }
+                }
+                catch {
+                    /* fall through to manual input */
+                }
                 const v = await p.text({
-                    message: isNewRepo(state)
-                        ? pc.bold("New repository name")
-                        : pc.bold("Flux GitLab repo name"),
+                    message: pc.bold("Flux repo name"),
                     placeholder: "fluxcd_ai",
                     defaultValue: state.repoName,
                 });
@@ -122,30 +308,48 @@ function buildFields(detectedIp, hasSavedPlan) {
         },
         {
             id: "repoLocalPath",
-            section: "GitLab Repository",
-            hidden: (state) => !isNewRepo(state),
+            section: "Git Repository",
             skip: (state) => saved(state, "repoLocalPath"),
             run: async (state) => {
+                if (isNewRepo(state)) {
+                    const v = await p.text({
+                        message: pc.bold("Local directory to clone into"),
+                        placeholder: `./${state.repoName}  (relative to current directory)`,
+                        defaultValue: state.repoLocalPath || state.repoName,
+                    });
+                    if (p.isCancel(v))
+                        return back();
+                    return { ...state, repoLocalPath: v };
+                }
                 const v = await p.text({
-                    message: pc.bold("Local directory to clone into"),
-                    placeholder: `./${state.repoName}  (relative to current directory)`,
-                    defaultValue: state.repoLocalPath || state.repoName,
+                    message: pc.bold("Path to your local repo checkout"),
+                    placeholder: `./${state.repoName}  (relative or absolute path)`,
+                    defaultValue: state.repoLocalPath || ".",
+                    validate: (val) => {
+                        const target = resolve(val || ".");
+                        if (!existsSync(target))
+                            return "Directory does not exist";
+                        const gitCheck = execSafe("git rev-parse --is-inside-work-tree", { cwd: target });
+                        if (gitCheck.exitCode !== 0)
+                            return "Not a git repository — run git init or clone first";
+                        return undefined;
+                    },
                 });
                 if (p.isCancel(v))
                     return back();
                 return { ...state, repoLocalPath: v };
             },
-            review: (state) => ["Local path", `./${state.repoLocalPath}`],
+            review: (state) => isNewRepo(state)
+                ? ["Local path", `./${state.repoLocalPath}`]
+                : ["Local repo path", resolve(state.repoLocalPath || ".")],
         },
         {
             id: "repoBranch",
-            section: "GitLab Repository",
+            section: "Git Repository",
             skip: (state) => saved(state, "repoBranch"),
             run: async (state) => {
                 const v = await p.text({
-                    message: isNewRepo(state)
-                        ? pc.bold("Template branch name to clone")
-                        : pc.bold("Git branch for Flux"),
+                    message: pc.bold("Git branch for Flux"),
                     placeholder: "main",
                     defaultValue: state.repoBranch,
                 });
@@ -155,6 +359,48 @@ function buildFields(detectedIp, hasSavedPlan) {
             },
             review: (state) => ["Branch", state.repoBranch],
         },
+        {
+            id: "templateTag",
+            section: "Git Repository",
+            hidden: (state) => !isNewRepo(state),
+            skip: (state) => saved(state, "templateTag"),
+            run: async (state) => {
+                const tags = await fetchTemplateTags();
+                if (tags.length > 0) {
+                    const options = [
+                        ...tags.map((tag, i) => ({
+                            value: tag,
+                            label: tag,
+                            hint: i === 0 ? "latest" : undefined,
+                        })),
+                        {
+                            value: "__manual__",
+                            label: "Enter manually…",
+                            hint: "type a tag or branch name",
+                        },
+                    ];
+                    const v = await p.select({
+                        message: pc.bold("Template version (tag) to clone"),
+                        options,
+                        initialValue: state.templateTag || tags[0],
+                    });
+                    if (p.isCancel(v))
+                        return back();
+                    if (v !== "__manual__") {
+                        return { ...state, templateTag: v };
+                    }
+                }
+                const v = await p.text({
+                    message: pc.bold("Template tag or branch to clone"),
+                    placeholder: "main",
+                    defaultValue: state.templateTag || "main",
+                });
+                if (p.isCancel(v))
+                    return back();
+                return { ...state, templateTag: v };
+            },
+            review: (state) => ["Template tag", state.templateTag],
+        },
         // ── DNS & TLS ─────────────────────────────────────────────────────────
         {
             id: "manageDnsAndTls",
@@ -183,25 +429,44 @@ function buildFields(detectedIp, hasSavedPlan) {
             section: "Components",
             skip: (state) => saved(state, "selectedComponents"),
             run: async (state) => {
+                const MONITORING_GROUP_ID = "__monitoring__";
+                const monitoringOption = {
+                    value: MONITORING_GROUP_ID,
+                    label: "Monitoring Stack",
+                    hint: "Victoria Metrics + Grafana Operator (dashboards, alerting, metrics)",
+                };
+                const hasMonitoring = MONITORING_COMPONENT_IDS.every((id) => state.selectedComponents.includes(id));
+                const monitoringExplicitlyRemoved = !hasMonitoring
+                    && state.selectedComponents.some((id) => !REQUIRED_COMPONENT_IDS.includes(id));
                 const selected = await p.multiselect({
                     message: pc.bold("Optional components to install"),
-                    options: OPTIONAL_COMPONENTS.map((c) => ({
-                        value: c.id,
-                        label: c.label,
-                        hint: c.hint,
-                    })),
-                    initialValues: state.selectedComponents.filter((id) => OPTIONAL_COMPONENTS.some((c) => c.id === id)),
+                    options: [
+                        monitoringOption,
+                        ...OPTIONAL_COMPONENTS.map((c) => ({
+                            value: c.id,
+                            label: c.label,
+                            hint: c.hint,
+                        })),
+                    ],
+                    initialValues: [
+                        ...((hasMonitoring || !monitoringExplicitlyRemoved) ? [MONITORING_GROUP_ID] : []),
+                        ...state.selectedComponents.filter((id) => OPTIONAL_COMPONENTS.some((c) => c.id === id)),
+                    ],
                     required: false,
                 });
                 if (p.isCancel(selected))
                     return back();
+                const picks = selected;
+                const monitoringIds = picks.includes(MONITORING_GROUP_ID) ? MONITORING_COMPONENT_IDS : [];
+                const otherIds = picks.filter((id) => id !== MONITORING_GROUP_ID);
                 const dnsTlsIds = state.manageDnsAndTls ? DNS_TLS_COMPONENT_IDS : [];
                 return {
                     ...state,
                     selectedComponents: [
                         ...REQUIRED_COMPONENT_IDS,
                         ...dnsTlsIds,
-                        ...selected,
+                        ...monitoringIds,
+                        ...otherIds,
                     ],
                 };
             },
@@ -274,12 +539,47 @@ function buildFields(detectedIp, hasSavedPlan) {
             hidden: (state) => !dnsAndTlsEnabled(state),
             skip: (state) => !!state.cloudflareApiToken,
             run: async (state) => {
+                if (isCI()) {
+                    const v = await p.password({
+                        message: pc.bold("Cloudflare API Token (DNS zone edit access)"),
+                        validate: (v) => { if (!v)
+                            return "Required"; },
+                    });
+                    if (p.isCancel(v))
+                        return back();
+                    return { ...state, cloudflareApiToken: v };
+                }
+                const method = await p.select({
+                    message: pc.bold("How would you like to authenticate with Cloudflare?"),
+                    options: [
+                        {
+                            value: "browser",
+                            label: "Login with browser",
+                            hint: "OAuth login → auto-creates a scoped DNS token — recommended",
+                        },
+                        {
+                            value: "pat",
+                            label: "Paste an API Token",
+                            hint: "manual token from dash.cloudflare.com",
+                        },
+                    ],
+                });
+                if (p.isCancel(method))
+                    return back();
+                if (method === "browser") {
+                    try {
+                        const token = await loginAndCreateCloudflareToken(state.clusterDomain);
+                        return { ...state, cloudflareApiToken: token };
+                    }
+                    catch (err) {
+                        log.warn(`Browser login failed: ${err.message}`);
+                        log.warn("Falling back to manual token entry");
+                    }
+                }
                 const v = await p.password({
                     message: pc.bold("Cloudflare API Token (DNS zone edit access)"),
-                    validate: (v) => {
-                        if (!v)
-                            return "Required";
-                    },
+                    validate: (v) => { if (!v)
+                        return "Required"; },
                 });
                 if (p.isCancel(v))
                     return back();
@@ -296,12 +596,51 @@ function buildFields(detectedIp, hasSavedPlan) {
             hidden: (state) => !openclawEnabled(state),
             skip: (state) => !!state.openaiApiKey,
             run: async (state) => {
+                if (isCI()) {
+                    const v = await p.password({
+                        message: pc.bold("OpenAI API Key"),
+                        validate: (v) => { if (!v)
+                            return "Required"; },
+                    });
+                    if (p.isCancel(v))
+                        return back();
+                    const openclawGatewayToken = state.openclawGatewayToken || exec("openssl rand -hex 32");
+                    return { ...state, openaiApiKey: v, openclawGatewayToken };
+                }
+                const method = await p.select({
+                    message: pc.bold("How would you like to provide your OpenAI API key?"),
+                    options: [
+                        {
+                            value: "browser",
+                            label: "Open dashboard in browser",
+                            hint: "opens platform.openai.com to create a key — recommended",
+                        },
+                        {
+                            value: "paste",
+                            label: "Paste an API Key",
+                            hint: "manual key entry",
+                        },
+                    ],
+                });
+                if (p.isCancel(method))
+                    return back();
+                if (method === "browser") {
+                    p.note(`${pc.bold("Create an API key with these steps:")}\n\n` +
+                        `  1. Log in to ${pc.cyan("platform.openai.com")}\n` +
+                        `  2. Click ${pc.cyan("+ Create new secret key")}\n` +
+                        `  3. Name it (e.g. ${pc.cyan("gitops-ai")})\n` +
+                        `  4. Copy the key value\n\n` +
+                        pc.dim("The key starts with sk-… and is only shown once."), "OpenAI API Key");
+                    await p.text({
+                        message: pc.dim("Press ") + pc.bold(pc.yellow("Enter")) + pc.dim(" to open browser…"),
+                        defaultValue: "",
+                    });
+                    openUrl(OPENAI_API_KEYS_URL);
+                }
                 const v = await p.password({
-                    message: pc.bold("OpenAI API Key (for AI components)"),
-                    validate: (v) => {
-                        if (!v)
-                            return "Required";
-                    },
+                    message: pc.bold("Paste the OpenAI API key"),
+                    validate: (v) => { if (!v)
+                        return "Required"; },
                 });
                 if (p.isCancel(v))
                     return back();
@@ -316,65 +655,162 @@ function buildFields(detectedIp, hasSavedPlan) {
         },
         // ── Network ──────────────────────────────────────────────────────────
         {
-            id: "ingressAllowedIps",
+            id: "networkAccessMode",
             section: "Network",
-            skip: (state) => saved(state, "ingressAllowedIps"),
+            skip: (state) => saved(state, "ingressAllowedIps") && saved(state, "clusterPublicIp"),
             run: async (state) => {
-                const v = await p.text({
-                    message: pc.bold("IPs allowed to access your cluster (CIDR, comma-separated)"),
-                    placeholder: "0.0.0.0/0",
-                    defaultValue: state.ingressAllowedIps,
+                const mode = await p.select({
+                    message: pc.bold("How will you access the cluster?"),
+                    options: [
+                        {
+                            value: "public",
+                            label: "Public",
+                            hint: "auto-detects your public IP",
+                        },
+                        {
+                            value: "local",
+                            label: "Local only (localhost / LAN)",
+                            hint: "uses 127.0.0.1 or a private IP",
+                        },
+                    ],
                 });
-                if (p.isCancel(v))
+                if (p.isCancel(mode))
                     return back();
-                return { ...state, ingressAllowedIps: v };
-            },
-            review: (state) => ["Allowed IPs", state.ingressAllowedIps],
-        },
-        {
-            id: "clusterPublicIp",
-            section: "Network",
-            skip: (state) => saved(state, "clusterPublicIp"),
-            run: async (state) => {
-                const useLocal = !dnsAndTlsEnabled(state);
-                const fallback = useLocal ? "127.0.0.1" : detectedIp;
-                const defaultIp = state.clusterPublicIp || fallback;
-                const v = await p.text({
-                    message: useLocal
-                        ? pc.bold("Cluster IP") + pc.dim("  (local because DNS management is disabled. Rewrite if it necessary)")
-                        : pc.bold("Public IP of your cluster"),
-                    defaultValue: defaultIp,
-                    placeholder: fallback || "x.x.x.x",
-                    validate: (v) => {
-                        if (!v && !defaultIp)
-                            return "Required";
-                    },
+                const m = mode;
+                async function resolvePublicIp() {
+                    if (detectedIp)
+                        return detectedIp;
+                    const services = ["ifconfig.me", "api.ipify.org", "icanhazip.com"];
+                    await withSpinner("Detecting public IP", async () => {
+                        for (const svc of services) {
+                            try {
+                                const ip = (await execAsync(`curl -s --max-time 4 ${svc}`)).trim();
+                                if (/^\d{1,3}(\.\d{1,3}){3}$/.test(ip)) {
+                                    detectedIp = ip;
+                                    return;
+                                }
+                            }
+                            catch { /* try next */ }
+                        }
+                    });
+                    return detectedIp;
+                }
+                if (m === "public") {
+                    const publicIp = await resolvePublicIp();
+                    const confirmIp = await p.text({
+                        message: pc.bold("Public IP of your cluster"),
+                        ...(publicIp
+                            ? { initialValue: publicIp }
+                            : { placeholder: "x.x.x.x" }),
+                        validate: (v) => { if (!v)
+                            return "Required"; },
+                    });
+                    if (p.isCancel(confirmIp))
+                        return back();
+                    const restriction = await p.select({
+                        message: pc.bold("Restrict ingress access?"),
+                        options: [
+                            {
+                                value: "open",
+                                label: "Open to everyone (0.0.0.0/0)",
+                                hint: "any IP can reach the cluster",
+                            },
+                            {
+                                value: "restrict",
+                                label: "Restrict to specific IPs",
+                                hint: "only listed CIDRs can reach the cluster",
+                            },
+                        ],
+                    });
+                    if (p.isCancel(restriction))
+                        return back();
+                    if (restriction === "open") {
+                        return { ...state, clusterPublicIp: confirmIp, ingressAllowedIps: "0.0.0.0/0" };
+                    }
+                    const allowedCidrs = await p.text({
+                        message: pc.bold("Allowed CIDRs (comma-separated)"),
+                        placeholder: "203.0.113.0/24,198.51.100.5/32",
+                        validate: (v) => { if (!v)
+                            return "At least one CIDR is required"; },
+                    });
+                    if (p.isCancel(allowedCidrs))
+                        return back();
+                    return { ...state, clusterPublicIp: confirmIp, ingressAllowedIps: allowedCidrs };
+                }
+                // local — detect LAN IPs from network interfaces
+                const lanIps = [];
+                const ifaces = networkInterfaces();
+                for (const [name, addrs] of Object.entries(ifaces)) {
+                    for (const addr of addrs ?? []) {
+                        if (addr.family === "IPv4" && !addr.internal) {
+                            lanIps.push({ ip: addr.address, iface: name });
+                        }
+                    }
+                }
+                let localIp;
+                if (lanIps.length > 0) {
+                    localIp = await p.select({
+                        message: pc.bold("Cluster IP"),
+                        options: [
+                            ...lanIps.map((l) => ({
+                                value: l.ip,
+                                label: l.ip,
+                                hint: l.iface,
+                            })),
+                            { value: "127.0.0.1", label: "127.0.0.1", hint: "localhost" },
+                            { value: "__custom__", label: "Enter manually" },
+                        ],
+                    });
+                    if (p.isCancel(localIp))
+                        return back();
+                    if (localIp === "__custom__") {
+                        localIp = await p.text({
+                            message: pc.bold("Cluster IP"),
+                            placeholder: "192.168.x.x",
+                            validate: (v) => { if (!v)
+                                return "Required"; },
+                        });
+                        if (p.isCancel(localIp))
+                            return back();
+                    }
+                }
+                else {
+                    localIp = await p.text({
+                        message: pc.bold("Cluster IP") + pc.dim("  (127.0.0.1 for localhost, or your LAN IP)"),
+                        defaultValue: "127.0.0.1",
+                    });
+                }
+                if (p.isCancel(localIp))
+                    return back();
+                const allowedIps = await p.text({
+                    message: pc.bold("IPs allowed to access the cluster (CIDR)"),
+                    defaultValue: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16",
+                    placeholder: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16",
                 });
-                if (p.isCancel(v))
+                if (p.isCancel(allowedIps))
                     return back();
-                return { ...state, clusterPublicIp: v };
+                return { ...state, clusterPublicIp: localIp, ingressAllowedIps: allowedIps };
             },
-            review: (state) => ["Public IP", state.clusterPublicIp],
+            review: (state) => ["Network", `${state.clusterPublicIp}  allowed: ${state.ingressAllowedIps}`],
         },
     ];
 }
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
-function resolveRepoRoot() {
-    const scriptDir = new URL(".", import.meta.url).pathname;
-    return resolve(scriptDir, "../../../");
-}
 // ---------------------------------------------------------------------------
 // Repo creation phase (only for "new" mode)
 // ---------------------------------------------------------------------------
 async function createAndCloneRepo(wizard) {
-    log.step("Authenticating with GitLab");
-    await gitlab.authenticate(wizard.gitlabPat, SOURCE_GITLAB_HOST);
+    const provider = await getProvider(wizard.gitProvider);
+    const label = providerLabel(wizard.gitProvider);
+    const host = provider.defaultHost;
+    log.step(`Authenticating with ${label}`);
+    await provider.authenticate(wizard.gitToken, host);
     log.step(`Resolving namespace '${wizard.repoOwner}'`);
-    const namespaceId = await gitlab.resolveNamespaceId(wizard.repoOwner, SOURCE_GITLAB_HOST);
+    const namespaceId = await provider.resolveNamespaceId(wizard.repoOwner, host, wizard.gitToken);
     log.step(`Creating project ${wizard.repoOwner}/${wizard.repoName}`);
-    const existing = await gitlab.getProject(wizard.repoOwner, wizard.repoName, SOURCE_GITLAB_HOST);
+    const existing = await provider.getProject(wizard.repoOwner, wizard.repoName, host, wizard.gitToken);
     let httpUrl;
     let pathWithNs;
     let repoExisted = false;
@@ -394,7 +830,7 @@ async function createAndCloneRepo(wizard) {
         log.success(`Using existing: ${pathWithNs}`);
     }
     else {
-        const created = await withSpinner("Creating GitLab project", () => gitlab.createProject(wizard.repoName, namespaceId, SOURCE_GITLAB_HOST));
+        const created = await withSpinner(`Creating ${label} project`, () => provider.createProject(wizard.repoName, namespaceId, host, wizard.gitToken));
         httpUrl = created.httpUrl;
         pathWithNs = created.pathWithNamespace;
         log.success(`Created: ${pathWithNs}`);
@@ -418,10 +854,22 @@ async function createAndCloneRepo(wizard) {
         }
     }
     else {
-        await withSpinner("Cloning template repository", () => execAsync(`git clone --quiet --branch "${wizard.repoBranch}" "https://${SOURCE_GITLAB_HOST}/${SOURCE_PROJECT_PATH}.git" "${cloneDir}"`));
+        const cloneRef = wizard.templateTag || "main";
+        let clonedRef = cloneRef;
+        try {
+            await withSpinner(`Cloning template (${cloneRef})`, () => execAsync(`git clone --quiet --branch "${cloneRef}" "https://${SOURCE_GITLAB_HOST}/${SOURCE_PROJECT_PATH}.git" "${cloneDir}"`));
+        }
+        catch {
+            log.warn(`Tag/branch '${cloneRef}' not found — falling back to 'main'`);
+            clonedRef = "main";
+            await withSpinner("Cloning template (main)", () => execAsync(`git clone --quiet --branch "main" "https://${SOURCE_GITLAB_HOST}/${SOURCE_PROJECT_PATH}.git" "${cloneDir}"`));
+        }
+        if (clonedRef !== wizard.repoBranch) {
+            exec(`git checkout -B "${wizard.repoBranch}"`, { cwd: cloneDir });
+        }
         exec(`git remote set-url origin "${httpUrl}"`, { cwd: cloneDir });
     }
-    const authRemote = `https://oauth2:${wizard.gitlabPat}@${SOURCE_GITLAB_HOST}/${pathWithNs}.git`;
+    const authRemote = provider.getAuthRemoteUrl(host, pathWithNs, wizard.gitToken);
     await withSpinner(`Pushing to ${pathWithNs}`, () => {
         const forceFlag = repoExisted ? " --force" : "";
         return execAsync(`git push -u "${authRemote}" "${wizard.repoBranch}"${forceFlag} --quiet`, { cwd: cloneDir });
@@ -481,10 +929,26 @@ export async function bootstrap() {
         }
     });
     console.log();
-    p.box(`💅 Secure, isolated and flexible GitOps infrastructure for modern requirements\n` +
-        `🤖 You can manage it yourself — or delegate to AI.\n` +
-        `🔐 Encrypted secrets, hardened containers, continuous delivery.`, pc.bold("Welcome to GitOps AI Bootstrapper"), {
-        contentAlign: "center",
+    const version = readPackageVersion();
+    const logo = [
+        "  ▄█████▄ ",
+        "  ██ ◆ ██ ",
+        "  ██   ██ ",
+        "  ▀██ ██▀ ",
+        "    ▀█▀   ",
+    ];
+    const taglines = [
+        "💅 Secure, isolated & flexible GitOps infrastructure",
+        "🤖 Manage it yourself — or delegate to AI",
+        "🔐 Encrypted secrets, hardened containers,",
+        "   continuous delivery",
+        pc.dim(`v${version}`),
+    ];
+    const banner = logo
+        .map((l, i) => pc.cyan(l) + "  " + (taglines[i] ?? ""))
+        .join("\n");
+    p.box(banner, pc.bold("Welcome to GitOps AI Bootstrapper"), {
+        contentAlign: "left",
         titleAlign: "center",
         rounded: true,
         formatBorder: (text) => pc.cyan(text),
@@ -495,14 +959,46 @@ export async function bootstrap() {
         log.warn("Loading saved inputs from previous run");
     }
     const prev = (saved ?? {});
-    // ── Detect public IP (silent) ────────────────────────────────────────
-    let detectedIp = prev.clusterPublicIp ?? "";
-    if (!detectedIp) {
-        try {
-            detectedIp = await execAsync("curl -s --max-time 5 ifconfig.me");
+    // Backward compat: migrate gitlabPat → gitToken
+    if (prev.gitlabPat && !prev.gitToken) {
+        prev.gitToken = prev.gitlabPat;
+    }
+    // ── Check for existing cluster ──────────────────────────────────────
+    const existing = k8s.detectExistingClusters();
+    if (existing) {
+        const clusterList = existing.names
+            .map((n) => `  ${pc.cyan(n)}`)
+            .join("\n");
+        const deleteHint = existing.type === "k3d"
+            ? `  ${pc.cyan(`k3d cluster delete ${existing.names[0]}`)}`
+            : `  ${pc.cyan("sudo /usr/local/bin/k3s-uninstall.sh")}`;
+        p.log.warn(pc.yellow(`Existing ${existing.type} cluster(s) detected:`));
+        p.note(`${pc.bold("Clusters found:")}\n${clusterList}\n\n` +
+            `Re-bootstrapping may overwrite existing resources.\n` +
+            `To start fresh, delete the cluster first:\n` +
+            deleteHint + `\n\n` +
+            pc.dim("Choose Continue to proceed anyway."), "Cluster Already Exists");
+        const shouldContinue = await p.confirm({
+            message: pc.bold("Continue with the existing cluster?"),
+            initialValue: false,
+        });
+        if (p.isCancel(shouldContinue) || !shouldContinue) {
+            finish("Bootstrap cancelled — existing cluster left untouched");
+            return;
         }
-        catch {
-            detectedIp = "";
+    }
+    // ── Detect public IP (silent, try multiple services) ─────────────────
+    let detectedIp = "";
+    if (!prev.clusterPublicIp) {
+        for (const svc of ["ifconfig.me", "api.ipify.org", "icanhazip.com"]) {
+            try {
+                const ip = (await execAsync(`curl -s --max-time 4 ${svc}`)).trim();
+                if (/^\d{1,3}(\.\d{1,3}){3}$/.test(ip)) {
+                    detectedIp = ip;
+                    break;
+                }
+            }
+            catch { /* try next */ }
         }
     }
     // ── Run interactive wizard ───────────────────────────────────────────
@@ -514,9 +1010,11 @@ export async function bootstrap() {
         : [
             ...REQUIRED_COMPONENT_IDS,
             ...(savedDnsTls ? DNS_TLS_COMPONENT_IDS : []),
+            ...MONITORING_COMPONENT_IDS,
             ...OPTIONAL_COMPONENTS.map((c) => c.id),
         ];
     const initialState = {
+        gitProvider: prev.gitProvider ?? "github",
         setupMode: prev.setupMode ?? "new",
         manageDnsAndTls: savedDnsTls,
         selectedComponents: savedComponents,
@@ -526,8 +1024,10 @@ export async function bootstrap() {
         repoLocalPath: prev.repoLocalPath ?? "",
         repoOwner: prev.repoOwner ?? "",
         repoBranch: prev.repoBranch ?? "main",
+        templateTag: prev.templateTag ?? "",
         letsencryptEmail: prev.letsencryptEmail ?? "",
-        gitlabPat: prev.gitlabPat ?? "",
+        gitToken: prev.gitToken ?? "",
+        gitFluxToken: prev.gitFluxToken ?? "",
         cloudflareApiToken: prev.cloudflareApiToken ?? "",
         openaiApiKey: prev.openaiApiKey ?? "",
         openclawGatewayToken: prev.openclawGatewayToken ?? "",
@@ -537,6 +1037,7 @@ export async function bootstrap() {
     const wizard = await stepWizard(buildFields(detectedIp, !!saved), initialState);
     // ── Save config ─────────────────────────────────────────────────────
     saveInstallPlan({
+        gitProvider: wizard.gitProvider,
         setupMode: wizard.setupMode,
         manageDnsAndTls: String(wizard.manageDnsAndTls),
         clusterName: wizard.clusterName,
@@ -544,11 +1045,13 @@ export async function bootstrap() {
         clusterPublicIp: wizard.clusterPublicIp,
         letsencryptEmail: wizard.letsencryptEmail,
         ingressAllowedIps: wizard.ingressAllowedIps,
-        gitlabPat: wizard.gitlabPat,
+        gitToken: wizard.gitToken,
+        gitFluxToken: wizard.gitFluxToken,
         repoName: wizard.repoName,
         repoLocalPath: wizard.repoLocalPath,
         repoOwner: wizard.repoOwner,
         repoBranch: wizard.repoBranch,
+        templateTag: wizard.templateTag,
         cloudflareApiToken: wizard.cloudflareApiToken,
         openaiApiKey: wizard.openaiApiKey ?? "",
         openclawGatewayToken: wizard.openclawGatewayToken ?? "",
@@ -558,11 +1061,8 @@ export async function bootstrap() {
     // ── Warn about CLI tools that will be installed ─────────────────────
     const toolDescriptions = [
         ["git", "Version control (repo operations)"],
-        ["jq", "JSON processor (API responses)"],
-        ["glab", "GitLab CLI (repo & auth management)"],
         ["kubectl", "Kubernetes CLI (cluster management)"],
         ["helm", "Kubernetes package manager (chart installs)"],
-        ["k9s", "Terminal UI for Kubernetes (monitoring)"],
         ["flux-operator", "FluxCD Operator CLI (GitOps reconciliation)"],
         ["sops", "Mozilla SOPS (secret encryption)"],
         ["age", "Age encryption (SOPS key backend)"],
@@ -589,12 +1089,12 @@ export async function bootstrap() {
         pc.dim("─".repeat(60)) + "\n\n" +
         pc.bold("Why are these needed?\n") +
         pc.dim("These tools are used to create and manage your Kubernetes cluster,\n") +
-        pc.dim("deploy components via Helm/Flux, encrypt secrets, and interact with GitLab.\n\n") +
+        pc.dim(`deploy components via Helm/Flux, encrypt secrets, and interact with ${providerLabel(wizard.gitProvider)}.\n\n`) +
         pc.bold("How to uninstall later:\n") +
         (isMacOS()
             ? `  ${pc.cyan(`brew uninstall ${uninstallMac}`)}\n`
-            : `  ${pc.cyan("sudo rm -f /usr/local/bin/{kubectl,helm,k9s,flux-operator,sops,age,age-keygen}")}\n` +
-                `  ${pc.cyan("sudo apt remove -y glab jq git")}  ${pc.dim("(if installed via apt)")}\n`) +
+            : `  ${pc.cyan("sudo rm -f /usr/local/bin/{kubectl,helm,flux-operator,sops,age,age-keygen}")}\n` +
+                `  ${pc.cyan(`sudo apt remove -y git`)}  ${pc.dim("(if installed via apt)")}\n`) +
         pc.dim("\nAlready-installed tools will be skipped. No system tools will be modified."), "Required CLI Tools");
     const confirmMsg = toBeInstalled.length > 0
         ? `Install ${toBeInstalled.length} missing tool(s) and continue?`
@@ -625,18 +1125,20 @@ export async function bootstrap() {
         }
     }
     else {
-        repoRoot = resolveRepoRoot();
+        repoRoot = resolve(wizard.repoLocalPath || ".");
     }
     // ── Build final config ───────────────────────────────────────────────
     const selectedComponents = wizard.selectedComponents;
     const isOpenclawEnabled = openclawEnabled(wizard);
     const fullConfig = {
+        gitProvider: wizard.gitProvider,
         clusterName: wizard.clusterName,
         clusterDomain: wizard.clusterDomain,
         clusterPublicIp: wizard.clusterPublicIp,
         letsencryptEmail: wizard.letsencryptEmail,
         ingressAllowedIps: wizard.ingressAllowedIps,
-        gitlabPat: wizard.gitlabPat,
+        gitToken: wizard.gitToken,
+        gitFluxToken: wizard.gitFluxToken || undefined,
         repoName: wizard.repoName,
         repoOwner: wizard.repoOwner,
         repoBranch: wizard.repoBranch,
@@ -646,6 +1148,8 @@ export async function bootstrap() {
             ? wizard.openclawGatewayToken
             : undefined,
         selectedComponents,
+        templateRef: wizard.templateTag?.trim() ||
+            (isNewRepo(wizard) ? "main" : undefined),
     };
     // ── Check macOS prerequisites ────────────────────────────────────────
     if (isMacOS()) {
@@ -666,19 +1170,25 @@ export async function bootstrap() {
         log.error(`Bootstrap failed\n${formatError(err)}`);
         return process.exit(1);
     }
-    // ── /etc/hosts suggestion (no DNS management) ───────────────────────
-    if (!wizard.manageDnsAndTls) {
+    // ── /etc/hosts suggestion (local IP or no DNS management) ───────────
+    const isLocalIp = /^(127\.|10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.)/.test(fullConfig.clusterPublicIp)
+        || fullConfig.clusterPublicIp === "localhost";
+    if (isLocalIp || !wizard.manageDnsAndTls) {
         const hostsEntries = selectedComponents
             .map((id) => COMPONENTS.find((c) => c.id === id))
             .filter((c) => !!c?.subdomain)
             .map((c) => `${fullConfig.clusterPublicIp}  ${c.subdomain}.${fullConfig.clusterDomain}`);
         if (hostsEntries.length > 0) {
             const hostsBlock = hostsEntries.join("\n");
-            p.note(`${pc.dim("Since automatic DNS is disabled, add these to")} ${pc.bold("/etc/hosts")}${pc.dim(":")}\n\n` +
+            const reason = isLocalIp
+                ? "Your cluster uses a local/private IP, so DNS won't resolve publicly."
+                : "Automatic DNS is disabled.";
+            p.note(`${pc.dim(reason + " Add these to")} ${pc.bold("/etc/hosts")}${pc.dim(":")}\n\n` +
                 hostsEntries.map((e) => pc.cyan(e)).join("\n"), "Local DNS");
             const addHosts = await p.confirm({
-                message: pc.bold("Append these entries to /etc/hosts now?"),
-                initialValue: false,
+                message: pc.bold("Append these entries to /etc/hosts now?") +
+                    pc.dim("  (requires sudo — macOS will prompt for your password)"),
+                initialValue: true,
             });
             if (!p.isCancel(addHosts) && addHosts) {
                 try {
@@ -708,8 +1218,22 @@ export async function bootstrap() {
     summary("Bootstrap Complete", summaryEntries);
     const finalSteps = [
         `All HelmReleases may take ${pc.yellow("~5 minutes")} to become ready.`,
-        `Check status: ${pc.cyan("kubectl get helmreleases -A")} or ${pc.cyan("k9s -A")}`,
+        `Check status: ${pc.cyan("kubectl get helmreleases -A")}`,
     ];
+    if (!commandExists("k9s")) {
+        finalSteps.push(`Install ${pc.bold("k9s")} for a terminal UI to monitor your cluster: ${isMacOS()
+            ? pc.cyan("brew install derailed/k9s/k9s")
+            : pc.cyan("https://k9scli.io/topics/install/")}`);
+    }
+    else {
+        finalSteps.push(`Monitor your cluster: ${pc.cyan("k9s -A")}`);
+    }
+    if (selectedComponents.includes("grafana-operator")) {
+        finalSteps.push(`Grafana dashboard: ${pc.cyan(`https://grafana.${fullConfig.clusterDomain}`)}`);
+    }
+    if (selectedComponents.includes("victoria-metrics-k8s-stack")) {
+        finalSteps.push(`Victoria Metrics: ${pc.cyan(`https://victoria.${fullConfig.clusterDomain}`)}`);
+    }
     if (isOpenclawEnabled) {
         finalSteps.push(`Open OpenClaw at ${pc.cyan(`https://openclaw.${fullConfig.clusterDomain}`)}`, `Pair a device: ${pc.cyan("npx fluxcd-ai-bootstraper openclaw-pair")}`);
     }