4runr-os 2.10.85 → 2.10.86

package/scripts/postinstall-os-server.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+/**
+ * Post-install: install Gateway dependencies so "npm start" in apps/os-server works.
+ * The published package copies gateway source+dist but not node_modules; install them here.
+ */
+
+import { execSync } from 'child_process';
+import * as fs from 'fs';
+import * as path from 'path';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const gatewayDir = path.join(__dirname, '..', 'apps', 'gateway');
+const packageJson = path.join(gatewayDir, 'package.json');
+const nodeModules = path.join(gatewayDir, 'node_modules');
+
+if (!fs.existsSync(packageJson)) {
+  process.exit(0); // No gateway in this install
+}
+
+const prismaSchema = path.join(__dirname, '..', 'prisma', 'schema.prisma');
+
+function ensurePrismaClient() {
+  if (!fs.existsSync(prismaSchema)) {
+    return;
+  }
+  try {
+    console.log('🔧 Prisma: generating client for Gateway (global 4runr-os install)...');
+    execSync('npm run db:generate', {
+      cwd: gatewayDir,
+      stdio: 'inherit',
+      shell: process.platform === 'win32',
+    });
+    console.log('✓ Prisma client ready for Gateway');
+  } catch (err) {
+    console.warn(
+      '⚠️  prisma generate failed. OS auto-start Gateway may fail until you run:\n' +
+        '  cd apps/os-server && npm run db:generate',
+    );
+  }
+}
+
+if (fs.existsSync(nodeModules) && fs.readdirSync(nodeModules).length > 0) {
+  ensurePrismaClient();
+  process.exit(0); // Deps already present (e.g. from prepublish) — still (re)generate Prisma
+}
+
+try {
+  console.log('📦 Installing Gateway dependencies (one-time)...');
+  execSync('npm install --omit=dev', {
+    cwd: gatewayDir,
+    stdio: 'inherit',
+    shell: process.platform === 'win32',
+  });
+  console.log('✓ Gateway dependencies ready');
+} catch (err) {
+  console.warn('⚠️  Gateway dependency install failed. Start gateway from repo with: cd apps/os-server && npm start');
+  // Don't fail the main install
+}
+
+ensurePrismaClient();

package/scripts/postinstall-os-tui.js

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+/**
+ * Post-install script: Build os-tui if Rust is available
+ */
+
+import { execSync } from 'child_process';
+import * as fs from 'fs';
+import * as path from 'path';
+import { fileURLToPath } from 'url';
+import { dirname } from 'path';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+const mk3Dir = path.join(__dirname, '..', 'os-tui');
+const binaryName = process.platform === 'win32' ? 'os-tui.exe' : 'os-tui';
+const binaryPath = path.join(mk3Dir, 'target', 'release', binaryName);
+
+// Check if binary already exists
+if (fs.existsSync(binaryPath)) {
+  console.log('✓ os-tui binary found');
+  process.exit(0);
+}
+
+// Check if os-tui source exists
+if (!fs.existsSync(mk3Dir)) {
+  console.warn('⚠️  os-tui source not found in package');
+  process.exit(0); // Not an error - might be dev mode
+}
+
+// Check if Rust is installed
+try {
+  execSync('cargo --version', { stdio: 'ignore' });
+} catch {
+  console.log('ℹ️  Rust not installed. os-tui will be built on first run if Rust is available.');
+  process.exit(0);
+}
+
+// Try to build
+try {
+  console.log('🔨 Building os-tui...');
+  execSync('cargo build --release', {
+    cwd: mk3Dir,
+    stdio: 'inherit',
+  });
+  console.log('✓ os-tui built successfully');
+  
+  // Clean up build artifacts to save disk space (~300-400MB)
+  try {
+    const cleanupScript = path.join(__dirname, 'cleanup-build-artifacts.js');
+    if (fs.existsSync(cleanupScript)) {
+      execSync(`node "${cleanupScript}"`, {
+        cwd: path.dirname(__dirname),
+        stdio: 'ignore', // Silent cleanup
+      });
+    }
+  } catch {
+    // Silent - cleanup is optional, don't fail if it doesn't work
+  }
+} catch (error) {
+  console.warn('⚠️  Failed to build os-tui. It will be built on first run.');
+  // Don't exit with error - allow install to complete
+}
+

package/scripts/seed-os-server-api-key.cjs

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+/**
+ * Seed the default local dev API key into Gateway Postgres (no tsx required).
+ * Usage: node seed-os-server-api-key.cjs <gatewayBundlePath> <apiKey> [label]
+ */
+
+'use strict';
+
+const { createRequire } = require('module');
+const fs = require('fs');
+const path = require('path');
+
+function loadPrismaClient(bundlePath) {
+  const req = createRequire(path.join(bundlePath, 'package.json'));
+  try {
+    return req('@prisma/client').PrismaClient;
+  } catch {
+    const generated = path.join(bundlePath, 'node_modules', '.prisma', 'client');
+    if (fs.existsSync(path.join(generated, 'index.js'))) {
+      return req(generated).PrismaClient;
+    }
+  }
+  throw new Error(
+    '@prisma/client not found in gateway bundle — run: cd apps/os-server && npm install && npm run db:generate',
+  );
+}
+
+async function main() {
+  const bundlePath = process.argv[2];
+  const key = process.argv[3];
+  const label = process.argv[4] || '4Runr OS dev';
+
+  if (!bundlePath || !key) {
+    console.error('Usage: node seed-os-server-api-key.cjs <gatewayBundlePath> <apiKey> [label]');
+    process.exit(1);
+  }
+
+  if (!fs.existsSync(path.join(bundlePath, 'package.json'))) {
+    console.error(`Gateway bundle not found: ${bundlePath}`);
+    process.exit(1);
+  }
+
+  process.env.DATABASE_URL =
+    process.env.DATABASE_URL ||
+    'postgresql://4runr:4runr_dev_pass@localhost:5432/4runr_local';
+
+  const PrismaClient = loadPrismaClient(bundlePath);
+  const prisma = new PrismaClient();
+
+  try {
+    const existing = await prisma.apiKey.findUnique({ where: { key } });
+    if (existing) {
+      if (existing.revoked) {
+        await prisma.apiKey.update({
+          where: { key },
+          data: { revoked: false, label },
+        });
+        console.log('reactivated');
+      } else {
+        console.log('exists');
+      }
+      return;
+    }
+
+    await prisma.apiKey.create({
+      data: { key, label, revoked: false },
+    });
+    console.log('created');
+  } finally {
+    await prisma.$disconnect().catch(() => {});
+  }
+}
+
+main().catch((err) => {
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+});

package/scripts/setup.js

@@ -65,7 +65,7 @@ try {
   }
 } catch {
   console.log('⚠️  Rust not installed');
-  console.log('\n   Rust is required to build mk3-tui.');
+  console.log('\n   Rust is required to build os-tui.');
   console.log('   Install Rust: https://rustup.rs/');
   console.log('   Or run: curl --proto "=https" --tlsv1.2 -sSf https://sh.rustup.rs | sh\n');
   console.log('   After installing Rust, run 4runr-setup again.\n');
@@ -331,47 +331,47 @@ try {
   }
 }
 
-  // Verify mk3-tui binary (check global install location)
+  // Verify os-tui binary (check global install location)
   let mk3Dir = null;
   try {
     // Try to find global install location
     const npmPrefix = execSync('npm config get prefix', { encoding: 'utf-8' }).trim();
     const globalPath = isWindows 
-      ? path.join(npmPrefix, 'node_modules', '4runr-os', 'mk3-tui')
-      : path.join(npmPrefix, 'lib', 'node_modules', '4runr-os', 'mk3-tui');
+      ? path.join(npmPrefix, 'node_modules', '4runr-os', 'os-tui')
+      : path.join(npmPrefix, 'lib', 'node_modules', '4runr-os', 'os-tui');
     
     if (fs.existsSync(globalPath)) {
       mk3Dir = globalPath;
     }
   } catch {
     // Fallback to local
-    mk3Dir = path.join(__dirname, '..', 'mk3-tui');
+    mk3Dir = path.join(__dirname, '..', 'os-tui');
   }
 
   if (mk3Dir && fs.existsSync(mk3Dir)) {
-    const binaryName = isWindows ? 'mk3-tui.exe' : 'mk3-tui';
+    const binaryName = isWindows ? 'os-tui.exe' : 'os-tui';
     const binaryPath = path.join(mk3Dir, 'target', 'release', binaryName);
     
     if (!fs.existsSync(binaryPath)) {
-      console.log('\n🔨 Building mk3-tui binary...');
+      console.log('\n🔨 Building os-tui binary...');
       try {
         execSync('cargo build --release', {
           cwd: mk3Dir,
           stdio: 'inherit',
         });
-        console.log('✅ mk3-tui built successfully');
+        console.log('✅ os-tui built successfully');
         
         // Clean up build artifacts to save disk space (keep only release binary)
         cleanupBuildArtifacts();
       } catch (error) {
-        console.warn('⚠️  Failed to build mk3-tui');
+        console.warn('⚠️  Failed to build os-tui');
         console.warn('   The binary will be built automatically on first run of 4r');
       }
     } else {
-      console.log('✅ mk3-tui binary found');
+      console.log('✅ os-tui binary found');
     }
   } else {
-    console.log('⚠️  mk3-tui source not found - will build on first run of 4r');
+    console.log('⚠️  os-tui source not found - will build on first run of 4r');
   }
 
   console.log('\n✅ Setup complete! You can now run: 4r\n');

package/src/security/package-integrity.ts

@@ -1,188 +1,188 @@
-/**
- * Package Integrity Verification
- * Verifies npm package integrity before updates
- */
-
-import * as crypto from 'crypto';
-import * as fs from 'fs';
-import { getInstalledGlobalPackageVersion } from '../npm-list-version.js';
-import { spawnNpmSync } from '../npm-spawn.js';
-import { sanitizePackageName } from './validation.js';
-
-/**
- * Get package integrity hash from npm registry
- */
-export function getPackageIntegrity(packageName: string, version: string): string | null {
-  try {
-    // SECURITY: Validate package name
-    const validation = sanitizePackageName(packageName);
-    
-    if (!validation.valid || !validation.sanitized) {
-      throw new Error(`Invalid package name: ${validation.error}`);
-    }
-    
-    // Get package info from npm (includes integrity hash); spawnNpmSync on Windows
-    const result = spawnNpmSync(['view', `${validation.sanitized}@${version}`, 'dist.integrity', '--json']);
-    
-    if (result.status !== 0 || !result.stdout) {
-      return null;
-    }
-    
-    const integrity = result.stdout.trim().replace(/"/g, '');
-    return integrity || null;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Verify package tarball integrity
- */
-export function verifyPackageIntegrity(tarballPath: string, expectedIntegrity: string): boolean {
-  try {
-    // Parse integrity string (format: algorithm-base64hash)
-    const match = expectedIntegrity.match(/^(sha\d+)-(.+)$/);
-    if (!match) {
-      return false;
-    }
-    
-    const [, algorithm, expectedHash] = match;
-    
-    // Read tarball and compute hash
-    const tarballData = fs.readFileSync(tarballPath);
-    const hash = crypto.createHash(algorithm.replace('sha', 'sha')).update(tarballData).digest('base64');
-    
-    return hash === expectedHash;
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Verify installed package version matches expected
- */
-export function verifyInstalledVersion(packageName: string, expectedVersion: string): boolean {
-  try {
-    const validation = sanitizePackageName(packageName);
-    if (!validation.valid || !validation.sanitized) {
-      return false;
-    }
-    const installedVersion = getInstalledGlobalPackageVersion(packageName);
-    return installedVersion === expectedVersion;
-  } catch {
-    return false;
-  }
-}
-
-/** Build error message from npm spawn result (include both stdout and stderr) */
-function npmErrorResult(result: {
-  status: number | null;
-  error?: Error;
-  stdout?: string | Buffer;
-  stderr?: string | Buffer;
-}): string {
-  const toStr = (x: string | Buffer | undefined) => (x == null ? '' : typeof x === 'string' ? x : x.toString('utf-8'));
-  const parts: string[] = [];
-  if (result.error) {
-    parts.push(result.error.message);
-  }
-  const out = [toStr(result.stderr), toStr(result.stdout)].filter(Boolean).join('\n').trim();
-  if (out) {
-    parts.push(out);
-  }
-  if (parts.length > 0) {
-    return parts.join('\n');
-  }
-  if (result.status === null) {
-    return 'npm did not return an exit code (spawn may have failed — try running npm from an elevated or normal shell, or install Node from nodejs.org so npm-cli.js sits next to node.exe).';
-  }
-  return `npm exited with code ${result.status}`;
-}
-
-/** Resolve a tag (e.g. 'latest') to a concrete version from the registry */
-function resolveTagVersion(packageName: string, tag: string): string | null {
-  try {
-    const result = spawnNpmSync(['view', `${packageName}@${tag}`, 'version']);
-    if (result.status === 0 && result.stdout) {
-      return result.stdout.trim().replace(/"/g, '') || null;
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Safe global npm install (no `--integrity` flag: npm 10+ rejects it as a CLI config; tarball is still verified on fetch).
- * On Windows, npm is invoked via `node .../npm-cli.js` (see npm-spawn.ts) so spawn does not rely on .cmd.
- * When version is 'latest', installs whatever the registry tags as latest (avoids ETARGET for unpublished versions).
- */
-export function safeNpmInstall(packageName: string, version: string): { success: boolean; error?: string } {
-  try {
-    const validation = sanitizePackageName(packageName);
-    
-    if (!validation.valid || !validation.sanitized) {
-      return { success: false, error: `Invalid package name: ${validation.error}` };
-    }
-    
-    const runInstall = (args: string[]) => spawnNpmSync(args);
-    
-    // When using 'latest', we verify against the resolved version after install
-    const versionToVerify = version === 'latest' ? null : version;
-
-    const result = runInstall([
-      'install',
-      '-g',
-      `${validation.sanitized}@${version}`,
-      '--no-audit',
-      '--no-fund',
-      '--loglevel=error',
-      '--progress=false',
-    ]);
-
-    if (result.status !== 0) {
-      return { success: false, error: npmErrorResult(result) };
-    }
-
-    const installed = getInstalledGlobalPackageVersion(validation.sanitized);
-    if (version === 'latest') {
-      const latestFromRegistry = resolveTagVersion(validation.sanitized, 'latest');
-      if (!installed) {
-        return {
-          success: false,
-          error:
-            'Could not read installed version after update (npm list). Run: npm install -g ' +
-            validation.sanitized +
-            '@latest',
-        };
-      }
-      if (latestFromRegistry && installed !== latestFromRegistry) {
-        return {
-          success: false,
-          error: `Install finished but global version is still ${installed} (npm registry latest is ${latestFromRegistry}). Close all 4r windows and retry.`,
-        };
-      }
-      return { success: true };
-    }
-
-    const verified = (() => {
-      const expected = versionToVerify ?? resolveTagVersion(validation.sanitized, version);
-      return expected ? verifyInstalledVersion(validation.sanitized, expected) : true;
-    })();
-    if (!verified) {
-      return {
-        success: false,
-        error:
-          installed == null
-            ? 'Could not read installed version after update (npm list). Run: npm install -g ' +
-              validation.sanitized +
-              '@latest'
-            : 'Installed version does not match expected. Run: npm install -g ' + validation.sanitized + '@latest',
-      };
-    }
-
-    return { success: true };
-  } catch (error: any) {
-    return { success: false, error: error?.message || String(error) };
-  }
-}
+/**
+ * Package Integrity Verification
+ * Verifies npm package integrity before updates
+ */
+
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import { getInstalledGlobalPackageVersion } from '../npm-list-version.js';
+import { spawnNpmSync } from '../npm-spawn.js';
+import { sanitizePackageName } from './validation.js';
+
+/**
+ * Get package integrity hash from npm registry
+ */
+export function getPackageIntegrity(packageName: string, version: string): string | null {
+  try {
+    // SECURITY: Validate package name
+    const validation = sanitizePackageName(packageName);
+    
+    if (!validation.valid || !validation.sanitized) {
+      throw new Error(`Invalid package name: ${validation.error}`);
+    }
+    
+    // Get package info from npm (includes integrity hash); spawnNpmSync on Windows
+    const result = spawnNpmSync(['view', `${validation.sanitized}@${version}`, 'dist.integrity', '--json']);
+    
+    if (result.status !== 0 || !result.stdout) {
+      return null;
+    }
+    
+    const integrity = result.stdout.trim().replace(/"/g, '');
+    return integrity || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Verify package tarball integrity
+ */
+export function verifyPackageIntegrity(tarballPath: string, expectedIntegrity: string): boolean {
+  try {
+    // Parse integrity string (format: algorithm-base64hash)
+    const match = expectedIntegrity.match(/^(sha\d+)-(.+)$/);
+    if (!match) {
+      return false;
+    }
+    
+    const [, algorithm, expectedHash] = match;
+    
+    // Read tarball and compute hash
+    const tarballData = fs.readFileSync(tarballPath);
+    const hash = crypto.createHash(algorithm.replace('sha', 'sha')).update(tarballData).digest('base64');
+    
+    return hash === expectedHash;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Verify installed package version matches expected
+ */
+export function verifyInstalledVersion(packageName: string, expectedVersion: string): boolean {
+  try {
+    const validation = sanitizePackageName(packageName);
+    if (!validation.valid || !validation.sanitized) {
+      return false;
+    }
+    const installedVersion = getInstalledGlobalPackageVersion(packageName);
+    return installedVersion === expectedVersion;
+  } catch {
+    return false;
+  }
+}
+
+/** Build error message from npm spawn result (include both stdout and stderr) */
+function npmErrorResult(result: {
+  status: number | null;
+  error?: Error;
+  stdout?: string | Buffer;
+  stderr?: string | Buffer;
+}): string {
+  const toStr = (x: string | Buffer | undefined) => (x == null ? '' : typeof x === 'string' ? x : x.toString('utf-8'));
+  const parts: string[] = [];
+  if (result.error) {
+    parts.push(result.error.message);
+  }
+  const out = [toStr(result.stderr), toStr(result.stdout)].filter(Boolean).join('\n').trim();
+  if (out) {
+    parts.push(out);
+  }
+  if (parts.length > 0) {
+    return parts.join('\n');
+  }
+  if (result.status === null) {
+    return 'npm did not return an exit code (spawn may have failed — try running npm from an elevated or normal shell, or install Node from nodejs.org so npm-cli.js sits next to node.exe).';
+  }
+  return `npm exited with code ${result.status}`;
+}
+
+/** Resolve a tag (e.g. 'latest') to a concrete version from the registry */
+function resolveTagVersion(packageName: string, tag: string): string | null {
+  try {
+    const result = spawnNpmSync(['view', `${packageName}@${tag}`, 'version']);
+    if (result.status === 0 && result.stdout) {
+      return result.stdout.trim().replace(/"/g, '') || null;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Safe global npm install (no `--integrity` flag: npm 10+ rejects it as a CLI config; tarball is still verified on fetch).
+ * On Windows, npm is invoked via `node .../npm-cli.js` (see npm-spawn.ts) so spawn does not rely on .cmd.
+ * When version is 'latest', installs whatever the registry tags as latest (avoids ETARGET for unpublished versions).
+ */
+export function safeNpmInstall(packageName: string, version: string): { success: boolean; error?: string } {
+  try {
+    const validation = sanitizePackageName(packageName);
+    
+    if (!validation.valid || !validation.sanitized) {
+      return { success: false, error: `Invalid package name: ${validation.error}` };
+    }
+    
+    const runInstall = (args: string[]) => spawnNpmSync(args);
+    
+    // When using 'latest', we verify against the resolved version after install
+    const versionToVerify = version === 'latest' ? null : version;
+
+    const result = runInstall([
+      'install',
+      '-g',
+      `${validation.sanitized}@${version}`,
+      '--no-audit',
+      '--no-fund',
+      '--loglevel=error',
+      '--progress=false',
+    ]);
+
+    if (result.status !== 0) {
+      return { success: false, error: npmErrorResult(result) };
+    }
+
+    const installed = getInstalledGlobalPackageVersion(validation.sanitized);
+    if (version === 'latest') {
+      const latestFromRegistry = resolveTagVersion(validation.sanitized, 'latest');
+      if (!installed) {
+        return {
+          success: false,
+          error:
+            'Could not read installed version after update (npm list). Run: npm install -g ' +
+            validation.sanitized +
+            '@latest',
+        };
+      }
+      if (latestFromRegistry && installed !== latestFromRegistry) {
+        return {
+          success: false,
+          error: `Install finished but global version is still ${installed} (npm registry latest is ${latestFromRegistry}). Close all 4r windows and retry.`,
+        };
+      }
+      return { success: true };
+    }
+
+    const verified = (() => {
+      const expected = versionToVerify ?? resolveTagVersion(validation.sanitized, version);
+      return expected ? verifyInstalledVersion(validation.sanitized, expected) : true;
+    })();
+    if (!verified) {
+      return {
+        success: false,
+        error:
+          installed == null
+            ? 'Could not read installed version after update (npm list). Run: npm install -g ' +
+              validation.sanitized +
+              '@latest'
+            : 'Installed version does not match expected. Run: npm install -g ' + validation.sanitized + '@latest',
+      };
+    }
+
+    return { success: true };
+  } catch (error: any) {
+    return { success: false, error: error?.message || String(error) };
+  }
+}