postgresai 0.17.0-dev.2 → 0.17.0-rc.2

package/README.md

@@ -250,7 +250,7 @@ postgresai mon health [--wait <sec>]  # Check monitoring services health
 
 When `--instance-id <uuid>` (or `PGAI_INSTANCE_ID`) is set, `local-install` forwards the id to the platform, which **adopts** the already-provisioned monitoring instance instead of self-registering a duplicate under an auto-created `postgres-ai-monitoring` project. The CLI then persists the adopted instance's real project to `.pgwatch-config`, so checkup reports upload alongside the rest of that instance's health data. Adoption is awaited (with one automatic retry); if it fails, the CLI warns and reports fall back to the default project until you re-run `local-install`. Without the flag, the legacy self-registration path is byte-for-byte unchanged.
 
-`local-install` writes `.env` in the monitoring directory. It preserves existing `REPLICATOR_PASSWORD` and `VM_AUTH_*` values or generates new random ones when missing; `VM_AUTH_USERNAME` defaults to `vmauth` when absent. The replication password is used by the demo PostgreSQL standby replication user, and the VM auth credentials are required before Docker Compose can provision Grafana datasources. If you run `docker compose` directly or maintain `.env` yourself, set both VM auth values before upgrading. For rotation, run `VM_AUTH_PASSWORD="$(openssl rand -base64 18)" ./scripts/rotate-vm-auth.sh` from the monitoring directory so `.env`, `sink-prometheus`, and `grafana` update together.
+`local-install` writes `.env` in the monitoring directory. It preserves existing `REPLICATOR_PASSWORD`, `VM_AUTH_*` and the VictoriaMetrics admin-endpoint keys (`VM_DELETE_AUTH_KEY`, `VM_SNAPSHOT_AUTH_KEY`, `VM_FORCE_MERGE_AUTH_KEY`, `VM_PPROF_AUTH_KEY`, added in 0.17) or generates new random ones when missing. The admin keys live on the `sink-prometheus` command line, so `mon update` and `mon update-config` also recreate that container to apply them; `mon restart` (`docker compose restart`) does not; `VM_AUTH_USERNAME` defaults to `vmauth` when absent. The replication password is used by the demo PostgreSQL standby replication user, and the VM auth credentials are required before Docker Compose can provision Grafana datasources. If you run `docker compose` directly or maintain `.env` yourself, set both VM auth values before upgrading. For rotation, run `VM_AUTH_PASSWORD="$(openssl rand -base64 18)" ./scripts/rotate-vm-auth.sh` from the monitoring directory so `.env`, `sink-prometheus`, and `grafana` update together.
 
 #### Monitoring target databases (`mon targets` subgroup)
 ```bash

package/dist/bin/postgres-ai.js

@@ -13524,7 +13524,7 @@ var {
 // package.json
 var package_default = {
   name: "postgresai",
-  version: "0.17.0-dev.2",
+  version: "0.17.0-rc.2",
   description: "postgres_ai CLI",
   license: "Apache-2.0",
   private: false,
@@ -16884,7 +16884,7 @@ var Result = import_lib.default.Result;
 var TypeOverrides = import_lib.default.TypeOverrides;
 var defaults = import_lib.default.defaults;
 // package.json
-var version = "0.17.0-dev.2";
+var version = "0.17.0-rc.2";
 var package_default2 = {
   name: "postgresai",
   version,
@@ -38701,47 +38701,101 @@ function stripMatchingQuotes(value) {
   }
   return trimmed;
 }
+var VM_ADMIN_AUTH_KEYS = [
+  "VM_DELETE_AUTH_KEY",
+  "VM_SNAPSHOT_AUTH_KEY",
+  "VM_FORCE_MERGE_AUTH_KEY",
+  "VM_PPROF_AUTH_KEY"
+];
 var REQUIRED_ENV_KEYS = [
   { key: "REPLICATOR_PASSWORD", defaultValue: () => crypto2.randomBytes(32).toString("hex"), introducedIn: "0.13" },
   { key: "VM_AUTH_USERNAME", defaultValue: () => "vmauth", introducedIn: "0.15" },
-  { key: "VM_AUTH_PASSWORD", defaultValue: () => crypto2.randomBytes(18).toString("base64"), introducedIn: "0.15" }
+  { key: "VM_AUTH_PASSWORD", defaultValue: () => crypto2.randomBytes(18).toString("base64"), introducedIn: "0.15" },
+  { key: "VM_DELETE_AUTH_KEY", defaultValue: () => crypto2.randomBytes(32).toString("hex"), introducedIn: "0.17" },
+  { key: "VM_SNAPSHOT_AUTH_KEY", defaultValue: () => crypto2.randomBytes(32).toString("hex"), introducedIn: "0.17" },
+  { key: "VM_FORCE_MERGE_AUTH_KEY", defaultValue: () => crypto2.randomBytes(32).toString("hex"), introducedIn: "0.17" },
+  { key: "VM_PPROF_AUTH_KEY", defaultValue: () => crypto2.randomBytes(32).toString("hex"), introducedIn: "0.17" }
 ];
 function ensureRequiredEnvVars(projectDir) {
   const envFile = path7.resolve(projectDir, ".env");
   const existing = fs9.existsSync(envFile) ? fs9.readFileSync(envFile, "utf8") : "";
   const added = [];
   const appendLines = [];
+  let content = existing;
   for (const spec of REQUIRED_ENV_KEYS) {
-    const re = new RegExp(`^${spec.key}=`, "m");
-    if (!re.test(existing)) {
+    const present = new RegExp(`^[ 	]*(?:export[ 	]+)?${spec.key}=`, "m");
+    if (!present.test(content)) {
       appendLines.push(`${spec.key}=${spec.defaultValue()}`);
       added.push(spec.key);
+      continue;
+    }
+    if (VM_ADMIN_AUTH_KEYS.includes(spec.key)) {
+      const blank = new RegExp(`^([ 	]*(?:export[ 	]+)?${spec.key}=)[ 	]*(?:""|'')?[ 	]*\r?$`, "gm");
+      if (blank.test(content)) {
+        const value = spec.defaultValue();
+        content = content.replace(blank, (_match, prefix) => `${prefix}${value}`);
+        added.push(spec.key);
+      }
     }
   }
-  if (appendLines.length === 0) {
+  if (appendLines.length === 0 && content === existing) {
     return added;
   }
-  const needsTrailingNewline = existing.length > 0 && !existing.endsWith(`
+  const needsTrailingNewline = content.length > 0 && !content.endsWith(`
 `);
-  const newContent = existing + (needsTrailingNewline ? `
-` : "") + appendLines.join(`
+  const newContent = content + (needsTrailingNewline ? `
+` : "") + (appendLines.length > 0 ? appendLines.join(`
 `) + `
-`;
-  fs9.writeFileSync(envFile, newContent, { encoding: "utf8", mode: 384 });
+` : "");
+  writeEnvFile(envFile, newContent);
   return added;
 }
+function writeEnvFile(envFile, content) {
+  let targetFile = envFile;
+  try {
+    if (fs9.existsSync(envFile))
+      targetFile = fs9.realpathSync(envFile);
+  } catch {}
+  const tmpFile = `${targetFile}.tmp`;
+  fs9.writeFileSync(tmpFile, content, { encoding: "utf8", mode: 384 });
+  try {
+    fs9.chmodSync(tmpFile, 384);
+    if (fs9.existsSync(targetFile)) {
+      const st = fs9.statSync(targetFile);
+      fs9.chownSync(tmpFile, st.uid, st.gid);
+    }
+  } catch {}
+  try {
+    fs9.renameSync(tmpFile, targetFile);
+  } catch (error) {
+    try {
+      fs9.unlinkSync(tmpFile);
+    } catch {}
+    throw error;
+  }
+}
 var LOCAL_INSTALL_MANAGED_ENV_KEYS = [
   "PGAI_TAG",
   "PGAI_REGISTRY",
   "GF_SECURITY_ADMIN_PASSWORD",
   "REPLICATOR_PASSWORD",
   "VM_AUTH_USERNAME",
-  "VM_AUTH_PASSWORD"
+  "VM_AUTH_PASSWORD",
+  "VM_DELETE_AUTH_KEY",
+  "VM_SNAPSHOT_AUTH_KEY",
+  "VM_FORCE_MERGE_AUTH_KEY",
+  "VM_PPROF_AUTH_KEY"
 ];
 function buildLocalInstallEnv(existingEnv, imageTag) {
   const readRaw = (key) => {
-    const m = existingEnv.match(new RegExp(`^${key}=(.+)$`, "m"));
-    return m ? m[1].trim() : null;
+    const re = new RegExp(`^[ 	]*(?:export[ 	]+)?${key}=(.*)$`, "gm");
+    let value = null;
+    for (const m of existingEnv.matchAll(re)) {
+      value = m[1].trim();
+    }
+    if (value === null)
+      return null;
+    return stripMatchingQuotes(value) === "" ? null : value;
   };
   const envLines = [`PGAI_TAG=${imageTag}`];
   const registry = readRaw("PGAI_REGISTRY");
@@ -38756,11 +38810,15 @@ function buildLocalInstallEnv(existingEnv, imageTag) {
   envLines.push(`VM_AUTH_USERNAME=${vmAuthUsername ? stripMatchingQuotes(vmAuthUsername) : "vmauth"}`);
   const vmAuthPassword = readRaw("VM_AUTH_PASSWORD");
   envLines.push(`VM_AUTH_PASSWORD=${vmAuthPassword ? stripMatchingQuotes(vmAuthPassword) : crypto2.randomBytes(18).toString("base64")}`);
+  for (const key of VM_ADMIN_AUTH_KEYS) {
+    const existing = readRaw(key);
+    envLines.push(`${key}=${existing ? stripMatchingQuotes(existing) : crypto2.randomBytes(32).toString("hex")}`);
+  }
   const preservedKeys = [];
   for (const line of existingEnv.split(/\r?\n/)) {
     if (!line.trim())
       continue;
-    const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=/);
+    const m = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=/);
     if (m) {
       if (LOCAL_INSTALL_MANAGED_ENV_KEYS.includes(m[1]))
         continue;
@@ -38772,9 +38830,9 @@ function buildLocalInstallEnv(existingEnv, imageTag) {
 `) + `
 `, preservedKeys };
 }
-async function execFilePromise(file, args) {
+async function execFilePromise(file, args, options = {}) {
   return new Promise((resolve, reject) => {
-    childProcess.execFile(file, args, (error, stdout, stderr) => {
+    childProcess.execFile(file, args, options, (error, stdout, stderr) => {
       if (error) {
         const err = error;
         err.code = typeof error.code === "number" ? error.code : 1;
@@ -40513,6 +40571,12 @@ function isDockerRunning() {
     return false;
   }
 }
+function shouldScaleOutNodeExporter(args) {
+  const upIndex = args.indexOf("up");
+  if (upIndex === -1)
+    return false;
+  return !args.slice(upIndex + 1).some((a) => !a.startsWith("-"));
+}
 function getComposeCmd() {
   const tryCmd = (cmd, args) => spawnSync2(cmd, args, { stdio: "ignore", timeout: 5000 }).status === 0;
   if (tryCmd("docker", ["compose", "version"]))
@@ -40725,7 +40789,7 @@ async function runCompose(args, grafanaPassword) {
     }
   }
   const finalArgs = [...args];
-  if (process.platform === "darwin" && args.includes("up")) {
+  if (process.platform === "darwin" && shouldScaleOutNodeExporter(args)) {
     finalArgs.push("--scale", "self-node-exporter=0");
   }
   return new Promise((resolve) => {
@@ -40737,6 +40801,51 @@ async function runCompose(args, grafanaPassword) {
     child.on("close", (code) => resolve(code || 0));
   });
 }
+async function applySinkPrometheusConfig(projectDir) {
+  const composeCmd = getComposeCmd();
+  if (!composeCmd) {
+    console.error(`
+\u2717 docker compose not found, so the sink-prometheus config was not applied.`);
+    return false;
+  }
+  let running;
+  try {
+    const { stdout } = await execFilePromise(composeCmd[0], [
+      ...composeCmd.slice(1),
+      "-f",
+      path7.resolve(projectDir, "docker-compose.yml"),
+      "ps",
+      "-q",
+      "sink-prometheus"
+    ], { cwd: projectDir });
+    running = stdout.trim().length > 0;
+  } catch (error) {
+    console.error(`
+\u2717 Could not determine whether sink-prometheus is running.`);
+    console.error("  The admin-endpoint keys may NOT be in effect. To apply them:");
+    console.error("  docker compose up -d --no-deps sink-prometheus");
+    if (process.env.DEBUG) {
+      console.error(`  ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return false;
+  }
+  if (!running) {
+    console.log(`
+(sink-prometheus is not running - the new config applies when you start the stack)`);
+    return true;
+  }
+  console.log(`
+Applying sink-prometheus config (VictoriaMetrics admin keys, #359)...`);
+  const code = await runCompose(["up", "-d", "--no-deps", "sink-prometheus"]);
+  if (code !== 0) {
+    console.error("\u2717 Could not apply the sink-prometheus config.");
+    console.error("  The admin-endpoint keys are NOT in effect until you run:");
+    console.error("  docker compose up -d --no-deps sink-prometheus");
+    return false;
+  }
+  console.log("\u2713 sink-prometheus is running the current config");
+  return true;
+}
 program2.command("help").description("show help").action(() => {
   program2.outputHelp();
 });
@@ -40775,7 +40884,7 @@ mon.command("local-install").description("install local monitoring stack (genera
   const previousTag = previousTagMatch ? previousTagMatch[1].trim() : null;
   const imageTag = opts.tag || package_default.version;
   const { content: envContent, preservedKeys } = buildLocalInstallEnv(existingEnv, imageTag);
-  fs9.writeFileSync(envFile, envContent, { encoding: "utf8", mode: 384 });
+  writeEnvFile(envFile, envContent);
   if (preservedKeys.length > 0) {
     console.log(`Preserved existing .env settings: ${preservedKeys.join(", ")}
 `);
@@ -41071,9 +41180,9 @@ Searched: ${demoCandidates.join(", ")}
       const envLines = envContent.split(/\r?\n/).filter((l) => !/^VM_AUTH_USERNAME=/.test(l) && !/^VM_AUTH_PASSWORD=/.test(l)).filter((l, i, arr) => !(i === arr.length - 1 && l === ""));
       envLines.push(`VM_AUTH_USERNAME=${vmAuthUsername}`);
       envLines.push(`VM_AUTH_PASSWORD=${vmAuthPassword}`);
-      fs9.writeFileSync(envFile, envLines.join(`
+      writeEnvFile(envFile, envLines.join(`
 `) + `
-`, { encoding: "utf8", mode: 384 });
+`);
     }
     console.log(`\u2713 VictoriaMetrics auth configured
 `);
@@ -41374,8 +41483,13 @@ mon.command("update-config").description("apply monitoring services configuratio
   }
   await refreshBundledComposeIfStale(projectDir);
   const code = await runCompose(["run", "--rm", "sources-generator"]);
-  if (code !== 0)
+  if (code !== 0) {
     process.exitCode = code;
+    return;
+  }
+  if (!await applySinkPrometheusConfig(projectDir)) {
+    process.exitCode = 1;
+  }
 });
 mon.command("update").description("update monitoring stack (migrate .env, pull images)").action(async () => {
   console.log(`Updating PostgresAI monitoring stack...
@@ -41417,6 +41531,10 @@ mon.command("update").description("update monitoring stack (migrate .env, pull i
 Updating Docker images...`);
     const code = await runCompose(["pull"]);
     if (code === 0) {
+      if (!await applySinkPrometheusConfig(projectDir)) {
+        process.exitCode = 1;
+        return;
+      }
       console.log(`
 \u2713 Update completed successfully`);
       console.log(`
@@ -43402,5 +43520,6 @@ export {
   refreshBundledComposeIfStale,
   registerMonitoringInstance,
   resolveAdoptedProject,
+  shouldScaleOutNodeExporter,
   updatePgwatchConfig
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "postgresai",
-  "version": "0.17.0-dev.2",
+  "version": "0.17.0-rc.2",
   "description": "postgres_ai CLI",
   "license": "Apache-2.0",
   "private": false,