okengine 0.6.1 → 0.7.0

package/src/cli/index.ts

@@ -3,6 +3,7 @@
  * `oke` CLI entry.
  */
 
+import { aiCli } from "./ai.ts";
 import { branchCli } from "./branch.ts";
 import { buildCli } from "./build.ts";
 import { clientAddCli } from "./client-add.ts";
@@ -79,6 +80,10 @@ if (cmd === "eval") {
   process.exit(await evalCli(sub ? [sub, ...rest] : rest));
 }
 
+if (cmd === "ai") {
+  process.exit(await aiCli(sub ? [sub, ...rest] : rest));
+}
+
 if (cmd === "branch") {
   process.exit(await branchCli(sub ? [sub, ...rest] : rest));
 }

package/src/cli/load-config.ts

@@ -47,14 +47,13 @@ export function defaultImagesFromConfig(config: OkeConfig): Readonly<Record<stri
   const index = dockerOrProdId(config.drivers?.store?.index);
   const kv = dockerOrProdId(config.drivers?.store?.kv);
   const signal = dockerOrProdId(config.drivers?.signal);
-  const clock = dockerOrProdId(config.drivers?.clock);
 
+  // Only real SQL-consuming facets pull a SQL image. Clock/signal no longer
+  // advertise a fictional postgres CronStore / LISTEN bus via compose.
   const needsSql =
     sql === "postgres" ||
     sql === "pgvector" ||
     index === "pgvector" ||
-    signal === "postgres" ||
-    clock === "postgres" ||
     (config.drivers?.prod ?? []).some((p) => p === "postgres" || p === "pgvector");
 
   if (needsSql) {
@@ -62,7 +61,8 @@ export function defaultImagesFromConfig(config: OkeConfig): Readonly<Record<stri
       sql === "pgvector" || index === "pgvector" ? DEFAULT_PGVECTOR_IMAGE : DEFAULT_SQL_IMAGE;
   }
 
-  const needsKv = kv === "redis" || (config.drivers?.prod ?? []).includes("redis");
+  const needsKv =
+    kv === "redis" || signal === "redis" || (config.drivers?.prod ?? []).includes("redis");
   if (needsKv) {
     out["store.kv"] = DEFAULT_KV_IMAGE;
   }

package/src/cli/openbao-bootstrap.test.ts

@@ -145,5 +145,6 @@ describe("openbao bootstrap material gates", () => {
     }
     expect(failed).toBeInstanceOf(OpenBaoBootstrapError);
     expect(String(failed)).toContain("unrecoverable");
+    expect(String(failed)).toContain("compose.vault.yml down -v");
   });
 });

package/src/cli/openbao-bootstrap.ts

@@ -221,8 +221,15 @@ export async function ensureOpenBao(
     if (!existsSync(unsealPath) || !existsSync(rootPath)) {
       throw new OpenBaoBootstrapError(
         `openbao bootstrap: OpenBao is initialized but ${stateDir} is missing ` +
-          `unseal.key/root.token. Without the unseal key the data is unrecoverable. ` +
-          `Restore your backup of .oke/openbao/ — permanent loss otherwise.`,
+          `unseal.key/root.token. Without the unseal key the vault data is unrecoverable.\n` +
+          `\n` +
+          `Usual cause in docker mode: a previous vault volume survived after the project\n` +
+          `(or .oke/openbao/) was deleted — Compose stop keeps volumes on purpose.\n` +
+          `\n` +
+          `Restore a backup of .oke/openbao/ if you have one.\n` +
+          `\n` +
+          `Dev reset (wipes vault secrets only, then re-init on next oke dev):\n` +
+          `  cd docker && docker compose -f compose.yml -f compose.vault.yml down -v`,
       );
     }
     unsealKey = readFileSync(unsealPath, "utf8").trim();

package/src/cli/registry.ts

@@ -287,7 +287,7 @@ export const OKE_COMMANDS: readonly CliCommand[] = [
   },
   {
     name: "docker",
-    summary: "Dockerfile + compose.<role>.yml",
+    summary: "derive compose · clean leftover stacks",
     leaf: true,
     flags: [
       {
@@ -300,6 +300,24 @@ export const OKE_COMMANDS: readonly CliCommand[] = [
       MANIFEST,
       HELP,
     ],
+    subcommands: [
+      {
+        name: "clean",
+        summary: "Remove oke-dev stacks (containers, networks, volumes)",
+        flags: [
+          {
+            long: "--yes",
+            short: "-y",
+            summary: "Non-interactive confirm",
+          },
+          {
+            long: "--all",
+            summary: "Every oke-dev-* stack (required with --yes outside a project)",
+          },
+          HELP,
+        ],
+      },
+    ],
   },
   {
     name: "images",
@@ -346,6 +364,56 @@ export const OKE_COMMANDS: readonly CliCommand[] = [
     leaf: true,
     flags: [MANIFEST, HELP],
   },
+  {
+    name: "ai",
+    summary: "configure AI driver + models",
+    subcommands: [
+      {
+        name: "setup",
+        summary: "Interactive / flagged AI provider + model setup",
+        flags: [
+          {
+            long: "--provider",
+            takesValue: true,
+            valueName: "id",
+            summary: "ollama · openai · anthropic · gemini · lmstudio · openrouter · custom",
+          },
+          {
+            long: "--chat",
+            takesValue: true,
+            valueName: "model",
+            summary: "Chat model id",
+          },
+          {
+            long: "--vision",
+            takesValue: true,
+            valueName: "model",
+            summary: "Vision model id",
+          },
+          {
+            long: "--embed",
+            takesValue: true,
+            valueName: "model",
+            summary: "Embedding model id",
+          },
+          {
+            long: "--pull",
+            summary: "Pull missing Ollama models (default)",
+          },
+          {
+            long: "--no-pull",
+            summary: "Skip ollama pull",
+          },
+          {
+            long: "--yes",
+            short: "-y",
+            summary: "Non-interactive (requires --provider)",
+          },
+          HELP,
+        ],
+      },
+    ],
+  },
   {
     name: "branch",
     summary: "fork journaled state",
@@ -459,6 +527,16 @@ export function flagTokensFor(command: CliCommand, sub?: string): readonly strin
 }
 
 function formatCommandUsage(cmd: CliCommand): string {
+  // Leaf + subcommands (e.g. `oke docker` derive · `oke docker clean`).
+  if (cmd.leaf && cmd.subcommands && cmd.subcommands.length > 0) {
+    const flagHint = cmd.flags
+      ?.filter((f) => f.long !== "--help")
+      .slice(0, 2)
+      .map((f) => formatFlagHint(f))
+      .join(" ");
+    const subs = cmd.subcommands.map((s) => s.name).join("|");
+    return `oke ${cmd.name}${flagHint ? ` ${flagHint}` : ""} · ${subs}`;
+  }
   if (cmd.subcommands?.length === 1) {
     const sub = cmd.subcommands[0]!;
     const flagHint = sub.flags

package/src/client/live-gap.test.ts

@@ -0,0 +1,35 @@
+/**
+ * Evidence: createClient has no live-signal subscription today.
+ *
+ * `delivery: "live"` is consumed server-side via `bus.live()` (and
+ * `on(signal, flow)` for flow subscribers). `okengine/client` exposes only
+ * HTTP REST / RPC — no SSE, WebSocket, or `api.live(…)`.
+ *
+ * Design for `client.live(signalName)` is tracked with the Signal docs page;
+ * do not treat this file as a stub to fill — ship the real surface when ready.
+ */
+
+import { describe, expect, test } from "bun:test";
+
+import * as client from "./index.ts";
+import { createClient } from "./create.ts";
+
+describe("createClient — live signal gap", () => {
+  test("public client module exports no live / subscribe helpers", () => {
+    const keys = Object.keys(client).sort();
+    expect(keys).not.toContain("live");
+    expect(keys).not.toContain("subscribe");
+    expect(keys).toContain("createClient");
+    expect(keys).toContain("createTransport");
+  });
+
+  test("createClient builds an HTTP call proxy only (no live method on the root)", async () => {
+    const api = createClient("http://app.test", {
+      fetch: async () => Response.json({ data: null, error: { code: "NotFound", data: {} } }),
+    });
+    // Root is a callable proxy for unit.flow — live is not a first-class API.
+    expect(typeof api).toBe("function");
+    expect(Object.prototype.hasOwnProperty.call(api, "live")).toBe(false);
+    expect("live" in (api as object)).toBe(false);
+  });
+});

package/src/client/transport.test.ts

@@ -47,6 +47,27 @@ describe("transport — retry", () => {
     expect(error?.code).toBe("TransportError");
     expect(n).toBe(2);
   });
+
+  test("structured 5xx envelope is returned (not TransportError)", async () => {
+    const api = createClient<PingApp>("http://app.test", {
+      fetch: async () =>
+        Response.json(
+          {
+            data: null,
+            error: {
+              code: "InternalError",
+              data: {},
+              message: "password policy failed: minLength 12",
+            },
+          },
+          { status: 500 },
+        ),
+    });
+
+    const { error } = await api.sys.ping();
+    expect(error?.code).toBe("InternalError");
+    expect(error?.message).toMatch(/password policy/i);
+  });
 });
 
 describe("transport — timeout", () => {

package/src/client/transport.ts

@@ -44,6 +44,11 @@ export function createTransport(base: string, opts: ClientOptions = {}): Transpo
             await opts.auth.refresh();
             continue;
           }
+          if (res.status >= 500) {
+            const structured = await decodeIfEnvelope(res);
+            if (structured) return structured;
+            throw new Error(`HTTP ${res.status}`);
+          }
           return decode(res);
         } catch (err) {
           const transient = isTransient(err);
@@ -110,21 +115,38 @@ async function once(
     ctrl && opts.timeout !== undefined ? setTimeout(() => ctrl.abort(), opts.timeout) : undefined;
 
   try {
-    const res = await fetchFn(url, {
+    return await fetchFn(url, {
       method,
       headers,
       body,
       signal: ctrl?.signal,
     });
-    if (res.status >= 500) {
-      throw new Error(`HTTP ${res.status}`);
-    }
-    return res;
   } finally {
     if (timer !== undefined) clearTimeout(timer);
   }
 }
 
+/**
+ * Decode a JSON `{ data, error }` envelope from a 5xx response, or `null`
+ * when the body is not a structured OKE failure (retry as transport error).
+ *
+ * @param res - HTTP response (body consumed)
+ */
+async function decodeIfEnvelope(res: Response): Promise<ClientResult | null> {
+  const text = await res.text();
+  if (!text) return null;
+  let json: unknown;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (json !== null && typeof json === "object" && "data" in json && "error" in json) {
+    return json as ClientResult;
+  }
+  return null;
+}
+
 function rpcRequest(
   base: string,
   key: string,

package/src/compiler/fixtures/skyport/oke.config.ts

@@ -9,7 +9,7 @@ export default defineConfig({
       files: { prod: "s3" },
       index: { prod: "pgvector" },
     },
-    signal: { prod: "postgres" },
+    signal: { prod: "redis" },
     vault: { prod: "openbao" },
     channel: { email: { prod: "smtp" } },
     ai: { prod: { driver: "anthropic" } },

package/src/config/define-config.test.ts

@@ -26,7 +26,7 @@ describe("fillDockerFromProd / defineConfig", () => {
   });
 
   test("vault prod → docker copies the prod driver", () => {
-    expect(fillDockerFromProd({ local: "dotenv", prod: "openbao" })?.docker).toBe("openbao");
+    expect(fillDockerFromProd({ local: "env", prod: "openbao" })?.docker).toBe("openbao");
   });
 
   test("defineConfig fills every element from prod", () => {
@@ -37,9 +37,9 @@ describe("fillDockerFromProd / defineConfig", () => {
           kv: { local: "memory", prod: "redis" },
           files: { local: "fs", prod: "s3" },
         },
-        signal: { local: "memory", prod: "postgres" },
-        clock: { local: "memory", prod: "postgres" },
-        vault: { local: "dotenv", prod: "openbao" },
+        signal: { local: "memory", prod: "redis" },
+        clock: { local: "memory", prod: "file" },
+        vault: { local: "env", prod: "openbao" },
         channel: {
           email: { local: "console", prod: "smtp" },
         },
@@ -49,8 +49,8 @@ describe("fillDockerFromProd / defineConfig", () => {
     expect(cfg.drivers?.store?.sql?.docker).toBe("postgres");
     expect(cfg.drivers?.store?.kv?.docker).toBe("redis");
     expect(cfg.drivers?.store?.files?.docker).toBe("s3");
-    expect(cfg.drivers?.signal?.docker).toBe("postgres");
-    expect(cfg.drivers?.clock?.docker).toBe("postgres");
+    expect(cfg.drivers?.signal?.docker).toBe("redis");
+    expect(cfg.drivers?.clock?.docker).toBe("file");
     expect(cfg.drivers?.vault?.docker).toBe("openbao");
     expect(cfg.drivers?.channel?.email?.docker).toBe("smtp");
     expect(cfg.drivers?.ai?.docker).toBe("anthropic");

package/src/config/index.ts

@@ -344,7 +344,7 @@ export function fillDriversDockerFromProd(
  * Define an `oke.config.ts` document.
  *
  * Missing `docker` driver pins are filled from `prod` so `oke dev -d` uses the
- * same server protocols as production (vault → dotenv for `docker/.env.docker`).
+ * same server protocols as production (vault → `env` for `docker/.env.docker`).
  * Legacy `dev`/`stack` keys are normalized to `local`/`docker`.
  *
  * @param config - Driver / tenancy / i18n / topology

package/src/console/server/console.test.ts

@@ -53,6 +53,51 @@ describe("console kernel", () => {
     }
   });
 
+  test("claim rejects weak passwords with ClaimFailed password_policy (not 500)", async () => {
+    const handle = await startConsoleApp({
+      cwd,
+      secret: "test-secret-console",
+      silentClaim: true,
+    });
+    try {
+      const weak = await handle.app.fetch(
+        new Request("http://console.test/console/setup/claim", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            claimCode: handle.state.claim.code,
+            email: "ops@example.com",
+            name: "Ops",
+            password: "short1A",
+          }),
+        }),
+      );
+      // Zod min(12) rejects before createOperator — still not an opaque 500.
+      expect(weak.status).toBe(422);
+      const shortOkZod = await handle.app.fetch(
+        new Request("http://console.test/console/setup/claim", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            claimCode: handle.state.claim.code,
+            email: "ops@example.com",
+            name: "Ops",
+            password: "longenoughword",
+          }),
+        }),
+      );
+      expect(shortOkZod.status).toBe(400);
+      const body = (await shortOkZod.json()) as {
+        error: { code: string; message?: string; data?: { reason?: string } };
+      };
+      expect(body.error.code).toBe("ClaimFailed");
+      expect(body.error.data?.reason).toBe("password_policy");
+      expect(body.error.message).toMatch(/12 characters/i);
+    } finally {
+      await handle.app.stop();
+    }
+  });
+
   test("claim creates first operator and closes the wizard permanently", async () => {
     const handle = await startConsoleApp({
       cwd,

package/src/console/server/flows.ts

@@ -7,8 +7,10 @@
 import { z } from "zod";
 import {
   authenticateOperator,
+  BreachCheckError,
   createOperator,
   issueSession,
+  PasswordPolicyError,
   scopesForRoles,
   userPrincipal,
   type IssuedSession,
@@ -24,6 +26,7 @@ import { maskWideEventForConsole, piiFieldNamesFromManifest } from "./runs-pii.t
 import { ClockResourceNotFoundError, ScheduleNotOverridableError } from "./clock.ts";
 import { createFileDiff, emitStructuralDiff } from "./structural.ts";
 import type { ConsoleState } from "./state.ts";
+import { consoleFailureMessage } from "./i18n.ts";
 import { PUBLIC_CONSOLE_FLOWS } from "./public-flows.ts";
 import { tenancyDeclared } from "./store.ts";
 
@@ -38,7 +41,8 @@ const ClaimIn = z.object({
   claimCode: z.string().min(1),
   email: z.string().email(),
   name: z.string().min(1),
-  password: z.string().min(8),
+  /** Matches default operator password policy (minLength 12). */
+  password: z.string().min(12),
 });
 
 const SessionOut = z.object({
@@ -292,7 +296,11 @@ const InvokeOut = z.object({
 });
 
 const SetupClosed = z.object({ reason: z.string() });
-const ClaimFailed = z.object({ reason: z.string() });
+const ClaimFailed = z.object({
+  reason: z.string(),
+  /** Password-policy detail lines when `reason` is `password_policy`. */
+  reasons: z.array(z.string()).optional(),
+});
 const AuthFailed = z.object({});
 const AuthRateLimited = z.object({ reason: z.string() });
 const NotFound = z.object({ flowId: z.string() });
@@ -1688,17 +1696,39 @@ function createSetupClaim(state: ConsoleState) {
     errors: { SetupClosed, ClaimFailed },
     do: async (input: z.infer<typeof ClaimIn>, fx) => {
       if (state.setupClosed) {
-        return fail("SetupClosed", { reason: "first operator already exists" });
+        const data = { reason: "first_operator_exists" };
+        return fail("SetupClosed", data, { message: consoleFailureMessage("SetupClosed", data) });
       }
       const verified = verifyClaimCode(state.claim, input.claimCode, state.now);
       if (!verified.ok) {
-        return fail("ClaimFailed", { reason: verified.reason });
+        const data = { reason: verified.reason };
+        return fail("ClaimFailed", data, { message: consoleFailureMessage("ClaimFailed", data) });
+      }
+      let op: Awaited<ReturnType<typeof createOperator>>;
+      try {
+        op = await createOperator(state.operators, {
+          email: input.email,
+          name: input.name,
+          password: input.password,
+        });
+      } catch (err) {
+        if (err instanceof PasswordPolicyError) {
+          const data = {
+            reason: "password_policy",
+            reasons: [...err.reasons],
+          };
+          return fail("ClaimFailed", data, {
+            message: consoleFailureMessage("ClaimFailed", data),
+          });
+        }
+        if (err instanceof BreachCheckError) {
+          const data = { reason: "password_breached" };
+          return fail("ClaimFailed", data, {
+            message: consoleFailureMessage("ClaimFailed", data),
+          });
+        }
+        throw err;
       }
-      const op = await createOperator(state.operators, {
-        email: input.email,
-        name: input.name,
-        password: input.password,
-      });
       state.persistOperator(op.id);
       const issued = await issueOperatorSession(state, op.id);
       fx.log.info("console.setup.claim", { operatorId: op.id });

package/src/console/server/i18n.ts

@@ -0,0 +1,41 @@
+/**
+ * Console-only failure copy — kept out of kernel built-in catalogs so the
+ * edge profile and app exports do not pay for operator-claim strings.
+ */
+
+const en = {
+  ClaimFailed: "Could not create the first operator.",
+  "ClaimFailed.mismatch": "That claim code does not match. Copy it from the boot log.",
+  "ClaimFailed.expired": "That claim code expired. Restart `oke dev` for a new one.",
+  "ClaimFailed.rate_limited": "Too many claim attempts. Wait a minute and try again.",
+  "ClaimFailed.missing": "No claim code is active. Restart `oke dev` to mint one.",
+  "ClaimFailed.password_policy":
+    "Password needs at least 12 characters, including a letter and a number.",
+  "ClaimFailed.password_breached":
+    "Choose a different password — this one appears in a breach list.",
+  SetupClosed: "Setup is closed — an operator already exists. Sign in instead.",
+  "SetupClosed.first_operator_exists":
+    "Setup is closed — an operator already exists. Sign in instead.",
+} as const;
+
+/**
+ * Resolve a Console claim/setup failure message (English; boot log is EN).
+ *
+ * @param code - Failure code
+ * @param data - Failure data (may include `reason`)
+ */
+export function consoleFailureMessage(code: string, data?: unknown): string {
+  const reason =
+    data !== null &&
+    data !== undefined &&
+    typeof data === "object" &&
+    "reason" in data &&
+    typeof (data as { reason: unknown }).reason === "string"
+      ? (data as { reason: string }).reason
+      : undefined;
+  if (reason) {
+    const keyed = en[`${code}.${reason}` as keyof typeof en];
+    if (keyed !== undefined) return keyed;
+  }
+  return en[code as keyof typeof en] ?? code;
+}

package/src/console/server/vault.ts

@@ -6,21 +6,16 @@
  * rotation blast radius are derived — never reimplemented in the UI.
  */
 
-import { readFileSync } from "node:fs";
-import { resolve } from "node:path";
 import type { ConfigEnv } from "../../config/index.ts";
-import { envVaultDriver, memoryVaultDriver, openbaoVaultDriver } from "../../drivers/index.ts";
-import { parseDotenv } from "../../drivers/vault-dotenv-parse.ts";
+import { buildVaultBootChain } from "../../elements/vault/boot-chain.ts";
 import {
   createVaultRuntime,
   vault as declareVault,
-  type VaultChainLayer,
   type VaultResolutionSource,
   type VaultResolutionStep,
   type VaultRuntime,
   type VaultSecretDecl,
 } from "../../elements/vault.ts";
-import { resolveComposeEnvPath } from "../../elements/vault/chain.ts";
 import type { JournalRun, JournalStore } from "../../kernel/journal.ts";
 import type { Manifest } from "../../manifest/types.ts";
 
@@ -236,41 +231,20 @@ export async function createManifestVaultRuntime(
   });
 
   const seed = options.seed ?? {};
-  const composeEnv = resolveComposeEnvPath(cwd);
-  const envMap = parseDotenv(readFileSync(composeEnv.path, "utf8").toString());
-  const openbaoUrl = process.env.OKE_VAULT_URL ?? envMap.get("OKE_VAULT_URL");
-  const openbaoToken = process.env.OKE_VAULT_TOKEN ?? envMap.get("OKE_VAULT_TOKEN");
-  const openbaoMount = process.env.OKE_VAULT_MOUNT ?? envMap.get("OKE_VAULT_MOUNT") ?? "secret";
-  const driverLayer: VaultChainLayer =
-    openbaoUrl && openbaoToken
-      ? {
-          driver: openbaoVaultDriver,
-          source: "driver",
-          options: { url: openbaoUrl, token: openbaoToken, mount: openbaoMount },
-        }
-      : {
-          driver: memoryVaultDriver,
-          source: "driver",
-          options: { secrets: seed },
-        };
+  const env = options.env ?? "local";
+  // Auto-detect: prefer OpenBao when credentials exist; soft-fallback to memory
+  // (historical Console behaviour — never fail the Console for missing vault).
   const runtime = createVaultRuntime({
     secrets,
-    allowDevFallbacks: options.allowDevFallbacks ?? (options.env ?? "local") !== "prod",
+    allowDevFallbacks: options.allowDevFallbacks ?? env !== "prod",
     now: options.now,
-    chain: [
-      { driver: envVaultDriver, source: "process.env" },
-      {
-        driver: envVaultDriver,
-        source: ".env.local",
-        options: { path: resolve(cwd, ".env.local") },
-      },
-      {
-        driver: envVaultDriver,
-        source: composeEnv.source,
-        options: { path: composeEnv.path },
-      },
-      driverLayer,
-    ],
+    chain: buildVaultBootChain({
+      cwd,
+      driverId: "openbao",
+      env,
+      seed,
+      missingOpenbao: "memory",
+    }),
   });
   await runtime.boot();
   return runtime;