postgresai 0.17.0-rc.1 → 0.17.0-rc.2

package/README.md

@@ -250,7 +250,7 @@ postgresai mon health [--wait <sec>]  # Check monitoring services health
 
 When `--instance-id <uuid>` (or `PGAI_INSTANCE_ID`) is set, `local-install` forwards the id to the platform, which **adopts** the already-provisioned monitoring instance instead of self-registering a duplicate under an auto-created `postgres-ai-monitoring` project. The CLI then persists the adopted instance's real project to `.pgwatch-config`, so checkup reports upload alongside the rest of that instance's health data. Adoption is awaited (with one automatic retry); if it fails, the CLI warns and reports fall back to the default project until you re-run `local-install`. Without the flag, the legacy self-registration path is byte-for-byte unchanged.
 
-`local-install` writes `.env` in the monitoring directory. It preserves existing `REPLICATOR_PASSWORD` and `VM_AUTH_*` values or generates new random ones when missing; `VM_AUTH_USERNAME` defaults to `vmauth` when absent. The replication password is used by the demo PostgreSQL standby replication user, and the VM auth credentials are required before Docker Compose can provision Grafana datasources. If you run `docker compose` directly or maintain `.env` yourself, set both VM auth values before upgrading. For rotation, run `VM_AUTH_PASSWORD="$(openssl rand -base64 18)" ./scripts/rotate-vm-auth.sh` from the monitoring directory so `.env`, `sink-prometheus`, and `grafana` update together.
+`local-install` writes `.env` in the monitoring directory. It preserves existing `REPLICATOR_PASSWORD`, `VM_AUTH_*` and the VictoriaMetrics admin-endpoint keys (`VM_DELETE_AUTH_KEY`, `VM_SNAPSHOT_AUTH_KEY`, `VM_FORCE_MERGE_AUTH_KEY`, `VM_PPROF_AUTH_KEY`, added in 0.17) or generates new random ones when missing. The admin keys live on the `sink-prometheus` command line, so `mon update` and `mon update-config` also recreate that container to apply them; `mon restart` (`docker compose restart`) does not; `VM_AUTH_USERNAME` defaults to `vmauth` when absent. The replication password is used by the demo PostgreSQL standby replication user, and the VM auth credentials are required before Docker Compose can provision Grafana datasources. If you run `docker compose` directly or maintain `.env` yourself, set both VM auth values before upgrading. For rotation, run `VM_AUTH_PASSWORD="$(openssl rand -base64 18)" ./scripts/rotate-vm-auth.sh` from the monitoring directory so `.env`, `sink-prometheus`, and `grafana` update together.
 
 #### Monitoring target databases (`mon targets` subgroup)
 ```bash
@@ -301,8 +301,8 @@ run `pgai orgs`) to discover the available ids.
 Tools exposed:
 - `list_issues`: returns the same JSON as `postgresai issues list` (args: `{ org_id, status?, hidden_only?, limit?, offset?, debug? }`).
 - `view_issue`: view a single issue with its comments (args: `{ issue_id, org_id, debug? }`).
-- `create_issue`: create a new issue (args: `{ title, description?, org_id, attachments?, debug? }`).
-- `update_issue`: update title/description/status/labels (args: `{ issue_id, org_id, title?, description?, status?, labels?, attachments?, debug? }`).
+- `create_issue`: create a new issue (args: `{ title, description?, org_id, project_id?, labels?, attachments?, is_hidden?, debug? }`).
+- `update_issue`: update title/description/status/labels/is_hidden (args: `{ issue_id, org_id, title?, description?, status?, labels?, attachments?, is_hidden?, debug? }`).
 - `post_issue_comment`: post a comment (args: `{ issue_id, org_id, content?, parent_comment_id?, attachments?, debug? }`).
 - `update_issue_comment`: update an existing comment (args: `{ comment_id, org_id, content?, attachments?, debug? }`).
 - `upload_file`: upload a local file and return the storage URL plus a ready-to-paste markdown link (args: `{ path, org_id, debug? }`).
@@ -353,8 +353,10 @@ sensitive.
 postgresai issues list                                       # List issues (shows: id, title, status, created_at; is_hidden only when set)
 postgresai issues list --hidden-only                         # Only hidden issues (PostgresAI staff)
 postgresai issues view <issueId>                             # View issue details and comments
-postgresai issues create --org-id <id> --title <t>           # Create a new issue
+postgresai issues create --org-id <id> <title>               # Create a new issue
+postgresai issues create --org-id <id> <title> --hidden      # Create a hidden issue (PostgresAI staff)
 postgresai issues update <issueId> [--title ... --status ...]# Update an existing issue
+postgresai issues update <issueId> --hidden|--no-hidden      # Hide / unhide an issue (PostgresAI staff)
 postgresai issues post-comment <issueId> <content>           # Post a comment to an issue
 postgresai issues update-comment <commentId> <content>       # Update an existing comment
 postgresai issues files upload <path>                        # Upload a file, print URL + markdown
@@ -370,7 +372,11 @@ postgresai issues files download <url> [-o <path>]           # Download a file
 Hidden issues are staff-internal. `issues list` and `issues view` mark them
 with `is_hidden: true`; the key is omitted entirely otherwise, so ordinary
 issues look exactly as they always have. `--hidden-only` lists just the hidden
-ones, filtered server-side.
+ones, filtered server-side. `issues create --hidden` creates one, and
+`issues update --hidden` / `--no-hidden` hides or unhides an existing issue
+(MCP: `is_hidden` on `create_issue` / `update_issue`). The CLI does no staff
+check of its own: the platform refuses a visibility change for a non-staff
+credential with a plain error, and the CLI prints it and exits non-zero.
 
 Staff access is granted per credential, not per person, and a credential that
 does not qualify simply sees nothing — `--hidden-only` returns an empty list

package/dist/bin/postgres-ai.js

@@ -13524,7 +13524,7 @@ var {
 // package.json
 var package_default = {
   name: "postgresai",
-  version: "0.17.0-rc.1",
+  version: "0.17.0-rc.2",
   description: "postgres_ai CLI",
   license: "Apache-2.0",
   private: false,
@@ -16884,7 +16884,7 @@ var Result = import_lib.default.Result;
 var TypeOverrides = import_lib.default.TypeOverrides;
 var defaults = import_lib.default.defaults;
 // package.json
-var version = "0.17.0-rc.1";
+var version = "0.17.0-rc.2";
 var package_default2 = {
   name: "postgresai",
   version,
@@ -17473,7 +17473,7 @@ async function fetchIssue(params) {
   }
 }
 async function createIssue(params) {
-  const { apiKey, apiBaseUrl, orgScope, title, orgId, description, projectId, labels, debug } = params;
+  const { apiKey, apiBaseUrl, orgScope, title, orgId, description, projectId, labels, hidden, debug } = params;
   if (!apiKey) {
     throw new Error("API key is required");
   }
@@ -17498,6 +17498,9 @@ async function createIssue(params) {
   if (labels && labels.length > 0) {
     bodyObj.labels = labels;
   }
+  if (hidden === true) {
+    bodyObj.is_hidden = true;
+  }
   const body = JSON.stringify(bodyObj);
   const headers = issueRequestHeaders(apiKey, orgScope);
   if (debug) {
@@ -17579,15 +17582,15 @@ async function createIssueComment(params) {
   }
 }
 async function updateIssue(params) {
-  const { apiKey, apiBaseUrl, orgScope, issueId, title, description, status, labels, debug } = params;
+  const { apiKey, apiBaseUrl, orgScope, issueId, title, description, status, labels, hidden, debug } = params;
   if (!apiKey) {
     throw new Error("API key is required");
   }
   if (!issueId) {
     throw new Error("issueId is required");
   }
-  if (title === undefined && description === undefined && status === undefined && labels === undefined) {
-    throw new Error("At least one field to update is required (title, description, status, or labels)");
+  if (title === undefined && description === undefined && status === undefined && labels === undefined && hidden === undefined) {
+    throw new Error("At least one field to update is required (title, description, status, labels, or hidden)");
   }
   const base = normalizeBaseUrl(apiBaseUrl);
   const url = new URL(`${base}/rpc/issue_update`);
@@ -17606,6 +17609,9 @@ async function updateIssue(params) {
   if (labels !== undefined) {
     bodyObj.p_labels = labels;
   }
+  if (hidden !== undefined) {
+    bodyObj.p_is_hidden = hidden;
+  }
   const body = JSON.stringify(bodyObj);
   const headers = issueRequestHeaders(apiKey, orgScope);
   if (debug) {
@@ -24947,6 +24953,13 @@ var ORG_ID_TOOL_PROPERTY = {
     description: "Organization ID. Optional with a per-organization token (uses the stored org); REQUIRED with a global token, which can reach every organization the user belongs to and will not assume one. Use orgs_list / `pgai orgs` to discover valid values."
   }
 };
+function parseHiddenArg(raw) {
+  if (raw === undefined || raw === null)
+    return {};
+  if (typeof raw === "boolean")
+    return { value: raw };
+  return { error: { content: [{ type: "text", text: "is_hidden must be a boolean" }], isError: true } };
+}
 async function handleToolCall(req, rootOpts, extra) {
   const toolName = req.params.name;
   const args = req.params.arguments || {};
@@ -25033,6 +25046,10 @@ async function handleToolCall(req, rootOpts, extra) {
       let description = rawDescription ? interpretEscapes(rawDescription) : undefined;
       const projectId = args.project_id !== undefined ? Number(args.project_id) : undefined;
       const labels = Array.isArray(args.labels) ? args.labels.map(String) : undefined;
+      const hiddenArg = parseHiddenArg(args.is_hidden);
+      if (hiddenArg.error)
+        return hiddenArg.error;
+      const hidden = hiddenArg.value === true;
       const attachments = Array.isArray(args.attachments) ? args.attachments.map(String).filter((p) => p.length > 0) : [];
       const scope = resolveMcpOrgScope(args, apiKey, cfg);
       if (scope.error)
@@ -25046,7 +25063,7 @@ async function handleToolCall(req, rootOpts, extra) {
         const uploaded = await uploadAttachments({ apiKey, orgScope: scope.orgScope, storageBaseUrl, attachmentPaths: attachments, debug });
         description = appendAttachmentsToContent(description ?? "", uploaded);
       }
-      const result = await createIssue({ apiKey, apiBaseUrl, title, orgId, orgScope: scope.orgScope, description, projectId, labels, debug });
+      const result = await createIssue({ apiKey, apiBaseUrl, title, orgId, orgScope: scope.orgScope, description, projectId, labels, hidden, debug });
       return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
     }
     if (toolName === "update_issue") {
@@ -25060,9 +25077,13 @@ async function handleToolCall(req, rootOpts, extra) {
       let description = rawDescription !== undefined ? interpretEscapes(rawDescription) : undefined;
       const status = args.status !== undefined ? Number(args.status) : undefined;
       const labels = Array.isArray(args.labels) ? args.labels.map(String) : undefined;
+      const hiddenArg = parseHiddenArg(args.is_hidden);
+      if (hiddenArg.error)
+        return hiddenArg.error;
+      const hidden = hiddenArg.value;
       const attachments = Array.isArray(args.attachments) ? args.attachments.map(String).filter((p) => p.length > 0) : [];
-      if (title === undefined && description === undefined && status === undefined && labels === undefined && attachments.length === 0) {
-        return { content: [{ type: "text", text: "At least one field to update is required (title, description, status, labels, or attachments)" }], isError: true };
+      if (title === undefined && description === undefined && status === undefined && labels === undefined && hidden === undefined && attachments.length === 0) {
+        return { content: [{ type: "text", text: "At least one field to update is required (title, description, status, labels, is_hidden, or attachments)" }], isError: true };
       }
       if (status !== undefined && (Number.isNaN(status) || status !== 0 && status !== 1)) {
         return { content: [{ type: "text", text: "status must be 0 (open) or 1 (closed)" }], isError: true };
@@ -25082,7 +25103,7 @@ async function handleToolCall(req, rootOpts, extra) {
         const uploaded = await uploadAttachments({ apiKey, orgScope: scope.orgScope, storageBaseUrl, attachmentPaths: attachments, debug });
         description = appendAttachmentsToContent(description, uploaded);
       }
-      const result = await updateIssue({ apiKey, apiBaseUrl, issueId, title, description, status, labels, orgScope: scope.orgScope, debug });
+      const result = await updateIssue({ apiKey, apiBaseUrl, issueId, title, description, status, labels, hidden, orgScope: scope.orgScope, debug });
       return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
     }
     if (toolName === "update_issue_comment") {
@@ -25357,6 +25378,7 @@ async function startMcpServer(rootOpts, extra) {
                 items: { type: "string" },
                 description: "Local file paths to upload and append as markdown links to the description (images render inline)"
               },
+              is_hidden: { type: "boolean", description: "Create as a hidden, staff-internal issue (PostgresAI staff only; same as CLI --hidden)" },
               debug: { type: "boolean", description: "Enable verbose debug logs" }
             },
             required: ["title"],
@@ -25365,7 +25387,7 @@ async function startMcpServer(rootOpts, extra) {
         },
         {
           name: "update_issue",
-          description: "Update an existing issue (title, description, status, labels). Use status=1 to close, status=0 to reopen. Local files passed via 'attachments' are uploaded and appended to 'description'; if 'description' is omitted, the existing description is fetched first and appended to.",
+          description: "Update an existing issue (title, description, status, labels, is_hidden). Use status=1 to close, status=0 to reopen. Local files passed via 'attachments' are uploaded and appended to 'description'; if 'description' is omitted, the existing description is fetched first and appended to.",
           inputSchema: {
             type: "object",
             properties: {
@@ -25384,6 +25406,7 @@ async function startMcpServer(rootOpts, extra) {
                 items: { type: "string" },
                 description: "Local file paths to upload and append as markdown links (images render inline). When provided without 'description', the existing description is fetched and appended to."
               },
+              is_hidden: { type: "boolean", description: "true hides the issue, false unhides it (PostgresAI staff only; same as CLI --hidden / --no-hidden). Omit (or pass null) to leave unchanged." },
               debug: { type: "boolean", description: "Enable verbose debug logs" }
             },
             required: ["issue_id"],
@@ -25731,7 +25754,7 @@ async function fetchIssue2(params) {
   }
 }
 async function createIssue2(params) {
-  const { apiKey, apiBaseUrl, orgScope, title, orgId, description, projectId, labels, debug } = params;
+  const { apiKey, apiBaseUrl, orgScope, title, orgId, description, projectId, labels, hidden, debug } = params;
   if (!apiKey) {
     throw new Error("API key is required");
   }
@@ -25756,6 +25779,9 @@ async function createIssue2(params) {
   if (labels && labels.length > 0) {
     bodyObj.labels = labels;
   }
+  if (hidden === true) {
+    bodyObj.is_hidden = true;
+  }
   const body = JSON.stringify(bodyObj);
   const headers = issueRequestHeaders2(apiKey, orgScope);
   if (debug) {
@@ -25837,15 +25863,15 @@ async function createIssueComment2(params) {
   }
 }
 async function updateIssue2(params) {
-  const { apiKey, apiBaseUrl, orgScope, issueId, title, description, status, labels, debug } = params;
+  const { apiKey, apiBaseUrl, orgScope, issueId, title, description, status, labels, hidden, debug } = params;
   if (!apiKey) {
     throw new Error("API key is required");
   }
   if (!issueId) {
     throw new Error("issueId is required");
   }
-  if (title === undefined && description === undefined && status === undefined && labels === undefined) {
-    throw new Error("At least one field to update is required (title, description, status, or labels)");
+  if (title === undefined && description === undefined && status === undefined && labels === undefined && hidden === undefined) {
+    throw new Error("At least one field to update is required (title, description, status, labels, or hidden)");
   }
   const base = normalizeBaseUrl(apiBaseUrl);
   const url = new URL(`${base}/rpc/issue_update`);
@@ -25864,6 +25890,9 @@ async function updateIssue2(params) {
   if (labels !== undefined) {
     bodyObj.p_labels = labels;
   }
+  if (hidden !== undefined) {
+    bodyObj.p_is_hidden = hidden;
+  }
   const body = JSON.stringify(bodyObj);
   const headers = issueRequestHeaders2(apiKey, orgScope);
   if (debug) {
@@ -38672,47 +38701,101 @@ function stripMatchingQuotes(value) {
   }
   return trimmed;
 }
+var VM_ADMIN_AUTH_KEYS = [
+  "VM_DELETE_AUTH_KEY",
+  "VM_SNAPSHOT_AUTH_KEY",
+  "VM_FORCE_MERGE_AUTH_KEY",
+  "VM_PPROF_AUTH_KEY"
+];
 var REQUIRED_ENV_KEYS = [
   { key: "REPLICATOR_PASSWORD", defaultValue: () => crypto2.randomBytes(32).toString("hex"), introducedIn: "0.13" },
   { key: "VM_AUTH_USERNAME", defaultValue: () => "vmauth", introducedIn: "0.15" },
-  { key: "VM_AUTH_PASSWORD", defaultValue: () => crypto2.randomBytes(18).toString("base64"), introducedIn: "0.15" }
+  { key: "VM_AUTH_PASSWORD", defaultValue: () => crypto2.randomBytes(18).toString("base64"), introducedIn: "0.15" },
+  { key: "VM_DELETE_AUTH_KEY", defaultValue: () => crypto2.randomBytes(32).toString("hex"), introducedIn: "0.17" },
+  { key: "VM_SNAPSHOT_AUTH_KEY", defaultValue: () => crypto2.randomBytes(32).toString("hex"), introducedIn: "0.17" },
+  { key: "VM_FORCE_MERGE_AUTH_KEY", defaultValue: () => crypto2.randomBytes(32).toString("hex"), introducedIn: "0.17" },
+  { key: "VM_PPROF_AUTH_KEY", defaultValue: () => crypto2.randomBytes(32).toString("hex"), introducedIn: "0.17" }
 ];
 function ensureRequiredEnvVars(projectDir) {
   const envFile = path7.resolve(projectDir, ".env");
   const existing = fs9.existsSync(envFile) ? fs9.readFileSync(envFile, "utf8") : "";
   const added = [];
   const appendLines = [];
+  let content = existing;
   for (const spec of REQUIRED_ENV_KEYS) {
-    const re = new RegExp(`^${spec.key}=`, "m");
-    if (!re.test(existing)) {
+    const present = new RegExp(`^[ 	]*(?:export[ 	]+)?${spec.key}=`, "m");
+    if (!present.test(content)) {
       appendLines.push(`${spec.key}=${spec.defaultValue()}`);
       added.push(spec.key);
+      continue;
+    }
+    if (VM_ADMIN_AUTH_KEYS.includes(spec.key)) {
+      const blank = new RegExp(`^([ 	]*(?:export[ 	]+)?${spec.key}=)[ 	]*(?:""|'')?[ 	]*\r?$`, "gm");
+      if (blank.test(content)) {
+        const value = spec.defaultValue();
+        content = content.replace(blank, (_match, prefix) => `${prefix}${value}`);
+        added.push(spec.key);
+      }
     }
   }
-  if (appendLines.length === 0) {
+  if (appendLines.length === 0 && content === existing) {
     return added;
   }
-  const needsTrailingNewline = existing.length > 0 && !existing.endsWith(`
+  const needsTrailingNewline = content.length > 0 && !content.endsWith(`
 `);
-  const newContent = existing + (needsTrailingNewline ? `
-` : "") + appendLines.join(`
+  const newContent = content + (needsTrailingNewline ? `
+` : "") + (appendLines.length > 0 ? appendLines.join(`
 `) + `
-`;
-  fs9.writeFileSync(envFile, newContent, { encoding: "utf8", mode: 384 });
+` : "");
+  writeEnvFile(envFile, newContent);
   return added;
 }
+function writeEnvFile(envFile, content) {
+  let targetFile = envFile;
+  try {
+    if (fs9.existsSync(envFile))
+      targetFile = fs9.realpathSync(envFile);
+  } catch {}
+  const tmpFile = `${targetFile}.tmp`;
+  fs9.writeFileSync(tmpFile, content, { encoding: "utf8", mode: 384 });
+  try {
+    fs9.chmodSync(tmpFile, 384);
+    if (fs9.existsSync(targetFile)) {
+      const st = fs9.statSync(targetFile);
+      fs9.chownSync(tmpFile, st.uid, st.gid);
+    }
+  } catch {}
+  try {
+    fs9.renameSync(tmpFile, targetFile);
+  } catch (error) {
+    try {
+      fs9.unlinkSync(tmpFile);
+    } catch {}
+    throw error;
+  }
+}
 var LOCAL_INSTALL_MANAGED_ENV_KEYS = [
   "PGAI_TAG",
   "PGAI_REGISTRY",
   "GF_SECURITY_ADMIN_PASSWORD",
   "REPLICATOR_PASSWORD",
   "VM_AUTH_USERNAME",
-  "VM_AUTH_PASSWORD"
+  "VM_AUTH_PASSWORD",
+  "VM_DELETE_AUTH_KEY",
+  "VM_SNAPSHOT_AUTH_KEY",
+  "VM_FORCE_MERGE_AUTH_KEY",
+  "VM_PPROF_AUTH_KEY"
 ];
 function buildLocalInstallEnv(existingEnv, imageTag) {
   const readRaw = (key) => {
-    const m = existingEnv.match(new RegExp(`^${key}=(.+)$`, "m"));
-    return m ? m[1].trim() : null;
+    const re = new RegExp(`^[ 	]*(?:export[ 	]+)?${key}=(.*)$`, "gm");
+    let value = null;
+    for (const m of existingEnv.matchAll(re)) {
+      value = m[1].trim();
+    }
+    if (value === null)
+      return null;
+    return stripMatchingQuotes(value) === "" ? null : value;
   };
   const envLines = [`PGAI_TAG=${imageTag}`];
   const registry = readRaw("PGAI_REGISTRY");
@@ -38727,11 +38810,15 @@ function buildLocalInstallEnv(existingEnv, imageTag) {
   envLines.push(`VM_AUTH_USERNAME=${vmAuthUsername ? stripMatchingQuotes(vmAuthUsername) : "vmauth"}`);
   const vmAuthPassword = readRaw("VM_AUTH_PASSWORD");
   envLines.push(`VM_AUTH_PASSWORD=${vmAuthPassword ? stripMatchingQuotes(vmAuthPassword) : crypto2.randomBytes(18).toString("base64")}`);
+  for (const key of VM_ADMIN_AUTH_KEYS) {
+    const existing = readRaw(key);
+    envLines.push(`${key}=${existing ? stripMatchingQuotes(existing) : crypto2.randomBytes(32).toString("hex")}`);
+  }
   const preservedKeys = [];
   for (const line of existingEnv.split(/\r?\n/)) {
     if (!line.trim())
       continue;
-    const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=/);
+    const m = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=/);
     if (m) {
       if (LOCAL_INSTALL_MANAGED_ENV_KEYS.includes(m[1]))
         continue;
@@ -38743,9 +38830,9 @@ function buildLocalInstallEnv(existingEnv, imageTag) {
 `) + `
 `, preservedKeys };
 }
-async function execFilePromise(file, args) {
+async function execFilePromise(file, args, options = {}) {
   return new Promise((resolve, reject) => {
-    childProcess.execFile(file, args, (error, stdout, stderr) => {
+    childProcess.execFile(file, args, options, (error, stdout, stderr) => {
       if (error) {
         const err = error;
         err.code = typeof error.code === "number" ? error.code : 1;
@@ -40484,6 +40571,12 @@ function isDockerRunning() {
     return false;
   }
 }
+function shouldScaleOutNodeExporter(args) {
+  const upIndex = args.indexOf("up");
+  if (upIndex === -1)
+    return false;
+  return !args.slice(upIndex + 1).some((a) => !a.startsWith("-"));
+}
 function getComposeCmd() {
   const tryCmd = (cmd, args) => spawnSync2(cmd, args, { stdio: "ignore", timeout: 5000 }).status === 0;
   if (tryCmd("docker", ["compose", "version"]))
@@ -40696,7 +40789,7 @@ async function runCompose(args, grafanaPassword) {
     }
   }
   const finalArgs = [...args];
-  if (process.platform === "darwin" && args.includes("up")) {
+  if (process.platform === "darwin" && shouldScaleOutNodeExporter(args)) {
     finalArgs.push("--scale", "self-node-exporter=0");
   }
   return new Promise((resolve) => {
@@ -40708,6 +40801,51 @@ async function runCompose(args, grafanaPassword) {
     child.on("close", (code) => resolve(code || 0));
   });
 }
+async function applySinkPrometheusConfig(projectDir) {
+  const composeCmd = getComposeCmd();
+  if (!composeCmd) {
+    console.error(`
+\u2717 docker compose not found, so the sink-prometheus config was not applied.`);
+    return false;
+  }
+  let running;
+  try {
+    const { stdout } = await execFilePromise(composeCmd[0], [
+      ...composeCmd.slice(1),
+      "-f",
+      path7.resolve(projectDir, "docker-compose.yml"),
+      "ps",
+      "-q",
+      "sink-prometheus"
+    ], { cwd: projectDir });
+    running = stdout.trim().length > 0;
+  } catch (error) {
+    console.error(`
+\u2717 Could not determine whether sink-prometheus is running.`);
+    console.error("  The admin-endpoint keys may NOT be in effect. To apply them:");
+    console.error("  docker compose up -d --no-deps sink-prometheus");
+    if (process.env.DEBUG) {
+      console.error(`  ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return false;
+  }
+  if (!running) {
+    console.log(`
+(sink-prometheus is not running - the new config applies when you start the stack)`);
+    return true;
+  }
+  console.log(`
+Applying sink-prometheus config (VictoriaMetrics admin keys, #359)...`);
+  const code = await runCompose(["up", "-d", "--no-deps", "sink-prometheus"]);
+  if (code !== 0) {
+    console.error("\u2717 Could not apply the sink-prometheus config.");
+    console.error("  The admin-endpoint keys are NOT in effect until you run:");
+    console.error("  docker compose up -d --no-deps sink-prometheus");
+    return false;
+  }
+  console.log("\u2713 sink-prometheus is running the current config");
+  return true;
+}
 program2.command("help").description("show help").action(() => {
   program2.outputHelp();
 });
@@ -40746,7 +40884,7 @@ mon.command("local-install").description("install local monitoring stack (genera
   const previousTag = previousTagMatch ? previousTagMatch[1].trim() : null;
   const imageTag = opts.tag || package_default.version;
   const { content: envContent, preservedKeys } = buildLocalInstallEnv(existingEnv, imageTag);
-  fs9.writeFileSync(envFile, envContent, { encoding: "utf8", mode: 384 });
+  writeEnvFile(envFile, envContent);
   if (preservedKeys.length > 0) {
     console.log(`Preserved existing .env settings: ${preservedKeys.join(", ")}
 `);
@@ -41042,9 +41180,9 @@ Searched: ${demoCandidates.join(", ")}
       const envLines = envContent.split(/\r?\n/).filter((l) => !/^VM_AUTH_USERNAME=/.test(l) && !/^VM_AUTH_PASSWORD=/.test(l)).filter((l, i, arr) => !(i === arr.length - 1 && l === ""));
       envLines.push(`VM_AUTH_USERNAME=${vmAuthUsername}`);
       envLines.push(`VM_AUTH_PASSWORD=${vmAuthPassword}`);
-      fs9.writeFileSync(envFile, envLines.join(`
+      writeEnvFile(envFile, envLines.join(`
 `) + `
-`, { encoding: "utf8", mode: 384 });
+`);
     }
     console.log(`\u2713 VictoriaMetrics auth configured
 `);
@@ -41345,8 +41483,13 @@ mon.command("update-config").description("apply monitoring services configuratio
   }
   await refreshBundledComposeIfStale(projectDir);
   const code = await runCompose(["run", "--rm", "sources-generator"]);
-  if (code !== 0)
+  if (code !== 0) {
     process.exitCode = code;
+    return;
+  }
+  if (!await applySinkPrometheusConfig(projectDir)) {
+    process.exitCode = 1;
+  }
 });
 mon.command("update").description("update monitoring stack (migrate .env, pull images)").action(async () => {
   console.log(`Updating PostgresAI monitoring stack...
@@ -41388,6 +41531,10 @@ mon.command("update").description("update monitoring stack (migrate .env, pull i
 Updating Docker images...`);
     const code = await runCompose(["pull"]);
     if (code === 0) {
+      if (!await applySinkPrometheusConfig(projectDir)) {
+        process.exitCode = 1;
+        return;
+      }
       console.log(`
 \u2713 Update completed successfully`);
       console.log(`
@@ -42228,7 +42375,7 @@ withOrgOptions(issues.command("create <title>")).description("create a new issue
 }, []).option("--attach <path>", "attach a file (uploads to storage and appends a markdown link to the description; repeatable)", (value, previous) => {
   previous.push(value);
   return previous;
-}, []).option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (rawTitle, opts) => {
+}, []).option("--hidden", "create as a hidden issue (PostgresAI staff)").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (rawTitle, opts) => {
   const rootOpts = program2.opts();
   const cfg = readConfig();
   const { apiKey } = getConfig(rootOpts);
@@ -42289,6 +42436,7 @@ withOrgOptions(issues.command("create <title>")).description("create a new issue
       description: augmentedDescription,
       projectId,
       labels,
+      hidden: opts.hidden === true,
       debug: !!opts.debug
     });
     spinner.stop();
@@ -42306,7 +42454,7 @@ withOrgOptions(issues.command("update <issueId>")).description("update an existi
 }, []).option("--clear-labels", "set labels to an empty list").option("--attach <path>", "attach a file (uploads and appends a markdown link to --description; if --description is omitted the existing description is fetched and appended to; repeatable)", (value, previous) => {
   previous.push(value);
   return previous;
-}, []).option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (issueId, opts) => {
+}, []).option("--hidden", "hide the issue (PostgresAI staff)").option("--no-hidden", "unhide the issue (PostgresAI staff)").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (issueId, opts) => {
   const rootOpts = program2.opts();
   const cfg = readConfig();
   const { apiKey } = getConfig(rootOpts);
@@ -42377,6 +42525,7 @@ withOrgOptions(issues.command("update <issueId>")).description("update an existi
       description,
       status,
       labels,
+      hidden: typeof opts.hidden === "boolean" ? opts.hidden : undefined,
       debug: !!opts.debug
     });
     spinner.stop();
@@ -43371,5 +43520,6 @@ export {
   refreshBundledComposeIfStale,
   registerMonitoringInstance,
   resolveAdoptedProject,
+  shouldScaleOutNodeExporter,
   updatePgwatchConfig
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "postgresai",
-  "version": "0.17.0-rc.1",
+  "version": "0.17.0-rc.2",
   "description": "postgres_ai CLI",
   "license": "Apache-2.0",
   "private": false,