openmates 0.25.0-alpha.1 → 0.25.0

package/dist/{chunk-4KYSLHVG.js → chunk-TUVCWVER.js}

@@ -33831,15 +33831,37 @@ async function readRuntimeIncidentState(installDir, role) {
     throw error;
   }
 }
-async function writeRuntimeIncidentState(installDir, role, state) {
+async function runtimeIncidentStateOwner(installDir, effectiveUid = process.geteuid?.() ?? process.getuid?.()) {
+  if (effectiveUid !== 0) return null;
+  const rootDir = path.join(installDir, ".openmates");
+  const stateDir2 = path.join(rootDir, "runtime-health");
+  const [rootInfo, stateInfo] = await Promise.all([fs.lstat(rootDir), fs.lstat(stateDir2)]);
+  for (const info of [rootInfo, stateInfo]) {
+    if (!info.isDirectory() || info.isSymbolicLink() || (info.mode & 511) !== 448) {
+      throw new Error("Runtime health state requires private installer-owned directories.");
+    }
+  }
+  if (rootInfo.uid !== stateInfo.uid || rootInfo.gid !== stateInfo.gid) {
+    throw new Error("Runtime health state directories have conflicting owners.");
+  }
+  return { uid: stateInfo.uid, gid: stateInfo.gid };
+}
+async function writeRuntimeIncidentState(installDir, role, state, effectiveUid = process.geteuid?.() ?? process.getuid?.()) {
   const stateDir2 = path.join(installDir, ".openmates", "runtime-health");
   const statePath = path.join(stateDir2, `${role}.json`);
-  const temporaryPath = `${statePath}.${process.pid}.tmp`;
+  const temporaryPath = `${statePath}.${randomUUID13()}.tmp`;
   await fs.mkdir(stateDir2, { recursive: true, mode: 448 });
-  await fs.writeFile(temporaryPath, `${JSON.stringify(state, null, 2)}
-`, { mode: 384 });
-  await fs.rename(temporaryPath, statePath);
-  await fs.chmod(statePath, 384);
+  const owner = await runtimeIncidentStateOwner(installDir, effectiveUid);
+  try {
+    await fs.writeFile(temporaryPath, `${JSON.stringify(state, null, 2)}
+`, { flag: "wx", mode: 384 });
+    if (owner && (owner.uid !== 0 || owner.gid !== 0)) await fs.chown(temporaryPath, owner.uid, owner.gid);
+    await fs.rename(temporaryPath, statePath);
+    await fs.chmod(statePath, 384);
+  } catch (error) {
+    await fs.rm(temporaryPath, { force: true }).catch(() => void 0);
+    throw error;
+  }
 }
 function isPrivateAddress(address) {
   const normalized = address.toLowerCase();
@@ -34736,6 +34758,56 @@ function lifecycleServiceSelection(role, flags, config) {
   }
   return { services: [], requested: false };
 }
+function validateReuseCompletedSetupScope(input) {
+  if (input.role !== "core" || input.installMode !== "image" || typeof input.servicesFlag !== "string" || input.excludeFlag !== void 0) {
+    throw new Error("--reuse-completed-setup requires a core image-mode update with explicit --services and no --exclude.");
+  }
+  if (!input.selectedServices.length || input.selectedServices.some((service) => service !== "api" && service !== "prometheus" && !service.endsWith("-worker"))) {
+    throw new Error("--reuse-completed-setup allows only api, worker, and prometheus services; exclude setup and infrastructure services.");
+  }
+  if (!/^sha-[a-f0-9]{40}$/i.test(input.targetTag)) {
+    throw new Error("--reuse-completed-setup requires an immutable --image-tag sha-<40 hex characters>.");
+  }
+}
+function validateReuseCompletedSetup(input) {
+  validateReuseCompletedSetupScope(input);
+  const expectedImage = `${input.registry.replace(/\/$/, "")}/openmates-cms-setup:${input.targetTag}`;
+  if (input.setup.image !== expectedImage || input.setup.status !== "exited" || input.setup.exitCode !== 0) {
+    throw new Error(`--reuse-completed-setup requires cms-setup exited successfully with target image ${expectedImage}.`);
+  }
+  for (const service of ["cms", "cms-database", "cache", "vault"]) {
+    const state = input.dependencies[service];
+    if (!state || state.status !== "running" || state.health !== void 0 && state.health !== "healthy") {
+      throw new Error(`--reuse-completed-setup requires running, healthy ${service}.`);
+    }
+  }
+}
+function imageUpdateUpArgs(baseArgs, selectedServices, filterRequested, reuseCompletedSetup) {
+  if (reuseCompletedSetup && (!filterRequested || selectedServices.length === 0)) {
+    throw new Error("--reuse-completed-setup requires explicitly selected services.");
+  }
+  return appendSelectedServices([...baseArgs, "up", "-d", ...reuseCompletedSetup ? ["--no-deps"] : []], selectedServices, filterRequested);
+}
+function inspectReuseCompletedSetupContainer(installPath, withOverrides, service, includeStopped) {
+  const compose = composeArgs(installPath, withOverrides, "image", "core", false);
+  const ps = spawnSync("docker", [...compose, "ps", ...includeStopped ? ["-a"] : [], "-q", service], { cwd: installPath, encoding: "utf8", timeout: 5e3 });
+  const ids = ps.status === 0 ? ps.stdout.trim().split(/\s+/).filter(Boolean) : [];
+  if (ids.length !== 1) throw new Error(`--reuse-completed-setup could not identify one ${service} container.`);
+  const inspect = (format) => {
+    const result = spawnSync("docker", ["inspect", "--format", format, ids[0]], { cwd: installPath, encoding: "utf8", timeout: 5e3 });
+    if (result.status !== 0) throw new Error(`--reuse-completed-setup could not inspect ${service}.`);
+    return result.stdout.trim();
+  };
+  const image = JSON.parse(inspect("{{json .Config.Image}}"));
+  const state = JSON.parse(inspect("{{json .State}}"));
+  return { image, status: state.Status, exitCode: state.ExitCode, health: state.Health?.Status };
+}
+function verifyReuseCompletedSetup(installPath, withOverrides, input) {
+  validateReuseCompletedSetupScope(input);
+  const setup = inspectReuseCompletedSetupContainer(installPath, withOverrides, "cms-setup", true);
+  const dependencies = Object.fromEntries(["cms", "cms-database", "cache", "vault"].map((service) => [service, inspectReuseCompletedSetupContainer(installPath, withOverrides, service, false)]));
+  validateReuseCompletedSetup({ ...input, setup, dependencies });
+}
 function shouldPullImages() {
   return process.env.OPENMATES_SKIP_IMAGE_PULL !== "1";
 }
@@ -34798,10 +34870,10 @@ ${renderFeatureOverrides(overrides)}`;
 function featureKind(featureId) {
   return featureId.split(":", 1)[0] || "unknown";
 }
-function composeArgs(installPath, withOverrides, installMode = getInstallMode(installPath), role = "core") {
+function composeArgs(installPath, withOverrides, installMode = getInstallMode(installPath), role = "core", materializeCloudNoWebapp = true) {
   const config = loadConfigForInstallPath(installPath);
   const deploymentMode = getInstallDeploymentMode(installPath, config);
-  ensureOfficialCloudNoWebappComposeFile(installPath, deploymentMode, role);
+  if (materializeCloudNoWebapp) ensureOfficialCloudNoWebappComposeFile(installPath, deploymentMode, role);
   const env = readEnvMap(installPath);
   const overlayPath = env.OPENMATES_CLOUD_OVERLAY_PATH || config?.openMatesCloudOverlayPath || void 0;
   const resolvedOverlayPath = overlayPath ?? defaultOpenMatesCloudOverlayPath(installPath);
@@ -36710,14 +36782,34 @@ async function serverUpdate(client2, rest, flags) {
   }
   const installPath = resolveServerPath(flags);
   const dryRun = flags["dry-run"] === true;
-  if (!dryRun) {
-    ensureGitWorkDirEnv(installPath);
-    ensureRuntimeMetricsDirectory(installPath);
-  }
   const config = loadConfigForInstallPath(installPath);
   const role = getServerRole(flags, config);
   const withOverrides = config?.composeProfile === "full";
   const installMode = getInstallMode(installPath, config);
+  const reuseCompletedSetup = flags["reuse-completed-setup"] === true;
+  if (flags["reuse-completed-setup"] !== void 0 && !reuseCompletedSetup) {
+    throw new Error("--reuse-completed-setup does not take a value.");
+  }
+  let guardedTarget;
+  if (reuseCompletedSetup) {
+    const selection = lifecycleServiceSelection(role, flags, config);
+    const requested = resolveTargetImageTag(flags, getImageTagFromEnv(installPath, config), getPackageVersion());
+    guardedTarget = requested.channel === "stable" ? { ...requested, tag: await resolveStableImageTag() } : requested;
+    requireDocker();
+    verifyReuseCompletedSetup(installPath, withOverrides, {
+      role,
+      installMode,
+      servicesFlag: flags.services,
+      excludeFlag: flags.exclude,
+      selectedServices: selection.services,
+      targetTag: guardedTarget.tag,
+      registry: DEFAULT_IMAGE_REGISTRY
+    });
+  }
+  if (!dryRun) {
+    ensureGitWorkDirEnv(installPath);
+    ensureRuntimeMetricsDirectory(installPath);
+  }
   const deploymentMode = getInstallDeploymentMode(installPath, config);
   const caddyPlan = caddyUpdatePlan(installPath, role, config, flags);
   const releaseUpdateLock = dryRun ? () => void 0 : acquireServerUpdateLock(installPath);
@@ -36742,7 +36834,7 @@ async function serverUpdate(client2, rest, flags) {
     if (installMode === "image") {
       const currentTag = getImageTagFromEnv(installPath, config);
       const requestedTarget = resolveTargetImageTag(flags, currentTag, getPackageVersion());
-      const target = requestedTarget.channel === "stable" ? { ...requestedTarget, tag: await resolveStableImageTag() } : requestedTarget;
+      const target = guardedTarget ?? (requestedTarget.channel === "stable" ? { ...requestedTarget, tag: await resolveStableImageTag() } : requestedTarget);
       const templateRef = templateRefForImageTag(target.tag, getPackageVersion());
       const sourceLinks = targetSourceLinks(target.tag, templateRef);
       const safetyPlan = planUpdate({ role, selectedServices, dryRun, skipBackup: flags["skip-backup"] === true, continuous: false, missingRequiredSecrets: missingOrUnverifiedSecrets });
@@ -36763,6 +36855,7 @@ async function serverUpdate(client2, rest, flags) {
         secretPreflight,
         providerKeyReminders: secretPreflight.emptySecretEnvKeys,
         sourceLinks,
+        reuseCompletedSetup,
         blocked: safetyPlan.blocked,
         blockReason: safetyPlan.blockReason,
         dryRun
@@ -36786,7 +36879,7 @@ async function serverUpdate(client2, rest, flags) {
           if (secretPreflight.emptySecretEnvKeys.length) {
             console.log(`  Provider keys: add ${secretPreflight.emptySecretEnvKeys.join(", ")} to activate those providers`);
           }
-          console.log("  Commands:      refresh compose, docker compose pull, docker compose up -d, health checks");
+          console.log(`  Commands:      refresh compose, docker compose pull, docker compose up -d${reuseCompletedSetup ? " --no-deps" : ""}, health checks`);
         }
         return;
       }
@@ -36826,11 +36919,23 @@ async function serverUpdate(client2, rest, flags) {
       } else {
         console.error("Skipping image pull because OPENMATES_SKIP_IMAGE_PULL=1.");
       }
+      if (reuseCompletedSetup) {
+        verifyReuseCompletedSetup(installPath, withOverrides, {
+          role,
+          installMode,
+          servicesFlag: flags.services,
+          excludeFlag: flags.exclude,
+          selectedServices,
+          targetTag: target.tag,
+          registry: DEFAULT_IMAGE_REGISTRY
+        });
+      }
       writeServerUpdateStatus(installPath, role, { status: "in_progress", targetImageTag: target.tag, sourceLinks, providerKeyReminders: secretPreflight.emptySecretEnvKeys, step: "up" });
-      const upArgs2 = appendSelectedServices(
-        [...composeArgs(installPath, withOverrides, installMode, role), "up", "-d"],
+      const upArgs2 = imageUpdateUpArgs(
+        composeArgs(installPath, withOverrides, installMode, role),
         selectedServices,
-        filterRequested
+        filterRequested,
+        reuseCompletedSetup
       );
       code2 = await runInteractive("docker", upArgs2, installPath);
       if (code2 !== 0) throw new Error(`Docker image restart failed with exit code ${code2}.`);
@@ -38095,6 +38200,7 @@ Command Options:
     --exclude <csv>     Update all role services except selected services
     --image-tag <tag>   Image mode: update to a specific prebuilt image tag
     --channel <name>    Image mode: update using stable/main or dev channel tags
+    --reuse-completed-setup  Core image mode: reuse verified sha-<40 hex> cms-setup with explicit --services
     --continuous        Run continuously in foreground, or use with install-service
     --interval <min>    Foreground continuous update interval (default: 30)
     install-service --continuous --channel <name> --window <window>

package/dist/cli.js

@@ -19,7 +19,7 @@ import {
   serializeToYaml,
   shouldRequireTrustedAccountGuard,
   waitForWorkflowRun
-} from "./chunk-4KYSLHVG.js";
+} from "./chunk-TUVCWVER.js";
 import "./chunk-IWKP55ZB.js";
 import "./chunk-BBKJZ23O.js";
 export {

package/dist/index.js

@@ -43,7 +43,7 @@ import {
   selectAssistantMessagesForSpeech,
   serializeToYaml,
   summarizeAssistantSpeech
-} from "./chunk-4KYSLHVG.js";
+} from "./chunk-TUVCWVER.js";
 import "./chunk-IWKP55ZB.js";
 import "./chunk-BBKJZ23O.js";
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmates",
-  "version": "0.25.0-alpha.1",
+  "version": "0.25.0",
   "description": "OpenMates CLI and SDK",
   "type": "module",
   "main": "dist/index.js",

package/templates/core/docker-compose.selfhost.yml

@@ -296,6 +296,7 @@ services:
       <<: *openmates-worker-env
       CELERY_QUEUES: app_ai
       CELERY_AUTOSCALE_MAX: ${APP_AI_WORKER_CONCURRENCY:-${CELERY_AUTOSCALE_MAX:-3}}
+      CELERY_METRICS_PORT: "9102"
     command: >
       sh -c "chown -R celeryuser:celeryuser /vault-data && gosu celeryuser python -m celery -A backend.core.api.app.tasks.celery_config worker --loglevel=info --queues=app_ai --concurrency=$${CELERY_AUTOSCALE_MAX} --max-tasks-per-child=50 --max-memory-per-child=600000 --prefetch-multiplier=1"
 
@@ -307,6 +308,7 @@ services:
       <<: *openmates-worker-env
       CELERY_QUEUES: app_images
       CELERY_AUTOSCALE_MAX: ${APP_IMAGES_WORKER_CONCURRENCY:-${CELERY_AUTOSCALE_MAX:-3}}
+      CELERY_METRICS_PORT: "9103"
     command: >
       sh -c "chown -R celeryuser:celeryuser /vault-data && gosu celeryuser python -m celery -A backend.core.api.app.tasks.celery_config worker --loglevel=info --queues=app_images --concurrency=$${CELERY_AUTOSCALE_MAX} --max-tasks-per-child=50 --max-memory-per-child=600000 --prefetch-multiplier=1"
 
@@ -340,6 +342,7 @@ services:
     environment:
       <<: *openmates-worker-env
       CELERY_QUEUES: app_pdf
+      CELERY_METRICS_PORT: "9104"
     command: >
       sh -c "chown -R celeryuser:celeryuser /vault-data && gosu celeryuser python -m celery -A backend.core.api.app.tasks.celery_config worker --loglevel=info --queues=app_pdf --concurrency=2 --max-tasks-per-child=10 --max-memory-per-child=1000000 --prefetch-multiplier=1"