okengine 0.11.2 → 0.12.0

package/src/cli/dev.ts

@@ -9,7 +9,9 @@ import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import type { SessionStore } from "../auth/sessions.ts";
 import type { ConsoleAppHandle } from "../console/server/app.ts";
+import { RUNS_INGEST_PATH } from "../console/server/runs-ingest.ts";
 import type { ConsoleState } from "../console/server/state.ts";
+import { RUNS_INGEST_SECRET_ENV, RUNS_INGEST_URL_ENV } from "../runs/bridge-to-console.ts";
 import {
   DEFAULT_DOCKER_DIR,
   deriveInfrastructure,
@@ -31,6 +33,7 @@ import {
   devStatusFromAiPhase,
   formatAppReadyLine,
   formatBootWarn,
+  formatClaimNote,
   formatCliChrome,
   formatDevBanner,
   formatDevHeroDetails,
@@ -62,6 +65,12 @@ import {
 import { loadManifest, loadOkeConfig, resolveImages } from "./load-config.ts";
 import { mcpContextFromConsole } from "./mcp-from-console.ts";
 import { resolveDevPorts } from "./ports.ts";
+import {
+  shouldAttachConsoleVite,
+  startConsoleVite,
+  type ConsoleViteHandle,
+  type StartConsoleViteOptions,
+} from "./dev-console-vite.ts";
 import { clearDevSessionLock, writeDevSessionLock } from "./dev-session-lock.ts";
 
 /** Max wait for the `bun --hot` app child to bind a port. */
@@ -200,7 +209,7 @@ export interface DevOptions {
   readonly secret?: string;
   /** Seed Manifest into Console (and therefore MCP). */
   readonly manifest?: Manifest | null;
-  /** Suppress claim-code print (tests). */
+  /** Suppress kernel stdout claim print (default true — the live board owns it). */
   readonly silentClaim?: boolean;
   /** Port overrides (use `0` for ephemeral in tests). */
   readonly appPort?: number;
@@ -261,6 +270,17 @@ export interface DevOptions {
   readonly regenClient?: (appUrl: string) => Promise<void>;
   /** Serve Console (injectable). */
   readonly serveConsole?: (port: number) => Promise<DevConsoleHandle>;
+  /**
+   * Force (`true`) or skip (`false`) Console Vite HMR. Default: attach
+   * on an okengine source checkout so `dev:keel` does not need `bun run build`.
+   */
+  readonly consoleVite?: boolean;
+  /**
+   * Injectable Console Vite sidecar (tests). Default: {@link startConsoleVite}.
+   *
+   * @param options - Kernel port + listen preference
+   */
+  readonly startConsoleVite?: (options: StartConsoleViteOptions) => Promise<ConsoleViteHandle>;
   /**
    * Serve MCP against the live Console context (injectable).
    * Default: {@link serveMcp} on :6535.
@@ -329,10 +349,17 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     options.composeHealthRun ??
     (options.composeHealth ? async (): Promise<string> => "[]" : undefined);
   const previousWarn = console.warn;
+  const bootNotices: string[] = [];
+  const noticeSeen = new Set<string>();
+  let chromeReady = false;
   console.warn = (...args: unknown[]) => {
     const msg = args.map(String).join(" ");
     if (/^oke boot:/i.test(msg.trim())) {
-      write(formatBootWarn(msg.trim()));
+      const key = msg.trim().replace(/\s+/g, " ");
+      if (noticeSeen.has(key)) return;
+      noticeSeen.add(key);
+      if (chromeReady) write(formatBootWarn(msg.trim()));
+      else bootNotices.push(msg.trim());
       return;
     }
     previousWarn.apply(console, args as Parameters<typeof console.warn>);
@@ -839,6 +866,9 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     }
   };
 
+  let consoleState: ConsoleState | null = null;
+  let claimConsoleUrl: string | undefined;
+
   const paintBootBoard = (aiStatus: DevStatus | undefined) => {
     const aiSt = aiStatus ?? heroAiStatus;
     const elements = heroSnapshot.elements.map((row) => {
@@ -890,9 +920,13 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
           appDrivers: pendingStackSummary.appDrivers,
         })
       : "";
-    // Breath between elements and Docker — they read as two panes, not one block.
-    const gap = elementsBlock && stackBlock ? "\n" : "";
-    return `${elementsBlock}${gap}${stackBlock}`;
+    const claim =
+      consoleState && !consoleState.setupClosed
+        ? formatClaimNote(consoleState.claim.code, termColorEnabled(), {
+            ...(claimConsoleUrl !== undefined ? { consoleUrl: claimConsoleUrl } : {}),
+          })
+        : "";
+    return `${elementsBlock}${stackBlock}${claim}`;
   };
 
   // Drop ephemeral progress — final elements + Docker board replaces it.
@@ -950,25 +984,6 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     await Promise.race([firstAiPaint, Bun.sleep(2_500)]);
   }
 
-  // Live ● for the whole session — catch Docker Desktop stops / crashes.
-  // Updates the board only (no redis stopped / starting / ready log spam).
-  if (dockerStarted && composeFiles) {
-    const { startComposeHealthWatch } = await import("../docker/compose-health.ts");
-    const started = dockerStarted;
-    stopComposeHealthWatch = startComposeHealthWatch({
-      files: started.files,
-      cwd: started.cwd,
-      env: started.env,
-      run: composeHealthRun,
-      intervalMs: 2_000,
-      onChange: (map) => {
-        liveComposeHealth = map;
-        if (map.get("ai") === "error") heroAiStatus = "error";
-        repaintBoard();
-      },
-    });
-  }
-
   /** Snapshot keys we mutate so `stop()` can leave the parent shell clean. */
   const processEnvSnapshot = new Map<string, string | undefined>();
   const setProcessEnv = (key: string, value: string): void => {
@@ -1000,9 +1015,11 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     const { syncDevSchema } = await import("./dev-schema-sync.ts");
     const configEnv = "dev" as const;
     try {
+      const injectedPush = options.dbPush;
       const result = await syncDevSchema(cwd, configEnv, {
         write: chromeWrite,
         quietComposeReady: true,
+        ...(injectedPush ? { pushFn: async (projectCwd: string) => injectedPush(projectCwd) } : {}),
       });
       write(
         formatStatusLine(
@@ -1071,6 +1088,33 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     }
   }
 
+  /** Host → Console WideEvent ingest secret (live Traces bridge). */
+  const runsIngestSecret = crypto.randomUUID();
+
+  let consoleVite: ConsoleViteHandle | null = null;
+  // Dry-run already returned above — Vite is a live sidecar, never planned.
+  const wantConsoleVite =
+    options.consoleVite === true ||
+    (options.consoleVite !== false &&
+      options.serveConsole === undefined &&
+      shouldAttachConsoleVite());
+  if (wantConsoleVite) {
+    const startVite = options.startConsoleVite ?? startConsoleVite;
+    try {
+      consoleVite = await startVite({
+        consolePort,
+        occupied: new Set([appPort, consolePort, mcpPort, docsMcpPort].filter((p) => p !== 0)),
+      });
+      write(formatStatusLine("Console UI hot reload"));
+    } catch (err) {
+      write(
+        formatStatusLine(
+          `Console UI hot reload skipped — ${err instanceof Error ? err.message : String(err)}`,
+        ),
+      );
+    }
+  }
+
   const serveConsole =
     options.serveConsole ??
     (async (port) => {
@@ -1080,9 +1124,13 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
         hostname: "127.0.0.1",
         cwd,
         env: "dev",
-        silentClaim: options.silentClaim ?? false,
+        okeConfig: loadedConfig,
+        // CLI paints the claim on the live board — do not dump it to raw stdout.
+        silentClaim: options.silentClaim ?? true,
+        runsIngestSecret,
         ...(options.secret !== undefined ? { secret: options.secret } : {}),
         ...(seedManifest !== undefined && seedManifest !== null ? { manifest: seedManifest } : {}),
+        ...(consoleVite ? { spaProxy: { origin: consoleVite.origin } } : {}),
       });
       write(formatServiceLine("Console", `http://127.0.0.1:${server.port}`));
       return {
@@ -1153,19 +1201,54 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
       }
     });
 
-  const app = await startApp(plan.entry, env);
-  const boundAppPort = app.port ?? appPort;
+  // Console before host so ingest URL/secret are real when the child boots.
   const consoleServer = await serveConsole(consolePort);
   const boundConsolePort = consoleServer.port ?? consolePort;
+  consoleState = consoleServer.console?.state ?? null;
+  claimConsoleUrl = `http://127.0.0.1:${boundConsolePort}`;
+  if (consoleState && !consoleState.setupClosed && process.stdout.isTTY !== true) {
+    repaintBoard();
+  }
+  env.OKE_DEV_HERO_CONSOLE = `http://127.0.0.1:${boundConsolePort}`;
+  const ingestSecret = consoleServer.console?.state.runsIngestSecret;
+  if (ingestSecret) {
+    env[RUNS_INGEST_URL_ENV] = `http://127.0.0.1:${boundConsolePort}${RUNS_INGEST_PATH}`;
+    env[RUNS_INGEST_SECRET_ENV] = ingestSecret;
+  }
+
+  const app = await startApp(plan.entry, env);
+  const boundAppPort = app.port ?? appPort;
 
   let mcpServer: DevMcpHandle | null = null;
-  let consoleState: ConsoleState | null = null;
   let secret: string | null = null;
   let sessions: SessionStore | null = null;
+  let attachedHost: { readonly stop: () => Promise<void> } | null = null;
 
   if (consoleServer.console) {
     const state = consoleServer.console.state;
     consoleState = state;
+    try {
+      const { attachHostToConsole } = await import("./attach-host-console.ts");
+      attachedHost = await attachHostToConsole({
+        entry: plan.entry,
+        cwd,
+        state,
+        ...(ingestSecret
+          ? {
+              runsBridge: {
+                url: `http://127.0.0.1:${boundConsolePort}${RUNS_INGEST_PATH}`,
+                secret: ingestSecret,
+              },
+            }
+          : {}),
+      });
+    } catch (err) {
+      write(
+        formatStatusLine(
+          `host attach skipped — ${err instanceof Error ? err.message : String(err)}`,
+        ),
+      );
+    }
     secret = state.secret;
     sessions = state.sessions;
     mcpServer = await serveMcpSurface({
@@ -1220,13 +1303,57 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     }
   });
 
-  // Initial sync so local DB matches schema.ts without a prior manual push.
-  if (autoPushEnabled) {
-    lastSchemaFilename = "src/schema.ts";
-    autoPushRunner.trigger();
-  }
+  const paintReadyChrome = (): void => {
+    const tty = process.stdout.isTTY === true;
+    if (tty) {
+      write(clearTerminalScreen());
+      bootBoard.reset();
+      write(
+        formatDevBanner({
+          profile: earlyProfile,
+          runtimeEnv: resolveDevRuntimeEnv(earlyProfile),
+          system: formatHeroSystemLine(),
+          version: okeVersion,
+          phase: "ready",
+        }),
+      );
+    }
+    bootBoard.paint(paintBootBoard(heroAiStatus));
+    for (const notice of bootNotices) {
+      write(formatBootWarn(notice));
+    }
+    bootNotices.length = 0;
+    write(formatAppReadyLine(`http://127.0.0.1:${boundAppPort}`));
+    write(formatServiceLine("Console", `http://127.0.0.1:${boundConsolePort}`));
+    if (mcpServer) {
+      write(formatServiceLine("MCP", `http://127.0.0.1:${boundMcpPort}`));
+    }
+    if (docsMcpServer) {
+      write(formatServiceLine("Docs MCP", `http://127.0.0.1:${boundDocsMcpPort}`));
+    }
+    write(formatDevLogSeparator());
+    chromeReady = true;
+  };
+  paintReadyChrome();
 
-  write(formatDevLogSeparator());
+  // Live ● after the ready board — mid-boot health ticks were rewriting
+  // elements/Docker on top of db-push lines and tearing the claim box.
+  if (dockerStarted && composeFiles) {
+    const { startComposeHealthWatch } = await import("../docker/compose-health.ts");
+    const started = dockerStarted;
+    stopComposeHealthWatch = startComposeHealthWatch({
+      files: started.files,
+      cwd: started.cwd,
+      env: started.env,
+      run: composeHealthRun,
+      intervalMs: 2_000,
+      onChange: (map) => {
+        liveComposeHealth = map;
+        if (map.get("ai") === "error") heroAiStatus = "error";
+        repaintBoard();
+      },
+    });
+  }
 
   const watchFs: DevWatchFn =
     options.watchFs ?? ((path, watchOptions, listener) => watch(path, watchOptions, listener));
@@ -1258,10 +1385,16 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     bootBoard.stop();
     autoPushRunner.cancel();
     watcher.close();
+    const host = attachedHost;
+    attachedHost = null;
+    void host?.stop();
     app.stop();
     consoleServer.stop();
     mcpServer?.stop();
     docsMcpServer?.stop();
+    const vite = consoleVite;
+    consoleVite = null;
+    void vite?.stop();
     void clearDevSessionLock(cwd);
     if (dockerStarted) {
       const started = dockerStarted;
@@ -1354,26 +1487,7 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     };
     const refreshChrome = async (): Promise<void> => {
       await syncComposeBoard();
-      write(clearTerminalScreen());
-      bootBoard.reset();
-      write(
-        formatDevBanner({
-          profile: earlyProfile,
-          runtimeEnv: resolveDevRuntimeEnv(earlyProfile),
-          system: formatHeroSystemLine(),
-          version: okeVersion,
-        }),
-      );
-      bootBoard.paint(paintBootBoard(heroAiStatus));
-      write(formatAppReadyLine(`http://127.0.0.1:${boundAppPort}`));
-      write(formatServiceLine("Console", `http://127.0.0.1:${boundConsolePort}`));
-      if (mcpServer) {
-        write(formatServiceLine("MCP", `http://127.0.0.1:${boundMcpPort}`));
-      }
-      if (docsMcpServer) {
-        write(formatServiceLine("Docs MCP", `http://127.0.0.1:${boundDocsMcpPort}`));
-      }
-      write(formatDevLogSeparator());
+      paintReadyChrome();
     };
     const composeAction = async (action: DevComposeControlAction): Promise<void> => {
       const files = started.files;
@@ -1563,8 +1677,8 @@ async function startAppHot(
     OKE_DEV_SURFACE: "Backend",
   };
 
-  // `--no-clear-screen`: Bun must not wipe the hero; the runner clears only
-  // request logs on soft reload and reprints Backend / Console / MCP URLs.
+  // `--no-clear-screen`: Bun must not wipe the parent board (claim + Docker).
+  // The runner reprints only the Backend ready line on soft reload.
   const proc = Bun.spawn(["bun", "--hot", "--no-clear-screen", runner], {
     cwd,
     env,

package/src/cli/docker-cli.test.ts

@@ -42,7 +42,7 @@ describe("oke docker CLI", () => {
     expect(await Bun.file(join(dir, "docker/docker-compose.yml")).exists()).toBe(true);
     const yml = await Bun.file(join(dir, "docker/docker-compose.yml")).text();
     expect(yml).not.toContain("test-password-not-in-yaml");
-    expect(yml).toContain(".env.docker");
+    expect(yml).toContain(".env.local");
     expect(yml).toContain("/_/ready");
     expect(logs.join("")).toContain("docker-compose.override.yml");
   });
@@ -72,7 +72,7 @@ describe("oke stack", () => {
     const code = await runStackPreview({
       cwd: dir,
       images: {
-        "channel.email": "axllent/mailpit:v1.22.3",
+        "channel.email": "axllent/mailpit:v1.30.7",
       },
       write: (t) => {
         out += t;

package/src/cli/docker.ts

@@ -183,7 +183,7 @@ export async function dockerCli(args: readonly string[]): Promise<number> {
 Derive production-grade Docker artefacts under docker/ (default).
 
 Layouts (mutually exclusive; default --single):
-  --single          docker-compose.yml + Dockerfile (+ .env.docker via oke dev)
+  --single          docker-compose.yml + Dockerfile (+ .env.local via oke dev)
   --split           compose.yml + compose.<role>.yml (+ compose.prod.yml)
   --stack           docker-stack.yml for docker stack deploy
 

package/src/cli/doctor.ts

@@ -41,6 +41,7 @@ function flattenEffectiveDrivers(
     ["vault", drivers.vault],
     ["channel.email", drivers.channel.email],
     ["channel.sms", drivers.channel.sms],
+    ["runs", drivers.runs],
   ];
 }
 
@@ -215,7 +216,7 @@ export async function runDoctor(options: DoctorOptions = {}): Promise<{
       // protection the moment DB + env are stolen together.
       severity: "error",
       message:
-        'vault master key comes from an environment variable in prod — set vault.encryption.masterKey = { kind: "kms", keyId } (or use managed aws-secrets-manager) so the key is never readable from the process environment',
+        'vault master key comes from an environment variable in prod — set vault.encryption.masterKey = { kind: "kms", keyId } (or use a managed provider) so the key is never readable from the process environment',
     });
   }
 

package/src/cli/drizzle-env.test.ts

@@ -3,7 +3,7 @@
  */
 
 import { afterEach, describe, expect, test } from "bun:test";
-import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { OkeConfig } from "../config/index.ts";
@@ -39,11 +39,7 @@ describe("resolveDrizzleKitEnv", () => {
 
   test("dev env → postgresql dialect + DATABASE_URL from compose env", async () => {
     const dir = await tempDir();
-    await mkdir(join(dir, "docker"), { recursive: true });
-    await writeFile(
-      join(dir, "docker", ".env.docker"),
-      "DATABASE_URL=postgres://u:p@127.0.0.1:5432/oke\n",
-    );
+    await writeFile(join(dir, ".env.local"), "DATABASE_URL=postgres://u:p@127.0.0.1:5432/oke\n");
     const prevDb = process.env["DATABASE_URL"];
     delete process.env["DATABASE_URL"];
     try {
@@ -72,11 +68,10 @@ describe("resolveDrizzleKitEnv", () => {
 });
 
 describe("applyComposeEnvToProcess", () => {
-  test("fills unset keys from docker/.env.docker without overwriting", async () => {
+  test("fills unset keys from .env.local without overwriting", async () => {
     const dir = await tempDir();
-    await mkdir(join(dir, "docker"), { recursive: true });
     await writeFile(
-      join(dir, "docker", ".env.docker"),
+      join(dir, ".env.local"),
       "DATABASE_URL=postgres://u:p@127.0.0.1:5432/oke\nREDIS_URL=redis://127.0.0.1:6379\n",
     );
     const prevDb = process.env["DATABASE_URL"];

package/src/cli/drizzle-env.ts

@@ -22,7 +22,7 @@ export interface DrizzleKitEnvContext {
 }
 
 /**
- * Load `docker/.env.docker` (or legacy `.env.docker`) as a name→value map.
+ * Load `.env.local` as a name→value map.
  *
  * @param cwd - Project root
  */
@@ -38,7 +38,7 @@ export async function readComposeEnv(cwd: string): Promise<Map<string, string>>
 }
 
 /**
- * Fill unset `process.env` keys from compose `.env.docker` (never overwrites).
+ * Fill unset `process.env` keys from `.env.local` (never overwrites).
  *
  * SQL / Redis binders read `process.env` directly — Vault can resolve the
  * same file, but `oke db seed` must hydrate env before `app.boot()`.

package/src/cli/hero-meta.test.ts

@@ -83,6 +83,43 @@ describe("hero-meta", () => {
     expect(decodeHeroSnapshot(encodeHeroSnapshot(snap))).toEqual(snap);
   });
 
+  test("sparse config (create-oke without --ai) still shows default compose drivers", () => {
+    const rows = resolveHeroElements(
+      {
+        drivers: {
+          store: { index: { test: "memory", prod: "meilisearch" } },
+          vault: { dev: "vault" },
+        },
+      },
+      { docker: true, sqlDriver: "postgres", kvDriver: "redis" },
+    );
+    const store = rows.find((r) => r.element === "store")?.detail ?? "";
+    expect(store).toContain("postgres");
+    expect(store).toContain("redis");
+    expect(store).toContain("files s3");
+    expect(store).toContain("index meilisearch");
+    expect(rows.find((r) => r.element === "signal")?.detail).toBe("redis");
+    expect(rows.find((r) => r.element === "clock")?.detail).toBe("postgres");
+    expect(rows.find((r) => r.element === "channel")?.detail).toContain("smtp");
+    expect(rows.find((r) => r.element === "vault")?.detail).toBe("vault");
+    expect(rows.find((r) => r.element === "ai")?.detail).toBe("—");
+  });
+
+  test("keel-shaped config with drivers.ai lights the eighth element", () => {
+    const rows = resolveHeroElements(
+      {
+        drivers: {
+          store: { index: { test: "memory", prod: "meilisearch" } },
+          vault: { dev: "vault" },
+          ai: { dev: "openai-compatible", test: "mock", prod: "openai-compatible" },
+        },
+      },
+      { docker: true, sqlDriver: "postgres", kvDriver: "redis", aiModel: "granite3.3:2b" },
+    );
+    expect(rows.find((r) => r.element === "ai")?.detail).toBe("openai-compatible · granite3.3:2b");
+    expect(rows.find((r) => r.element === "ai")?.status).not.toBe("idle");
+  });
+
   test("hero AI row includes configured model id", () => {
     const snap = buildDevHeroSnapshot({
       config: SAMPLE,

package/src/cli/hero-meta.ts

@@ -3,6 +3,7 @@
  */
 
 import { release } from "node:os";
+import { resolveEffectiveDrivers } from "../config/driver-defaults.ts";
 import {
   resolveDriverId,
   type ConfigEnv,
@@ -163,11 +164,14 @@ export function resolveHeroElements(
   const drivers = config?.drivers;
   // `-d` reads the `docker` profile for every element (not a store-only override).
   const configEnv: ConfigEnv = options.configEnv ?? (options.docker ? "dev" : "test");
+  // Sparse `oke.config.ts` (create-oke / keel) only pins overrides — boot still
+  // uses DRIVER_DEFAULTS. The hero must show that same effective map.
+  const effective = resolveEffectiveDrivers(drivers);
 
   // Gate rates share `drivers.store.kv` (no separate drivers.gate).
   const gateKv =
     options.kvDriver ??
-    resolveDriverId(drivers?.store?.kv, configEnv) ??
+    resolveDriverId(effective.store.kv, configEnv) ??
     (options.docker ? "redis" : "memory");
 
   const aiDriver = resolveDriverId(drivers?.ai, configEnv);
@@ -177,15 +181,32 @@ export function resolveHeroElements(
   const byName: Record<string, string> = {
     // Status ● is rendered separately — flow has no driver id.
     flow: "",
-    signal: resolveDriverId(drivers?.signal, configEnv) ?? "—",
-    store: storeDetail(drivers?.store, configEnv, {
-      sql: options.sqlDriver,
-      kv: options.kvDriver,
-    }),
-    clock: resolveDriverId(drivers?.clock, configEnv) ?? "—",
+    signal: resolveDriverId(effective.signal, configEnv) ?? "—",
+    store: storeDetail(
+      {
+        sql: effective.store.sql,
+        kv: effective.store.kv,
+        files: effective.store.files,
+        index: drivers?.store?.index,
+      },
+      configEnv,
+      {
+        sql: options.sqlDriver,
+        kv: options.kvDriver,
+      },
+    ),
+    clock: resolveDriverId(effective.clock, configEnv) ?? "—",
     gate: gateKv,
-    vault: resolveDriverId(drivers?.vault, configEnv) ?? "—",
-    channel: channelDetail(drivers?.channel, configEnv),
+    vault: resolveDriverId(effective.vault, configEnv) ?? "—",
+    channel: channelDetail(
+      {
+        email: effective.channel.email,
+        sms: effective.channel.sms,
+        whatsapp: drivers?.channel?.whatsapp,
+        push: drivers?.channel?.push,
+      },
+      configEnv,
+    ),
     ai: aiDetail,
   };
 

package/src/cli/index.ts

@@ -10,6 +10,7 @@ import { branchCli } from "./branch.ts";
 import { buildCli } from "./build.ts";
 import { clientAddCli } from "./client-add.ts";
 import { completionCli } from "./completion.ts";
+import { consoleCli } from "./console-cmd.ts";
 import { dbCli } from "./db.ts";
 import { devCli } from "./dev.ts";
 import { doctorCli } from "./doctor.ts";
@@ -132,6 +133,10 @@ if (cmd === "gates" && sub === "list") {
   process.exit(await gatesListCli(rest));
 }
 
+if (cmd === "console") {
+  process.exit(await consoleCli(sub ? [sub, ...rest] : rest));
+}
+
 if (cmd === "completion") {
   process.exit(completionCli(sub ? [sub, ...rest] : rest));
 }

package/src/cli/load-config.images.test.ts

@@ -18,21 +18,21 @@ describe("flattenImagesConfig", () => {
           sql: "postgres:18-alpine",
           kv: "redis:8-alpine",
           files: "rustfs/rustfs:1.0.0",
-          index: "getmeili/meilisearch:v1.37",
+          index: "getmeili/meilisearch:v1.53",
         },
-        channel: { email: "axllent/mailpit:v1.22.3" },
-        ai: "ollama/ollama:0.32.6",
-        pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+        channel: { email: "axllent/mailpit:v1.30.7" },
+        ai: "ollama/ollama:0.32.13",
+        pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.53",
         proxy: "caddy:2-alpine",
       }),
     ).toEqual({
       "store.sql": "postgres:18-alpine",
       "store.kv": "redis:8-alpine",
       "store.files": "rustfs/rustfs:1.0.0",
-      "store.index": "getmeili/meilisearch:v1.37",
-      "channel.email": "axllent/mailpit:v1.22.3",
-      ai: "ollama/ollama:0.32.6",
-      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+      "store.index": "getmeili/meilisearch:v1.53",
+      "channel.email": "axllent/mailpit:v1.30.7",
+      ai: "ollama/ollama:0.32.13",
+      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.53",
       proxy: "caddy:2-alpine",
     });
   });
@@ -55,7 +55,7 @@ describe("defaultImagesFromConfig", () => {
     });
     expect(images).toEqual({
       "store.sql": "postgres:18-alpine",
-      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.53",
       "store.kv": "redis:8-alpine",
     });
   });
@@ -70,7 +70,7 @@ describe("defaultImagesFromConfig", () => {
       },
     });
     expect(images["store.sql"]).toBe("pgvector/pgvector:pg17");
-    expect(images.pgdog).toBe("ghcr.io/pgdogdev/pgdog:v0.1.51");
+    expect(images.pgdog).toBe("ghcr.io/pgdogdev/pgdog:v0.1.53");
   });
 
   test("clock postgres alone pulls store.sql image", () => {
@@ -81,7 +81,7 @@ describe("defaultImagesFromConfig", () => {
     });
     expect(images).toEqual({
       "store.sql": "postgres:18-alpine",
-      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.53",
     });
   });
 
@@ -93,7 +93,7 @@ describe("defaultImagesFromConfig", () => {
     });
     expect(images).toEqual({
       "store.sql": "postgres:18-alpine",
-      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.53",
     });
   });
 

package/src/cli/load-config.ts

@@ -15,7 +15,7 @@ import type { Manifest } from "../manifest/types.ts";
 /** Default image pins when `images` is omitted but prod drivers need containers. */
 const DEFAULT_SQL_IMAGE = "postgres:18-alpine";
 const DEFAULT_PGVECTOR_IMAGE = "pgvector/pgvector:pg17";
-const DEFAULT_PGDOG_IMAGE = "ghcr.io/pgdogdev/pgdog:v0.1.51";
+const DEFAULT_PGDOG_IMAGE = "ghcr.io/pgdogdev/pgdog:v0.1.53";
 const DEFAULT_KV_IMAGE = "redis:8-alpine";
 
 /**