openpalm 0.10.0-rc9 → 0.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openpalm",
-  "version": "0.10.0-rc9",
+  "version": "0.10.0",
   "type": "module",
   "license": "MPL-2.0",
   "description": "OpenPalm CLI — install and manage a self-hosted OpenPalm stack",
@@ -26,7 +26,7 @@
     "build:windows-arm64": "bun build src/main.ts --compile --target=bun-windows-arm64 --outfile dist/openpalm-cli-windows-arm64.exe"
   },
   "dependencies": {
-    "@openpalm/lib": ">=0.9.8 <1.0.0",
+    "@openpalm/lib": ">=0.10.0 <1.0.0",
     "citty": "^0.2.1",
     "yaml": "^2.8.0"
   }

package/src/commands/install.ts

@@ -5,7 +5,7 @@ import cliPkg from '../../package.json' with { type: 'json' };
 import { defaultWorkDir } from '../lib/paths.ts';
 import { resolveOpenPalmHome, resolveConfigDir, resolveVaultDir, resolveDataDir } from '@openpalm/lib';
 import { ensureSecrets, ensureStackEnv, resolveRequestedImageTag } from '../lib/env.ts';
-import { ensureDirectoryTree, seedOpenPalmDir, openBrowser, runDockerCompose } from '../lib/docker.ts';
+import { ensureDirectoryTree, seedOpenPalmDir, openBrowser, runDockerCompose, runDockerComposeCapture } from '../lib/docker.ts';
 import {
   ensureOpenCodeConfig, ensureOpenCodeSystemConfig,
   performSetup,
@@ -195,9 +195,15 @@ async function prepareInstallFiles(
   try { ensureOpenCodeConfig(); ensureOpenCodeSystemConfig(); } catch (err) { logger.debug('failed to ensure OpenCode config', { error: String(err) }); }
 
   try {
+    // Download + validate wrapped in a single timeout. The download can be
+    // slow on first install (binary fetch from GitHub) but must not block
+    // the install indefinitely — 30s is generous enough for most connections.
     await Promise.race([
-      runVarlockValidation(dataDir, vaultDir),
-      new Promise((_, reject) => setTimeout(() => reject(new Error('timeout')), 5_000)),
+      (async () => {
+        const varlockBin = await ensureVarlock();
+        await runVarlockValidation(varlockBin, vaultDir);
+      })(),
+      new Promise((_, reject) => setTimeout(() => reject(new Error('timeout')), 30_000)),
     ]);
     console.log('Configuration validated.');
   } catch (err) { logger.debug('varlock validation skipped', { error: String(err) }); }
@@ -246,6 +252,7 @@ async function runWizardInstall(configDir: string, noOpen: boolean, noStart = fa
   }
 
   console.log('Setup complete. Checking Docker...');
+  wizard.setDeploying(true);
   await requireDocker();
 
   console.log('Starting services...');
@@ -257,13 +264,16 @@ async function runWizardInstall(configDir: string, noOpen: boolean, noStart = fa
   const allServices = await buildManagedServices(state);
   const composeArgs = fullComposeArgs(state);
   try {
-    wizard.updateDeployStatus(buildDeployStatusEntries(allServices, 'pending', 'Waiting...'));
+    wizard.updateDeployStatus(buildDeployStatusEntries(allServices, 'pending', 'Pulling images...'));
     await runDockerCompose([...composeArgs, 'pull', ...allServices]).catch(() => {
       console.warn('Warning: image pull failed — if this is your first install, check your network connection.');
     });
     wizard.updateDeployStatus(buildDeployStatusEntries(allServices, 'pending', 'Starting...'));
     await runDockerCompose([...composeArgs, 'up', '-d', ...allServices]);
-    wizard.markAllRunning();
+
+    // Poll container health so the wizard shows real progress per-service
+    await pollContainerHealth(composeArgs, allServices, wizard);
+
     console.log('\n✓ All services are running:');
     for (const svc of allServices) {
       console.log(`  • ${svc}`);
@@ -273,7 +283,10 @@ async function runWizardInstall(configDir: string, noOpen: boolean, noStart = fa
     console.log(`  Memory API: http://localhost:${3898}`);
     console.log(`  Guardian:   http://localhost:${3899}`);
     console.log('');
-    await new Promise(resolve => setTimeout(resolve, 3000));
+    // pollContainerHealth returns as soon as all services are healthy, but
+    // the frontend polls every 2.5s — keep the server alive long enough for
+    // at least 2-3 polls to fetch the final "all running" state with URLs.
+    await new Promise(resolve => setTimeout(resolve, 8000));
   } catch (err) {
     wizard.updateDeployStatus(buildDeployStatusEntries(allServices, 'error', String(err)));
     wizard.setDeployError(String(err));
@@ -291,17 +304,91 @@ async function runFileInstall(filePath: string, noStart: boolean): Promise<void>
     throw new Error(`Setup config file not found: ${filePath}. Check the --file path and try again.`);
   }
   const config = await parseConfigFile(filePath, await Bun.file(filePath).text());
-  if (config.version === 1) throw new Error('v1 setup config format is no longer supported. Use the v2 SetupSpec format (with a "spec" field).');
-  if (!config.spec) throw new Error('Setup config must contain a "spec" field with the v2 StackSpec.');
+
+  // Normalize old wrapped format: { spec: { version, capabilities }, capabilities: [...] }
+  // into flat format:              { version, capabilities: {...}, connections: [...] }
+  if (config.spec && typeof config.spec === 'object') {
+    const spec = config.spec as Record<string, unknown>;
+    // Old format had connections array as top-level "capabilities"
+    if (Array.isArray(config.capabilities)) config.connections = config.capabilities;
+    config.version = spec.version;
+    config.capabilities = spec.capabilities;
+    delete config.spec;
+  }
+
+  if (config.version !== 2) throw new Error('Setup config must be version 2. See example.spec.yaml for the format.');
+  if (!config.capabilities || typeof config.capabilities !== 'object' || Array.isArray(config.capabilities)) {
+    throw new Error('Setup config must contain a "capabilities" object (llm, embeddings, memory).');
+  }
+
+  // Resolve security.adminToken from environment when not in spec
+  const security = (config.security ?? {}) as Record<string, unknown>;
+  if (!security.adminToken && process.env.OP_ADMIN_TOKEN) {
+    security.adminToken = process.env.OP_ADMIN_TOKEN;
+    config.security = security;
+  }
 
   const result = await performSetup(config as unknown as SetupSpec);
   if (!result.ok) throw new Error(`Setup failed: ${result.error}`);
   console.log('Setup complete.');
   if (noStart) { console.log('Config written. Run `openpalm start` to start services.'); return; }
   await requireDocker();
+  await ensureVolumeMountTargets(resolveOpenPalmHome(), resolveVaultDir());
   await deployServices('install');
 }
 
+/**
+ * Poll `docker compose ps` until all services are running/healthy (or timeout).
+ * Updates the wizard deploy status per-service so the frontend shows real progress.
+ */
+async function pollContainerHealth(
+  composeArgs: string[],
+  services: string[],
+  wizard: ReturnType<typeof createSetupServer>,
+): Promise<void> {
+  const MAX_WAIT_MS = 120_000; // 2 minutes
+  const POLL_INTERVAL = 3_000;
+  const start = Date.now();
+  const running = new Set<string>();
+  const psArgs = [...composeArgs, 'ps', '--format', 'json'];
+  let prevRunningCount = 0;
+
+  while (Date.now() - start < MAX_WAIT_MS) {
+    try {
+      const output = await runDockerComposeCapture(psArgs);
+      for (const line of output.trim().split('\n')) {
+        if (!line.trim()) continue;
+        try {
+          const container = JSON.parse(line) as { Service?: string; State?: string; Health?: string };
+          const svc = container.Service;
+          if (!svc || !services.includes(svc)) continue;
+          const isHealthy = container.Health === 'healthy' || (container.State === 'running' && !container.Health);
+          if (isHealthy) running.add(svc);
+        } catch { /* skip malformed JSON line */ }
+      }
+    } catch { /* compose ps failed — retry next tick */ }
+
+    if (running.size !== prevRunningCount) {
+      prevRunningCount = running.size;
+      const entries = services.map(svc => ({
+        service: svc,
+        status: (running.has(svc) ? 'running' : 'pending') as 'running' | 'pending',
+        label: running.has(svc) ? 'Running' : 'Starting...',
+      }));
+      wizard.updateDeployStatus(entries);
+    }
+
+    if (running.size >= services.length) return;
+
+    await new Promise(resolve => setTimeout(resolve, POLL_INTERVAL));
+  }
+
+  // Timeout: mark remaining as running so the UI completes, but warn
+  const pending = services.filter(s => !running.has(s));
+  console.warn(`Warning: health check timed out for: ${pending.join(', ')}. They may still be starting.`);
+  wizard.markAllRunning();
+}
+
 /**
  * Parse all compose files under homeDir/stack/ and pre-create every host-side
  * volume mount target as the current user. This prevents Docker from creating
@@ -381,8 +468,7 @@ async function ensureVolumeMountTargets(homeDir: string, vaultDir: string): Prom
   }
 }
 
-async function runVarlockValidation(_dataDir: string, vaultDir: string): Promise<void> {
-  const varlockBin = await ensureVarlock();
+async function runVarlockValidation(varlockBin: string, vaultDir: string): Promise<void> {
   const schemaPath = join(vaultDir, 'user', 'user.env.schema');
   if (!(await Bun.file(schemaPath).exists())) return;
   const tmpDir = await prepareVarlockDir(schemaPath, join(vaultDir, 'user', 'user.env'));

package/src/install-flow.test.ts

@@ -114,18 +114,16 @@ function seedFromLocal(homeDir: string, enabledAddons: string[] = []): void {
 
 function makeSetupSpec(): Record<string, unknown> {
   return {
-    spec: {
-      version: 2,
-      capabilities: {
-        llm: 'ollama/qwen2.5-coder:3b',
-        embeddings: { provider: 'ollama', model: 'nomic-embed-text:latest', dims: 768 },
-        memory: { userId: 'testuser', customInstructions: '' },
-        slm: 'ollama/qwen2.5-coder:3b',
-      },
+    version: 2,
+    capabilities: {
+      llm: 'ollama/qwen2.5-coder:3b',
+      embeddings: { provider: 'ollama', model: 'nomic-embed-text:latest', dims: 768 },
+      memory: { userId: 'testuser', customInstructions: '' },
+      slm: 'ollama/qwen2.5-coder:3b',
     },
     security: { adminToken: 'test-admin-token-12345' },
     owner: { name: 'Test', email: 'test@test.com' },
-    capabilities: [{
+    connections: [{
       id: 'ollama',
       name: 'Ollama',
       provider: 'ollama',

package/src/lib/docker.ts

@@ -161,12 +161,16 @@ export async function seedOpenPalmDir(
     if (!res.ok) throw new Error(`Failed to download tarball (HTTP ${res.status})`);
     await Bun.write(tmpTar, res);
 
+    // Extract full tarball — avoid --wildcards which is GNU tar-only and
+    // breaks on macOS (BSD tar), causing silent extraction failure.
     const extractProc = Bun.spawn(
-      ['tar', 'xzf', tmpTar, '--strip-components=1', '--wildcards',
-        '*/.openpalm/stack/core.compose.yml', '*/.openpalm/registry/*', '*/.openpalm/vault/*', '*/core/assistant/opencode/*'],
+      ['tar', 'xzf', tmpTar, '--strip-components=1'],
       { cwd: tmpDir, stdout: 'ignore', stderr: 'pipe' },
     );
-    await extractProc.exited;
+    const extractCode = await extractProc.exited;
+    if (extractCode !== 0) {
+      throw new Error(`tar extraction failed (exit code ${extractCode})`);
+    }
 
     const srcCoreCompose = join(tmpDir, '.openpalm', 'stack', 'core.compose.yml');
     if (!await Bun.file(srcCoreCompose).exists()) {

package/src/lib/env.ts

@@ -71,21 +71,13 @@ export async function ensureSecrets(vaultDir: string): Promise<void> {
   }
 
   mkdirSync(join(vaultDir, 'user'), { recursive: true });
-  const userId = process.env.USER || process.env.LOGNAME || process.env.USERNAME || 'default_user';
-  const content = `# OpenPalm User Secrets — generated by openpalm install
-# All values are configured via the setup wizard.
-# This file is compatible with both \`source user.env\` and Docker Compose env_file.
-
-# LLM provider keys (configure at least one via the setup wizard)
-export OPENAI_API_KEY=
-export OPENAI_BASE_URL=
-# export ANTHROPIC_API_KEY=
-# export GROQ_API_KEY=
-# export MISTRAL_API_KEY=
-# export GOOGLE_API_KEY=
-
-# Memory
-export MEMORY_USER_ID=${userId}
+  // user.env is for user-added custom env vars only.
+  // All standard secrets (API keys, tokens) live in stack.env.
+  // Do NOT put API key placeholders here — user.env is loaded after
+  // stack.env by Docker Compose, so empty values would override real keys.
+  const content = `# OpenPalm — User Extensions
+# Add any custom environment variables here.
+# These are loaded by compose alongside stack.env.
 `;
 
   await Bun.write(secretsPath, content);

package/src/main.test.ts

@@ -9,22 +9,21 @@ import { detectHostInfo, main, reconcileStackEnvImageTag, resolveRequestedImageT
 function writeMinimalSetupSpec(dir: string): string {
   const specPath = join(dir, 'setup-spec.yaml');
   const yaml = [
-    'spec:',
-    '  version: 2',
-    '  capabilities:',
-    '    llm: openai/gpt-4o',
-    '    embeddings:',
-    '      provider: openai',
-    '      model: text-embedding-3-small',
-    '      dims: 1536',
-    '    memory:',
-    '      userId: test_user',
+    'version: 2',
+    'capabilities:',
+    '  llm: openai/gpt-4o',
+    '  embeddings:',
+    '    provider: openai',
+    '    model: text-embedding-3-small',
+    '    dims: 1536',
+    '  memory:',
+    '    userId: test_user',
     'security:',
     '  adminToken: test-admin-token-12345',
     'owner:',
     '  name: Test User',
     '  email: test@example.com',
-    'capabilities:',
+    'connections:',
     '  - id: openai',
     '    name: OpenAI',
     '    provider: openai',
@@ -582,7 +581,7 @@ describe('cli entrypoint (subprocess)', () => {
 });
 
 describe('secrets.env generation', () => {
-  it('generates user.env with export prefix and user-managed keys', async () => {
+  it('generates user.env as empty placeholder (no API key placeholders)', async () => {
     const { ensureSecrets } = await import('./lib/env.ts');
     const tempDir = mkdtempSync(join(tmpdir(), 'openpalm-secrets-'));
     const vaultDir = join(tempDir, 'vault');
@@ -591,11 +590,12 @@ describe('secrets.env generation', () => {
     try {
       await ensureSecrets(vaultDir);
       const content = await Bun.file(join(vaultDir, 'user', 'user.env')).text();
-      expect(content).toContain('export OPENAI_API_KEY=');
-      expect(content).toContain('export MEMORY_USER_ID=');
-      // System secrets (OP_ADMIN_TOKEN, OP_MEMORY_TOKEN) belong in stack.env, not user.env
+      // user.env is for user-added custom vars only — no API key placeholders
+      // (empty values would override real keys in stack.env via compose env-file precedence)
+      expect(content).not.toContain('OPENAI_API_KEY');
       expect(content).not.toContain('OP_ADMIN_TOKEN');
       expect(content).not.toContain('OP_MEMORY_TOKEN');
+      expect(content).toContain('User Extensions');
     } finally {
       rmSync(tempDir, { recursive: true, force: true });
     }

package/src/setup-wizard/server-errors.test.ts

@@ -123,15 +123,13 @@ describe("setup wizard server error scenarios", () => {
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
           // no security.adminToken
-          spec: {
-            version: 2,
-            capabilities: {
-              llm: "openai/gpt-4o",
-              embeddings: { provider: "openai", model: "text-embedding-3-small", dims: 1536 },
-              memory: { userId: "user1", customInstructions: "" },
-            },
+          version: 2,
+          capabilities: {
+            llm: "openai/gpt-4o",
+            embeddings: { provider: "openai", model: "text-embedding-3-small", dims: 1536 },
+            memory: { userId: "user1", customInstructions: "" },
           },
-          capabilities: [{ id: "c1", name: "C1", provider: "openai", baseUrl: "", apiKey: "sk-test" }],
+          connections: [{ id: "c1", name: "C1", provider: "openai", baseUrl: "", apiKey: "sk-test" }],
         }),
       });
       expect(res.status).toBe(400);
@@ -143,7 +141,7 @@ describe("setup wizard server error scenarios", () => {
     }
   });
 
-  it("returns 400 when capabilities array is not an array", async () => {
+  it("returns 400 when connections array is not an array", async () => {
     const { stop } = createSetupServer(serverPort, {
       configDir,
     });
@@ -153,29 +151,27 @@ describe("setup wizard server error scenarios", () => {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
-          spec: {
-            version: 2,
-            capabilities: {
-              llm: "openai/gpt-4o",
-              embeddings: { provider: "openai", model: "text-embedding-3-small", dims: 1536 },
-              memory: { userId: "user1", customInstructions: "" },
-            },
+          version: 2,
+          capabilities: {
+            llm: "openai/gpt-4o",
+            embeddings: { provider: "openai", model: "text-embedding-3-small", dims: 1536 },
+            memory: { userId: "user1", customInstructions: "" },
           },
           security: { adminToken: "valid-token-12345" },
           owner: { name: "Test User", email: "test@example.com" },
-          capabilities: "not-an-array",
+          connections: "not-an-array",
         }),
       });
       expect(res.status).toBe(400);
       const data = (await res.json()) as { ok: boolean; error: string };
       expect(data.ok).toBe(false);
-      expect(data.error).toContain("capabilities");
+      expect(data.error).toContain("connections");
     } finally {
       stop();
     }
   });
 
-  it("returns 400 when spec is missing", async () => {
+  it("returns 400 when capabilities config is missing", async () => {
     const { stop } = createSetupServer(serverPort, {
       configDir,
     });
@@ -185,16 +181,17 @@ describe("setup wizard server error scenarios", () => {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
+          version: 2,
           security: { adminToken: "valid-token-12345" },
           owner: { name: "Test User", email: "test@example.com" },
-          capabilities: [{ id: "c1", name: "C1", provider: "openai", baseUrl: "", apiKey: "sk-test" }],
-          // no spec
+          connections: [{ id: "c1", name: "C1", provider: "openai", baseUrl: "", apiKey: "sk-test" }],
+          // no capabilities
         }),
       });
       expect(res.status).toBe(400);
       const data = (await res.json()) as { ok: boolean; error: string };
       expect(data.ok).toBe(false);
-      expect(data.error).toContain("spec");
+      expect(data.error).toContain("capabilities");
     } finally {
       stop();
     }
@@ -210,17 +207,15 @@ describe("setup wizard server error scenarios", () => {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
-          spec: {
-            version: 2,
-            capabilities: {
-              llm: "fakeprovider/gpt-4o",
-              embeddings: { provider: "openai", model: "text-embedding-3-small", dims: 1536 },
-              memory: { userId: "user1", customInstructions: "" },
-            },
+          version: 2,
+          capabilities: {
+            llm: "fakeprovider/gpt-4o",
+            embeddings: { provider: "openai", model: "text-embedding-3-small", dims: 1536 },
+            memory: { userId: "user1", customInstructions: "" },
           },
           security: { adminToken: "valid-token-12345" },
           owner: { name: "Test User", email: "test@example.com" },
-          capabilities: [{ id: "c1", name: "C1", provider: "fakeprovider", baseUrl: "", apiKey: "sk-test" }],
+          connections: [{ id: "c1", name: "C1", provider: "fakeprovider", baseUrl: "", apiKey: "sk-test" }],
         }),
       });
       // Connection-provider matching is no longer validated; setup succeeds
@@ -242,17 +237,15 @@ describe("setup wizard server error scenarios", () => {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
-          spec: {
-            version: 2,
-            capabilities: {
-              llm: "anthropic/claude-3-opus", // No anthropic capability provided
-              embeddings: { provider: "openai", model: "text-embedding-3-small", dims: 1536 },
-              memory: { userId: "user1", customInstructions: "" },
-            },
+          version: 2,
+          capabilities: {
+            llm: "anthropic/claude-3-opus", // No anthropic connection provided
+            embeddings: { provider: "openai", model: "text-embedding-3-small", dims: 1536 },
+            memory: { userId: "user1", customInstructions: "" },
           },
           security: { adminToken: "valid-token-12345" },
           owner: { name: "Test User", email: "test@example.com" },
-          capabilities: [{ id: "c1", name: "C1", provider: "openai", baseUrl: "", apiKey: "sk-test" }],
+          connections: [{ id: "c1", name: "C1", provider: "openai", baseUrl: "", apiKey: "sk-test" }],
         }),
       });
       // Provider matching is no longer validated; setup succeeds

package/src/setup-wizard/server-integration.test.ts

@@ -220,24 +220,22 @@ describe("setup wizard server integration", () => {
 
     try {
       const body = {
-        spec: {
-          version: 2,
-          capabilities: {
-            llm: "ollama/qwen2.5-coder:3b",
-            embeddings: {
-              provider: "ollama",
-              model: "nomic-embed-text",
-              dims: 768,
-            },
-            memory: {
-              userId: "integ_user",
-              customInstructions: "",
-            },
+        version: 2,
+        capabilities: {
+          llm: "ollama/qwen2.5-coder:3b",
+          embeddings: {
+            provider: "ollama",
+            model: "nomic-embed-text",
+            dims: 768,
+          },
+          memory: {
+            userId: "integ_user",
+            customInstructions: "",
           },
         },
         security: { adminToken: "integration-test-token-123" },
         owner: { name: "Integration Test", email: "integ@test.local" },
-        capabilities: [
+        connections: [
           {
             id: "ollama-local",
             name: "Ollama Local",
@@ -301,24 +299,22 @@ describe("setup wizard server integration", () => {
 
       // Complete setup
       const body = {
-        spec: {
-          version: 2,
-          capabilities: {
-            llm: "openai/gpt-4o",
-            embeddings: {
-              provider: "openai",
-              model: "text-embedding-3-small",
-              dims: 1536,
-            },
-            memory: {
-              userId: "status_user",
-              customInstructions: "",
-            },
+        version: 2,
+        capabilities: {
+          llm: "openai/gpt-4o",
+          embeddings: {
+            provider: "openai",
+            model: "text-embedding-3-small",
+            dims: 1536,
+          },
+          memory: {
+            userId: "status_user",
+            customInstructions: "",
           },
         },
         security: { adminToken: "status-test-token-123" },
         owner: { name: "Status Test", email: "status@test.local" },
-        capabilities: [
+        connections: [
           {
             id: "openai-test",
             name: "OpenAI",
@@ -429,24 +425,22 @@ describe("setup wizard server integration", () => {
 
     try {
       const body = {
-        spec: {
-          version: 2,
-          capabilities: {
-            llm: "openai/gpt-4o",
-            embeddings: {
-              provider: "openai",
-              model: "text-embedding-3-small",
-              dims: 1536,
-            },
-            memory: {
-              userId: "retry_user",
-              customInstructions: "",
-            },
+        version: 2,
+        capabilities: {
+          llm: "openai/gpt-4o",
+          embeddings: {
+            provider: "openai",
+            model: "text-embedding-3-small",
+            dims: 1536,
+          },
+          memory: {
+            userId: "retry_user",
+            customInstructions: "",
           },
         },
         security: { adminToken: "retry-test-token-123" },
         owner: { name: "Retry Test", email: "retry@test.local" },
-        capabilities: [
+        connections: [
           {
             id: "openai-retry",
             name: "OpenAI",

package/src/setup-wizard/server.test.ts

@@ -247,24 +247,22 @@ describe("setup wizard server", () => {
 
     try {
       const body = {
-        spec: {
-          version: 2,
-          capabilities: {
-            llm: "openai/gpt-4o",
-            embeddings: {
-              provider: "openai",
-              model: "text-embedding-3-small",
-              dims: 1536,
-            },
-            memory: {
-              userId: "test_user",
-              customInstructions: "",
-            },
+        version: 2,
+        capabilities: {
+          llm: "openai/gpt-4o",
+          embeddings: {
+            provider: "openai",
+            model: "text-embedding-3-small",
+            dims: 1536,
+          },
+          memory: {
+            userId: "test_user",
+            customInstructions: "",
           },
         },
         security: { adminToken: "test-admin-token-12345" },
         owner: { name: "Test", email: "test@example.com" },
-        capabilities: [
+        connections: [
           {
             id: "openai-main",
             name: "OpenAI",

package/src/setup-wizard/server.ts

@@ -32,6 +32,8 @@ type SetupServerState = {
   setupResult: SetupResult | null;
   deployStatus: DeployStatusEntry[];
   deployError: string | null;
+  /** True while services are being started (distinguishes from --no-start). */
+  deploying: boolean;
 };
 
 // ── JSON Response Helpers ────────────────────────────────────────────────
@@ -86,6 +88,7 @@ export type SetupServer = {
   /** Update deploy status for a service (for progress tracking). */
   updateDeployStatus: (entries: DeployStatusEntry[]) => void;
   setDeployError: (error: string) => void;
+  setDeploying: (value: boolean) => void;
   markAllRunning: () => void;
 };
 
@@ -111,6 +114,7 @@ export function createSetupServer(
     setupResult: null,
     deployStatus: [],
     deployError: null,
+    deploying: false,
   };
 
   // Completion signal: resolves when setup POST succeeds
@@ -243,6 +247,7 @@ export function createSetupServer(
         setupComplete: state.setupComplete,
         deployStatus: state.deployStatus,
         deployError: state.deployError,
+        deploying: state.deploying,
       });
     }
 
@@ -304,6 +309,9 @@ export function createSetupServer(
     setDeployError: (error: string) => {
       state.deployError = error;
     },
+    setDeploying: (value: boolean) => {
+      state.deploying = value;
+    },
     markAllRunning: () => {
       for (const entry of state.deployStatus) {
         if (entry.status !== "error") {

package/src/setup-wizard/wizard-state.js

@@ -199,6 +199,9 @@ var verifyGeneration = {};
 /** Deploy poll error counter */
 var deployPollErrors = 0;
 
+/** Last known deploy service entries — used as fallback when server stops */
+var lastDeployData = null;
+
 // Initialize provider states
 PROVIDERS.forEach(function (p) {
   providerState[p.id] = {

package/src/setup-wizard/wizard.js

@@ -367,29 +367,27 @@ function buildPayload() {
 
   // Build SetupSpec payload
   var payload = {
-    spec: {
-      version: 2,
-      capabilities: {
-        llm: llmProvider + "/" + (llm ? llm.model : ""),
-        embeddings: {
-          provider: embProvider,
-          model: emb ? emb.model : "",
-          dims: emb ? (emb.dims || 1536) : 1536,
-        },
-        memory: {
-          userId: memoryUserId,
-          customInstructions: "",
-        },
+    version: 2,
+    capabilities: {
+      llm: llmProvider + "/" + (llm ? llm.model : ""),
+      embeddings: {
+        provider: embProvider,
+        model: emb ? emb.model : "",
+        dims: emb ? (emb.dims || 1536) : 1536,
+      },
+      memory: {
+        userId: memoryUserId,
+        customInstructions: "",
       },
-      addons: addons,
     },
+    addons: addons,
     security: { adminToken: adminToken },
-    capabilities: capabilities,
+    connections: capabilities,
   };
 
   // Add optional slm capability (uses its own provider, not the LLM provider)
   if (small && small.model) {
-    payload.spec.capabilities.slm = small.connId + "/" + small.model;
+    payload.capabilities.slm = small.connId + "/" + small.model;
   }
 
   // Add reranking configuration if enabled
@@ -399,7 +397,7 @@ function buildPayload() {
     var rerankModel = $("reranking-model") ? ($("reranking-model").value || "").trim() : "";
     var topK = $("reranking-top-k") ? parseInt($("reranking-top-k").value, 10) : 20;
     var topN = $("reranking-top-n") ? parseInt($("reranking-top-n").value, 10) : 5;
-    payload.spec.capabilities.reranking = {
+    payload.capabilities.reranking = {
       enabled: true,
       mode: rerankMode,
       model: rerankMode === "dedicated" ? rerankModel : "",
@@ -481,6 +479,13 @@ async function pollDeployStatus() {
     var data = await res.json();
     deployPollErrors = 0;
 
+    // Remember latest service list so we can show URLs if the server stops
+    if (data.deployStatus && data.deployStatus.length > 0) {
+      lastDeployData = data.deployStatus.map(function (s) {
+        return { service: s.service, status: s.status, label: s.label };
+      });
+    }
+
     updateDeployUI(data);
 
     if (data.deployError) {
@@ -492,17 +497,24 @@ async function pollDeployStatus() {
         stopDeployPolling();
         showDeployDone(data);
       }
-    } else if (data.setupComplete && (!data.deployStatus || data.deployStatus.length === 0)) {
-      // Setup complete but no deployment started (--no-start mode)
+    } else if (data.setupComplete && !data.deploying && (!data.deployStatus || data.deployStatus.length === 0)) {
+      // Setup complete and not deploying (--no-start mode)
       stopDeployPolling();
       showDeployDone({ deployStatus: [] });
     }
   } catch (e) {
     deployPollErrors++;
     if (deployPollErrors >= 3) {
-      // Server is gone — setup completed without deployment (--no-start)
+      // Server is gone — use last known service list if available
       stopDeployPolling();
-      showDeployDone({ deployStatus: [] });
+      if (lastDeployData && lastDeployData.length > 0) {
+        var doneEntries = lastDeployData.map(function (s) {
+          return { service: s.service, status: "running", label: s.label };
+        });
+        showDeployDone({ deployStatus: doneEntries });
+      } else {
+        showDeployDone({ deployStatus: [] });
+      }
     }
   }
 }