unoverse 0.1.18 → 0.1.19

package/bin/unoverse.mjs

@@ -9,7 +9,8 @@
  */
 import { existsSync } from "node:fs";
 import { spawnSync } from "node:child_process";
-import { join, resolve } from "node:path";
+import { join, resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
 import { create } from "../lib/create.mjs";
 
 /**
@@ -20,15 +21,17 @@ import { create } from "../lib/create.mjs";
  * root. Found means the operator commands exist; not found means they simply are not
  * offered, instead of being advertised and then refusing.
  */
-// Two layouts, one search. A universe keeps the machinery in .unoverse/; the platform
-// monorepo keeps it in scripts/. Neither is typed by a human.
-const OPERATOR = [".unoverse/operator.sh", "scripts/operator.sh"];
+// THE OPERATOR SHIPS WITH THIS PACKAGE, not with the universe. A universe is a folder
+// holding a docker-compose.yml, and nothing else: it carries no tooling to keep in step.
+// The scripts act on that folder (each resolves $ROOT by walking up for the compose
+// file), so the code is global and the data is local.
+const VENDORED = join(dirname(fileURLToPath(import.meta.url)), "../operator/operator.sh");
+const IN_REPO = join(dirname(fileURLToPath(import.meta.url)), "../../../scripts/operator.sh");
+const OPERATOR = existsSync(VENDORED) ? VENDORED : IN_REPO;
 
 function findUniverse() {
   for (let dir = process.cwd(); ; ) {
-    for (const rel of OPERATOR) {
-      if (existsSync(join(dir, rel))) return { root: dir, script: join(dir, rel) };
-    }
+    if (existsSync(join(dir, "docker-compose.yml"))) return { root: dir, script: OPERATOR };
     const parent = resolve(dir, "..");
     if (parent === dir) return null;
     dir = parent;

package/lib/create.mjs

@@ -8,6 +8,8 @@
  * a real auth round-trip against the registry, not a format check.
  */
 import { createInterface } from "node:readline/promises";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import { existsSync, mkdirSync, readdirSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 
@@ -242,9 +244,12 @@ export async function create(nameArg) {
       // already in hand and already validated, so hand it over and configure now.
       rl.close();
       console.log("");
-      const operatorScript = [".unoverse/operator.sh", "scripts/operator.sh"]
-        .map((rel) => `${name}/${rel}`)
-        .find((f) => existsSync(f));
+      // This package's own operator, run against the folder just scaffolded.
+      const here = dirname(fileURLToPath(import.meta.url));
+      const vendored = resolve(here, "../operator/operator.sh");
+      const operatorScript = existsSync(vendored)
+        ? vendored
+        : resolve(here, "../../../scripts/operator.sh");
       const r = spawnSync("bash", [operatorScript, "init"], {
         stdio: "inherit",
         cwd: name,

package/operator/lib/check.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+# unoverse check
+
+cmd_check() {
+  echo ""
+  echo -e "  ${BOLD}Unoverse Platform Health Check${NC}"
+  echo ""
+  local pass=0 total=0
+
+  # 1. Services
+  for svc in unoverse canvas umap memory; do
+    total=$((total + 1))
+    local status
+    status=$(docker compose -f "$ROOT/docker-compose.yml" ps --format '{{.Status}}' "$svc" 2>/dev/null | head -1)
+    if echo "$status" | grep -qi "up"; then
+      ok "$svc"
+      pass=$((pass + 1))
+    elif echo "$status" | grep -qi "created"; then
+      fail "$svc ${DIM}(stuck in Created, the container never started)${NC}"
+    elif [ -z "$status" ]; then
+      fail "$svc ${DIM}(no container found)${NC}"
+    else
+      fail "$svc ${DIM}($status)${NC}"
+    fi
+  done
+  echo ""
+
+  # 2. Health endpoints
+  for endpoint in 4105:unoverse 4101:engine 5001:umap 4104:memory; do
+    local port="${endpoint%%:*}" name="${endpoint##*:}"
+    total=$((total + 1))
+    local code
+    code=$(curl -s -o /dev/null -w '%{http_code}' "http://localhost:$port/health" 2>/dev/null)
+    if [ "$code" = "200" ]; then
+      ok "$name health ${DIM}:$port${NC}"
+      pass=$((pass + 1))
+    else
+      fail "$name health ${DIM}:$port → $code${NC}"
+    fi
+  done
+  echo ""
+
+  # 3. Packages built
+  local built=0 pkg_total=0
+  for pkg in "$ROOT"/packages/*/; do
+    [ -f "$pkg/package.json" ] || continue
+    local name
+    name=$(basename "$pkg")
+    case "$name" in marketplace|gravity-client|plugin-base|skills|prompt-blocks) continue;; esac
+    pkg_total=$((pkg_total + 1))
+    if [ -f "$pkg/dist/index.js" ]; then
+      built=$((built + 1))
+    else
+      fail "$name ${DIM}(missing dist/index.js)${NC}"
+    fi
+  done
+  total=$((total + 1))
+  if [ "$built" -eq "$pkg_total" ]; then
+    ok "$built/$pkg_total packages built"
+    pass=$((pass + 1))
+  else
+    fail "$built/$pkg_total packages built"
+  fi
+
+  # 4. Unoverse node catalog
+  total=$((total + 1))
+  local plugin_count
+  # Catalog lives on unoverse; :4106 is Docker-internal and :4105 /plugins is JWT-gated,
+  # so count nodes from inside the container (node:20-slim has no curl → use node fetch).
+  plugin_count=$(docker compose -f "$ROOT/docker-compose.yml" exec -T unoverse node -e "fetch('http://127.0.0.1:4106/nodes').then(r=>r.json()).then(d=>console.log((d.nodes||[]).length)).catch(()=>console.log(0))" 2>/dev/null | tr -d ' \r')
+  if [ "$plugin_count" -gt "0" ]; then
+    ok "$plugin_count nodes loaded"
+    pass=$((pass + 1))
+  else
+    fail "0 nodes loaded ${DIM}(check unoverse logs)${NC}"
+  fi
+
+  # 5. Canvas
+  total=$((total + 1))
+  local canvas_code
+  canvas_code=$(curl -s -o /dev/null -w '%{http_code}' "http://localhost:3001" 2>/dev/null)
+  if [ "$canvas_code" = "200" ]; then
+    ok "Canvas ${DIM}http://localhost:3001${NC}"
+    pass=$((pass + 1))
+  else
+    fail "Canvas ${DIM}http://localhost:3001 → $canvas_code${NC}"
+  fi
+
+  # Summary
+  echo ""
+  if [ "$pass" -eq "$total" ]; then
+    echo -e "  ${GREEN}${BOLD}All $total checks passed${NC}"
+  else
+    echo -e "  ${YELLOW}${BOLD}$pass/$total checks passed${NC}"
+  fi
+  echo ""
+}

package/operator/lib/common.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# Shared colors, helpers, and constants
+
+GRAVITY_VERSION="1.0.0"
+DOCR_REGISTRY="registry.digitalocean.com"
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+CYAN='\033[0;36m'
+DIM='\033[2m'
+BOLD='\033[1m'
+NC='\033[0m'
+BLUE='\033[0;34m'
+MAGENTA='\033[0;35m'
+WHITE='\033[1;37m'
+UNDERLINE='\033[4m'
+
+ok()   { echo -e "  ${GREEN}✓${NC} $1"; }
+warn() { echo -e "  ${YELLOW}⚠${NC} $1"; }
+fail() { echo -e "  ${RED}✗${NC} $1"; }
+info() { echo -e "  ${DIM}$1${NC}"; }
+link() { echo -e "  ${CYAN}${UNDERLINE}$1${NC}"; }
+banner() {
+  echo ""
+  echo -e "  ${BOLD}${CYAN}⬡ $1${NC}"
+  echo -e "  ${DIM}─────────────────────────────────${NC}"
+}
+
+# The branded access box. ONE definition so start.sh, update.sh and dashboard.sh
+# never drift apart again.
+print_access_urls() {
+  echo -e "  ${WHITE}${BOLD}unoverse${NC}${DIM}, the experience layer for AI${NC}"
+  echo -e "  ${DIM}Use the Unoverse MCP to build agents. Somewhere, Skynet is taking notes. 🤖${NC}"
+  echo ""
+  echo -e "  ${CYAN}Canvas${NC}  ${DIM}(build agents)${NC}   ${UNDERLINE}http://localhost:3001${NC}"
+  echo -e "  ${CYAN}Studio${NC}  ${DIM}(build assets)${NC}   ${UNDERLINE}http://localhost:3002${NC}"
+  echo -e "  ${CYAN}API${NC}     ${DIM}(REST + MCP)${NC}     ${UNDERLINE}http://localhost:4105${NC}"
+  echo ""
+  echo -e "  ${DIM}▶ Next:${NC} open this repo in ${BOLD}Claude Code${NC} and ask it to build an agent"
+}
+
+# Elapsed time helper
+timer_start() { GRAVITY_START=$(date +%s); }
+timer_elapsed() {
+  local end=$(date +%s)
+  local elapsed=$((end - GRAVITY_START))
+  if [ $elapsed -ge 60 ]; then
+    echo "$((elapsed / 60))m $((elapsed % 60))s"
+  else
+    echo "${elapsed}s"
+  fi
+}
+
+# The old "studio mode" system (mode file, is_platform_mode, require_platform_mode)
+# was removed 2026-07-28: Studio is a separate app now, and this CLI has one job:
+# operate a universe. See _legacy/scripts-lib/ for the retired authoring tools.

package/operator/lib/dashboard.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# unoverse dashboard (default command when no args)
+
+cmd_dashboard() {
+  echo ""
+  echo -e "  ${BOLD}${CYAN}⬡ Unoverse Platform${NC} ${DIM}v${GRAVITY_VERSION}${NC}"
+  echo -e "  ${DIM}─────────────────────────────────${NC}"
+
+  # Check if .env exists
+  if [ ! -f "$ROOT/.env" ]; then
+    echo ""
+    echo -e "  ${YELLOW}${BOLD}First time?${NC} Run ${GREEN}${BOLD}unoverse init${NC} to get started."
+    echo ""
+    return
+  fi
+
+  # Quick status — use -a to see Created containers too
+  local ps
+  ps=$(docker compose -f "$ROOT/docker-compose.yml" ps -a --format "{{.Name}}\t{{.Status}}" 2>/dev/null) || true
+
+  if [ -n "$ps" ]; then
+    local total running created
+    total=$(echo "$ps" | wc -l | tr -d ' ')
+    running=$(echo "$ps" | grep -ci "up" || echo "0")
+    created=$(echo "$ps" | grep -ci "created" || echo "0")
+
+    echo ""
+    if [ "$running" -eq "$total" ] && [ "$total" -gt 0 ]; then
+      echo -e "  ${GREEN}●${NC} ${BOLD}Platform running${NC} ${DIM}($running services)${NC}"
+      echo ""
+      print_access_urls
+    elif [ "$created" -gt 0 ] && [ "$running" -eq 0 ]; then
+      echo -e "  ${RED}●${NC} ${BOLD}$total containers stuck in Created state${NC}"
+      echo ""
+      echo -e "  Containers were created but never started."
+      echo -e "  Run ${GREEN}${BOLD}unoverse check${NC} to diagnose"
+    elif [ "$running" -gt 0 ]; then
+      echo -e "  ${YELLOW}●${NC} ${BOLD}$running/$total services up${NC}"
+      echo ""
+      print_access_urls
+    else
+      echo -e "  ${RED}●${NC} ${BOLD}Platform not running${NC} ${DIM}($total containers stopped)${NC}"
+      echo ""
+      echo -e "  Run ${GREEN}${BOLD}unoverse start${NC} to launch"
+    fi
+  else
+    echo ""
+    echo -e "  ${DIM}●${NC} ${BOLD}Platform stopped${NC}"
+    echo ""
+    echo -e "  Run ${GREEN}${BOLD}unoverse start${NC} to launch"
+  fi
+
+  echo ""
+  echo -e "  ${DIM}Run ${NC}${BOLD}unoverse help${NC}${DIM} for all commands${NC}"
+  echo ""
+}
+
+# ── unoverse open — browser shortcut (merged from open.sh 2026-07-28) ──
+
+cmd_open() {
+  local target="${1:-canvas}"
+  local url
+
+  case "$target" in
+    canvas)        url="http://localhost:3001" ;;
+    api)           url="http://localhost:4105" ;;
+    logs|dozzle)   url="http://localhost:8080" ;;
+    *)
+      fail "Unknown target: $target"
+      info "Options: canvas, api, logs"
+      return
+      ;;
+  esac
+
+  ok "Opening $target → ${UNDERLINE}$url${NC}"
+
+  # Cross-platform open
+  if command -v open &>/dev/null; then
+    open "$url"
+  elif command -v xdg-open &>/dev/null; then
+    xdg-open "$url"
+  else
+    info "Open in your browser: $url"
+  fi
+}

package/operator/lib/db-setup.sh

@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+# unoverse check — runs node-pg-migrate to apply all pending migrations
+
+cmd_db_setup() {
+  banner "Database Setup"
+  timer_start
+
+  # Load DATABASE_URL from .env
+  local db_url
+  # MIGRATIONS CONNECT DIRECT (INFRASTRUCTURE.md, Postgres law): when the env
+  # carries a pooled DATABASE_URL (PgBouncer transaction mode), node-pg-migrate
+  # must bypass it — DDL and advisory locks don't ride transaction pooling.
+  # DATABASE_URL_DIRECT is rendered by the Terraform alongside the pooled URL.
+  db_url=$(grep "^DATABASE_URL_DIRECT=" "$ROOT/.env" 2>/dev/null | cut -d'=' -f2-)
+  [ -z "$db_url" ] && db_url=$(grep "^DATABASE_URL=" "$ROOT/.env" 2>/dev/null | cut -d'=' -f2-)
+  if [ -z "$db_url" ]; then
+    fail "DATABASE_URL not found in .env"
+    exit 1
+  fi
+  ok "DATABASE_URL configured"
+
+  # Auto-add sslmode=prefer if not specified (works for both SSL and non-SSL Postgres)
+  if [[ "$db_url" != *"sslmode="* ]]; then
+    if [[ "$db_url" == *"?"* ]]; then
+      db_url="${db_url}&sslmode=prefer"
+    else
+      db_url="${db_url}?sslmode=prefer"
+    fi
+  fi
+
+  # Detect environment: monorepo (local dev) vs starter (Docker)
+  if [ -d "$ROOT/apps/unoverse/engine" ]; then
+    # ── Local dev — run node-pg-migrate directly ──
+    echo ""
+    echo "  Running migrations (local dev)..."
+
+    NODE_TLS_REJECT_UNAUTHORIZED=0 DATABASE_URL="$db_url" \
+      npx node-pg-migrate up \
+        --migrations-dir "$ROOT/apps/unoverse/engine/migrations" \
+        --migration-file-language sql \
+        --no-lock \
+        2>&1 | sed 's/^/  /' || {
+      fail "Migrations failed"
+      exit 1
+    }
+
+    # Seed security corpus (idempotent)
+    _seed_security_corpus "$db_url" "$ROOT/apps/memory/src/security/corpus-seed.json"
+
+  else
+    # ── Starter/production — run via the unoverse container ──
+    echo ""
+
+    if ! docker compose -f "$ROOT/docker-compose.yml" ps --status running unoverse 2>/dev/null | grep -q unoverse; then
+      echo ""
+      echo -e "  ${YELLOW}The unoverse service must be running to apply migrations.${NC}"
+      echo -e "  ${DIM}(Migration files are bundled inside the unoverse Docker image)${NC}"
+      echo ""
+      echo -e "  Start services first, then re-run:"
+      echo -e "    ${GREEN}unoverse start${NC}"
+      echo -e "    ${GREEN}unoverse check${NC}"
+      echo ""
+      exit 1
+    fi
+
+    echo "  Running migrations (via Docker)..."
+
+    docker compose -f "$ROOT/docker-compose.yml" exec -T \
+      -e NODE_TLS_REJECT_UNAUTHORIZED=0 \
+      -e DATABASE_URL="$db_url" \
+      unoverse \
+      npx node-pg-migrate up \
+        --migrations-dir /app/apps/unoverse/engine/migrations \
+        --migration-file-language sql \
+        --no-lock \
+        2>&1 | sed 's/^/  /' || {
+      fail "Migrations failed"
+      exit 1
+    }
+
+    # Seed security corpus via Docker
+    docker compose -f "$ROOT/docker-compose.yml" exec -T \
+      -e NODE_TLS_REJECT_UNAUTHORIZED=0 unoverse node --no-warnings -e "
+      const fs = require('fs');
+      const { Pool } = require('pg');
+      (async () => {
+        try {
+          const seedData = JSON.parse(fs.readFileSync('/app/apps/memory/src/security/corpus-seed.json', 'utf-8'));
+          const ssl = process.env.DATABASE_URL.includes('sslmode=') ? { rejectUnauthorized: false } : false;
+          const pool = new Pool({ connectionString: process.env.DATABASE_URL, ssl });
+          for (const a of seedData) {
+            await pool.query(
+              'INSERT INTO security_attack_corpus (id,category,label,attack_prompt,expected_result,severity,source,is_active) VALUES (\$1,\$2,\$3,\$4,\$5,\$6,\$7,true) ON CONFLICT (id) DO NOTHING',
+              [a.id, a.category, a.label, a.attack_prompt, a.expected_result, a.severity, a.source]
+            );
+          }
+          console.log('  ✓ Seeded ' + seedData.length + ' security corpus attacks');
+          await pool.end();
+        } catch (e) { console.warn('  ⚠ Security corpus seed skipped: ' + e.message); }
+        process.exit(0);
+      })();
+    " 2>&1 || true
+  fi
+
+  echo ""
+  ok "Database setup complete ${DIM}($(timer_elapsed))${NC}"
+  echo ""
+
+  # Auto-verify schema after setup
+  echo "  Verifying schema..."
+  echo ""
+  cmd_db_verify
+}
+
+# Seed security attack corpus (local dev helper)
+_seed_security_corpus() {
+  local db_url="$1"
+  local seed_file="$2"
+
+  if [ ! -f "$seed_file" ]; then
+    echo "  ⚠ Security corpus seed file not found: skipping"
+    return 0
+  fi
+
+  NODE_TLS_REJECT_UNAUTHORIZED=0 DATABASE_URL="$db_url" node --no-warnings -e "
+    const fs = require('fs');
+    const { Pool } = require('pg');
+    (async () => {
+      try {
+        const seedData = JSON.parse(fs.readFileSync('$seed_file', 'utf-8'));
+        const ssl = process.env.DATABASE_URL.includes('sslmode=') ? { rejectUnauthorized: false } : false;
+        const pool = new Pool({ connectionString: process.env.DATABASE_URL, ssl });
+        for (const a of seedData) {
+          await pool.query(
+            'INSERT INTO security_attack_corpus (id,category,label,attack_prompt,expected_result,severity,source,is_active) VALUES (\$1,\$2,\$3,\$4,\$5,\$6,\$7,true) ON CONFLICT (id) DO NOTHING',
+            [a.id, a.category, a.label, a.attack_prompt, a.expected_result, a.severity, a.source]
+          );
+        }
+        console.log('  ✓ Seeded ' + seedData.length + ' security corpus attacks');
+        await pool.end();
+      } catch (e) { console.warn('  ⚠ Security corpus seed skipped: ' + e.message); }
+      process.exit(0);
+    })();
+  " 2>&1 || true
+}