openpalm 0.11.0-beta.1 → 0.11.0-beta.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openpalm",
-  "version": "0.11.0-beta.1",
+  "version": "0.11.0-beta.3",
   "type": "module",
   "license": "MPL-2.0",
   "description": "OpenPalm CLI — install and manage a self-hosted OpenPalm stack",
@@ -28,7 +28,7 @@
     "build:windows-arm64": "bun build src/main.ts --compile --target=bun-windows-arm64 --outfile dist/openpalm-cli-windows-arm64.exe"
   },
   "dependencies": {
-    "@openpalm/lib": "0.11.0",
+    "@openpalm/lib": "0.11.0-beta.1",
     "citty": "^0.2.1",
     "yaml": "^2.8.0"
   }

package/src/commands/install.ts

@@ -285,10 +285,12 @@ async function runFileInstall(filePath: string, noStart: boolean): Promise<void>
     throw new Error('Setup config must contain a "capabilities" object (llm, embeddings).');
   }
 
-  // Resolve security.adminToken from environment when not in spec
+  // Resolve security.uiLoginPassword from environment when not in spec.
+  // Phase 4 (auth/proxy refactor) renamed the env var to OP_UI_LOGIN_PASSWORD
+  // and the spec field to security.uiLoginPassword.
   const security = (config.security ?? {}) as Record<string, unknown>;
-  if (!security.adminToken && process.env.OP_UI_TOKEN) {
-    security.adminToken = process.env.OP_UI_TOKEN;
+  if (!security.uiLoginPassword && process.env.OP_UI_LOGIN_PASSWORD) {
+    security.uiLoginPassword = process.env.OP_UI_LOGIN_PASSWORD;
     config.security = security;
   }
 

package/src/install-flow.test.ts

@@ -105,7 +105,7 @@ function makeSetupSpec(): Record<string, unknown> {
     version: 2,
     llm: { provider: 'ollama', model: 'qwen2.5-coder:3b', baseUrl: 'http://host.docker.internal:11434' },
     embedding: { provider: 'ollama', model: 'nomic-embed-text:latest', dims: 768, baseUrl: 'http://host.docker.internal:11434' },
-    security: { adminToken: 'test-admin-token-12345' },
+    security: { uiLoginPassword: 'test-admin-token-12345' },
     owner: { name: 'Test', email: 'test@test.com' },
     connections: [{
       id: 'ollama',

package/src/lib/ui-server.ts

@@ -8,7 +8,7 @@
  */
 import { join } from 'node:path';
 import { existsSync } from 'node:fs';
-import { resolveOpenPalmHome, resolveConfigDir, resolveUiBuildDir, createLogger } from '@openpalm/lib';
+import { resolveOpenPalmHome, resolveConfigDir, resolveUiBuildDir, createLogger, readStackEnv } from '@openpalm/lib';
 import { ensureValidState } from './cli-state.ts';
 import { startOpenCodeSubprocess, type OpenCodeSubprocess } from './opencode-subprocess.ts';
 import { openBrowser } from './browser.ts';
@@ -63,11 +63,14 @@ export async function startUIServer(opts: UIServerOptions = {}): Promise<void> {
   }
 
   const state = ensureValidState();
-  const { adminToken } = state;
-  // OP_UI_TOKEN is unset during first-run install — the SvelteKit hooks
-  // detect that and redirect /* to /setup, where the wizard generates
-  // the token. Don't short-circuit here, or the install wizard can
-  // never come up.
+  // OP_UI_LOGIN_PASSWORD is unset during first-run install — the SvelteKit
+  // hooks detect that and redirect /* to /setup, where the wizard sets
+  // it. Don't short-circuit here, or the install wizard can never come up.
+  const stackEnv = readStackEnv(state.stackDir);
+  const uiLoginPassword =
+    process.env.OP_UI_LOGIN_PASSWORD
+      ?? stackEnv.OP_UI_LOGIN_PASSWORD
+      ?? '';
 
   // Start OpenCode subprocess (non-fatal — UI still works without it)
   let openCodeSub: OpenCodeSubprocess | null = null;
@@ -99,11 +102,11 @@ export async function startUIServer(opts: UIServerOptions = {}): Promise<void> {
         // Pass resolved absolute OP_HOME so the child doesn't re-resolve a
         // relative value (e.g. `.dev` from a repo-root .env) against its
         // own cwd (packages/ui/build/).
-        OP_HOME:     homeDir,
-        HOST:        '127.0.0.1',
-        PORT:        String(port),
-        ORIGIN:      `http://127.0.0.1:${port}`,
-        OP_UI_TOKEN: adminToken,
+        OP_HOME:                homeDir,
+        HOST:                   '127.0.0.1',
+        PORT:                   String(port),
+        ORIGIN:                 `http://127.0.0.1:${port}`,
+        OP_UI_LOGIN_PASSWORD:   uiLoginPassword,
         ...(openCodeBaseUrl ? { OP_OPENCODE_URL: openCodeBaseUrl } : {}),
       },
       stdout: 'inherit',

package/src/main.test.ts

@@ -19,7 +19,7 @@ function writeMinimalSetupSpec(dir: string): string {
     '    model: text-embedding-3-small',
     '    dims: 1536',
     'security:',
-    '  adminToken: test-admin-token-12345',
+    '  uiLoginPassword: test-admin-token-12345',
     'owner:',
     '  name: Test User',
     '  email: test@example.com',
@@ -113,7 +113,7 @@ describe('cli main', () => {
   const originalWarn = console.warn;
   const originalHome = process.env.OP_HOME;
   const originalWorkDir = process.env.OP_WORK_DIR;
-  const originalAdminToken = process.env.OP_UI_TOKEN;
+  const originalLoginPassword = process.env.OP_UI_LOGIN_PASSWORD;
 
   afterEach(() => {
     globalThis.fetch = originalFetch;
@@ -122,7 +122,7 @@ describe('cli main', () => {
     restoreDockerCli();
     process.env.OP_HOME = originalHome;
     process.env.OP_WORK_DIR = originalWorkDir;
-    process.env.OP_UI_TOKEN = originalAdminToken;
+    process.env.OP_UI_LOGIN_PASSWORD = originalLoginPassword;
   });
 
   it('runs bootstrap install directly without admin delegation', async () => {
@@ -133,7 +133,7 @@ describe('cli main', () => {
 
     process.env.OP_HOME = base;
     process.env.OP_WORK_DIR = workDir;
-    delete process.env.OP_UI_TOKEN;
+    delete process.env.OP_UI_LOGIN_PASSWORD;
 
     mockDockerCli();
     const fetchedUrls: string[] = [];
@@ -255,7 +255,7 @@ describe('cli main', () => {
     // carries forward existing content.
     mkdirSync(join(base, 'state'), { recursive: true });
     mkdirSync(join(base, 'config', 'stack'), { recursive: true });
-    writeFileSync(join(base, 'config', 'stack', 'stack.env'), 'OP_UI_TOKEN=existing-token\n');
+    writeFileSync(join(base, 'config', 'stack', 'stack.env'), 'OP_UI_LOGIN_PASSWORD=existing-password\n');
     writeFileSync(stackConfig, 'llm: old\n');
 
     process.env.OP_HOME = base;
@@ -284,7 +284,7 @@ describe('cli main', () => {
       const backups = readdirSync(backupsDir);
       expect(backups.length).toBeGreaterThan(0);
       expect(readFileSync(join(backupsDir, backups[0], 'config', 'stack.yml'), 'utf8')).toContain('llm: old');
-      expect(readFileSync(join(backupsDir, backups[0], 'config', 'stack', 'stack.env'), 'utf8')).toContain('OP_UI_TOKEN=existing-token');
+      expect(readFileSync(join(backupsDir, backups[0], 'config', 'stack', 'stack.env'), 'utf8')).toContain('OP_UI_LOGIN_PASSWORD=existing-password');
     } finally {
       rmSync(base, { recursive: true, force: true });
     }
@@ -304,7 +304,7 @@ describe('cli main', () => {
     mkdirSync(chatAddonDir, { recursive: true });
     writeFileSync(coreCompose, 'services:\n  assistant:\n    image: test\n');
     writeFileSync(join(adminAddonDir, 'compose.yml'), 'services:\n  admin:\n    image: admin\n');
-    writeFileSync(join(adminAddonDir, '.env.schema'), 'OP_UI_TOKEN=\n');
+    writeFileSync(join(adminAddonDir, '.env.schema'), 'OP_UI_LOGIN_PASSWORD=\n');
     writeFileSync(join(chatAddonDir, 'compose.yml'), 'services:\n  chat:\n    image: chat\n    environment:\n      CHANNEL_NAME: "Chat"\n      CHANNEL_ID: "chat"\n');
     writeFileSync(join(chatAddonDir, '.env.schema'), 'CHANNEL_CHAT_SECRET=\n');
     writeFileSync(guardianEnv, '# Guardian channel HMAC secrets — managed by openpalm\n');
@@ -411,7 +411,7 @@ describe('validate command', () => {
     const tempHome = mkdtempSync(join(tmpdir(), 'openpalm-test-'));
     const stackDir = join(tempHome, 'config', 'stack');
     mkdirSync(stackDir, { recursive: true });
-    writeFileSync(join(stackDir, 'stack.env'), 'OP_UI_TOKEN=abc\nOP_ASSISTANT_TOKEN=def\n');
+    writeFileSync(join(stackDir, 'stack.env'), 'OP_UI_LOGIN_PASSWORD=abc\n');
 
     const originalHome = process.env.OP_HOME;
     const originalExit = process.exit;
@@ -436,7 +436,7 @@ describe('scan command', () => {
     const tempHome = mkdtempSync(join(tmpdir(), 'openpalm-test-'));
     const stackDir = join(tempHome, 'config', 'stack');
     mkdirSync(stackDir, { recursive: true });
-    writeFileSync(join(stackDir, 'stack.env'), 'OP_UI_TOKEN=abc\nOPENAI_API_KEY=sk-test\n');
+    writeFileSync(join(stackDir, 'stack.env'), 'OP_UI_LOGIN_PASSWORD=abc\nOPENAI_API_KEY=sk-test\n');
 
     const originalHome = process.env.OP_HOME;
     const originalExit = process.exit;
@@ -553,8 +553,8 @@ describe('install image tag pinning', () => {
   });
 
   it('preserves export prefix when upserting a key', () => {
-    expect(upsertEnvValue('export OP_UI_TOKEN=old\n', 'OP_UI_TOKEN', 'new')).toBe(
-      'export OP_UI_TOKEN=new\n',
+    expect(upsertEnvValue('export OP_UI_LOGIN_PASSWORD=old\n', 'OP_UI_LOGIN_PASSWORD', 'new')).toBe(
+      'export OP_UI_LOGIN_PASSWORD=new\n',
     );
   });