mirrorneuron-cli 1.2.8__tar.gz → 1.2.15__tar.gz

{mirrorneuron_cli-1.2.8/mirrorneuron_cli.egg-info → mirrorneuron_cli-1.2.15}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mirrorneuron-cli
-Version: 1.2.8
+Version: 1.2.15
 Summary: MirrorNeuron CLI
 License-Expression: MIT
 Classifier: Programming Language :: Python :: 3

{mirrorneuron_cli-1.2.8 → mirrorneuron_cli-1.2.15/mirrorneuron_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mirrorneuron-cli
-Version: 1.2.8
+Version: 1.2.15
 Summary: MirrorNeuron CLI
 License-Expression: MIT
 Classifier: Programming Language :: Python :: 3

{mirrorneuron_cli-1.2.8 → mirrorneuron_cli-1.2.15}/mn_cli/libs/model_cmds.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import json
+import os
 import subprocess
 from typing import Annotated, Any, Optional
 
@@ -250,16 +251,21 @@ def install_model_entry(
     target = docker_model_name(entry)
     if _docker_model_cli_available():
         _ensure_runner(compatibility.backend, compatibility.accelerator)
-        _docker_model_pull(target)
+        pull_result = _pull_model(target)
         run_command = ["model", "run", "--detach"]
         resolved_context = context_size or entry.get("context_size")
         if resolved_context and _docker_model_run_supports_context_size():
             run_command.extend(["--context-size", str(resolved_context)])
         run_command.append(target)
         _docker(run_command, timeout=300)
-        return {"entry": entry, "docker_model": target, "compatibility": payload, "transport": "docker_cli"}
+        return {
+            "entry": entry,
+            "docker_model": target,
+            "compatibility": payload,
+            **pull_result,
+        }
 
-    api_result = dmr_api_pull_model(target, timeout=900)
+    api_result = dmr_api_pull_model(target, timeout=_model_pull_timeout_seconds())
     return {
         "entry": entry,
         "docker_model": target,
@@ -269,6 +275,21 @@ def install_model_entry(
     }
 
 
+def _model_pull_timeout_seconds() -> float:
+    try:
+        return max(float(os.getenv("MN_DOCKER_MODEL_PULL_TIMEOUT_SECONDS", "3600")), 1.0)
+    except ValueError:
+        return 3600.0
+
+
+def _pull_model(target: str) -> dict[str, Any]:
+    if _endpoint_responds():
+        api_result = dmr_api_pull_model(target, timeout=_model_pull_timeout_seconds())
+        return {"transport": "docker_model_runner_api", "api": api_result}
+    _docker_model_pull(target)
+    return {"transport": "docker_cli"}
+
+
 def _docker_model_pull(target: str, *, attempts: int = 2) -> None:
     last_error: RuntimeError | None = None
     for attempt in range(1, attempts + 1):

{mirrorneuron_cli-1.2.8 → mirrorneuron_cli-1.2.15}/mn_cli/libs/skill_dependencies.py

@@ -79,8 +79,19 @@ def gar_requirement_lines(manifest: dict[str, Any] | None) -> list[str]:
     ]
 
 
+def gar_requirements_file_lines(manifest: dict[str, Any] | None) -> list[str]:
+    requirements = pinned_skill_dependency_requirements(manifest)
+    if not requirements:
+        return []
+    return [
+        f"--index-url {GAR_PIP_INDEX_URL}",
+        f"--extra-index-url {PYPI_PIP_INDEX_URL}",
+        *requirements,
+    ]
+
+
 def gar_requirements_text(manifest: dict[str, Any] | None) -> str:
-    lines = gar_requirement_lines(manifest)
+    lines = gar_requirements_file_lines(manifest)
     return "\n".join(lines).strip() + ("\n" if lines else "")
 
 

{mirrorneuron_cli-1.2.8 → mirrorneuron_cli-1.2.15}/mn_cli/libs/sys_cmds.py

@@ -310,15 +310,21 @@ def ensure_context_engine(
             )
             summary = ensure_context_engine_runtime(force=force)
             progress.update(task, description="[green]Context memory is ready.")
+        details = [
+            ("Service", summary["service"]),
+            ("Model", summary["model"]),
+            ("Model status", summary.get("model_status", "unknown")),
+        ]
+        if summary.get("membrane_dir"):
+            details.append(("Membrane", summary["membrane_dir"]))
+        if summary.get("engine_image"):
+            details.append(("Engine image", summary["engine_image"]))
+
         print_success_confirmation(
             console,
             "Context engine",
             status=summary["status"],
-            details=[
-                ("Service", summary["service"]),
-                ("Model", summary["model"]),
-                ("Membrane", summary["membrane_dir"]),
-            ],
+            details=details,
             next_steps="mn runtime health",
         )
     except Exception as exc:

{mirrorneuron_cli-1.2.8 → mirrorneuron_cli-1.2.15}/mn_cli/server_cmds.py

@@ -9,6 +9,7 @@ import shutil
 import socket
 import subprocess
 import sys
+import tempfile
 import time
 import urllib.request
 from datetime import datetime, timezone
@@ -116,6 +117,7 @@ DEFAULT_MEMBRANE_ENGINE_IMAGE_REPOSITORY = (
     "us-central1-docker.pkg.dev/mirrorneuron-public-packages/"
     "mirrorneuron-runtime/membrane-context-engine"
 )
+PUBLIC_GAR_PROJECT_PATH = "/mirrorneuron-public-packages/"
 CONTEXT_ENGINE_SERVICE = "membrane-context-engine"
 CONTEXT_ENGINE_CONTAINER = "mirror-neuron-context-engine"
 CONTEXT_ENGINE_MODEL_CONTAINER = "mirror-neuron-context-engine-model"
@@ -2027,32 +2029,45 @@ def ensure_context_engine_runtime(*, force: bool = False) -> dict[str, str]:
     _remove_non_mirror_neuron_container(CONTEXT_ENGINE_CONTAINER)
     _remove_non_mirror_neuron_container(CONTEXT_ENGINE_MODEL_CONTAINER)
     _ensure_docker_model_runner()
+    model_already_installed = _docker_model_inspect_ok(model)
+    model_status = "already_installed" if model_already_installed else "compose_pending"
 
     already_running = _docker_container_running(CONTEXT_ENGINE_CONTAINER)
-    if force or not already_running:
+    if force or not already_running or not model_already_installed:
+        compose_env = env
+        anonymous_docker_config: Path | None = None
         if use_engine_image:
+            compose_env, anonymous_docker_config = _anonymous_public_gar_docker_env(env, engine_image)
+        compose_process_env = _compose_subprocess_env(compose_env)
+        try:
+            if use_engine_image:
+                subprocess.run(
+                    runtime_compose_cmd("pull", CONTEXT_ENGINE_SERVICE),
+                    check=True,
+                    stdout=subprocess.DEVNULL,
+                    env=compose_process_env,
+                )
+                up_args = ("up", "-d", "--no-build", CONTEXT_ENGINE_SERVICE)
+            else:
+                subprocess.run(
+                    runtime_compose_cmd("build", CONTEXT_ENGINE_SERVICE),
+                    check=True,
+                    stdout=subprocess.DEVNULL,
+                    env=compose_process_env,
+                )
+                up_args = ("up", "-d", CONTEXT_ENGINE_SERVICE)
             subprocess.run(
-                runtime_compose_cmd("pull", CONTEXT_ENGINE_SERVICE),
-                check=True,
-                stdout=subprocess.DEVNULL,
-                env=env,
-            )
-            up_args = ("up", "-d", "--no-build", CONTEXT_ENGINE_SERVICE)
-        else:
-            subprocess.run(
-                runtime_compose_cmd("build", CONTEXT_ENGINE_SERVICE),
+                runtime_compose_cmd(*up_args),
                 check=True,
                 stdout=subprocess.DEVNULL,
-                env=env,
+                env=compose_process_env,
             )
-            up_args = ("up", "-d", CONTEXT_ENGINE_SERVICE)
-        subprocess.run(
-            runtime_compose_cmd(*up_args),
-            check=True,
-            stdout=subprocess.DEVNULL,
-            env=env,
-        )
+        finally:
+            if anonymous_docker_config is not None:
+                shutil.rmtree(anonymous_docker_config, ignore_errors=True)
         status = "restarted" if already_running and force else "started"
+        if not model_already_installed:
+            model_status = "installed" if _docker_model_inspect_ok(model) else "compose_managed"
     else:
         status = "already_running"
 
@@ -2061,10 +2076,106 @@ def ensure_context_engine_runtime(*, force: bool = False) -> dict[str, str]:
         "service": CONTEXT_ENGINE_SERVICE,
         "container": CONTEXT_ENGINE_CONTAINER,
         "model": model,
+        "model_status": model_status,
         "compose_profiles": profiles,
         **({"engine_image": engine_image} if use_engine_image else {"membrane_dir": str(source_dir)}),
     }
 
+def _compose_subprocess_env(env: dict[str, str]) -> dict[str, str]:
+    merged = dict(os.environ)
+    merged.update({str(key): str(value) for key, value in env.items()})
+    return merged
+
+def _docker_model_inspect_ok(model: str) -> bool:
+    if not model:
+        return False
+    return _docker_command_ok(["docker", "model", "inspect", model])
+
+def _anonymous_public_gar_docker_env(env: dict[str, str], image: str) -> tuple[dict[str, str], Path | None]:
+    if not _is_public_gar_image(image):
+        return env, None
+
+    registry_host = _docker_image_registry_host(image)
+    config_dir = Path(tempfile.mkdtemp(prefix="mn-public-gar-docker-config-"))
+    source_config = _docker_config_dir(env) / "config.json"
+    config: dict[str, Any] = {}
+    if source_config.exists():
+        try:
+            loaded = json.loads(source_config.read_text(encoding="utf-8"))
+            if isinstance(loaded, dict):
+                config = loaded
+        except Exception:
+            logger.debug("Could not read Docker config for public GAR pull; using anonymous config", exc_info=True)
+
+    config = _docker_config_without_public_gar_credentials(config, registry_host)
+    (config_dir / "config.json").write_text(json.dumps(config, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+    _expose_docker_cli_plugins(source_config.parent, config_dir)
+    _expose_docker_contexts(source_config.parent, config_dir)
+
+    next_env = dict(env)
+    next_env["DOCKER_CONFIG"] = str(config_dir)
+    return next_env, config_dir
+
+def _expose_docker_cli_plugins(source_config_dir: Path, target_config_dir: Path) -> None:
+    source_plugins = source_config_dir / "cli-plugins"
+    if not source_plugins.is_dir():
+        return
+    target_plugins = target_config_dir / "cli-plugins"
+    try:
+        os.symlink(source_plugins, target_plugins, target_is_directory=True)
+    except Exception:
+        try:
+            shutil.copytree(source_plugins, target_plugins, symlinks=True)
+        except Exception:
+            logger.debug("Could not expose Docker CLI plugins for anonymous GAR pull", exc_info=True)
+
+def _expose_docker_contexts(source_config_dir: Path, target_config_dir: Path) -> None:
+    source_contexts = source_config_dir / "contexts"
+    if not source_contexts.is_dir():
+        return
+    target_contexts = target_config_dir / "contexts"
+    try:
+        os.symlink(source_contexts, target_contexts, target_is_directory=True)
+    except Exception:
+        try:
+            shutil.copytree(source_contexts, target_contexts, symlinks=True)
+        except Exception:
+            logger.debug("Could not expose Docker contexts for anonymous GAR pull", exc_info=True)
+
+def _is_public_gar_image(image: str) -> bool:
+    text = str(image or "").strip()
+    return PUBLIC_GAR_PROJECT_PATH in text and _docker_image_registry_host(text).endswith(".pkg.dev")
+
+def _docker_image_registry_host(image: str) -> str:
+    return str(image or "").split("/", 1)[0].strip().lower()
+
+def _docker_config_dir(env: dict[str, str]) -> Path:
+    configured = str(env.get("DOCKER_CONFIG") or os.environ.get("DOCKER_CONFIG") or "").strip()
+    return Path(configured).expanduser() if configured else Path.home() / ".docker"
+
+def _docker_config_without_public_gar_credentials(config: dict[str, Any], registry_host: str) -> dict[str, Any]:
+    sanitized = dict(config)
+    sanitized.pop("credsStore", None)
+    for key in ("credHelpers", "auths"):
+        value = sanitized.get(key)
+        if not isinstance(value, dict):
+            continue
+        filtered = {
+            str(registry): details
+            for registry, details in value.items()
+            if not _docker_registry_matches_public_gar(str(registry), registry_host)
+        }
+        if filtered:
+            sanitized[key] = filtered
+        else:
+            sanitized.pop(key, None)
+    return sanitized
+
+def _docker_registry_matches_public_gar(registry: str, registry_host: str) -> bool:
+    normalized = registry.strip().lower()
+    normalized = normalized.removeprefix("https://").removeprefix("http://").split("/", 1)[0]
+    return normalized == registry_host or normalized.endswith(".pkg.dev")
+
 def _compose_profiles_with(value: object, required_profile: str) -> str:
     profiles: list[str] = []
     seen: set[str] = set()
@@ -3725,7 +3836,6 @@ def _start_server(
     if token:
         _write_network_token(network_token)
     env = _runtime_base_env(compose_runtime)
-    persisted_join_profile_before_network = bool(compose_runtime and not ip and _persisted_join_profile(env))
     mode_override = docker_network_mode or os.getenv("MN_DOCKER_NETWORK_MODE", "").strip()
     requested_docker_mode = _docker_network_mode(
         mode_override or None,

{mirrorneuron_cli-1.2.8 → mirrorneuron_cli-1.2.15}/tests/test_model_cmds.py

@@ -15,6 +15,7 @@ runner = CliRunner()
 @pytest.fixture(autouse=True)
 def isolate_model_ownership(monkeypatch, tmp_path):
     monkeypatch.setenv("MN_MODEL_OWNERSHIP_PATH", str(tmp_path / "ownership.json"))
+    monkeypatch.setattr("mn_cli.libs.model_cmds._endpoint_responds", lambda: False)
 
 
 def _completed(command, returncode=0, stdout="", stderr=""):
@@ -271,6 +272,40 @@ def test_model_install_falls_back_to_dmr_rest_when_cli_plugin_missing(mocker):
     assert {"from": "ai/gemma4:E2B"} in payloads
 
 
+def test_model_install_prefers_dmr_rest_pull_when_runner_api_reachable(mocker, monkeypatch):
+    calls = []
+    requests = []
+    monkeypatch.setattr("mn_cli.libs.model_cmds._endpoint_responds", lambda: True)
+
+    def fake_run(command, **kwargs):
+        calls.append(command)
+        if command[:4] == ["docker", "model", "status", "--json"]:
+            return _completed(command, stdout=json.dumps({"running": True, "backends": {"llama.cpp": "Running"}}))
+        if command[:4] == ["docker", "model", "run", "--help"]:
+            return _completed(command, stdout="Options:\n")
+        return _completed(command)
+
+    def fake_urlopen(request, timeout=0):
+        requests.append((request.full_url, request.get_method(), request.data, timeout))
+        return FakeResponse("{}")
+
+    mocker.patch("subprocess.run", side_effect=fake_run)
+    mocker.patch("urllib.request.urlopen", side_effect=fake_urlopen)
+    mocker.patch(
+        "mn_sdk.model_runtime.detect_host_hardware",
+        return_value=HostHardwareProfile("darwin", "arm64", total_memory_gb=16, unified_memory_gb=16, has_apple_silicon=True),
+    )
+
+    result = runner.invoke(app, ["model", "install", "gemma4:e2b"])
+
+    assert result.exit_code == 0
+    assert ["docker", "model", "pull", "ai/gemma4:E2B"] not in calls
+    assert ["docker", "model", "run", "--detach", "ai/gemma4:E2B"] in calls
+    assert any(url.endswith("/models/create") and method == "POST" for url, method, _data, _timeout in requests)
+    payloads = [json.loads(data.decode("utf-8")) for _url, _method, data, _timeout in requests if data]
+    assert {"from": "ai/gemma4:E2B"} in payloads
+
+
 def test_model_list_reads_dmr_rest_tags_when_cli_plugin_missing(mocker):
     def fake_run(command, **kwargs):
         if command[:3] == ["docker", "model", "--help"] or command[:3] == ["docker", "model", "list"]:

{mirrorneuron_cli-1.2.8 → mirrorneuron_cli-1.2.15}/tests/test_run_cmds.py

@@ -789,6 +789,27 @@ def test_runtime_ensure_context_engine_explains_first_launch(mocker):
     assert "First launch may download the context model" in stdout_text
     assert "Context engine" in result.stdout
     assert "hf.co/example/context-model" in result.stdout
+    assert "/tmp/Membrane" in result.stdout
+    mock_ensure.assert_called_once_with(force=False)
+
+
+def test_runtime_ensure_context_engine_reports_release_image(mocker):
+    mock_ensure = mocker.patch(
+        "mn_cli.libs.sys_cmds.ensure_context_engine_runtime",
+        return_value={
+            "status": "started",
+            "service": "membrane-context-engine",
+            "model": "hf.co/example/context-model",
+            "engine_image": "us-central1-docker.pkg.dev/example/runtime/membrane-context-engine:v1.2.14",
+        },
+    )
+
+    result = runner.invoke(app, ["runtime", "ensure-context-engine"])
+
+    assert result.exit_code == 0
+    assert "Context engine" in result.stdout
+    assert "hf.co/example/context-model" in result.stdout
+    assert "membrane-context-engine:v1.2.14" in result.stdout
     mock_ensure.assert_called_once_with(force=False)
 
 
@@ -983,6 +1004,9 @@ def test_openshell_skill_dependency_context_injects_pinned_gar_install(tmp_path)
     assert context != sandbox_dir
     assert "mirrorneuron-websocket-stream-skill==1.2.7" in requirements
     assert "https://us-central1-python.pkg.dev/mirrorneuron-public-packages/agent-skills/simple/" in requirements
+    assert "--index-url\n" not in requirements
+    assert "--index-url https://us-central1-python.pkg.dev/mirrorneuron-public-packages/agent-skills/simple/" in requirements
+    assert "--extra-index-url https://pypi.org/simple" in requirements
     assert "COPY __mn_skill_dependencies/requirements.txt" in dockerfile
     assert "pip install --break-system-packages --no-cache-dir -r /tmp/mn-skill-dependencies/requirements.txt" in dockerfile
 

{mirrorneuron_cli-1.2.8 → mirrorneuron_cli-1.2.15}/tests/test_run_helpers.py

@@ -384,6 +384,9 @@ def test_stage_skill_dependency_payloads_injects_pinned_gar_requirements_for_doc
     dockerfile = payloads["worker/docker_worker/Dockerfile"].decode()
     assert "mirrorneuron-rag-skill==1.2.7" in requirements
     assert "https://us-central1-python.pkg.dev/mirrorneuron-public-packages/agent-skills/simple/" in requirements
+    assert "--index-url\n" not in requirements
+    assert "--index-url https://us-central1-python.pkg.dev/mirrorneuron-public-packages/agent-skills/simple/" in requirements
+    assert "--extra-index-url https://pypi.org/simple" in requirements
     assert "COPY __mn_skill_dependencies/requirements.txt" in dockerfile
     assert "pip install --break-system-packages --no-cache-dir -r /tmp/mn-skill-dependencies/requirements.txt" in dockerfile
 

{mirrorneuron_cli-1.2.8 → mirrorneuron_cli-1.2.15}/tests/test_server_cmds.py

@@ -1,5 +1,6 @@
 import json
 import pytest
+import shutil
 import subprocess
 import sys
 from io import StringIO
@@ -324,6 +325,9 @@ def test_deploy_compose_passes_host_shared_storage_to_core():
 
     assert "MN_HOST_SHARED_STORAGE_ROOT:" in compose_text
     assert "${MN_HOST_SHARED_STORAGE_ROOT:-${MN_SHARED_STORAGE_ROOT:-" in compose_text
+    assert "membrane-context-engine:" in compose_text
+    assert "context-engine-model:" in compose_text
+    assert "MN_CONTEXT_MODEL_ENDPOINT" in compose_text
 
 def test_runtime_blueprint_env_updates_ignores_legacy_host_mn_dir(tmp_path):
     legacy_home = tmp_path / "legacy-mn-home"
@@ -574,6 +578,7 @@ def test_ensure_context_engine_runtime_persists_profile_and_starts_compose(mocke
     server_cmds.RUNTIME_COMPOSE_FILE.write_text("services: {}\n", encoding="utf-8")
     mocker.patch("mn_cli.server_cmds._ensure_context_engine_source", return_value=membrane_dir)
     mocker.patch("mn_cli.server_cmds._ensure_docker_model_runner")
+    inspect_model = mocker.patch("mn_cli.server_cmds._docker_model_inspect_ok", side_effect=[False, True])
     mocker.patch("mn_cli.server_cmds._remove_non_mirror_neuron_container")
     mocker.patch("mn_cli.server_cmds._docker_container_running", return_value=False)
     run = mocker.patch("mn_cli.server_cmds.subprocess.run")
@@ -585,10 +590,13 @@ def test_ensure_context_engine_runtime_persists_profile_and_starts_compose(mocke
     assert env["MEMBRANE_DIR"] == str(membrane_dir)
     assert env["MN_CONTEXT_MODEL_RUNNER_MODEL"] == server_cmds.DEFAULT_CONTEXT_MODEL_RUNNER_MODEL
     assert result["status"] == "started"
+    assert result["model_status"] == "installed"
+    assert inspect_model.call_args_list[0].args[0] == server_cmds.DEFAULT_CONTEXT_MODEL_RUNNER_MODEL
     assert run.call_args_list[0].args[0] == runtime_compose_cmd("build", "membrane-context-engine")
     assert run.call_args_list[1].args[0] == runtime_compose_cmd("up", "-d", "membrane-context-engine")
 
-def test_ensure_context_engine_runtime_uses_release_image_without_source_clone(mocker):
+def test_ensure_context_engine_runtime_uses_release_image_without_source_clone(mocker, monkeypatch):
+    monkeypatch.setenv("PATH", "/usr/local/bin:/usr/bin:/bin")
     server_cmds.RUNTIME_COMPOSE_ENV.parent.mkdir(parents=True, exist_ok=True)
     server_cmds.RUNTIME_COMPOSE_ENV.write_text(
         "COMPOSE_PROJECT_NAME=mirror-neuron\n"
@@ -600,6 +608,7 @@ def test_ensure_context_engine_runtime_uses_release_image_without_source_clone(m
     server_cmds.RUNTIME_COMPOSE_FILE.write_text("services: {}\n", encoding="utf-8")
     ensure_source = mocker.patch("mn_cli.server_cmds._ensure_context_engine_source")
     mocker.patch("mn_cli.server_cmds._ensure_docker_model_runner")
+    inspect_model = mocker.patch("mn_cli.server_cmds._docker_model_inspect_ok", return_value=True)
     mocker.patch("mn_cli.server_cmds._remove_non_mirror_neuron_container")
     mocker.patch("mn_cli.server_cmds._docker_container_running", return_value=False)
     run = mocker.patch("mn_cli.server_cmds.subprocess.run")
@@ -616,10 +625,63 @@ def test_ensure_context_engine_runtime_uses_release_image_without_source_clone(m
     assert env["MN_MEMBRANE_ENGINE_IMAGE"] == expected_image
     assert "MEMBRANE_DIR" not in env
     assert result["status"] == "started"
+    assert result["model_status"] == "already_installed"
     assert result["engine_image"] == expected_image
     ensure_source.assert_not_called()
+    inspect_model.assert_called_once_with(server_cmds.DEFAULT_CONTEXT_MODEL_RUNNER_MODEL)
     assert run.call_args_list[0].args[0] == runtime_compose_cmd("pull", "membrane-context-engine")
     assert run.call_args_list[1].args[0] == runtime_compose_cmd("up", "-d", "--no-build", "membrane-context-engine")
+    assert run.call_args_list[0].kwargs["env"]["DOCKER_CONFIG"] != str(Path.home() / ".docker")
+    assert run.call_args_list[0].kwargs["env"]["PATH"] == "/usr/local/bin:/usr/bin:/bin"
+
+def test_public_gar_docker_env_strips_gcloud_helpers(monkeypatch, tmp_path):
+    docker_config = tmp_path / "docker-config"
+    docker_config.mkdir()
+    docker_plugins = docker_config / "cli-plugins"
+    docker_plugins.mkdir()
+    (docker_plugins / "docker-compose").write_text("#!/bin/sh\n", encoding="utf-8")
+    docker_context = docker_config / "contexts" / "meta" / "desktop-linux"
+    docker_context.mkdir(parents=True)
+    (docker_context / "meta.json").write_text('{"Name":"desktop-linux"}\n', encoding="utf-8")
+    (docker_config / "config.json").write_text(
+        json.dumps(
+            {
+                "currentContext": "desktop-linux",
+                "auths": {
+                    "https://us-central1-docker.pkg.dev": {"auth": "private"},
+                    "ghcr.io": {"auth": "keep"},
+                },
+                "credHelpers": {
+                    "us-central1-docker.pkg.dev": "gcloud",
+                    "ghcr.io": "ghcr",
+                },
+                "credsStore": "desktop",
+                "proxies": {"default": {"httpProxy": "http://proxy.test"}},
+            }
+        ),
+        encoding="utf-8",
+    )
+    env = {"DOCKER_CONFIG": str(docker_config)}
+
+    next_env, temp_config_dir = server_cmds._anonymous_public_gar_docker_env(
+        env,
+        "us-central1-docker.pkg.dev/mirrorneuron-public-packages/mirrorneuron-runtime/membrane-context-engine:v1.2.8",
+    )
+
+    try:
+        assert temp_config_dir is not None
+        assert next_env["DOCKER_CONFIG"] == str(temp_config_dir)
+        assert next_env["DOCKER_CONFIG"] != env["DOCKER_CONFIG"]
+        sanitized = json.loads((temp_config_dir / "config.json").read_text(encoding="utf-8"))
+        assert "credsStore" not in sanitized
+        assert sanitized["credHelpers"] == {"ghcr.io": "ghcr"}
+        assert sanitized["auths"] == {"ghcr.io": {"auth": "keep"}}
+        assert sanitized["proxies"] == {"default": {"httpProxy": "http://proxy.test"}}
+        assert sanitized["currentContext"] == "desktop-linux"
+        assert (temp_config_dir / "cli-plugins" / "docker-compose").exists()
+        assert (temp_config_dir / "contexts" / "meta" / "desktop-linux" / "meta.json").exists()
+    finally:
+        shutil.rmtree(temp_config_dir, ignore_errors=True)
 
 def test_ensure_context_engine_runtime_skips_compose_when_already_running(mocker, tmp_path):
     membrane_dir = tmp_path / "Membrane"
@@ -635,6 +697,7 @@ def test_ensure_context_engine_runtime_skips_compose_when_already_running(mocker
     server_cmds.RUNTIME_COMPOSE_FILE.write_text("services: {}\n", encoding="utf-8")
     mocker.patch("mn_cli.server_cmds._ensure_context_engine_source", return_value=membrane_dir)
     mocker.patch("mn_cli.server_cmds._ensure_docker_model_runner")
+    inspect_model = mocker.patch("mn_cli.server_cmds._docker_model_inspect_ok", return_value=True)
     mocker.patch("mn_cli.server_cmds._remove_non_mirror_neuron_container")
     mocker.patch("mn_cli.server_cmds._docker_container_running", return_value=True)
     run = mocker.patch("mn_cli.server_cmds.subprocess.run")
@@ -643,8 +706,36 @@ def test_ensure_context_engine_runtime_skips_compose_when_already_running(mocker
 
     assert result["status"] == "already_running"
     assert result["model"] == "hf.co/acme/context"
+    assert result["model_status"] == "already_installed"
+    inspect_model.assert_called_once_with("hf.co/acme/context")
     run.assert_not_called()
 
+def test_ensure_context_engine_runtime_reconciles_missing_model_with_compose(mocker, tmp_path):
+    membrane_dir = tmp_path / "Membrane"
+    membrane_dir.mkdir()
+    (membrane_dir / "Dockerfile").write_text("FROM scratch\n", encoding="utf-8")
+    server_cmds.RUNTIME_COMPOSE_ENV.parent.mkdir(parents=True, exist_ok=True)
+    server_cmds.RUNTIME_COMPOSE_ENV.write_text(
+        "COMPOSE_PROJECT_NAME=mirror-neuron\n"
+        "COMPOSE_PROFILES=context\n"
+        "MN_CONTEXT_MODEL_RUNNER_MODEL=hf.co/acme/context\n",
+        encoding="utf-8",
+    )
+    server_cmds.RUNTIME_COMPOSE_FILE.write_text("services: {}\n", encoding="utf-8")
+    mocker.patch("mn_cli.server_cmds._ensure_context_engine_source", return_value=membrane_dir)
+    mocker.patch("mn_cli.server_cmds._ensure_docker_model_runner")
+    mocker.patch("mn_cli.server_cmds._docker_model_inspect_ok", side_effect=[False, True])
+    mocker.patch("mn_cli.server_cmds._remove_non_mirror_neuron_container")
+    mocker.patch("mn_cli.server_cmds._docker_container_running", return_value=True)
+    run = mocker.patch("mn_cli.server_cmds.subprocess.run")
+
+    result = server_cmds.ensure_context_engine_runtime()
+
+    assert result["status"] == "started"
+    assert result["model_status"] == "installed"
+    assert run.call_args_list[0].args[0] == runtime_compose_cmd("build", "membrane-context-engine")
+    assert run.call_args_list[1].args[0] == runtime_compose_cmd("up", "-d", "membrane-context-engine")
+
 def test_runtime_compose_cmd_includes_models_override():
     server_cmds.RUNTIME_COMPOSE_ENV.parent.mkdir(parents=True, exist_ok=True)
     server_cmds.RUNTIME_COMPOSE_ENV.write_text("COMPOSE_PROJECT_NAME=mirror-neuron\n", encoding="utf-8")