openmates 0.25.0-alpha.0 → 0.25.0-alpha.2

package/dist/{chunk-VEUFTIP4.js → chunk-TUVCWVER.js}

@@ -32647,7 +32647,7 @@ var ROLE_DEFINITIONS = {
     dataBearing: true,
     requiredServices: ["api", "cms", "cms-database", "cache", "vault", "vault-setup", "cms-setup"],
     optionalServices: [...CORE_WORKER_SERVICES, "admin-sidecar", "webapp", "openobserve", "promtail", "prometheus", "cadvisor", "node-exporter", "alertmanager"],
-    healthChecks: ["http://localhost:8000/health"],
+    healthChecks: ["http://127.0.0.1:8000/health"],
     templatePath: "templates/core/docker-compose.selfhost.yml",
     composeFile: "backend/core/docker-compose.selfhost.yml"
   },
@@ -32655,7 +32655,7 @@ var ROLE_DEFINITIONS = {
     dataBearing: true,
     requiredServices: ["app-uploads", "clamav", "vault", "vault-setup", "admin-sidecar"],
     optionalServices: [],
-    healthChecks: ["http://localhost:8000/health"],
+    healthChecks: ["http://127.0.0.1:8000/health"],
     templatePath: "templates/upload/docker-compose.yml",
     composeFile: "backend/upload/docker-compose.yml"
   },
@@ -32663,7 +32663,7 @@ var ROLE_DEFINITIONS = {
     dataBearing: false,
     requiredServices: ["preview", "admin-sidecar"],
     optionalServices: ["cache"],
-    healthChecks: ["http://localhost:8080/health"],
+    healthChecks: ["http://127.0.0.1:8080/health"],
     templatePath: "templates/preview/docker-compose.preview.yml",
     composeFile: "backend/preview/docker-compose.preview.yml"
   }
@@ -33831,15 +33831,37 @@ async function readRuntimeIncidentState(installDir, role) {
     throw error;
   }
 }
-async function writeRuntimeIncidentState(installDir, role, state) {
+async function runtimeIncidentStateOwner(installDir, effectiveUid = process.geteuid?.() ?? process.getuid?.()) {
+  if (effectiveUid !== 0) return null;
+  const rootDir = path.join(installDir, ".openmates");
+  const stateDir2 = path.join(rootDir, "runtime-health");
+  const [rootInfo, stateInfo] = await Promise.all([fs.lstat(rootDir), fs.lstat(stateDir2)]);
+  for (const info of [rootInfo, stateInfo]) {
+    if (!info.isDirectory() || info.isSymbolicLink() || (info.mode & 511) !== 448) {
+      throw new Error("Runtime health state requires private installer-owned directories.");
+    }
+  }
+  if (rootInfo.uid !== stateInfo.uid || rootInfo.gid !== stateInfo.gid) {
+    throw new Error("Runtime health state directories have conflicting owners.");
+  }
+  return { uid: stateInfo.uid, gid: stateInfo.gid };
+}
+async function writeRuntimeIncidentState(installDir, role, state, effectiveUid = process.geteuid?.() ?? process.getuid?.()) {
   const stateDir2 = path.join(installDir, ".openmates", "runtime-health");
   const statePath = path.join(stateDir2, `${role}.json`);
-  const temporaryPath = `${statePath}.${process.pid}.tmp`;
+  const temporaryPath = `${statePath}.${randomUUID13()}.tmp`;
   await fs.mkdir(stateDir2, { recursive: true, mode: 448 });
-  await fs.writeFile(temporaryPath, `${JSON.stringify(state, null, 2)}
-`, { mode: 384 });
-  await fs.rename(temporaryPath, statePath);
-  await fs.chmod(statePath, 384);
+  const owner = await runtimeIncidentStateOwner(installDir, effectiveUid);
+  try {
+    await fs.writeFile(temporaryPath, `${JSON.stringify(state, null, 2)}
+`, { flag: "wx", mode: 384 });
+    if (owner && (owner.uid !== 0 || owner.gid !== 0)) await fs.chown(temporaryPath, owner.uid, owner.gid);
+    await fs.rename(temporaryPath, statePath);
+    await fs.chmod(statePath, 384);
+  } catch (error) {
+    await fs.rm(temporaryPath, { force: true }).catch(() => void 0);
+    throw error;
+  }
 }
 function isPrivateAddress(address) {
   const normalized = address.toLowerCase();
@@ -34159,7 +34181,7 @@ function selectExpectedServerApiUrl(input) {
   if (input.allowExplicitOverride && input.explicitApiUrl?.trim()) {
     return input.explicitApiUrl;
   }
-  return input.configuredApiUrl || "http://localhost:8000";
+  return input.configuredApiUrl || "http://127.0.0.1:8000";
 }
 function mergeQuickServerTestUpdateStatus(current, outcome) {
   const { role: _role, updated_at: _updatedAt, ...status } = current;
@@ -34736,6 +34758,56 @@ function lifecycleServiceSelection(role, flags, config) {
   }
   return { services: [], requested: false };
 }
+function validateReuseCompletedSetupScope(input) {
+  if (input.role !== "core" || input.installMode !== "image" || typeof input.servicesFlag !== "string" || input.excludeFlag !== void 0) {
+    throw new Error("--reuse-completed-setup requires a core image-mode update with explicit --services and no --exclude.");
+  }
+  if (!input.selectedServices.length || input.selectedServices.some((service) => service !== "api" && service !== "prometheus" && !service.endsWith("-worker"))) {
+    throw new Error("--reuse-completed-setup allows only api, worker, and prometheus services; exclude setup and infrastructure services.");
+  }
+  if (!/^sha-[a-f0-9]{40}$/i.test(input.targetTag)) {
+    throw new Error("--reuse-completed-setup requires an immutable --image-tag sha-<40 hex characters>.");
+  }
+}
+function validateReuseCompletedSetup(input) {
+  validateReuseCompletedSetupScope(input);
+  const expectedImage = `${input.registry.replace(/\/$/, "")}/openmates-cms-setup:${input.targetTag}`;
+  if (input.setup.image !== expectedImage || input.setup.status !== "exited" || input.setup.exitCode !== 0) {
+    throw new Error(`--reuse-completed-setup requires cms-setup exited successfully with target image ${expectedImage}.`);
+  }
+  for (const service of ["cms", "cms-database", "cache", "vault"]) {
+    const state = input.dependencies[service];
+    if (!state || state.status !== "running" || state.health !== void 0 && state.health !== "healthy") {
+      throw new Error(`--reuse-completed-setup requires running, healthy ${service}.`);
+    }
+  }
+}
+function imageUpdateUpArgs(baseArgs, selectedServices, filterRequested, reuseCompletedSetup) {
+  if (reuseCompletedSetup && (!filterRequested || selectedServices.length === 0)) {
+    throw new Error("--reuse-completed-setup requires explicitly selected services.");
+  }
+  return appendSelectedServices([...baseArgs, "up", "-d", ...reuseCompletedSetup ? ["--no-deps"] : []], selectedServices, filterRequested);
+}
+function inspectReuseCompletedSetupContainer(installPath, withOverrides, service, includeStopped) {
+  const compose = composeArgs(installPath, withOverrides, "image", "core", false);
+  const ps = spawnSync("docker", [...compose, "ps", ...includeStopped ? ["-a"] : [], "-q", service], { cwd: installPath, encoding: "utf8", timeout: 5e3 });
+  const ids = ps.status === 0 ? ps.stdout.trim().split(/\s+/).filter(Boolean) : [];
+  if (ids.length !== 1) throw new Error(`--reuse-completed-setup could not identify one ${service} container.`);
+  const inspect = (format) => {
+    const result = spawnSync("docker", ["inspect", "--format", format, ids[0]], { cwd: installPath, encoding: "utf8", timeout: 5e3 });
+    if (result.status !== 0) throw new Error(`--reuse-completed-setup could not inspect ${service}.`);
+    return result.stdout.trim();
+  };
+  const image = JSON.parse(inspect("{{json .Config.Image}}"));
+  const state = JSON.parse(inspect("{{json .State}}"));
+  return { image, status: state.Status, exitCode: state.ExitCode, health: state.Health?.Status };
+}
+function verifyReuseCompletedSetup(installPath, withOverrides, input) {
+  validateReuseCompletedSetupScope(input);
+  const setup = inspectReuseCompletedSetupContainer(installPath, withOverrides, "cms-setup", true);
+  const dependencies = Object.fromEntries(["cms", "cms-database", "cache", "vault"].map((service) => [service, inspectReuseCompletedSetupContainer(installPath, withOverrides, service, false)]));
+  validateReuseCompletedSetup({ ...input, setup, dependencies });
+}
 function shouldPullImages() {
   return process.env.OPENMATES_SKIP_IMAGE_PULL !== "1";
 }
@@ -34798,10 +34870,10 @@ ${renderFeatureOverrides(overrides)}`;
 function featureKind(featureId) {
   return featureId.split(":", 1)[0] || "unknown";
 }
-function composeArgs(installPath, withOverrides, installMode = getInstallMode(installPath), role = "core") {
+function composeArgs(installPath, withOverrides, installMode = getInstallMode(installPath), role = "core", materializeCloudNoWebapp = true) {
   const config = loadConfigForInstallPath(installPath);
   const deploymentMode = getInstallDeploymentMode(installPath, config);
-  ensureOfficialCloudNoWebappComposeFile(installPath, deploymentMode, role);
+  if (materializeCloudNoWebapp) ensureOfficialCloudNoWebappComposeFile(installPath, deploymentMode, role);
   const env = readEnvMap(installPath);
   const overlayPath = env.OPENMATES_CLOUD_OVERLAY_PATH || config?.openMatesCloudOverlayPath || void 0;
   const resolvedOverlayPath = overlayPath ?? defaultOpenMatesCloudOverlayPath(installPath);
@@ -34935,7 +35007,7 @@ function firstCsvValue(value) {
 }
 function deriveSelfHostCliUrls(envContent) {
   return {
-    apiUrl: firstCsvValue(getEnvVar(envContent, "VITE_API_URL")) || "http://localhost:8000",
+    apiUrl: firstCsvValue(getEnvVar(envContent, "VITE_API_URL")) || "http://127.0.0.1:8000",
     appUrl: firstCsvValue(getEnvVar(envContent, "PRODUCTION_URL")) || "http://localhost:5173"
   };
 }
@@ -34958,6 +35030,14 @@ function packagedCaddyTemplatePath(role) {
 function packagedCoreAlertmanagerTemplatePath() {
   return join15(dirname8(new URL(import.meta.url).pathname), "..", "templates", "core", "monitoring", "alertmanager", "alertmanager.yml");
 }
+function ensureCoreAlertmanagerRuntimeFile(installPath) {
+  const templatePath = packagedCoreAlertmanagerTemplatePath();
+  if (!existsSync13(templatePath)) throw new Error(`Packaged Alertmanager config not found: ${templatePath}`);
+  const runtimePath = join15(installPath, CORE_ALERTMANAGER_CONFIG_FILE);
+  if (fileHash(templatePath) === fileHash(runtimePath)) return;
+  mkdirSync13(dirname8(runtimePath), { recursive: true });
+  copyFileSync2(templatePath, runtimePath);
+}
 function ensureCorePrometheusRuntimeFiles(installPath) {
   const packagedDir = join15(dirname8(new URL(import.meta.url).pathname), "..", "templates", "core", "monitoring", "prometheus");
   const runtimeDir = join15(installPath, CORE_PROMETHEUS_CONFIG_DIR);
@@ -35029,11 +35109,7 @@ async function writeImageModeRuntimeFiles(installPath, imageTag, role) {
     const promtailConfigPath = join15(installPath, CORE_PROMTAIL_CONFIG_FILE);
     mkdirSync13(dirname8(promtailConfigPath), { recursive: true });
     writeFileSync8(promtailConfigPath, SELFHOST_PROMTAIL_CONFIG_TEMPLATE);
-    const alertmanagerTemplatePath = packagedCoreAlertmanagerTemplatePath();
-    if (!existsSync13(alertmanagerTemplatePath)) throw new Error(`Packaged Alertmanager config not found: ${alertmanagerTemplatePath}`);
-    const alertmanagerConfigPath = join15(installPath, CORE_ALERTMANAGER_CONFIG_FILE);
-    mkdirSync13(dirname8(alertmanagerConfigPath), { recursive: true });
-    copyFileSync2(alertmanagerTemplatePath, alertmanagerConfigPath);
+    ensureCoreAlertmanagerRuntimeFile(installPath);
   }
   writeFileSync8(join15(vaultConfigDir, "vault.hcl"), VAULT_CONFIG_TEMPLATE);
   ensureImageRuntimeConfig(installPath);
@@ -35081,7 +35157,7 @@ async function checkUrl(url) {
 }
 async function waitForServerHealth(installPath, role = "core", options = {}) {
   if (role === "upload" || role === "preview") {
-    const healthUrl = role === "upload" ? "http://localhost:8000/health" : "http://localhost:8080/health";
+    const healthUrl = planServerRuntime({ role }).healthChecks[0];
     const deadline2 = Date.now() + UPDATE_HEALTH_TIMEOUT_MS;
     while (Date.now() < deadline2) {
       if (await checkUrl(healthUrl)) return;
@@ -36706,14 +36782,34 @@ async function serverUpdate(client2, rest, flags) {
   }
   const installPath = resolveServerPath(flags);
   const dryRun = flags["dry-run"] === true;
-  if (!dryRun) {
-    ensureGitWorkDirEnv(installPath);
-    ensureRuntimeMetricsDirectory(installPath);
-  }
   const config = loadConfigForInstallPath(installPath);
   const role = getServerRole(flags, config);
   const withOverrides = config?.composeProfile === "full";
   const installMode = getInstallMode(installPath, config);
+  const reuseCompletedSetup = flags["reuse-completed-setup"] === true;
+  if (flags["reuse-completed-setup"] !== void 0 && !reuseCompletedSetup) {
+    throw new Error("--reuse-completed-setup does not take a value.");
+  }
+  let guardedTarget;
+  if (reuseCompletedSetup) {
+    const selection = lifecycleServiceSelection(role, flags, config);
+    const requested = resolveTargetImageTag(flags, getImageTagFromEnv(installPath, config), getPackageVersion());
+    guardedTarget = requested.channel === "stable" ? { ...requested, tag: await resolveStableImageTag() } : requested;
+    requireDocker();
+    verifyReuseCompletedSetup(installPath, withOverrides, {
+      role,
+      installMode,
+      servicesFlag: flags.services,
+      excludeFlag: flags.exclude,
+      selectedServices: selection.services,
+      targetTag: guardedTarget.tag,
+      registry: DEFAULT_IMAGE_REGISTRY
+    });
+  }
+  if (!dryRun) {
+    ensureGitWorkDirEnv(installPath);
+    ensureRuntimeMetricsDirectory(installPath);
+  }
   const deploymentMode = getInstallDeploymentMode(installPath, config);
   const caddyPlan = caddyUpdatePlan(installPath, role, config, flags);
   const releaseUpdateLock = dryRun ? () => void 0 : acquireServerUpdateLock(installPath);
@@ -36738,7 +36834,7 @@ async function serverUpdate(client2, rest, flags) {
     if (installMode === "image") {
       const currentTag = getImageTagFromEnv(installPath, config);
       const requestedTarget = resolveTargetImageTag(flags, currentTag, getPackageVersion());
-      const target = requestedTarget.channel === "stable" ? { ...requestedTarget, tag: await resolveStableImageTag() } : requestedTarget;
+      const target = guardedTarget ?? (requestedTarget.channel === "stable" ? { ...requestedTarget, tag: await resolveStableImageTag() } : requestedTarget);
       const templateRef = templateRefForImageTag(target.tag, getPackageVersion());
       const sourceLinks = targetSourceLinks(target.tag, templateRef);
       const safetyPlan = planUpdate({ role, selectedServices, dryRun, skipBackup: flags["skip-backup"] === true, continuous: false, missingRequiredSecrets: missingOrUnverifiedSecrets });
@@ -36759,6 +36855,7 @@ async function serverUpdate(client2, rest, flags) {
         secretPreflight,
         providerKeyReminders: secretPreflight.emptySecretEnvKeys,
         sourceLinks,
+        reuseCompletedSetup,
         blocked: safetyPlan.blocked,
         blockReason: safetyPlan.blockReason,
         dryRun
@@ -36782,7 +36879,7 @@ async function serverUpdate(client2, rest, flags) {
           if (secretPreflight.emptySecretEnvKeys.length) {
             console.log(`  Provider keys: add ${secretPreflight.emptySecretEnvKeys.join(", ")} to activate those providers`);
           }
-          console.log("  Commands:      refresh compose, docker compose pull, docker compose up -d, health checks");
+          console.log(`  Commands:      refresh compose, docker compose pull, docker compose up -d${reuseCompletedSetup ? " --no-deps" : ""}, health checks`);
         }
         return;
       }
@@ -36822,11 +36919,23 @@ async function serverUpdate(client2, rest, flags) {
       } else {
         console.error("Skipping image pull because OPENMATES_SKIP_IMAGE_PULL=1.");
       }
+      if (reuseCompletedSetup) {
+        verifyReuseCompletedSetup(installPath, withOverrides, {
+          role,
+          installMode,
+          servicesFlag: flags.services,
+          excludeFlag: flags.exclude,
+          selectedServices,
+          targetTag: target.tag,
+          registry: DEFAULT_IMAGE_REGISTRY
+        });
+      }
       writeServerUpdateStatus(installPath, role, { status: "in_progress", targetImageTag: target.tag, sourceLinks, providerKeyReminders: secretPreflight.emptySecretEnvKeys, step: "up" });
-      const upArgs2 = appendSelectedServices(
-        [...composeArgs(installPath, withOverrides, installMode, role), "up", "-d"],
+      const upArgs2 = imageUpdateUpArgs(
+        composeArgs(installPath, withOverrides, installMode, role),
         selectedServices,
-        filterRequested
+        filterRequested,
+        reuseCompletedSetup
       );
       code2 = await runInteractive("docker", upArgs2, installPath);
       if (code2 !== 0) throw new Error(`Docker image restart failed with exit code ${code2}.`);
@@ -38091,6 +38200,7 @@ Command Options:
     --exclude <csv>     Update all role services except selected services
     --image-tag <tag>   Image mode: update to a specific prebuilt image tag
     --channel <name>    Image mode: update using stable/main or dev channel tags
+    --reuse-completed-setup  Core image mode: reuse verified sha-<40 hex> cms-setup with explicit --services
     --continuous        Run continuously in foreground, or use with install-service
     --interval <min>    Foreground continuous update interval (default: 30)
     install-service --continuous --channel <name> --window <window>

package/dist/cli.js

@@ -19,7 +19,7 @@ import {
   serializeToYaml,
   shouldRequireTrustedAccountGuard,
   waitForWorkflowRun
-} from "./chunk-VEUFTIP4.js";
+} from "./chunk-TUVCWVER.js";
 import "./chunk-IWKP55ZB.js";
 import "./chunk-BBKJZ23O.js";
 export {

package/dist/index.js

@@ -43,7 +43,7 @@ import {
   selectAssistantMessagesForSpeech,
   serializeToYaml,
   summarizeAssistantSpeech
-} from "./chunk-VEUFTIP4.js";
+} from "./chunk-TUVCWVER.js";
 import "./chunk-IWKP55ZB.js";
 import "./chunk-BBKJZ23O.js";
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmates",
-  "version": "0.25.0-alpha.0",
+  "version": "0.25.0-alpha.2",
   "description": "OpenMates CLI and SDK",
   "type": "module",
   "main": "dist/index.js",

package/templates/core/docker-compose.selfhost.yml

@@ -296,6 +296,7 @@ services:
       <<: *openmates-worker-env
       CELERY_QUEUES: app_ai
       CELERY_AUTOSCALE_MAX: ${APP_AI_WORKER_CONCURRENCY:-${CELERY_AUTOSCALE_MAX:-3}}
+      CELERY_METRICS_PORT: "9102"
     command: >
       sh -c "chown -R celeryuser:celeryuser /vault-data && gosu celeryuser python -m celery -A backend.core.api.app.tasks.celery_config worker --loglevel=info --queues=app_ai --concurrency=$${CELERY_AUTOSCALE_MAX} --max-tasks-per-child=50 --max-memory-per-child=600000 --prefetch-multiplier=1"
 
@@ -307,6 +308,7 @@ services:
       <<: *openmates-worker-env
       CELERY_QUEUES: app_images
       CELERY_AUTOSCALE_MAX: ${APP_IMAGES_WORKER_CONCURRENCY:-${CELERY_AUTOSCALE_MAX:-3}}
+      CELERY_METRICS_PORT: "9103"
     command: >
       sh -c "chown -R celeryuser:celeryuser /vault-data && gosu celeryuser python -m celery -A backend.core.api.app.tasks.celery_config worker --loglevel=info --queues=app_images --concurrency=$${CELERY_AUTOSCALE_MAX} --max-tasks-per-child=50 --max-memory-per-child=600000 --prefetch-multiplier=1"
 
@@ -340,6 +342,7 @@ services:
     environment:
       <<: *openmates-worker-env
       CELERY_QUEUES: app_pdf
+      CELERY_METRICS_PORT: "9104"
     command: >
       sh -c "chown -R celeryuser:celeryuser /vault-data && gosu celeryuser python -m celery -A backend.core.api.app.tasks.celery_config worker --loglevel=info --queues=app_pdf --concurrency=2 --max-tasks-per-child=10 --max-memory-per-child=1000000 --prefetch-multiplier=1"