[runleveldev]

Wires the opensource-server provider (@mieweb/os-cloud-provider, from mieweb/opensource-server#484, released to npmjs as 2026.10.3) into @mieweb/cli. Rebased onto main after #14 merged, and squashed into one commit.

Changes

• --target mieweb uses the built-in provider @mieweb/os-cloud-provider@^2026.10.3, a regular dependency installed from npmjs. deploy, destroy, tail, login, logout and whoami go through it. Its default image is the matching release, ghcr.io/mieweb/opensource-server/cloud:v2026.10.3.
• Fallback: commands the provider doesn't implement (dev) run on the Node host harness instead of erroring with "does not implement".
• DeployContext.persistTargetConfig: a provider can save settings it resolved interactively to mieweb.jsonc. For example, the provider prompts for an os.mieweb.org site and saves it. The CLI edits the file with jsonc-parser, keeping comments, and refuses secret-looking keys.
• mieweb init adds "start": "mieweb --target mieweb dev", which the cloud image's app.service runs. The host harness listens on $PORT when it's set.
• Removed pr-preview.yml: it published PR builds to GitHub Packages for testing across repos while the contract and provider were unreleased. Both are now on npmjs.
• Tests for provider resolution, the fallback and write-back; README, config schema and changesets updated.

Verified

• CI-equivalent run locally: typecheck, all tests, and pnpm check:packs, which confirms no workspace: ranges in the packed tarballs.
• Clean install: the CLI was packed with pnpm pack and installed into an empty project with npm i <tgz> --userconfig /dev/null (npmjs only, no token). The provider 2026.10.3 and @mieweb/*@0.3.1 all resolved from npmjs.
  • Without credentials, mieweb whoami returns "Not authenticated — provider opensource-server", and deploy with a bad token gives the login hint.
  • With a real API key, whoami against manager.os.mieweb.org returns "Authenticated as rgingras".
• A full deploy → browser check → tail → redeploy → destroy run against manager.os.mieweb.org was done earlier with the preview builds of this code; see the PR history.

Also fixed (folded in from #18)

• Missing wrangler: with wrangler not installed, wrangler-delegated commands on the cloudflare target used to end in a stack trace (a regression from feat(deploy): provider contract + wrangler reference provider #14). They now print mieweb: wrangler binary not found… and exit 1.
• mieweb --version: prints the mieweb version and exits 0 on every target. Before, it printed an error after the version on non-cloudflare targets.
• Three tests; patch changeset cli-missing-wrangler.

[Copilot]

🟡 Changes recommended

Secret validation, optional-auth routing, scaffold dependencies, and Node compatibility remain unresolved.

5 open issues

• CLI Node engine range conflicts with mandatory dependency · New
• Auth verbs bypass runProviderVerb default handling · New
• Generated config lacks libSQL and Valkey runtime dependencies · New
• Generated CLI dependency excludes provider integration release · New
• Secret guard misses nested credentials and leaks patch values · New

1 file not reviewed

• pnpm-lock.yaml: Generated file

What changed in this PR

Integrates the opensource-server deploy provider into the CLI’s mieweb target while retaining the Node host harness for development.

Changes:

• Bundles the provider, adds optional-command fallback, and enables config write-back.
• Adds scaffolded startup support and honors $PORT.
• Improves missing-wrangler/version handling and removes preview publishing.

File	Description
pnpm-lock.yaml	Locks provider dependencies.
packages/​cloud-adapters/​src/​host.mjs	Honors $PORT.
packages/​cli/​test/​provider.test.mjs	Tests provider resolution and config persistence.
packages/​cli/​test/​provider-core.test.mjs	Tests missing wrangler and version output.
packages/​cli/​src/​provider.mjs	Adds provider mapping and config write-back.
packages/​cli/​src/​init.mjs	Generates a start script.
packages/​cli/​src/​index.mjs	Updates fallback routing and version handling.
packages/​cli/​src/​cloudflare.mjs	Reports wrangler execution failures cleanly.
packages/​cli/​README.md	Documents provider-backed commands.
packages/​cli/​package.json	Adds the bundled provider dependency.
packages/​cli/​mieweb-config.schema.json	Documents provider defaults and fallback.
.github/​workflows/​pr-preview.yml	Removes preview publishing.
.changeset/​init-start-script.md	Records startup and port support.
.changeset/​cli-os-cloud-provider.md	Records provider integration and persistence.
.changeset/​cli-missing-wrangler.md	Records wrangler and version fixes.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The generated start script depends on a CLI omitted by production-only installs.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Declare @​mieweb/cli as a production dependency

packages/​cli/​src/​init.mjs:119

The new start script invokes mieweb at runtime, but the scaffold declares @mieweb/cli only as a devDependency. A production-only install (npm ci --omit=dev) therefore omits the executable required by npm start, causing startup to fail with mieweb: not found. Move @mieweb/cli into dependencies and update the scaffold test to check its runtime dependency entry.

5 resolved since last review

• Secret guard misses nested credentials and leaks patch values
• Generated CLI dependency excludes provider integration release
• Generated config lacks libSQL and Valkey runtime dependencies
• Auth verbs bypass runProviderVerb default handling
• CLI Node engine range conflicts with mandatory dependency

1 file not reviewed

• pnpm-lock.yaml: Generated file

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The changes address prior feedback, include regression coverage for the main integration paths, and have no unresolved review findings.

No open issues 🎉

1 file not reviewed

• pnpm-lock.yaml: Generated file

_{Review effort: Balanced}