openpalm 0.9.1 → 0.9.2-rc2

package/src/commands/service.ts

@@ -0,0 +1,93 @@
+import { defineCommand } from 'citty';
+import { tryAdminRequest } from '../lib/admin.ts';
+import { runDockerCompose } from '../lib/docker.ts';
+import { ensureStagedState, fullComposeArgs, buildManagedServiceNames } from '../lib/staging.ts';
+import { runLogsAction } from './logs.ts';
+import { runStartAction } from './start.ts';
+import { runStopAction } from './stop.ts';
+import { runRestartAction } from './restart.ts';
+
+const startCmd = defineCommand({
+  meta: { name: 'start', description: 'Start services' },
+  args: {
+    services: { type: 'positional', description: 'Service names', required: false },
+  },
+  async run({ args }) { await runStartAction(args._ ?? []); },
+});
+
+const stopCmd = defineCommand({
+  meta: { name: 'stop', description: 'Stop services' },
+  args: {
+    services: { type: 'positional', description: 'Service names', required: false },
+  },
+  async run({ args }) { await runStopAction(args._ ?? []); },
+});
+
+const restartCmd = defineCommand({
+  meta: { name: 'restart', description: 'Restart services' },
+  args: {
+    services: { type: 'positional', description: 'Service names', required: false },
+  },
+  async run({ args }) { await runRestartAction(args._ ?? []); },
+});
+
+const logsCmd = defineCommand({
+  meta: { name: 'logs', description: 'View service logs' },
+  args: {
+    services: { type: 'positional', description: 'Service names', required: false },
+  },
+  async run({ args }) { await runLogsAction(args._ ?? []); },
+});
+
+const updateCmd = defineCommand({
+  meta: { name: 'update', description: 'Pull latest images' },
+  async run() {
+    // Try admin delegation first
+    const adminResult = await tryAdminRequest('/admin/containers/pull', { method: 'POST' });
+    if (adminResult !== null) {
+      console.log(JSON.stringify(adminResult, null, 2));
+      return;
+    }
+
+    // Direct compose pull + recreate (scoped to managed services)
+    const state = await ensureStagedState();
+    const composeArgs = fullComposeArgs(state);
+    const managedServices = buildManagedServiceNames(state);
+    console.log('Pulling latest images...');
+    await runDockerCompose([...composeArgs, 'pull', ...managedServices]);
+    console.log('Recreating containers...');
+    await runDockerCompose([...composeArgs, 'up', '-d', '--force-recreate', ...managedServices]);
+    console.log('Update complete.');
+  },
+});
+
+const statusCmd = defineCommand({
+  meta: { name: 'status', description: 'Show container status' },
+  async run() {
+    // Try admin delegation first
+    const adminResult = await tryAdminRequest('/admin/containers/list');
+    if (adminResult !== null) {
+      console.log(JSON.stringify(adminResult, null, 2));
+      return;
+    }
+
+    // Direct compose ps
+    const state = await ensureStagedState();
+    await runDockerCompose([...fullComposeArgs(state), 'ps', '--format', 'table']);
+  },
+});
+
+export default defineCommand({
+  meta: {
+    name: 'service',
+    description: 'Service lifecycle operations (start|stop|restart|logs|update|status)',
+  },
+  subCommands: {
+    start: startCmd,
+    stop: stopCmd,
+    restart: restartCmd,
+    logs: logsCmd,
+    update: updateCmd,
+    status: statusCmd,
+  },
+});

package/src/commands/start.ts

@@ -0,0 +1,79 @@
+import { defineCommand } from 'citty';
+import { tryAdminRequest } from '../lib/admin.ts';
+import { runDockerCompose } from '../lib/docker.ts';
+import { ensureStagedState, fullComposeArgs, buildManagedServiceNames } from '../lib/staging.ts';
+
+export default defineCommand({
+  meta: {
+    name: 'start',
+    description: 'Start services (all or named)',
+  },
+  args: {
+    services: {
+      type: 'positional',
+      description: 'Service names to start (omit for all)',
+      required: false,
+    },
+    'with-admin': {
+      type: 'boolean',
+      description: 'Include admin UI and docker-socket-proxy',
+      default: false,
+    },
+  },
+  async run({ args }) {
+    const services = args._ ?? [];
+    const withAdmin = args['with-admin'] ?? false;
+    await runStartAction(services, { withAdmin });
+  },
+});
+
+export async function runStartAction(
+  services: string[],
+  opts?: { withAdmin?: boolean },
+): Promise<void> {
+  const withAdmin = opts?.withAdmin ?? false;
+
+  if (services.length === 0) {
+    // Try admin delegation first (gives admin's scheduler/audit a chance to observe)
+    const adminResult = await tryAdminRequest('/admin/install', { method: 'POST' });
+    if (adminResult !== null) {
+      console.log(JSON.stringify(adminResult, null, 2));
+      return;
+    }
+
+    // Direct compose — stage artifacts and start managed services
+    const state = await ensureStagedState();
+    const composeArgs = fullComposeArgs(state);
+    const managedServices = buildManagedServiceNames(state);
+
+    if (withAdmin) {
+      // Include the admin profile — starts admin + docker-socket-proxy
+      await runDockerCompose([...composeArgs, '--profile', 'admin', 'up', '-d', ...managedServices, 'admin', 'docker-socket-proxy']);
+    } else {
+      await runDockerCompose([...composeArgs, 'up', '-d', ...managedServices]);
+    }
+    return;
+  }
+
+  // Start specific services — try admin first, fall back to direct compose
+  for (const service of services) {
+    const adminResult = await tryAdminRequest('/admin/containers/up', {
+      method: 'POST',
+      body: JSON.stringify({ service }),
+    });
+    if (adminResult !== null) {
+      console.log(JSON.stringify(adminResult, null, 2));
+      continue;
+    }
+
+    // Direct compose for specific service
+    const state = await ensureStagedState();
+    const composeArgs = fullComposeArgs(state);
+    // If starting admin explicitly, include the admin profile
+    if (service === 'admin' || service === 'docker-socket-proxy') {
+      await runDockerCompose([...composeArgs, '--profile', 'admin', 'up', '-d', service]);
+    } else {
+      await runDockerCompose([...composeArgs, 'up', '-d', service]);
+    }
+  }
+}

package/src/commands/status.ts

@@ -0,0 +1,23 @@
+import { defineCommand } from 'citty';
+import { tryAdminRequest } from '../lib/admin.ts';
+import { runDockerCompose } from '../lib/docker.ts';
+import { ensureStagedState, fullComposeArgs } from '../lib/staging.ts';
+
+export default defineCommand({
+  meta: {
+    name: 'status',
+    description: 'Show container status',
+  },
+  async run() {
+    // Try admin delegation first for richer output
+    const adminResult = await tryAdminRequest('/admin/containers/list');
+    if (adminResult !== null) {
+      console.log(JSON.stringify(adminResult, null, 2));
+      return;
+    }
+
+    // Direct compose ps
+    const state = await ensureStagedState();
+    await runDockerCompose([...fullComposeArgs(state), 'ps', '--format', 'table']);
+  },
+});

package/src/commands/stop.ts

@@ -0,0 +1,70 @@
+import { defineCommand } from 'citty';
+import { tryAdminRequest, getServiceNames } from '../lib/admin.ts';
+import { runDockerCompose } from '../lib/docker.ts';
+import { ensureStagedState, fullComposeArgs } from '../lib/staging.ts';
+
+export default defineCommand({
+  meta: {
+    name: 'stop',
+    description: 'Stop services (all or named)',
+  },
+  args: {
+    services: {
+      type: 'positional',
+      description: 'Service names to stop (omit for all)',
+      required: false,
+    },
+  },
+  async run({ args }) {
+    const services = args._ ?? [];
+    await runStopAction(services);
+  },
+});
+
+export async function runStopAction(services: string[]): Promise<void> {
+  if (services.length === 0) {
+    // Try admin delegation — stop each managed container
+    const adminResult = await tryAdminRequest('/admin/containers/list');
+    if (adminResult !== null) {
+      const serviceNames = getServiceNames(adminResult);
+      for (const service of serviceNames) {
+        const result = await tryAdminRequest('/admin/containers/down', {
+          method: 'POST',
+          body: JSON.stringify({ service }),
+        });
+        if (result !== null) {
+          console.log(JSON.stringify(result, null, 2));
+        } else {
+          console.warn(`Warning: failed to stop ${service} via admin API`);
+        }
+      }
+      return;
+    }
+
+    // Direct compose down — include admin profile to tear down all services
+    const state = await ensureStagedState();
+    await runDockerCompose([...fullComposeArgs(state), '--profile', 'admin', 'down']);
+    return;
+  }
+
+  // Stop specific services
+  for (const service of services) {
+    const adminResult = await tryAdminRequest('/admin/containers/down', {
+      method: 'POST',
+      body: JSON.stringify({ service }),
+    });
+    if (adminResult !== null) {
+      console.log(JSON.stringify(adminResult, null, 2));
+      continue;
+    }
+
+    // Direct compose stop for specific service
+    const state = await ensureStagedState();
+    const composeArgs = fullComposeArgs(state);
+    if (service === 'admin' || service === 'docker-socket-proxy') {
+      await runDockerCompose([...composeArgs, '--profile', 'admin', 'stop', service]);
+    } else {
+      await runDockerCompose([...composeArgs, 'stop', service]);
+    }
+  }
+}

package/src/commands/uninstall.ts

@@ -0,0 +1,37 @@
+import { defineCommand } from 'citty';
+import { tryAdminRequest } from '../lib/admin.ts';
+import { runDockerCompose } from '../lib/docker.ts';
+import { ensureStagedState, fullComposeArgs } from '../lib/staging.ts';
+
+export default defineCommand({
+  meta: {
+    name: 'uninstall',
+    description: 'Stop and remove the OpenPalm stack (preserves config and data)',
+  },
+  args: {
+    volumes: {
+      type: 'boolean',
+      description: 'Also remove Docker volumes',
+      default: false,
+    },
+  },
+  async run({ args }) {
+    // Try admin delegation first
+    const adminResult = await tryAdminRequest('/admin/uninstall', { method: 'POST' });
+    if (adminResult !== null) {
+      console.log(JSON.stringify(adminResult, null, 2));
+      return;
+    }
+
+    // Direct compose down — include admin profile to tear down all services
+    const state = await ensureStagedState();
+    const composeArgs = fullComposeArgs(state);
+    const downArgs = args.volumes ? ['down', '-v'] : ['down'];
+    await runDockerCompose([...composeArgs, '--profile', 'admin', ...downArgs]);
+
+    console.log('OpenPalm stack stopped and removed.');
+    if (!args.volumes) {
+      console.log('Config and data directories are preserved. Use --volumes to also remove Docker volumes.');
+    }
+  },
+});

package/src/commands/update.ts

@@ -0,0 +1,32 @@
+import { defineCommand } from 'citty';
+import { tryAdminRequest } from '../lib/admin.ts';
+import { runDockerCompose } from '../lib/docker.ts';
+import { ensureStagedState, fullComposeArgs, buildManagedServiceNames } from '../lib/staging.ts';
+
+export default defineCommand({
+  meta: {
+    name: 'update',
+    description: 'Pull latest images and recreate containers',
+  },
+  async run() {
+    // Try admin delegation first
+    const adminResult = await tryAdminRequest('/admin/containers/pull', { method: 'POST' });
+    if (adminResult !== null) {
+      console.log(JSON.stringify(adminResult, null, 2));
+      return;
+    }
+
+    // Direct compose: pull + recreate
+    const state = await ensureStagedState();
+    const composeArgs = fullComposeArgs(state);
+    const managedServices = buildManagedServiceNames(state);
+
+    console.log('Pulling latest images...');
+    await runDockerCompose([...composeArgs, 'pull', ...managedServices]);
+
+    console.log('Recreating containers...');
+    await runDockerCompose([...composeArgs, 'up', '-d', '--force-recreate', ...managedServices]);
+
+    console.log('Update complete.');
+  },
+});

package/src/commands/validate.ts

@@ -0,0 +1,47 @@
+import { defineCommand } from 'citty';
+import { join } from 'node:path';
+import { rm } from 'node:fs/promises';
+import { defaultConfigHome, defaultStateHome } from '../lib/paths.ts';
+import { ensureVarlock, prepareVarlockDir } from '../lib/varlock.ts';
+
+export default defineCommand({
+  meta: {
+    name: 'validate',
+    description: 'Validate configuration against schema',
+  },
+  async run() {
+    const stateHome = defaultStateHome();
+    const configHome = defaultConfigHome();
+
+    const primarySchema = join(stateHome, 'artifacts', 'secrets.env.schema');
+    const envPath = join(configHome, 'secrets.env');
+
+    if (!(await Bun.file(primarySchema).exists())) {
+      console.error(
+        `Error: secrets.env.schema not found at ${primarySchema}.\nRun 'openpalm install' first to stage schema files.`,
+      );
+      process.exit(1);
+    }
+
+    if (!(await Bun.file(envPath).exists())) {
+      console.error(
+        `Error: secrets.env not found at ${envPath}.\nRun 'openpalm install' first.`,
+      );
+      process.exit(1);
+    }
+
+    const varlockBin = await ensureVarlock(stateHome);
+    const tmpDir = await prepareVarlockDir(primarySchema, envPath);
+    let exitCode = 1;
+    try {
+      const proc = Bun.spawn(
+        [varlockBin, 'load', '--path', `${tmpDir}/`],
+        { stdout: 'inherit', stderr: 'inherit' },
+      );
+      exitCode = await proc.exited;
+    } finally {
+      await rm(tmpDir, { recursive: true, force: true });
+    }
+    process.exit(exitCode);
+  },
+});

package/src/lib/admin.ts

@@ -0,0 +1,107 @@
+import { loadAdminToken } from './env.ts';
+
+export const ADMIN_URL = process.env.OPENPALM_ADMIN_API_URL || 'http://localhost:8100';
+
+/**
+ * Returns true if the admin health endpoint is reachable.
+ */
+export async function isAdminReachable(): Promise<boolean> {
+  try {
+    const response = await fetch(`${ADMIN_URL}/health`, {
+      method: 'GET',
+      signal: AbortSignal.timeout(2000),
+    });
+    return response.ok;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * @deprecated Use isAdminReachable() instead. Kept for backward compatibility.
+ */
+export const isStackRunning = isAdminReachable;
+
+/**
+ * Makes an authenticated request to the admin API.
+ * Throws if the response is not ok.
+ */
+export async function adminRequest(path: string, init?: RequestInit): Promise<unknown> {
+  const token = await loadAdminToken();
+  if (!token) {
+    throw new Error(
+      'No admin token found. Set OPENPALM_ADMIN_TOKEN in your environment or ' +
+      `configure it in secrets.env via the setup wizard (${ADMIN_URL}/setup).`,
+    );
+  }
+  const response = await fetch(`${ADMIN_URL}${path}`, {
+    ...init,
+    headers: {
+      'Content-Type': 'application/json',
+      'X-Requested-By': 'cli',
+      'X-Admin-Token': token,
+      ...init?.headers,
+    },
+    signal: init?.signal ?? AbortSignal.timeout(120_000),
+  });
+
+  const text = await response.text();
+  if (!response.ok) {
+    throw new Error(text || `${response.status} ${response.statusText}`);
+  }
+
+  if (!text) return { ok: true };
+  try {
+    return JSON.parse(text) as unknown;
+  } catch {
+    return text;
+  }
+}
+
+/**
+ * Try to delegate an operation to the admin API.
+ * Returns the result if admin is reachable and has a valid token.
+ * Returns null if admin is unreachable or no token is available.
+ * Attempts the request directly — no separate health check round-trip.
+ */
+export async function tryAdminRequest(path: string, init?: RequestInit): Promise<unknown | null> {
+  const token = await loadAdminToken();
+  if (!token) return null;
+
+  try {
+    return await adminRequest(path, {
+      ...init,
+      signal: init?.signal ?? AbortSignal.timeout(10_000),
+    });
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Waits for the admin health endpoint to become healthy (up to 120s).
+ */
+export async function waitForAdminHealthy(): Promise<void> {
+  const started = Date.now();
+  while (Date.now() - started < 120_000) {
+    if (await isAdminReachable()) {
+      return;
+    }
+    await Bun.sleep(3000);
+  }
+  throw new Error('Admin did not become healthy within 120 seconds');
+}
+
+/**
+ * Extracts service names from an admin containers/list response.
+ */
+export function getServiceNames(status: unknown): string[] {
+  if (!status || typeof status !== 'object' || !('containers' in status)) {
+    return [];
+  }
+  const containers = (status as { containers?: unknown }).containers;
+  if (!containers || typeof containers !== 'object') {
+    return [];
+  }
+  return Object.keys(containers as Record<string, unknown>);
+}

package/src/lib/docker.ts

@@ -0,0 +1,107 @@
+import { mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { ensureXdgDirs } from '@openpalm/lib';
+
+const REPO_OWNER = 'itlackey';
+const REPO_NAME = 'openpalm';
+
+/**
+ * Creates the full XDG directory tree required by the stack.
+ * Delegates to @openpalm/lib for core dirs, then adds CLI-specific extras.
+ */
+export async function ensureDirectoryTree(
+  _configHome: string,
+  _dataHome: string,
+  stateHome: string,
+  workDir: string,
+): Promise<void> {
+  // Core XDG dirs (CONFIG_HOME, DATA_HOME, STATE_HOME subtrees)
+  ensureXdgDirs();
+
+  // CLI-specific extras not in lib
+  for (const dir of [
+    join(stateHome, 'bin'),
+    workDir,
+  ]) {
+    await mkdir(dir, { recursive: true });
+  }
+}
+
+/**
+ * Downloads an asset from a GitHub release, falling back to raw.githubusercontent.com.
+ */
+export async function fetchAsset(repoRef: string, filename: string): Promise<string> {
+  const releaseUrl = `https://github.com/${REPO_OWNER}/${REPO_NAME}/releases/download/${repoRef}/${filename}`;
+  const rawUrl = `https://raw.githubusercontent.com/${REPO_OWNER}/${REPO_NAME}/${repoRef}/assets/${filename}`;
+
+  const releaseResponse = await fetch(releaseUrl, { signal: AbortSignal.timeout(30000) });
+  if (releaseResponse.ok) {
+    return await releaseResponse.text();
+  }
+
+  const rawResponse = await fetch(rawUrl, { signal: AbortSignal.timeout(30000) });
+  if (rawResponse.ok) {
+    return await rawResponse.text();
+  }
+
+  throw new Error(`Failed to download ${filename} from ${repoRef}`);
+}
+
+/**
+ * Runs a `docker compose` command with inherited stdio. Throws on non-zero exit.
+ */
+export async function runDockerCompose(args: string[]): Promise<void> {
+  const proc = Bun.spawn(['docker', 'compose', ...args], {
+    stdout: 'inherit',
+    stderr: 'inherit',
+    stdin: 'inherit',
+  });
+  const code = await proc.exited;
+  if (code !== 0) {
+    throw new Error(`docker compose ${args.join(' ')} failed with exit code ${code}`);
+  }
+}
+
+/**
+ * Runs a `docker compose` command and captures stdout as a string.
+ * Throws on non-zero exit.
+ */
+export async function runDockerComposeCapture(args: string[]): Promise<string> {
+  const proc = Bun.spawn(['docker', 'compose', ...args], {
+    stdout: 'pipe',
+    stderr: 'inherit',
+    stdin: 'inherit',
+  });
+  const output = await new Response(proc.stdout).text();
+  const code = await proc.exited;
+  if (code !== 0) {
+    throw new Error(`docker compose ${args.join(' ')} failed with exit code ${code}`);
+  }
+  return output;
+}
+
+// composeProjectArgs() removed — use fullComposeArgs(state) from staging.ts instead.
+// That function builds the correct file list including channel overlays and staged env files.
+
+// ensureOpenCodeConfig and ensureOpenCodeSystemConfig are imported from @openpalm/lib.
+// See packages/lib/src/control-plane/secrets.ts and core-assets.ts.
+
+/**
+ * Opens a URL in the user's default browser. Best-effort, never throws.
+ */
+export async function openBrowser(url: string): Promise<void> {
+  const platform = process.platform;
+  try {
+    if (platform === 'darwin') {
+      Bun.spawn(['open', url], { stdout: 'ignore', stderr: 'ignore' });
+      return;
+    }
+    if (platform === 'win32') {
+      Bun.spawn(['cmd', '/c', 'start', url], { stdout: 'ignore', stderr: 'ignore' });
+      return;
+    }
+    Bun.spawn(['xdg-open', url], { stdout: 'ignore', stderr: 'ignore' });
+  } catch {
+    // Best effort
+  }
+}