4bnode 4.1.0 → 4.1.1

package/lib/ui.js

@@ -1,6 +1,9 @@
+import fs from "fs";
+import path from "path";
 import chalk from "chalk";
 import gradient from "gradient-string";
 import ora from "ora";
+import { addDepsToPackageJson } from "./codegen.js";
 
 // Brand gradients
 const brand = gradient(["#00c6ff", "#0072ff", "#7b2ff7"]);
@@ -132,14 +135,24 @@ export function showNextSteps(steps) {
 
 export async function installDeps(packages, opts = {}) {
   const { execSync } = await import("child_process");
+  const { dev = false, ...execOpts } = opts;
   const names = Array.isArray(packages) ? packages : [packages];
   const label = names.join(", ");
+  // Record in package.json first, so the app is installable even if the live
+  // install fails (offline) — a later `npm install` then resolves everything.
+  try {
+    const pkgPath = path.join(execOpts.cwd || process.cwd(), "package.json");
+    if (fs.existsSync(pkgPath)) {
+      const { content, changed } = addDepsToPackageJson(fs.readFileSync(pkgPath, "utf8"), names, { dev });
+      if (changed) fs.writeFileSync(pkgPath, content, "utf8");
+    }
+  } catch {}
   const spinner = createSpinner(`Installing ${label}...`);
   spinner.start();
   try {
-    execSync(`npm install ${names.join(" ")}`, {
+    execSync(`npm install ${dev ? "-D " : ""}${names.join(" ")}`, {
       stdio: "pipe",
-      ...opts,
+      ...execOpts,
     });
     spinner.succeed(success(`Installed ${label}`));
   } catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "4bnode",
-  "version": "4.1.0",
+  "version": "4.1.1",
   "description": "4bnode is a CLI-powered backend development platform with a built-in visual dashboard to generate, manage, and test Node.js/Express APIs faster.",
   "main": "index.js",
   "type": "module",
@@ -8,7 +8,9 @@
     "4bnode": "index.js"
   },
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "test": "node lib/codegen.test.js",
+    "sync": "node lib/sync-skeleton.js",
+    "prepublishOnly": "npm run sync"
   },
   "repository": {
     "type": "git",

package/scripts/audit-dev-surface.mjs

@@ -0,0 +1,153 @@
+#!/usr/bin/env node
+// Audit the /_dev dashboard exposure across 4bnode apps (read-only).
+//
+//   node scripts/audit-dev-surface.mjs <dir> [--since=2026-06-07]
+//
+// Scans <dir> recursively for 4bnode apps (any folder containing
+// .4bnode/dev-api.js) and reports, per app:
+//   • whether the /_dev mount is gated on NODE_ENV (production-safe)
+//   • whether dev-api.js carries the loopback network guard
+//   • whether a .passkey exists and whether it is a known-weak PIN
+//   • route/source files modified on/after --since, and any that contain
+//     code-execution / cryptominer signatures (possible injected backdoor)
+//
+// Nothing is modified. Rotate weak/shared passkeys with `npx 4bnode passkey`.
+
+import fs from 'fs';
+import path from 'path';
+import crypto from 'crypto';
+
+const args = process.argv.slice(2);
+const root = path.resolve(args.find((a) => !a.startsWith('--')) || '.');
+const sinceArg = (args.find((a) => a.startsWith('--since=')) || '').split('=')[1];
+const since = sinceArg ? new Date(sinceArg) : null;
+
+const sha = (s) => crypto.createHash('sha256').update(s).digest('hex');
+// Common weak PINs operators reuse. Hashes compared against .4bnode/.passkey.
+const WEAK_PINS = ['123456', '000000', '111111', '121212', '123123', '654321',
+  '666666', '999999', '112233', '159753', '147258', '101010', '696969', '777777',
+  '123321', '789456', '000001', '222222', '555555', '888888', '123654', '098765'];
+const WEAK_HASHES = new Map(WEAK_PINS.map((p) => [sha(p), p]));
+
+// Signatures of code execution / miners that should never appear in generated routes.
+const BACKDOOR_PATTERNS = [
+  [/child_process|\brequire\(\s*['"]child_process['"]\s*\)/, 'child_process import'],
+  [/\bexec(Sync)?\s*\(/, 'exec() call'],
+  [/\bspawn(Sync)?\s*\(/, 'spawn() call'],
+  [/\beval\s*\(/, 'eval()'],
+  [/new\s+Function\s*\(/, 'new Function()'],
+  [/Buffer\.from\([^)]*,\s*['"]base64['"]\)/, 'base64-decoded payload'],
+  [/(curl|wget)\s+[^\n|]*\|\s*(sh|bash)/, 'pipe-to-shell download'],
+  [/xmrig|minerd|stratum\+tcp|coinhive|cryptonight|nanopool|supportxmr|nicehash/i, 'cryptominer signature'],
+  [/\/dev\/tcp\//, 'reverse-shell /dev/tcp'],
+];
+
+const C = { red: (s) => `\x1b[31m${s}\x1b[0m`, yel: (s) => `\x1b[33m${s}\x1b[0m`,
+  grn: (s) => `\x1b[32m${s}\x1b[0m`, dim: (s) => `\x1b[2m${s}\x1b[0m`, bold: (s) => `\x1b[1m${s}\x1b[0m` };
+
+function findApps(dir, depth = 0, acc = []) {
+  if (depth > 4) return acc;
+  let entries;
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return acc; }
+  if (entries.some((e) => e.isDirectory() && e.name === '.4bnode') &&
+      fs.existsSync(path.join(dir, '.4bnode', 'dev-api.js'))) {
+    acc.push(dir);
+  }
+  for (const e of entries) {
+    if (e.isDirectory() && e.name !== 'node_modules' && e.name !== '.git' && e.name !== '.4bnode') {
+      findApps(path.join(dir, e.name), depth + 1, acc);
+    }
+  }
+  return acc;
+}
+
+function scanSourceFiles(appDir) {
+  const targets = ['index.js', 'src'];
+  const files = [];
+  const walk = (p) => {
+    let st; try { st = fs.statSync(p); } catch { return; }
+    if (st.isDirectory()) {
+      if (path.basename(p) === 'node_modules' || path.basename(p) === '.git') return;
+      for (const c of fs.readdirSync(p)) walk(path.join(p, c));
+    } else if (p.endsWith('.js') || p.endsWith('.mjs') || p.endsWith('.cjs')) {
+      files.push(p);
+    }
+  };
+  for (const t of targets) walk(path.join(appDir, t));
+  const findings = [];
+  for (const f of files) {
+    let content, mtime;
+    try { content = fs.readFileSync(f, 'utf8'); mtime = fs.statSync(f).mtime; } catch { continue; }
+    const rel = path.relative(appDir, f);
+    const hits = [];
+    const lines = content.split('\n');
+    for (const [re, label] of BACKDOOR_PATTERNS) {
+      for (let i = 0; i < lines.length; i++) {
+        if (re.test(lines[i])) hits.push(`${rel}:${i + 1} — ${label}`);
+      }
+    }
+    const recent = since && mtime >= since;
+    if (hits.length || recent) findings.push({ rel, mtime, hits, recent });
+  }
+  return findings;
+}
+
+function auditApp(appDir) {
+  const name = path.basename(appDir);
+  const issues = [];
+  // 1. Mount gating
+  const idx = path.join(appDir, 'index.js');
+  if (fs.existsSync(idx)) {
+    const c = fs.readFileSync(idx, 'utf8');
+    const mountIdx = Math.max(c.indexOf('app.use("/_dev"'), c.indexOf("app.use('/_dev'"));
+    if (mountIdx !== -1) {
+      const gateIdx = c.search(/NODE_ENV\s*!==\s*['"]production['"]/);
+      const gated = gateIdx !== -1 && gateIdx < mountIdx;
+      if (!gated) issues.push([C.red('CRITICAL'), '/_dev is mounted WITHOUT a NODE_ENV production gate']);
+    }
+  }
+  // 2. Loopback guard in dev-api.js
+  const devApi = path.join(appDir, '.4bnode', 'dev-api.js');
+  const devApiSrc = fs.existsSync(devApi) ? fs.readFileSync(devApi, 'utf8') : '';
+  if (devApiSrc && !devApiSrc.includes('isLoopbackRequest')) {
+    issues.push([C.red('CRITICAL'), 'dev-api.js has NO loopback network guard (reachable off-host)']);
+  }
+  // 3. Passkey
+  const pkFile = path.join(appDir, '.4bnode', '.passkey');
+  if (!fs.existsSync(pkFile)) {
+    issues.push([C.red('CRITICAL'), 'NO .passkey file — dashboard auth is open (anyone gets in)']);
+  } else {
+    const h = fs.readFileSync(pkFile, 'utf8').trim();
+    if (WEAK_HASHES.has(h)) {
+      issues.push([C.red('CRITICAL'), `weak/guessable passkey "${WEAK_HASHES.get(h)}" — rotate with \`npx 4bnode passkey\``]);
+    }
+  }
+  // 4. Backdoor / recent-change scan
+  const findings = scanSourceFiles(appDir);
+  const backdoors = findings.filter((f) => f.hits.length);
+  const recents = findings.filter((f) => f.recent && !f.hits.length);
+
+  console.log(`\n${C.bold(name)} ${C.dim(appDir)}`);
+  if (!issues.length && !backdoors.length) {
+    console.log(`  ${C.grn('✔')} no exposure issues found`);
+  }
+  for (const [sev, msg] of issues) console.log(`  ${sev}  ${msg}`);
+  for (const f of backdoors) {
+    console.log(`  ${C.red('BACKDOOR?')} ${f.rel} ${C.dim('(modified ' + f.mtime.toISOString() + ')')}`);
+    for (const h of f.hits) console.log(`      ${C.yel(h)}`);
+  }
+  if (recents.length) {
+    console.log(`  ${C.yel('REVIEW')}  ${recents.length} source file(s) modified since ${sinceArg}:`);
+    for (const f of recents) console.log(`      ${f.rel} ${C.dim(f.mtime.toISOString())}`);
+  }
+  return { name, critical: issues.filter((i) => i[0].includes('CRITICAL')).length + backdoors.length };
+}
+
+console.log(C.bold(`\n4bnode /_dev exposure audit — ${root}`));
+if (since) console.log(C.dim(`Flagging source changed on/after ${sinceArg}`));
+const apps = findApps(root);
+if (!apps.length) { console.log(C.yel('\nNo 4bnode apps (.4bnode/dev-api.js) found under that path.')); process.exit(0); }
+let totalCritical = 0;
+for (const app of apps) totalCritical += auditApp(app).critical;
+console.log(`\n${C.bold('Summary:')} ${apps.length} app(s) scanned, ${totalCritical ? C.red(totalCritical + ' critical finding(s)') : C.grn('0 critical findings')}.`);
+process.exit(totalCritical ? 1 : 0);

package/scripts/reveal-passkey.mjs

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+// Reveal the 6-digit dashboard PIN for a 4bnode app by reversing its hash.
+//
+//   node scripts/reveal-passkey.mjs /path/to/app
+//
+// The PIN is stored as a SHA-256 hash in .4bnode/.passkey. A 6-digit PIN has
+// only 1,000,000 possibilities, so we just hash them all and match. (This is
+// exactly why a 6-digit PIN is weak — but it lets you recover/audit it.)
+
+import fs from 'fs';
+import path from 'path';
+import crypto from 'crypto';
+
+const appDir = path.resolve(process.argv[2] || '.');
+const pkFile = path.join(appDir, '.4bnode', '.passkey');
+
+if (!fs.existsSync(pkFile)) {
+  console.log(`No .passkey file in ${path.join(appDir, '.4bnode')} — the dashboard had NO password set (open).`);
+  process.exit(0);
+}
+
+const target = fs.readFileSync(pkFile, 'utf8').trim();
+const sha = (s) => crypto.createHash('sha256').update(s).digest('hex');
+
+// Try all 6-digit PINs (000000–999999), including shorter numeric values.
+for (let n = 0; n < 1_000_000; n++) {
+  const pin = String(n).padStart(6, '0');
+  if (sha(pin) === target) { console.log(`PIN: ${pin}`); process.exit(0); }
+}
+// Fallback: also try the value un-padded (e.g. "1234") in case it wasn't 6 digits.
+for (let n = 0; n < 1_000_000; n++) {
+  if (sha(String(n)) === target) { console.log(`PIN: ${n}`); process.exit(0); }
+}
+console.log('Not a numeric PIN up to 6 digits — the passkey is something else (longer/alphanumeric).');
+console.log(`Stored hash: ${target}`);

package/skeleton/.4bnode/assets/js/App.js

@@ -9,11 +9,15 @@ import { DashboardPage } from "./pages/DashboardPage.js";
 import { DatabasePage } from "./pages/DatabasePage.js";
 import { SchemasPage } from "./pages/SchemasPage.js";
 import { RoutesPage } from "./pages/RoutesPage.js";
+import { DocsPage } from "./pages/DocsPage.js";
+import { AiBuilderPage } from "./pages/AiBuilderPage.js";
+import { SecurityPage } from "./pages/SecurityPage.js";
+import { ApiKeysPage } from "./pages/ApiKeysPage.js";
 import { ApiTesterPage } from "./pages/ApiTesterPage.js";
 import { RealtimePage } from "./pages/RealtimePage.js";
 import { SerialPortPage } from "./pages/SerialPortPage.js";
+import { MailPage } from "./pages/MailPage.js";
 import { LogsPage } from "./pages/LogsPage.js";
-import { ReportsPage } from "./pages/ReportsPage.js";
 import { EnvironmentPage } from "./pages/EnvironmentPage.js";
 
 function getHashPage() {
@@ -61,12 +65,27 @@ export function App() {
   }, []);
 
   const refresh = useCallback(async () => {
-    const [dashData, statusData] = await Promise.all([
-      api("/dashboard"),
-      api("/status"),
-    ]);
-    setData(dashData);
-    setStatus(statusData);
+    // File-writing actions (create route, docs, security, ...) modify index.js,
+    // which triggers a nodemon restart. Since the dashboard is served by that same
+    // app, the refresh fetch fired right after can hit the restart window and fail,
+    // leaving the UI stale until a manual reload. Retry across the restart so new
+    // state shows up in real time.
+    let lastErr;
+    for (let attempt = 0; attempt < 8; attempt++) {
+      try {
+        const [dashData, statusData] = await Promise.all([
+          api("/dashboard"),
+          api("/status"),
+        ]);
+        setData(dashData);
+        setStatus(statusData);
+        return;
+      } catch (err) {
+        lastErr = err;
+        await new Promise((r) => setTimeout(r, 500));
+      }
+    }
+    throw lastErr;
   }, []);
 
   useEffect(() => {
@@ -75,13 +94,17 @@ export function App() {
 
   const pages = {
     dashboard: html`<${DashboardPage} />`,
+    "ai-builder": html`<${AiBuilderPage} />`,
     database: html`<${DatabasePage} />`,
     schemas: html`<${SchemasPage} />`,
     routes: html`<${RoutesPage} />`,
+    docs: html`<${DocsPage} />`,
+    security: html`<${SecurityPage} />`,
+    "api-keys": html`<${ApiKeysPage} />`,
     "api-tester": html`<${ApiTesterPage} />`,
     realtime: html`<${RealtimePage} />`,
     serialport: html`<${SerialPortPage} />`,
-    reports: html`<${ReportsPage} />`,
+    mail: html`<${MailPage} />`,
     logs: html`<${LogsPage} />`,
     env: html`<${EnvironmentPage} />`,
   };
@@ -93,7 +116,6 @@ export function App() {
     <div className="main">
       <div className="topbar">
         <h2>${PAGE_TITLES[page] || "Dashboard"}</h2>
-        <span className="topbar-badge">Development</span>
       </div>
       <div className="content">
         <${AnimatePresence} mode="wait">

package/skeleton/.4bnode/assets/js/Root.js

@@ -3,11 +3,9 @@ import { AnimatePresence } from "framer-motion";
 import { motion } from "framer-motion";
 import { html, API, getStoredPasskey } from "./lib.js";
 import { App } from "./App.js";
-import { SplashScreen } from "./screens/SplashScreen.js";
 import { PasskeyScreen } from "./screens/PasskeyScreen.js";
 
 export function Root() {
-  const [showSplash, setShowSplash] = useState(true);
   const [authed, setAuthed] = useState(false);
   const [checking, setChecking] = useState(true);
 
@@ -29,9 +27,7 @@ export function Root() {
   if (checking) return null;
 
   return html`<${AnimatePresence} mode="wait">
-    ${showSplash
-      ? html`<${SplashScreen} key="splash" onDone=${() => setShowSplash(false)} />`
-      : !authed
+    ${!authed
       ? html`<${PasskeyScreen} key="passkey" onSuccess=${() => setAuthed(true)} />`
       : html`<${motion.div} key="app"
           style=${{ display: 'flex', height: '100vh', width: '100%' }}

package/skeleton/.4bnode/assets/js/components/Sidebar.js

@@ -13,6 +13,8 @@ export function Sidebar() {
       icon: Icons.dashboard,
       section: "Overview",
     },
+    // AI Builder — temporarily hidden from the menu (re-enable by uncommenting)
+    // { id: "ai-builder", label: "AI Builder", icon: Icons.ai },
     {
       id: "database",
       label: "Database",
@@ -27,15 +29,18 @@ export function Sidebar() {
       lockMsg: "Requires database",
     },
     { id: "routes", label: "API Routes", icon: Icons.route },
+    { id: "docs", label: "API Docs", icon: Icons.docs },
     { id: "api-tester", label: "API Tester", icon: Icons.apiTester },
     {
-      id: "realtime",
-      label: "Real-time",
-      icon: Icons.realtime,
+      id: "security",
+      label: "Security",
+      icon: Icons.shield,
       section: "Features",
     },
+    { id: "api-keys", label: "API Keys", icon: Icons.apiKeys },
+    { id: "realtime", label: "Real-time", icon: Icons.realtime },
     { id: "serialport", label: "SerialPort", icon: Icons.serial },
-    { id: "reports", label: "Reports", icon: Icons.reports, locked: !dbOk, lockMsg: "Requires database" },
+    { id: "mail", label: "Email", icon: Icons.mail },
     { id: "logs", label: "Logs", icon: Icons.logs, section: "Settings" },
     { id: "env", label: "Environment", icon: Icons.env },
   ];
@@ -44,7 +49,6 @@ export function Sidebar() {
   return html`<div className="sidebar">
     <div className="sidebar-brand">
       <pre>${`██╗  ██╗██████╗ ███╗   ██╗ ██████╗ ██████╗ ███████╗\n██║  ██║██╔══██╗████╗  ██║██╔═══██╗██╔══██╗██╔════╝\n███████║██████╔╝██╔██╗ ██║██║   ██║██║  ██║█████╗\n╚════██║██╔══██╗██║╚██╗██║██║   ██║██║  ██║██╔══╝\n     ██║██████╔╝██║ ╚████║╚██████╔╝██████╔╝███████╗\n     ╚═╝╚═════╝ ╚═╝  ╚═══╝ ╚═════╝ ╚═════╝ ╚══════╝`}</pre>
-      <span>Project Dashboard</span>
     </div>
     ${navItems.map((item) => {
       const sectionHeader =

package/skeleton/.4bnode/assets/js/lib.js

@@ -20,7 +20,10 @@ import {
   LuSend,
   LuSettings,
   LuScrollText,
-  LuFileSpreadsheet,
+  LuSparkles,
+  LuBookOpen,
+  LuMail,
+  LuKeyRound,
 } from "react-icons/lu";
 
 export const html = htm.bind(React.createElement);
@@ -61,8 +64,11 @@ export async function api(path, options = {}) {
     if (res.ok) return { message: "Done" };
     throw new Error("Server restarting, please wait...");
   }
-  if (!res.ok)
-    throw new Error(data.error || data.message || "Request failed");
+  if (!res.ok) {
+    const e = new Error(data.error || data.message || "Request failed");
+    e.data = data; // expose extra fields (e.g. command output) to callers
+    throw e;
+  }
   return data;
 }
 
@@ -82,22 +88,29 @@ export const Icons = {
   serial: html`<${LuCable} size=${16} />`,
   zap: html`<${LuZap} size=${16} />`,
   shield: html`<${LuShield} size=${16} />`,
+  apiKeys: html`<${LuKeyRound} size=${16} />`,
   box: html`<${LuBox} size=${16} />`,
   apiTester: html`<${LuFlaskConical} size=${16} />`,
   send: html`<${LuSend} size=${16} />`,
   logs: html`<${LuScrollText} size=${16} />`,
-  reports: html`<${LuFileSpreadsheet} size=${16} />`,
+  ai: html`<${LuSparkles} size=${16} />`,
+  docs: html`<${LuBookOpen} size=${16} />`,
+  mail: html`<${LuMail} size=${16} />`,
 };
 
 export const PAGE_TITLES = {
   dashboard: "Dashboard",
+  "ai-builder": "AI Builder",
   database: "Database",
   schemas: "Schemas",
   routes: "API Routes",
+  docs: "API Docs",
+  security: "Security",
+  "api-keys": "API Keys",
   "api-tester": "API Tester",
   realtime: "Real-time",
   serialport: "SerialPort",
+  mail: "Email",
   logs: "Logs",
-  reports: "Reports",
   env: "Environment",
 };