@agenticmail/enterprise 0.5.327 → 0.5.329

package/src/cli-reset-password.ts

@@ -1,138 +0,0 @@
-/**
- * CLI Command: reset-password
- *
- * Reset the admin password directly in the database.
- * Useful for recovery or when locked out.
- *
- * Usage:
- *   npx @agenticmail/enterprise reset-password
- *   DATABASE_URL=postgres://... npx @agenticmail/enterprise reset-password
- */
-
-import { existsSync, readFileSync } from 'fs';
-import { join } from 'path';
-import { homedir } from 'os';
-
-export async function runResetPassword(_args: string[]): Promise<void> {
-  const { default: inquirer } = await import('inquirer');
-  const { default: chalk } = await import('chalk');
-  const { default: ora } = await import('ora');
-
-  console.log('');
-  console.log(chalk.bold('  AgenticMail Enterprise — Password Reset'));
-  console.log(chalk.dim('  Reset your admin login password.\n'));
-
-  // Find DATABASE_URL
-  let dbUrl = process.env.DATABASE_URL;
-  if (!dbUrl) {
-    // Try loading from .env
-    const envPaths = [
-      join(process.cwd(), '.env'),
-      join(homedir(), '.agenticmail', '.env'),
-    ];
-    for (const p of envPaths) {
-      if (!existsSync(p)) continue;
-      try {
-        for (const line of readFileSync(p, 'utf8').split('\n')) {
-          const t = line.trim();
-          if (t.startsWith('DATABASE_URL=')) {
-            dbUrl = t.slice('DATABASE_URL='.length).replace(/^["']|["']$/g, '');
-            console.log(chalk.dim(`  Found DATABASE_URL in ${p}`));
-            break;
-          }
-        }
-        if (dbUrl) break;
-      } catch {}
-    }
-  }
-
-  if (!dbUrl) {
-    const answer = await inquirer.prompt([{
-      type: 'input',
-      name: 'dbUrl',
-      message: 'DATABASE_URL:',
-      validate: (v: string) => v.trim().length > 5 ? true : 'Enter your database connection string',
-    }]);
-    dbUrl = answer.dbUrl.trim();
-  }
-
-  // Get new password
-  const { newPassword } = await inquirer.prompt([{
-    type: 'password',
-    name: 'newPassword',
-    message: 'New admin password:',
-    mask: '*',
-    validate: (v: string) => v.length >= 8 ? true : 'Password must be at least 8 characters',
-  }]);
-
-  const { confirmPassword } = await inquirer.prompt([{
-    type: 'password',
-    name: 'confirmPassword',
-    message: 'Confirm password:',
-    mask: '*',
-    validate: (v: string) => v === newPassword ? true : 'Passwords do not match',
-  }]);
-
-  if (newPassword !== confirmPassword) {
-    console.log(chalk.red('  Passwords do not match.'));
-    process.exit(1);
-  }
-
-  const spinner = ora('Resetting admin password...').start();
-
-  try {
-    const bcryptMod = await import('bcryptjs');
-    const bcrypt = bcryptMod.default || bcryptMod;
-    const hash = await bcrypt.hash(newPassword, 12);
-
-    if (dbUrl!.startsWith('postgres')) {
-      const pgMod = await import('postgres' as string);
-      const sql = (pgMod.default || pgMod)(dbUrl!);
-      // Update the first admin/owner user
-      const result = await sql`
-        UPDATE users SET password_hash = ${hash}, updated_at = NOW()
-        WHERE id = (
-          SELECT id FROM users
-          WHERE role IN ('admin', 'owner')
-          ORDER BY created_at ASC
-          LIMIT 1
-        )
-        RETURNING email, role
-      `;
-      await sql.end();
-
-      if (result.length > 0) {
-        spinner.succeed(`Password reset for ${result[0].email} (${result[0].role})`);
-      } else {
-        spinner.warn('No admin user found in database. Run setup first.');
-      }
-    } else {
-      // SQLite
-      const sqliteMod = await import('better-sqlite3' as string);
-      const Database = sqliteMod.default || sqliteMod;
-      const dbPath = dbUrl!.replace('file:', '').replace('sqlite:', '');
-      const db = new Database(dbPath);
-
-      const user = db.prepare(
-        "SELECT id, email, role FROM users WHERE role IN ('admin', 'owner') ORDER BY created_at ASC LIMIT 1"
-      ).get() as any;
-
-      if (user) {
-        db.prepare('UPDATE users SET password_hash = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?').run(hash, user.id);
-        db.close();
-        spinner.succeed(`Password reset for ${user.email} (${user.role})`);
-      } else {
-        db.close();
-        spinner.warn('No admin user found in database. Run setup first.');
-      }
-    }
-
-    console.log('');
-    console.log(chalk.green('  You can now log in with your new password.'));
-    console.log('');
-  } catch (e: any) {
-    spinner.fail('Failed: ' + e.message);
-    console.log(chalk.dim('  Make sure DATABASE_URL is correct and the database is accessible.'));
-    process.exit(1);
-  }
-}

package/src/cli-serve.ts

@@ -1,314 +0,0 @@
-/**
- * `npx @agenticmail/enterprise serve` / `start`
- *
- * Starts the enterprise server headlessly (no interactive wizard).
- * Auto-loads .env file from cwd or ~/.agenticmail/.env if present.
- * Reads configuration from environment variables:
- *   DATABASE_URL  — Postgres/SQLite connection string (required)
- *   JWT_SECRET    — JWT signing secret (required)
- *   PORT          — HTTP port (default: 8080)
- */
-
-import { existsSync, readFileSync } from 'fs';
-import { join } from 'path';
-import { homedir } from 'os';
-
-function loadEnvFile(): void {
-  // Try cwd first, then ~/.agenticmail/
-  const candidates = [
-    join(process.cwd(), '.env'),
-    join(homedir(), '.agenticmail', '.env'),
-  ];
-
-  for (const envPath of candidates) {
-    if (!existsSync(envPath)) continue;
-    try {
-      const content = readFileSync(envPath, 'utf8');
-      for (const line of content.split('\n')) {
-        const trimmed = line.trim();
-        if (!trimmed || trimmed.startsWith('#')) continue;
-        const eq = trimmed.indexOf('=');
-        if (eq < 0) continue;
-        const key = trimmed.slice(0, eq).trim();
-        let val = trimmed.slice(eq + 1).trim();
-        // Strip quotes
-        if ((val.startsWith('"') && val.endsWith('"')) || (val.startsWith("'") && val.endsWith("'"))) {
-          val = val.slice(1, -1);
-        }
-        if (!process.env[key]) process.env[key] = val;
-      }
-      console.log(`Loaded config from ${envPath}`);
-      return;
-    } catch { /* ignore */ }
-  }
-}
-
-/**
- * If JWT_SECRET or AGENTICMAIL_VAULT_KEY are missing, generate them
- * and append to ~/.agenticmail/.env so they persist across restarts.
- */
-async function ensureSecrets(): Promise<void> {
-  const { randomUUID } = await import('crypto');
-  const envDir = join(homedir(), '.agenticmail');
-  const envPath = join(envDir, '.env');
-  let dirty = false;
-
-  if (!process.env.JWT_SECRET) {
-    process.env.JWT_SECRET = randomUUID() + randomUUID();
-    dirty = true;
-    console.log('[startup] Generated new JWT_SECRET (existing sessions will need to re-login)');
-  }
-
-  if (!process.env.AGENTICMAIL_VAULT_KEY) {
-    process.env.AGENTICMAIL_VAULT_KEY = randomUUID() + randomUUID();
-    dirty = true;
-    console.log('[startup] Generated new AGENTICMAIL_VAULT_KEY');
-    console.log('[startup] ⚠️  Previously encrypted credentials will need to be re-entered in the dashboard');
-  }
-
-  if (dirty) {
-    try {
-      if (!existsSync(envDir)) {
-        const { mkdirSync } = await import('fs');
-        mkdirSync(envDir, { recursive: true });
-      }
-      // Append new secrets to .env (don't overwrite existing)
-      const { appendFileSync } = await import('fs');
-      const lines: string[] = [];
-      // Read existing to avoid duplicates
-      let existing = '';
-      if (existsSync(envPath)) {
-        existing = readFileSync(envPath, 'utf8');
-      }
-      if (!existing.includes('JWT_SECRET=')) {
-        lines.push(`JWT_SECRET=${process.env.JWT_SECRET}`);
-      }
-      if (!existing.includes('AGENTICMAIL_VAULT_KEY=')) {
-        lines.push(`AGENTICMAIL_VAULT_KEY=${process.env.AGENTICMAIL_VAULT_KEY}`);
-      }
-      if (lines.length) {
-        appendFileSync(envPath, '\n' + lines.join('\n') + '\n', { mode: 0o600 });
-        console.log(`[startup] Saved secrets to ${envPath}`);
-      }
-    } catch (e: any) {
-      console.warn(`[startup] Could not save secrets to ${envPath}: ${e.message}`);
-    }
-  }
-}
-
-export async function runServe(_args: string[]) {
-  loadEnvFile();
-
-  const DATABASE_URL = process.env.DATABASE_URL;
-  const PORT = parseInt(process.env.PORT || '8080', 10);
-
-  // Auto-generate and persist secrets if missing
-  await ensureSecrets();
-
-  const JWT_SECRET = process.env.JWT_SECRET!;
-  const _VAULT_KEY = process.env.AGENTICMAIL_VAULT_KEY!;
-
-  if (!DATABASE_URL) {
-    console.error('ERROR: DATABASE_URL is required.');
-    console.error('');
-    console.error('Set it via environment variable or .env file:');
-    console.error('  DATABASE_URL=postgresql://user:pass@host:5432/db npx @agenticmail/enterprise start');
-    console.error('');
-    console.error('Or create a .env file (in cwd or ~/.agenticmail/.env):');
-    console.error('  DATABASE_URL=postgresql://user:pass@host:5432/db');
-    console.error('  JWT_SECRET=your-secret-here');
-    console.error('  PORT=3200');
-    process.exit(1);
-  }
-
-  const { createAdapter, smartDbConfig } = await import('./db/factory.js');
-  const { createServer } = await import('./server.js');
-
-  const db = await createAdapter(smartDbConfig(DATABASE_URL));
-
-  await db.migrate();
-
-  const server = createServer({
-    port: PORT,
-    db,
-    jwtSecret: JWT_SECRET,
-    corsOrigins: ['*'],
-  });
-
-  await server.start();
-  console.log(`AgenticMail Enterprise server running on :${PORT}`);
-
-  // Start prevent-sleep if configured
-  try {
-    const { startPreventSleep } = await import('./engine/screen-unlock.js');
-    const adminDb = (server as any).getAdminDb?.() || (server as any).adminDb;
-    if (adminDb) {
-      const settings = await adminDb.getSettings?.().catch(() => null);
-      const screenAccess = settings?.securityConfig?.screenAccess;
-      if (screenAccess?.enabled && screenAccess?.preventSleep) {
-        startPreventSleep();
-        console.log('[startup] Prevent-sleep enabled — system will stay awake while agents are active');
-      }
-    }
-  } catch {}
-
-  // ─── Auto-configure system persistence ──────────────────
-  // Ensures the server auto-starts on reboot, crash-recovers with backoff,
-  // and log rotation is in place. Runs once — idempotent.
-  try {
-    await setupSystemPersistence();
-  } catch (e: any) {
-    console.warn('[startup] System persistence setup skipped: ' + e.message);
-  }
-
-  // Auto-start cloudflared if tunnel token is present
-  const tunnelToken = process.env.CLOUDFLARED_TOKEN;
-  if (tunnelToken) {
-    try {
-      const { execSync, spawn } = await import('child_process');
-      try {
-        execSync('which cloudflared', { timeout: 3000 });
-      } catch {
-        console.log('[startup] cloudflared not found — skipping tunnel auto-start');
-        console.log('[startup] Install cloudflared to enable tunnel: https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/');
-        return;
-      }
-
-      // Check if already running
-      try {
-        execSync('pgrep -f "cloudflared.*tunnel.*run"', { timeout: 3000 });
-        console.log('[startup] cloudflared tunnel already running');
-        return;
-      } catch { /* not running, start it */ }
-
-      const subdomain = process.env.AGENTICMAIL_SUBDOMAIN || process.env.AGENTICMAIL_DOMAIN || '';
-      console.log(`[startup] Starting cloudflared tunnel${subdomain ? ` for ${subdomain}.agenticmail.io` : ''}...`);
-
-      const child = spawn('cloudflared', ['tunnel', '--no-autoupdate', 'run', '--token', tunnelToken], {
-        detached: true,
-        stdio: 'ignore',
-      });
-      child.unref();
-      console.log('[startup] cloudflared tunnel started (pid ' + child.pid + ')');
-    } catch (e: any) {
-      console.warn('[startup] Could not auto-start cloudflared: ' + e.message);
-    }
-  }
-}
-
-// ─── System Persistence ─────────────────────────────────
-// Automatically sets up PM2 startup, log rotation, and process saving.
-// Idempotent — safe to run on every boot.
-
-async function setupSystemPersistence(): Promise<void> {
-  const { execSync, spawnSync } = await import('child_process');
-  const { existsSync: exists, writeFileSync, mkdirSync } = await import('fs');
-  const { join: pathJoin } = await import('path');
-  const platform = process.platform;
-
-  // Only works if running under PM2
-  if (!process.env.PM2_HOME && !process.env.pm_id) {
-    // Not running under PM2 — skip (user is running directly via node/npx)
-    return;
-  }
-
-  const markerDir = pathJoin(homedir(), '.agenticmail');
-  const markerFile = pathJoin(markerDir, '.persistence-configured');
-
-  // Check if already configured (avoid running pm2 commands every boot)
-  if (exists(markerFile)) {
-    // Already configured — just save current process list silently
-    try { execSync('pm2 save --silent', { timeout: 10000, stdio: 'ignore' }); } catch {}
-    return;
-  }
-
-  console.log('[startup] Configuring system persistence (one-time setup)...');
-
-  // 1. Set up PM2 startup — auto-start on boot
-  // pm2 startup outputs the command needed (may require sudo on Linux)
-  try {
-    if (platform === 'darwin') {
-      // macOS: launchd — pm2 startup creates plist and loads it
-      const result = spawnSync('pm2', ['startup', 'launchd', '--silent'], {
-        timeout: 15000, stdio: 'pipe', encoding: 'utf-8',
-      });
-      // If it outputs a sudo command, try running it
-      const output = (result.stdout || '') + (result.stderr || '');
-      const sudoMatch = output.match(/sudo\s+env\s+.*pm2\s+startup.*/);
-      if (sudoMatch) {
-        // Can't run sudo without password — log the command for the user
-        console.log('[startup] PM2 startup requires sudo. Run this once:');
-        console.log('  ' + sudoMatch[0]);
-      } else {
-        console.log('[startup] PM2 startup configured (launchd)');
-      }
-      // Try loading the plist if it exists
-      const plistPath = pathJoin(homedir(), 'Library', 'LaunchAgents', `pm2.${process.env.USER || 'user'}.plist`);
-      if (exists(plistPath)) {
-        try { execSync(`launchctl load -w "${plistPath}"`, { timeout: 5000, stdio: 'ignore' }); } catch {}
-      }
-    } else if (platform === 'linux') {
-      // Linux: systemd (Debian/Ubuntu/RHEL/Pi)
-      const result = spawnSync('pm2', ['startup', 'systemd', '--silent'], {
-        timeout: 15000, stdio: 'pipe', encoding: 'utf-8',
-      });
-      const output = (result.stdout || '') + (result.stderr || '');
-      const sudoMatch = output.match(/sudo\s+env\s+.*pm2\s+startup.*/);
-      if (sudoMatch) {
-        // Try running it — if we have sudo access
-        try {
-          execSync(sudoMatch[0], { timeout: 15000, stdio: 'ignore' });
-          console.log('[startup] PM2 startup configured (systemd)');
-        } catch {
-          console.log('[startup] PM2 startup requires root. Run this once:');
-          console.log('  ' + sudoMatch[0]);
-        }
-      } else {
-        console.log('[startup] PM2 startup configured (systemd)');
-      }
-    } else if (platform === 'win32') {
-      // Windows: use pm2-windows-startup
-      try {
-        execSync('npm list -g pm2-windows-startup', { timeout: 10000, stdio: 'ignore' });
-      } catch {
-        console.log('[startup] Installing pm2-windows-startup...');
-        try {
-          execSync('npm install -g pm2-windows-startup', { timeout: 60000, stdio: 'ignore' });
-          execSync('pm2-startup install', { timeout: 15000, stdio: 'ignore' });
-          console.log('[startup] PM2 startup configured (Windows Service)');
-        } catch (e: any) {
-          console.warn('[startup] Could not install pm2-windows-startup: ' + e.message);
-        }
-      }
-    }
-  } catch (e: any) {
-    console.warn('[startup] PM2 startup setup: ' + e.message);
-  }
-
-  // 2. Install log rotation (if not already present)
-  try {
-    const moduleList = execSync('pm2 ls --silent 2>/dev/null || true', { timeout: 10000, encoding: 'utf-8' });
-    if (!moduleList.includes('pm2-logrotate')) {
-      console.log('[startup] Installing pm2-logrotate...');
-      execSync('pm2 install pm2-logrotate --silent', { timeout: 60000, stdio: 'ignore' });
-      // Configure: 10MB max, keep 5 rotated files, compress
-      execSync('pm2 set pm2-logrotate:max_size 10M --silent', { timeout: 5000, stdio: 'ignore' });
-      execSync('pm2 set pm2-logrotate:retain 5 --silent', { timeout: 5000, stdio: 'ignore' });
-      execSync('pm2 set pm2-logrotate:compress true --silent', { timeout: 5000, stdio: 'ignore' });
-      console.log('[startup] Log rotation configured (10MB, 5 files)');
-    }
-  } catch {}
-
-  // 3. Save current process list for resurrection on reboot
-  try {
-    execSync('pm2 save --silent', { timeout: 10000, stdio: 'ignore' });
-    console.log('[startup] Process list saved');
-  } catch {}
-
-  // 4. Write marker file so we don't repeat this setup
-  try {
-    if (!exists(markerDir)) mkdirSync(markerDir, { recursive: true });
-    writeFileSync(markerFile, new Date().toISOString() + '\n' + `platform=${platform}\n`, { mode: 0o600 });
-    console.log('[startup] System persistence configured successfully');
-  } catch {}
-}

package/src/cli.ts

@@ -1,103 +0,0 @@
-#!/usr/bin/env node
-/**
- * AgenticMail Enterprise CLI
- *
- * Commands:
- *   (none) / setup     Interactive setup wizard
- *   validate <path>    Validate a community skill manifest
- *   build-skill        AI-assisted skill scaffolding
- *   submit-skill       Submit a skill as a PR to agenticmail/enterprise
- *   recover            Recover a domain registration on a new machine
- *   verify-domain      Check DNS verification status for your domain
- *
- * Usage:
- *   npx @agenticmail/enterprise
- *   npx @agenticmail/enterprise validate ./community-skills/my-skill/
- *   npx @agenticmail/enterprise validate --all
- *   npx @agenticmail/enterprise build-skill
- *   npx @agenticmail/enterprise submit-skill ./community-skills/my-skill/
- *   npx @agenticmail/enterprise recover --domain agents.agenticmail.io
- *   npx @agenticmail/enterprise verify-domain
- */
-
-const args = process.argv.slice(2);
-const command = args[0];
-
-switch (command) {
-  case 'validate':
-    import('./engine/cli-validate.js').then(m => m.runValidate(args.slice(1))).catch(fatal);
-    break;
-
-  case 'build-skill':
-    import('./engine/cli-build-skill.js').then(m => m.runBuildSkill(args.slice(1))).catch(fatal);
-    break;
-
-  case 'submit-skill':
-    import('./engine/cli-submit-skill.js').then(m => m.runSubmitSkill(args.slice(1))).catch(fatal);
-    break;
-
-  case 'recover':
-    import('./domain-lock/cli-recover.js').then(m => m.runRecover(args.slice(1))).catch(fatal);
-    break;
-
-  case 'verify-domain':
-    import('./domain-lock/cli-verify.js').then(m => m.runVerifyDomain(args.slice(1))).catch(fatal);
-    break;
-
-  case 'reset-password':
-    import('./cli-reset-password.js').then(m => m.runResetPassword(args.slice(1))).catch(fatal);
-    break;
-
-  case '--help':
-  case '-h':
-    console.log(`
-AgenticMail Enterprise CLI
-
-Commands:
-  setup                   Interactive setup wizard (default)
-  start / serve           Start the server (uses DATABASE_URL env)
-  validate <path>         Validate a community skill manifest
-    --all                 Validate all skills in community-skills/
-    --json                Machine-readable output
-  build-skill             AI-assisted skill scaffolding
-  submit-skill <path>     Submit a skill as a PR
-  recover                 Recover a domain/subdomain on a new machine
-  reset-password          Reset admin password directly in the database
-  verify-domain           Check DNS verification for your domain
-
-Domain Recovery & Verification:
-  npx @agenticmail/enterprise recover
-  npx @agenticmail/enterprise recover --domain agents.acme.com --key <hex>
-  npx @agenticmail/enterprise verify-domain
-  npx @agenticmail/enterprise verify-domain --domain agents.acme.com --poll
-
-  Set DATABASE_URL to auto-connect to your database during recovery.
-  Both commands support interactive prompts when flags are omitted.
-
-Skill Development:
-  npx @agenticmail/enterprise validate ./community-skills/github-issues/
-  npx @agenticmail/enterprise validate --all
-  npx @agenticmail/enterprise build-skill
-  npx @agenticmail/enterprise submit-skill ./community-skills/my-skill/
-`);
-    break;
-
-  case 'serve':
-  case 'start':
-    import('./cli-serve.js').then(m => m.runServe(args.slice(1))).catch(fatal);
-    break;
-
-  case 'agent':
-    import('./cli-agent.js').then(m => m.runAgent(args.slice(1))).catch(fatal);
-    break;
-
-  case 'setup':
-  default:
-    import('./setup/index.js').then(m => m.runSetupWizard()).catch(fatal);
-    break;
-}
-
-function fatal(err: Error) {
-  console.error('Fatal error:', err.message);
-  process.exit(1);
-}