okengine 0.11.2 → 0.13.0

package/site/content/docs/reference/security.md

@@ -40,14 +40,23 @@ Our path is concrete: a booking name containing "ignore previous instructions an
 
 #### 10.4 Remaining closures
 
-- **`invoke-as` is attenuated** exactly like an API key: an operator cannot assume a scope set they could not grant. Impersonating a real user is development-only.
-- **Exports are a separate capability** — row-limited by default, audited with the query recorded, PII masked without `pii:reveal`, and **CSV formula injection neutralised** (values beginning `=`, `+`, `-`, `@` are quoted, or Excel executes them on the recipient's machine).
+- **`invoke-as` is attenuated** exactly like an API key: an operator cannot assume a scope set they could not grant. Impersonating a real user is development-only. Console `POST /console/flows/invoke` runs the target flow on a bound host under the selected identity’s scopes (`trustedInvoke` is in-process only — never from public HTTP); when the host adapter is unbound, invoke fails closed.
+- **Store SQL browse** masks classified PII by default. `QUERY /console/store/query` with `revealPii: true` returns cleartext for the current page and writes an audited `console.store.query.reveal` log (operator, ref, child). The SQL query console (`POST /console/store/sql`) stays masked unless `revealPii: true`, which writes `console.store.sql.reveal` (operator, ref). Call API (`POST /console/flows/invoke`) masks the same classified field names on the handler response unless `revealPii: true`, which writes `console.flows.invoke.reveal` and opens the host store session with cleartext so columns the handler reads (for example `ownerEmail`) are not already `[redacted]`. `asGate` (a Manifest policy gate or `public`) sets `oke.gate` and `row_security` on postgres / pglite and writes `console.store.sql.asGate`; Operator (omit `asGate`) still bypasses RLS. Per-cell `POST /console/store/reveal` remains available. The Console auth schema (`sql:oke_console` — `oke_operators`, sessions, roles, keys) is hidden from Store browse unless `OKE_CONSOLE_AUTH_STORE=1`. When listed it is **read-only**; edit / delete / raw SQL are refused so operator-plane rows are never joined to `public`.
+- **Host WideEvent ingest** (`POST /console/runs/ingest`, `oke dev` only) is secret-gated and never echoes the event body. Operators read runs only through `projectRun` / `maskWideEventForConsole` on `GET /console/runs` and `/console/live` — the same PII boundary as Console-local runs.
+- **Store SQL performance** (`QUERY /console/store/sql/stats`, `/locks`, `POST /console/store/sql/advise`) is engine-native query text — not Store browse masking. Statements show `pg_stat_statements` fingerprints (`$n`). Live `pg_stat_activity.query` is collapsed until `revealPii: true`, which writes `console.store.sql.stats.reveal` (operator, ref). Named limitation `StoreSqlStatsQueryTextGap`. This surface does not terminate sessions or call `pg_stat_statements_reset`.
+- **Store KV performance** (`QUERY /console/store/kv/stats`) is Redis-wire `INFO` / `COMMANDSTATS` / `SLOWLOG` / `LATENCY` — not Store browse. INFO is instance-wide (`StoreKvStatsServerWideGap`). SLOWLOG args are keys and values — collapsed until `revealPii: true`, which writes `console.store.kv.stats.reveal` (operator, ref). Named limitation `StoreKvStatsSlowlogArgsGap`. `memory` returns `KvStatsUnsupported`. This surface does not run `MONITOR` and does not invent a hot-key table.
+- **Runs SQL** (`POST /console/runs/query`, Observability SQL tab) is operator-session, read-only, 5s timeout, 1000-row cap. DuckDB filesystem access is disabled for the statement. Masking is column-key only (`dim_*` and JSON blobs `input` / `output` / `logs` / `dimensions`). Aliases and expressions can leak classified values — named limitation `RunsQueryPiiProjectionGap`. This is **not** the `projectRun` guarantee. `revealPii: true` writes `console.runs.query.reveal`. Flow `fx.runs.query` stays unrestricted app SQL.
 - **Plugin panels** run in a sandboxed iframe without `allow-same-origin`, communicating only over a `postMessage` bridge with their own CSP, no access to the operator session token, and exposure limited to that plugin's declared flows.
-- **Session and framing:** `frame-ancestors 'none'`, `SameSite=Strict`, step-up authentication before destructive actions.
-- **Secret write path:** TLS required, no autocomplete, never echoed, never logged, not retained in browser memory after submission.
-- **The setup claim code** is rate-limited and compared in constant time. The first-operator password
-  uses the same policy as Gate auth (minLength 12, letter + number); weak passwords return
-  `ClaimFailed` / `password_policy`, not an opaque 500.
+- **Session and framing:** `frame-ancestors 'none'`, `SameSite=Strict`, step-up authentication before destructive actions. An expired operator session redirects to Sign in with `?next=` set to the current `/overview`, `/flows`, `/store`, `/vault`, or `/observability` href (search included); after login the operator returns there. `/monitoring` is rewritten to `/observability`. Any other `next` (including `/units`) is dropped so the gate cannot be used as an open redirect. Unknown Console paths are 404.
+- **Secret write path:** TLS required, no autocomplete, never echoed, never logged, not retained in browser memory after submission. Vault set / rotate / rotate-master use typed confirm (`SET` / `ROTATE` / `ROTATE_MASTER`). The Console never accepts a master key in the HTTP body (`OKE_VAULT_MASTER_KEY` only). `GET /console/vault/audit/verify` is read-only (no typed phrase).
+- **The setup claim code** is rate-limited and compared in constant time. It is
+  printed on the `oke dev` board (TTY only — never on `GET /console/setup/status`)
+  and mirrored to gitignored `.oke/claim-code` (mode 0600) for
+  `oke console claim-code` while setup is open; the file is removed after a
+  successful claim. The first-operator password
+  uses Console policy (minLength 12, upper + lower + number + special / `requireSpecial` — stricter than Gate auth’s
+  minLength 8 with the same character classes); weak passwords return `ClaimFailed` /
+  `password_policy`, not an opaque 500.
 
 #### 10.5 Reversibility governs the confirmation pattern
 

package/src/auth/auth.test.ts

@@ -274,7 +274,7 @@ describe("operator plane", () => {
     const op = await createOperator(store, {
       email: "ops@example.com",
       name: "Ops",
-      password: "correct horse battery staple 1",
+      password: "Correct Horse Battery Staple 1!",
     });
 
     expect(store.credentials.has(op.id)).toBe(true);
@@ -287,7 +287,7 @@ describe("operator plane", () => {
     const authed = await authenticateOperator(
       store,
       "ops@example.com",
-      "correct horse battery staple 1",
+      "Correct Horse Battery Staple 1!",
     );
     expect(authed?.id).toBe(op.id);
   });

package/src/auth/bindings.ts

@@ -275,10 +275,10 @@ export function createAuthHttpBindings(
   } = { refresh, revoke, me };
   const bindings: Binding[] = [
     bindAuthHttp(
-      http.post(`${base}/refresh`).gate(gate.public, ...(refreshRate ? [refreshRate] : [])),
+      http.post(`${base}/refresh`).gate.public.gate(...(refreshRate ? [refreshRate] : [])),
       refresh,
     ),
-    bindAuthHttp(http.post(`${base}/revoke`).gate(gate.public), revoke),
+    bindAuthHttp(http.post(`${base}/revoke`).gate.public, revoke),
     bindAuthHttp(http.get(`${base}/me`).gate(AUTH_SESSION_GATE), me),
   ];
 
@@ -371,11 +371,11 @@ export function createAuthHttpBindings(
     flows.signUpEmail = signUpEmail;
     bindings.push(
       bindAuthHttp(
-        http.post(`${base}/sign-in/email`).gate(gate.public, ...(signInRate ? [signInRate] : [])),
+        http.post(`${base}/sign-in/email`).gate.public.gate(...(signInRate ? [signInRate] : [])),
         signInEmail,
       ),
       bindAuthHttp(
-        http.post(`${base}/sign-up/email`).gate(gate.public, ...(signUpRate ? [signUpRate] : [])),
+        http.post(`${base}/sign-up/email`).gate.public.gate(...(signUpRate ? [signUpRate] : [])),
         signUpEmail,
       ),
     );
@@ -406,7 +406,7 @@ export function isSessionFresh(
  * @param flowDef - Flow
  */
 export function bindAuthHttp(trigger: HttpTrigger, flowDef: AnyFlowDef): Binding {
-  const withPosture = trigger.gates.length > 0 ? trigger : trigger.gate(gate.public);
+  const withPosture = trigger.gates.length > 0 ? trigger : trigger.gate.public;
   const normalized = normalizeTrigger(withPosture);
   const list = flowDef.triggers as Trigger[];
   list.push(normalized);

package/src/auth/config.ts

@@ -6,6 +6,7 @@
 
 import type { PasswordHashOptions } from "../runtime/types.ts";
 import type { SessionStore } from "./sessions.ts";
+import type { ApiKeyStore } from "./api-keys.ts";
 import type { BreachCheckFn } from "./breach-check.ts";
 import type { PasswordPolicyOptions } from "./password-policy.ts";
 import {
@@ -109,6 +110,11 @@ export interface GateAuthOptions extends AuthSchemaOptions {
    * Not part of the public app DX — escape hatch for embedding.
    */
   readonly sessions?: SessionStore;
+  /**
+   * In-memory API key store for Bearer key auth (tests / embedding).
+   * Distinct from schema `apiKeys` table options.
+   */
+  readonly apiKeyStore?: ApiKeyStore;
   /** Injectable clock. */
   readonly now?: () => number;
 }
@@ -164,6 +170,7 @@ export interface ResolvedGateAuth {
   };
   readonly hooks: AuthDatabaseHooks | undefined;
   readonly sessions: SessionStore | undefined;
+  readonly apiKeyStore: ApiKeyStore | undefined;
   readonly now: (() => number) | undefined;
 }
 
@@ -271,6 +278,7 @@ export function resolveGateAuth(options: ResolveGateAuthOptions): ResolvedGateAu
     },
     hooks: auth.hooks,
     sessions: auth.sessions,
+    apiKeyStore: auth.apiKeyStore,
     now: auth.now,
   };
 }

package/src/auth/gate-auth.test.ts

@@ -176,7 +176,7 @@ describe("gate.auth — email Flows + security", () => {
         headers: { "content-type": "application/json" },
         body: JSON.stringify({
           email: "user@example.com",
-          password: "CorrectHorse1",
+          password: "CorrectHorse1!",
           name: "User",
         }),
       }),
@@ -192,7 +192,7 @@ describe("gate.auth — email Flows + security", () => {
       new Request("http://localhost/auth/sign-in/email", {
         method: "POST",
         headers: { "content-type": "application/json" },
-        body: JSON.stringify({ email: "missing@example.com", password: "CorrectHorse1" }),
+        body: JSON.stringify({ email: "missing@example.com", password: "CorrectHorse1!" }),
       }),
     );
     const badBody = (await bad.json()) as { error: { code: string; data?: { reason?: string } } };
@@ -262,7 +262,7 @@ describe("gate.auth — email Flows + security", () => {
         headers: { "content-type": "application/json" },
         body: JSON.stringify({
           email: "weak@example.com",
-          password: "CorrectHorse1",
+          password: "CorrectHorse1!",
           name: "Strong",
         }),
       }),
@@ -289,14 +289,14 @@ describe("gate.auth — email Flows + security", () => {
       new Request("http://localhost/auth/sign-up/email", {
         method: "POST",
         headers: { "content-type": "application/json" },
-        body: JSON.stringify({ email: "dup@example.com", password: "CorrectHorse1" }),
+        body: JSON.stringify({ email: "dup@example.com", password: "CorrectHorse1!" }),
       }),
     );
     const again = await app.fetch(
       new Request("http://localhost/auth/sign-up/email", {
         method: "POST",
         headers: { "content-type": "application/json" },
-        body: JSON.stringify({ email: "dup@example.com", password: "CorrectHorse1" }),
+        body: JSON.stringify({ email: "dup@example.com", password: "CorrectHorse1!" }),
       }),
     );
     const body = (await again.json()) as { error: { data?: { reason?: string } } };

package/src/auth/index.ts

@@ -113,9 +113,12 @@ export {
 
 export {
   assertPasswordPolicy,
+  generatePassword,
   resolvePasswordPolicy,
   PasswordPolicyError,
   DEFAULT_PASSWORD_MIN_LENGTH,
+  DEFAULT_PASSWORD_POLICY,
+  type GeneratePasswordOptions,
   type PasswordPolicyOptions,
   type ResolvedPasswordPolicy,
 } from "./password-policy.ts";

package/src/auth/operator.ts

@@ -43,7 +43,7 @@ export interface CreateOperatorOptions {
   readonly roles?: readonly string[];
   /**
    * Password length / character-class policy. Defaults applied when omitted
-   * (minLength 12, letter + number). Pass custom knobs to tighten/loosen
+   * (minLength 8, letter, number, upper, lower, symbol). Pass custom knobs to tighten/loosen
    * within reason — never skip without {@link skipPasswordPolicy}.
    */
   readonly passwordPolicy?: PasswordPolicyOptions;

package/src/auth/password-policy.test.ts

@@ -5,17 +5,154 @@ import {
   sha1HexUpper,
   BreachCheckError,
 } from "./breach-check.ts";
-import { assertPasswordPolicy, PasswordPolicyError } from "./password-policy.ts";
+import {
+  assertPasswordPolicy,
+  DEFAULT_PASSWORD_POLICY,
+  generatePassword,
+  PasswordPolicyError,
+  resolvePasswordPolicy,
+} from "./password-policy.ts";
+import {
+  CONSOLE_PASSWORD_POLICY,
+  consolePasswordMeetsPolicy,
+  evaluateConsolePasswordRules,
+  generateConsolePassword,
+} from "../console/password-policy.ts";
 import { createBunCrypto } from "../runtime/primitives.ts";
 import { ARGON2ID_MEMORY_COST_FLOOR } from "../runtime/types.ts";
 import { createOperator, createOperatorStore } from "./operator.ts";
 import { createSessionStore, issueSession, rotateRefresh, SessionError } from "./sessions.ts";
 
 describe("password policy", () => {
-  test("defaults require length 12, letter, number", () => {
-    expect(() => assertPasswordPolicy("short1A", {})).toThrow(PasswordPolicyError);
-    expect(() => assertPasswordPolicy("longenoughword", {})).toThrow(PasswordPolicyError);
-    expect(() => assertPasswordPolicy("Longenough12", {})).not.toThrow();
+  test("defaults require length 8, upper, lower, number, special", () => {
+    expect(() => assertPasswordPolicy("Aa1!", {})).toThrow(PasswordPolicyError);
+    expect(() => assertPasswordPolicy("password", {})).toThrow(PasswordPolicyError);
+    expect(() => assertPasswordPolicy("Password1", {})).toThrow(PasswordPolicyError);
+    expect(() => assertPasswordPolicy("Password1!", {})).not.toThrow();
+  });
+
+  test("DEFAULT_PASSWORD_POLICY separates upper, lower, and requireSpecial", () => {
+    const resolved = resolvePasswordPolicy(DEFAULT_PASSWORD_POLICY);
+    expect(resolved.minLength).toBe(8);
+    expect(resolved.requireLetter).toBe(true);
+    expect(resolved.requireNumber).toBe(true);
+    expect(resolved.requireUppercase).toBe(true);
+    expect(resolved.requireLowercase).toBe(true);
+    expect(resolved.requireSpecial).toBe(true);
+
+    expect(() => assertPasswordPolicy("password1!", DEFAULT_PASSWORD_POLICY)).toThrow(
+      /requireUppercase/,
+    );
+    expect(() => assertPasswordPolicy("PASSWORD1!", DEFAULT_PASSWORD_POLICY)).toThrow(
+      /requireLowercase/,
+    );
+  });
+
+  test("rejects password missing ONLY a special character (Global + Console)", () => {
+    // Global: length 8+, upper, lower, number — no special.
+    const globalOnlyMissingSpecial = "Password1";
+    expect(globalOnlyMissingSpecial.length).toBeGreaterThanOrEqual(
+      DEFAULT_PASSWORD_POLICY.minLength,
+    );
+    expect(/[A-Z]/.test(globalOnlyMissingSpecial)).toBe(true);
+    expect(/[a-z]/.test(globalOnlyMissingSpecial)).toBe(true);
+    expect(/\d/.test(globalOnlyMissingSpecial)).toBe(true);
+    expect(/[^A-Za-z0-9]/.test(globalOnlyMissingSpecial)).toBe(false);
+    expect(() => assertPasswordPolicy(globalOnlyMissingSpecial, DEFAULT_PASSWORD_POLICY)).toThrow(
+      PasswordPolicyError,
+    );
+    try {
+      assertPasswordPolicy(globalOnlyMissingSpecial, DEFAULT_PASSWORD_POLICY);
+    } catch (err) {
+      expect(err).toBeInstanceOf(PasswordPolicyError);
+      expect((err as PasswordPolicyError).reasons).toEqual(["requireSpecial"]);
+    }
+
+    // Console: length 12+, upper, lower, number — no special.
+    const consoleOnlyMissingSpecial = "Password1234";
+    expect(consoleOnlyMissingSpecial.length).toBeGreaterThanOrEqual(
+      CONSOLE_PASSWORD_POLICY.minLength,
+    );
+    expect(/[A-Z]/.test(consoleOnlyMissingSpecial)).toBe(true);
+    expect(/[a-z]/.test(consoleOnlyMissingSpecial)).toBe(true);
+    expect(/\d/.test(consoleOnlyMissingSpecial)).toBe(true);
+    expect(/[^A-Za-z0-9]/.test(consoleOnlyMissingSpecial)).toBe(false);
+    expect(() => assertPasswordPolicy(consoleOnlyMissingSpecial, CONSOLE_PASSWORD_POLICY)).toThrow(
+      PasswordPolicyError,
+    );
+    try {
+      assertPasswordPolicy(consoleOnlyMissingSpecial, CONSOLE_PASSWORD_POLICY);
+    } catch (err) {
+      expect(err).toBeInstanceOf(PasswordPolicyError);
+      expect((err as PasswordPolicyError).reasons).toEqual(["requireSpecial"]);
+    }
+  });
+
+  test("requireUppercase, requireLowercase, and requireSpecial can be turned off", () => {
+    const loose = {
+      minLength: 8,
+      requireUppercase: false,
+      requireLowercase: false,
+      requireSpecial: false,
+      requireLetter: true,
+      requireNumber: true,
+    };
+    expect(() => assertPasswordPolicy("password1", loose)).not.toThrow();
+    expect(() => assertPasswordPolicy("PASSWORD1", loose)).not.toThrow();
+  });
+
+  test("ui-next checklist criteria match Console server validation exactly", () => {
+    const rules = evaluateConsolePasswordRules("");
+    expect(rules.map((r) => r.id)).toEqual([
+      "length",
+      "uppercase",
+      "lowercase",
+      "number",
+      "special",
+    ]);
+    expect(rules.find((r) => r.id === "length")?.label).toBe(
+      `At least ${CONSOLE_PASSWORD_POLICY.minLength} characters`,
+    );
+    expect(CONSOLE_PASSWORD_POLICY.minLength).toBe(12);
+    expect(CONSOLE_PASSWORD_POLICY.requireSpecial).toBe(true);
+
+    const samples = [
+      "",
+      "short",
+      "password1234",
+      "Password1234",
+      "PASSWORD1234!",
+      "Password!!!!!",
+      "Password12!!",
+      "CorrectHorse1!",
+    ];
+    for (const password of samples) {
+      const allMet = evaluateConsolePasswordRules(password).every((rule) => rule.met);
+      const serverOk = consolePasswordMeetsPolicy(password);
+      expect(allMet).toBe(serverOk);
+      if (serverOk) {
+        expect(() => assertPasswordPolicy(password, CONSOLE_PASSWORD_POLICY)).not.toThrow();
+      } else {
+        expect(() => assertPasswordPolicy(password, CONSOLE_PASSWORD_POLICY)).toThrow(
+          PasswordPolicyError,
+        );
+      }
+    }
+  });
+
+  test("generatePassword always satisfies the requested policy", () => {
+    const seen = new Set<string>();
+    for (let i = 0; i < 64; i++) {
+      const password = generatePassword(CONSOLE_PASSWORD_POLICY);
+      expect(password.length).toBeGreaterThanOrEqual(CONSOLE_PASSWORD_POLICY.minLength);
+      expect(() => assertPasswordPolicy(password, CONSOLE_PASSWORD_POLICY)).not.toThrow();
+      expect(consolePasswordMeetsPolicy(password)).toBe(true);
+      expect(evaluateConsolePasswordRules(password).every((rule) => rule.met)).toBe(true);
+      seen.add(password);
+    }
+    expect(seen.size).toBe(64);
+    expect(() => assertPasswordPolicy(generatePassword(), DEFAULT_PASSWORD_POLICY)).not.toThrow();
+    expect(generateConsolePassword()).toHaveLength(16);
   });
 
   test("createOperator rejects weak passwords by default without passwordPolicy", async () => {

package/src/auth/password-policy.ts

@@ -2,16 +2,23 @@
  * Password policy — length + character-class rules (never weaker defaults).
  */
 
+/** Non-alphanumeric special character (any Unicode letter/digit excluded via ASCII class). */
+const SPECIAL_CHAR_RE = /[^A-Za-z0-9]/;
+
 /** Options for {@link assertPasswordPolicy}. */
 export interface PasswordPolicyOptions {
-  /** Minimum length (default 12). */
+  /** Minimum length (default {@link DEFAULT_PASSWORD_MIN_LENGTH}). */
   readonly minLength?: number;
   /** Require at least one letter (default true). */
   readonly requireLetter?: boolean;
   /** Require at least one digit (default true). */
   readonly requireNumber?: boolean;
-  /** Require at least one non-alphanumeric symbol (default false). */
-  readonly requireSymbol?: boolean;
+  /** Require at least one uppercase letter (default true). */
+  readonly requireUppercase?: boolean;
+  /** Require at least one lowercase letter (default true). */
+  readonly requireLowercase?: boolean;
+  /** Require at least one non-alphanumeric special character (default true). */
+  readonly requireSpecial?: boolean;
 }
 
 /** Resolved policy with defaults applied. */
@@ -19,11 +26,26 @@ export interface ResolvedPasswordPolicy {
   readonly minLength: number;
   readonly requireLetter: boolean;
   readonly requireNumber: boolean;
-  readonly requireSymbol: boolean;
+  readonly requireUppercase: boolean;
+  readonly requireLowercase: boolean;
+  readonly requireSpecial: boolean;
 }
 
-/** Default minimum password length. */
-export const DEFAULT_PASSWORD_MIN_LENGTH = 12;
+/** Default minimum password length (global / Gate auth). */
+export const DEFAULT_PASSWORD_MIN_LENGTH = 8;
+
+/**
+ * Global password policy defaults (Gate auth / `createIdentity` / `createOperator`
+ * when no `passwordPolicy` is passed). Console claim uses a stricter constant.
+ */
+export const DEFAULT_PASSWORD_POLICY: ResolvedPasswordPolicy = {
+  minLength: DEFAULT_PASSWORD_MIN_LENGTH,
+  requireLetter: true,
+  requireNumber: true,
+  requireUppercase: true,
+  requireLowercase: true,
+  requireSpecial: true,
+};
 
 /**
  * Resolve policy options with safe defaults.
@@ -32,13 +54,24 @@ export const DEFAULT_PASSWORD_MIN_LENGTH = 12;
  */
 export function resolvePasswordPolicy(options: PasswordPolicyOptions = {}): ResolvedPasswordPolicy {
   return {
-    minLength: options.minLength ?? DEFAULT_PASSWORD_MIN_LENGTH,
-    requireLetter: options.requireLetter ?? true,
-    requireNumber: options.requireNumber ?? true,
-    requireSymbol: options.requireSymbol ?? false,
+    minLength: options.minLength ?? DEFAULT_PASSWORD_POLICY.minLength,
+    requireLetter: options.requireLetter ?? DEFAULT_PASSWORD_POLICY.requireLetter,
+    requireNumber: options.requireNumber ?? DEFAULT_PASSWORD_POLICY.requireNumber,
+    requireUppercase: options.requireUppercase ?? DEFAULT_PASSWORD_POLICY.requireUppercase,
+    requireLowercase: options.requireLowercase ?? DEFAULT_PASSWORD_POLICY.requireLowercase,
+    requireSpecial: options.requireSpecial ?? DEFAULT_PASSWORD_POLICY.requireSpecial,
   };
 }
 
+/**
+ * Whether `password` contains a non-alphanumeric special character.
+ *
+ * @param password - Plaintext
+ */
+export function passwordHasSpecial(password: string): boolean {
+  return SPECIAL_CHAR_RE.test(password);
+}
+
 /**
  * Validate a password against policy. Throws {@link PasswordPolicyError}.
  *
@@ -54,17 +87,100 @@ export function assertPasswordPolicy(password: string, options: PasswordPolicyOp
   if (policy.requireLetter && !/[A-Za-z]/.test(password)) {
     reasons.push("requireLetter");
   }
+  if (policy.requireUppercase && !/[A-Z]/.test(password)) {
+    reasons.push("requireUppercase");
+  }
+  if (policy.requireLowercase && !/[a-z]/.test(password)) {
+    reasons.push("requireLowercase");
+  }
   if (policy.requireNumber && !/\d/.test(password)) {
     reasons.push("requireNumber");
   }
-  if (policy.requireSymbol && !/[^A-Za-z0-9]/.test(password)) {
-    reasons.push("requireSymbol");
+  if (policy.requireSpecial && !passwordHasSpecial(password)) {
+    reasons.push("requireSpecial");
   }
   if (reasons.length > 0) {
     throw new PasswordPolicyError(reasons);
   }
 }
 
+/** Extra options for {@link generatePassword}. */
+export interface GeneratePasswordOptions extends PasswordPolicyOptions {
+  /** Output length (default `max(minLength, 16)`). */
+  readonly length?: number;
+}
+
+const GEN_UPPER = "ABCDEFGHJKLMNPQRSTUVWXYZ";
+const GEN_LOWER = "abcdefghijkmnpqrstuvwxyz";
+const GEN_DIGITS = "23456789";
+const GEN_SPECIAL = "!@#$%^&*-_=+?";
+
+/**
+ * Cryptographically random password that satisfies {@link assertPasswordPolicy}.
+ * Ambiguous glyphs (`0O1Il`) are omitted so a revealed value is easy to retype.
+ *
+ * @param options - Policy + optional length
+ */
+export function generatePassword(options: GeneratePasswordOptions = {}): string {
+  const policy = resolvePasswordPolicy(options);
+  const length = options.length ?? Math.max(policy.minLength, 16);
+  if (length < policy.minLength) {
+    throw new Error(`generatePassword: length ${length} is below minLength ${policy.minLength}`);
+  }
+
+  const classes: string[] = [];
+  if (policy.requireUppercase) classes.push(GEN_UPPER);
+  if (policy.requireLowercase) classes.push(GEN_LOWER);
+  if (policy.requireLetter && !policy.requireUppercase && !policy.requireLowercase) {
+    classes.push(GEN_UPPER + GEN_LOWER);
+  }
+  if (policy.requireNumber) classes.push(GEN_DIGITS);
+  if (policy.requireSpecial) classes.push(GEN_SPECIAL);
+  const pool = classes.length > 0 ? classes.join("") : GEN_UPPER + GEN_LOWER + GEN_DIGITS;
+  if (length < classes.length) {
+    throw new Error(`generatePassword: length ${length} cannot cover ${classes.length} classes`);
+  }
+
+  const chars: string[] = classes.map((set) => pickChar(set));
+  while (chars.length < length) chars.push(pickChar(pool));
+  shuffleInPlace(chars);
+  const password = chars.join("");
+  assertPasswordPolicy(password, policy);
+  return password;
+}
+
+function pickChar(set: string): string {
+  return set[randomInt(set.length)] ?? set[0]!;
+}
+
+function shuffleInPlace(items: string[]): void {
+  for (let i = items.length - 1; i > 0; i--) {
+    const j = randomInt(i + 1);
+    const a = items[i]!;
+    items[i] = items[j]!;
+    items[j] = a;
+  }
+}
+
+/** Unbiased `0 .. maxExclusive-1` from `crypto.getRandomValues`. */
+function randomInt(maxExclusive: number): number {
+  if (!Number.isInteger(maxExclusive) || maxExclusive <= 0) {
+    throw new Error("randomInt: maxExclusive must be a positive integer");
+  }
+  const bytes = maxExclusive <= 256 ? 1 : 2;
+  const range = bytes === 1 ? 256 : 65536;
+  if (maxExclusive > range) {
+    throw new Error(`randomInt: maxExclusive ${maxExclusive} exceeds ${range}`);
+  }
+  const limit = range - (range % maxExclusive);
+  const buf = new Uint8Array(bytes);
+  for (;;) {
+    crypto.getRandomValues(buf);
+    const value = bytes === 1 ? (buf[0] ?? 0) : ((buf[0] ?? 0) << 8) | (buf[1] ?? 0);
+    if (value < limit) return value % maxExclusive;
+  }
+}
+
 /** Password failed policy checks. */
 export class PasswordPolicyError extends Error {
   readonly reasons: readonly string[];

package/src/auth/plugin.ts

@@ -40,8 +40,8 @@ export interface AuthPluginOptions {
    */
   readonly password?: PasswordHashOptions;
   /**
-   * Password length / character-class policy (defaults: minLength 12,
-   * letter + number). Credential-set paths enforce defaults unless a
+   * Password length / character-class policy (defaults: minLength 8,
+   * letter, number, upper, lower, symbol). Credential-set paths enforce defaults unless a
    * caller passes `skipPasswordPolicy` (tests only).
    */
   readonly passwordPolicy?: PasswordPolicyOptions;

package/src/cli/ai-setup/ai-setup.test.ts

@@ -151,7 +151,7 @@ export default defineConfig({
 
       const config = readFileSync(join(dir, "oke.config.ts"), "utf8");
       expect(config).toContain('dev: "ollama"');
-      expect(config).toContain('ai: "ollama/ollama:0.32.6"');
+      expect(config).toContain('ai: "ollama/ollama:0.32.13"');
       const env = readFileSync(join(dir, ".env.local"), "utf8");
       expect(env).toContain("# OKE_AI_DRIVER=ollama");
       expect(env).toMatch(/^#\s*OKE_AI_MODEL=gemma4:e4b$/m);

package/src/cli/ai-setup/apply.ts

@@ -5,7 +5,6 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { OLLAMA_IMAGE } from "../../docker/recipes/index.ts";
-import { DEFAULT_DOCKER_DIR } from "../../docker/types.ts";
 
 /** Choices applied to the project. */
 export type AiSetupApplyInput = {
@@ -70,10 +69,8 @@ export function applyAiSetup(
     : existsSync(envExample)
       ? readFileSync(envExample, "utf8")
       : "";
-  // Driver / URL / model stay commented so docker mode can hydrate from
-  // `docker/.env.docker` without being shadowed. The chosen model is still
-  // written into `.env.local` as a hint (and into `.env.docker` when present);
-  // `loadExistingStackControls` seeds commented `OKE_AI_MODEL` on first boot.
+  // Driver / URL / model stay commented so `oke dev --docker` can write
+  // the live compose URL into `.env.local` without a leftover pin winning.
   env = upsertEnv(env, "OKE_AI_DRIVER", input.driver, { comment: true });
   if (input.baseUrl) env = upsertEnv(env, "OKE_AI_URL", input.baseUrl, { comment: true });
   if (input.chatModel) {
@@ -94,18 +91,6 @@ export function applyAiSetup(
   }
   writeFileSync(envPath, env.endsWith("\n") ? env : `${env}\n`, "utf8");
 
-  // `docker/.env.docker` is regenerated from `.env.local` only on its first
-  // boot (existing values there are treated as durable, possibly hand-edited
-  // pins — see stack-id.ts). Once it exists, a later `oke ai setup` run must
-  // update it directly, or the docker profile keeps the old model forever.
-  if (input.chatModel) {
-    const dockerEnvPath = join(cwd, DEFAULT_DOCKER_DIR, ".env.docker");
-    if (existsSync(dockerEnvPath)) {
-      const dockerEnv = readFileSync(dockerEnvPath, "utf8");
-      writeFileSync(dockerEnvPath, upsertEnv(dockerEnv, "OKE_AI_MODEL", input.chatModel), "utf8");
-    }
-  }
-
   const aiTsPath = writeAiModels(cwd, input);
 
   return { configPath, envPath, aiTsPath };
@@ -162,7 +147,7 @@ export function upsertImage(source: string, key: string, image: string): string
 export type UpsertEnvOptions = {
   /**
    * When true, write `# KEY=value` (opt-in override). Used for AI stack keys
-   * so they do not shadow `docker/.env.docker`.
+   * so `oke dev --docker` can write the live compose URL into `.env.local`.
    */
   readonly comment?: boolean;
 };

package/src/cli/ai-setup/index.ts

@@ -205,7 +205,7 @@ function nonInteractiveInput(args: AiSetupCliArgs): AiSetupApplyInput {
       chatModel: args.chat ?? "granite3.3:2b",
       visionModel: null,
       embedModel: null,
-      image: "ghcr.io/ggml-org/llama.cpp:server-b10290",
+      image: "ghcr.io/ggml-org/llama.cpp:server-b10450",
     };
   }
   if (provider === "ollama") {
@@ -215,7 +215,7 @@ function nonInteractiveInput(args: AiSetupCliArgs): AiSetupApplyInput {
       chatModel: args.chat ?? "gemma4:e4b",
       visionModel: args.vision === undefined ? "qwen3-vl:4b" : args.vision || null,
       embedModel: args.embed ?? "nomic-embed-text",
-      image: "ollama/ollama:0.32.6",
+      image: "ollama/ollama:0.32.13",
     };
   }
   if (provider === "vllm") {
@@ -225,7 +225,7 @@ function nonInteractiveInput(args: AiSetupCliArgs): AiSetupApplyInput {
       chatModel: args.chat ?? "Qwen/Qwen3-0.6B",
       visionModel: null,
       embedModel: null,
-      image: "vllm/vllm-openai:v0.26.0",
+      image: "vllm/vllm-openai:v0.27.1",
     };
   }
   if (provider === "sglang") {
@@ -235,7 +235,7 @@ function nonInteractiveInput(args: AiSetupCliArgs): AiSetupApplyInput {
       chatModel: args.chat ?? "Qwen/Qwen3-0.6B",
       visionModel: null,
       embedModel: null,
-      image: "lmsysorg/sglang:v0.5.16-runtime",
+      image: "lmsysorg/sglang:v0.5.17-runtime",
     };
   }
   if (provider === "anthropic") {