@legioncodeinc/hive 0.2.1 → 0.3.1

package/dist/daemon/installer/products.d.ts

@@ -0,0 +1,33 @@
+/**
+ * PRD-009a: the hard-coded product allowlist and per-product registration verbs (is-AC-3/13).
+ *
+ * This is the single source of truth for which slugs exist, their npm bin names, and the OWN
+ * registration verb each product runs post-install, exactly as honeycomb's `install.sh` does today
+ * (`doctor install-service`, `honeycomb install`, `nectar install`). The install endpoint only ever
+ * acts on a slug present in {@link INSTALLABLE_PRODUCTS}; `hive` is deliberately absent (it is the
+ * running daemon, never a portal install target).
+ */
+import type { InstallableProduct, ProductSlug } from "../../shared/onboarding-types.js";
+/** The four known product slugs (is-AC-3). The install allowlist is the installable subset below. */
+export declare const PRODUCT_SLUGS: readonly ["honeycomb", "doctor", "hive", "nectar"];
+/**
+ * The npm package name for each slug, used as LOCAL DETECTION evidence (the folder name under the
+ * global node_modules). This is deliberately independent of the manifest so detection works before
+ * any manifest is fetched (is-AC-1); the manifest remains the sole authority for INSTALL targets.
+ */
+export declare const PRODUCT_PACKAGES: Record<ProductSlug, string>;
+/** The three portal-installable products; `hive` is excluded (not installable, 400). */
+export declare const INSTALLABLE_PRODUCTS: readonly ["doctor", "honeycomb", "nectar"];
+/** Per-product static facts: the npm bin name and the argv of its own post-install registration verb. */
+export interface ProductProfile {
+    /** The npm bin name (equals the slug for every fleet product). */
+    readonly binName: string;
+    /** The registration verb argv run after a successful npm install (is-AC-13). */
+    readonly registrationVerb: readonly string[];
+}
+/** True for one of the four known slugs (is-AC-3 allowlist membership). */
+export declare function isProductSlug(value: string): value is ProductSlug;
+/** True for a portal-installable product (`hive` is excluded). */
+export declare function isInstallableProduct(value: string): value is InstallableProduct;
+/** The static profile (bin name + registration verb) for an installable product. */
+export declare function productProfile(product: InstallableProduct): ProductProfile;

package/dist/daemon/installer/products.js

@@ -0,0 +1,42 @@
+/**
+ * PRD-009a: the hard-coded product allowlist and per-product registration verbs (is-AC-3/13).
+ *
+ * This is the single source of truth for which slugs exist, their npm bin names, and the OWN
+ * registration verb each product runs post-install, exactly as honeycomb's `install.sh` does today
+ * (`doctor install-service`, `honeycomb install`, `nectar install`). The install endpoint only ever
+ * acts on a slug present in {@link INSTALLABLE_PRODUCTS}; `hive` is deliberately absent (it is the
+ * running daemon, never a portal install target).
+ */
+/** The four known product slugs (is-AC-3). The install allowlist is the installable subset below. */
+export const PRODUCT_SLUGS = ["honeycomb", "doctor", "hive", "nectar"];
+/**
+ * The npm package name for each slug, used as LOCAL DETECTION evidence (the folder name under the
+ * global node_modules). This is deliberately independent of the manifest so detection works before
+ * any manifest is fetched (is-AC-1); the manifest remains the sole authority for INSTALL targets.
+ */
+export const PRODUCT_PACKAGES = {
+    honeycomb: "@legioncodeinc/honeycomb",
+    doctor: "@legioncodeinc/doctor",
+    hive: "@legioncodeinc/hive",
+    nectar: "@legioncodeinc/nectar"
+};
+/** The three portal-installable products; `hive` is excluded (not installable, 400). */
+export const INSTALLABLE_PRODUCTS = ["doctor", "honeycomb", "nectar"];
+const PROFILES = {
+    doctor: { binName: "doctor", registrationVerb: ["install-service"] },
+    honeycomb: { binName: "honeycomb", registrationVerb: ["install"] },
+    nectar: { binName: "nectar", registrationVerb: ["install"] }
+};
+/** True for one of the four known slugs (is-AC-3 allowlist membership). */
+export function isProductSlug(value) {
+    return PRODUCT_SLUGS.includes(value);
+}
+/** True for a portal-installable product (`hive` is excluded). */
+export function isInstallableProduct(value) {
+    return INSTALLABLE_PRODUCTS.includes(value);
+}
+/** The static profile (bin name + registration verb) for an installable product. */
+export function productProfile(product) {
+    return PROFILES[product];
+}
+//# sourceMappingURL=products.js.map

package/dist/daemon/installer/products.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"products.js","sourceRoot":"","sources":["../../../src/daemon/installer/products.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,qGAAqG;AACrG,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAU,CAAC;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAgC;IAC3D,SAAS,EAAE,0BAA0B;IACrC,MAAM,EAAE,uBAAuB;IAC/B,IAAI,EAAE,qBAAqB;IAC3B,MAAM,EAAE,uBAAuB;CAChC,CAAC;AAEF,wFAAwF;AACxF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAU,CAAC;AAU/E,MAAM,QAAQ,GAA+C;IAC3D,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,iBAAiB,CAAC,EAAE;IACpE,SAAS,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,SAAS,CAAC,EAAE;IAClE,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,SAAS,CAAC,EAAE;CAC7D,CAAC;AAEF,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAQ,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAQ,oBAA0C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,OAA2B;IACxD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC"}

package/dist/daemon/installer/routes.d.ts

@@ -0,0 +1,43 @@
+/**
+ * PRD-009a: the `/api/onboarding/*` installer surface and its service factory.
+ *
+ * These Hono routes are registered on hive's app BEFORE the generic `/api/*` BFF proxy (the same
+ * registration-order discipline as `/api/fleet-status` and `/api/telemetry/stream`), so hive itself
+ * answers them rather than proxying to a workload daemon. Every route runs the three-check guard
+ * (`security.ts`): Host, Origin, and the one-time token. Manifest resolution, detection, the install
+ * state machine, and the token store are all reached through the injectable config, so a test never
+ * hits the network, real npm, or the real filesystem.
+ */
+import type { Hono } from "hono";
+import type { EmitDeps } from "../../telemetry/emit.js";
+import { type InstallStateStore } from "./install-state.js";
+import { type InstallerConfig } from "./config.js";
+import { type ManifestResolver } from "./manifest.js";
+import { type TokenStore } from "./token.js";
+import { type FunnelTelemetry } from "./funnel-telemetry.js";
+import { type SetupAuthFetchImpl } from "../setup-auth.js";
+import { type FetchImpl as FleetFetchImpl } from "../fleet-status.js";
+/** Service options: the installer config seams plus the fleet-status inputs the health check reuses. */
+export interface InstallerServiceOptions extends Partial<InstallerConfig> {
+    /** The fetch used by the health check's `fetchFleetStatus` (defaults to the global `fetch`). */
+    readonly fleetStatusFetch?: FleetFetchImpl;
+    /** Override doctor's status URL for the health check (defaults to the fixed loopback constant). */
+    readonly doctorStatusUrl?: string;
+    /** Fetch seam for `/setup/state` auth observation (`login_completed`, PRD-009c). */
+    readonly setupAuthFetch?: SetupAuthFetchImpl;
+    /** Injectable telemetry deps for funnel emission (tests record POST bodies). */
+    readonly funnelEmitDeps?: EmitDeps;
+    /** Override onboarding session ledger dir (tests). */
+    readonly funnelStateDir?: string;
+}
+/** The assembled installer service: a route registrar plus its state (exposed for tests). */
+export interface InstallerService {
+    register(app: Hono): void;
+    readonly config: InstallerConfig;
+    readonly store: InstallStateStore;
+    readonly tokenStore: TokenStore;
+    readonly manifest: ManifestResolver;
+    readonly funnel: FunnelTelemetry;
+}
+/** Build the installer service with a memoized npm-prefix resolver over the injected seams. */
+export declare function createInstallerService(options?: InstallerServiceOptions): InstallerService;

package/dist/daemon/installer/routes.js

@@ -0,0 +1,201 @@
+/**
+ * PRD-009a: the `/api/onboarding/*` installer surface and its service factory.
+ *
+ * These Hono routes are registered on hive's app BEFORE the generic `/api/*` BFF proxy (the same
+ * registration-order discipline as `/api/fleet-status` and `/api/telemetry/stream`), so hive itself
+ * answers them rather than proxying to a workload daemon. Every route runs the three-check guard
+ * (`security.ts`): Host, Origin, and the one-time token. Manifest resolution, detection, the install
+ * state machine, and the token store are all reached through the injectable config, so a test never
+ * hits the network, real npm, or the real filesystem.
+ */
+import { z } from "zod";
+import { DOCTOR_STATUS_URL } from "../../shared/constants.js";
+import { createInstallStateStore } from "./install-state.js";
+import { createInstallerConfig } from "./config.js";
+import { createManifestResolver } from "./manifest.js";
+import { createTokenStore } from "./token.js";
+import { detectFleet, installedVersion } from "./detection.js";
+import { isInstallableProduct } from "./products.js";
+import { resolveNpmPrefixViaCli } from "./bin-resolver.js";
+import { guardInstallerRequest } from "./security.js";
+import { createFunnelTelemetry, OnboardingEventBodySchema } from "./funnel-telemetry.js";
+import { fetchSetupAuthenticated } from "../setup-auth.js";
+import { fetchFleetStatus, isFleetReady } from "../fleet-status.js";
+const InstallBodySchema = z.object({ product: z.string() });
+function jsonError(c, status, error) {
+    return c.json({ error }, status);
+}
+async function readJsonBody(c) {
+    try {
+        return await c.req.json();
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Build the installer service with a memoized npm-prefix resolver over the injected seams. */
+export function createInstallerService(options = {}) {
+    const base = createInstallerConfig(options);
+    // Memoize `npm prefix -g` so it runs at most once per daemon session (is-AC: prefix cached).
+    let prefixPromise = null;
+    const config = {
+        ...base,
+        resolveNpmPrefix: () => {
+            if (prefixPromise === null) {
+                prefixPromise = options.resolveNpmPrefix ? options.resolveNpmPrefix() : resolveNpmPrefixViaCli(config);
+            }
+            return prefixPromise;
+        }
+    };
+    const funnel = createFunnelTelemetry({
+        config,
+        emitDeps: options.funnelEmitDeps,
+        stateDir: options.funnelStateDir
+    });
+    const store = createInstallStateStore(config, {
+        onInstallStarted: (product) => funnel.recordProductInstallStarted(product),
+        onInstallCompleted: (product) => funnel.recordProductInstallCompleted(product),
+        onInstallFailed: (product, stage) => funnel.recordProductInstallFailed(product, stage)
+    });
+    const tokenStore = createTokenStore(config);
+    const manifest = createManifestResolver(config);
+    const fleetStatusFetch = options.fleetStatusFetch ?? fetch;
+    const setupAuthFetch = options.setupAuthFetch ?? fetch;
+    const doctorStatusUrl = options.doctorStatusUrl ?? DOCTOR_STATUS_URL;
+    const register = (app) => {
+        // 1) Detection (is-AC-1/2). Token required only while a session is active (is-AC-10 carve-out).
+        app.get("/api/onboarding/detect", async (c) => {
+            const rejection = guardInstallerRequest(c, tokenStore, "detect");
+            if (rejection !== null)
+                return rejection;
+            return c.json(await detectFleet(config, store));
+        });
+        // 2) Install start (is-AC-3/4/5/15/16). Server resolves the target; the request carries only a slug.
+        app.post("/api/onboarding/install", async (c) => {
+            const rejection = guardInstallerRequest(c, tokenStore, "always");
+            if (rejection !== null)
+                return rejection;
+            const body = await readJsonBody(c);
+            const parsed = InstallBodySchema.safeParse(body);
+            if (!parsed.success)
+                return jsonError(c, 400, "invalid_body");
+            // is-AC-3: only the four slugs; `hive` is not installable. Either way a 400 with no spawn.
+            const product = parsed.data.product;
+            if (!isInstallableProduct(product))
+                return jsonError(c, 400, "invalid_product");
+            // is-AC-4/5: resolve `packageName@version` server-side, refusing rather than falling to @latest.
+            const resolution = await manifest.resolve(product);
+            if (resolution.kind === "unpublished")
+                return jsonError(c, 409, "unpublished");
+            if (resolution.kind === "manifest_unresolved")
+                return jsonError(c, 409, "manifest_unresolved");
+            // is-AC-15: already installed at the pinned version -> short-circuit, never spawn npm.
+            const snapshot = store.detectState(product);
+            const detectedVersion = await installedVersion(config, product);
+            if (snapshot.status === "installed" || detectedVersion === resolution.version) {
+                return c.json({ product, state: "installed" }, 200);
+            }
+            // is-AC-16: begin (or attach to an in-flight install); either way the wire state is in_progress.
+            store.begin(product, {
+                packageName: resolution.packageName,
+                version: resolution.version,
+                target: resolution.target
+            });
+            return c.json({ product, state: "install_in_progress" }, 202);
+        });
+        // 3) SSE progress (is-AC-11/12/14). Mirrors the telemetry-proxy relay discipline: a streamed
+        //    body, no buffering beyond the current event, tied to the request's abort signal.
+        app.get("/api/onboarding/install/:product/events", (c) => {
+            const rejection = guardInstallerRequest(c, tokenStore, "always");
+            if (rejection !== null)
+                return rejection;
+            const product = c.req.param("product");
+            if (!isInstallableProduct(product))
+                return jsonError(c, 400, "invalid_product");
+            const signal = c.req.raw.signal;
+            const stream = new ReadableStream({
+                start(controller) {
+                    const encoder = new TextEncoder();
+                    let closed = false;
+                    const subscriber = {
+                        send(event) {
+                            if (closed)
+                                return;
+                            try {
+                                controller.enqueue(encoder.encode(`data: ${JSON.stringify(event)}\n\n`));
+                            }
+                            catch {
+                                closed = true;
+                            }
+                        },
+                        close() {
+                            if (closed)
+                                return;
+                            closed = true;
+                            try {
+                                controller.close();
+                            }
+                            catch {
+                                // The stream may already be closed by a client disconnect; nothing to do.
+                            }
+                        }
+                    };
+                    const unsubscribe = store.subscribe(product, subscriber);
+                    const onAbort = () => {
+                        unsubscribe();
+                        subscriber.close();
+                    };
+                    // is-AC-14: a client disconnect removes this subscriber but the install continues.
+                    if (signal.aborted)
+                        onAbort();
+                    else
+                        signal.addEventListener("abort", onAbort, { once: true });
+                }
+            });
+            return new Response(stream, {
+                status: 200,
+                headers: {
+                    "content-type": "text/event-stream",
+                    "cache-control": "no-store",
+                    connection: "keep-alive"
+                }
+            });
+        });
+        // 4) Health check (is-AC-18): reuse the existing readiness projection, do not re-derive it.
+        app.get("/api/onboarding/health", async (c) => {
+            const rejection = guardInstallerRequest(c, tokenStore, "always");
+            if (rejection !== null)
+                return rejection;
+            const status = await fetchFleetStatus(fleetStatusFetch, doctorStatusUrl);
+            const ready = isFleetReady(status);
+            funnel.observeHealthReady(ready);
+            const authenticated = await fetchSetupAuthenticated(setupAuthFetch, { signal: c.req.raw.signal });
+            funnel.observeAuthenticated(authenticated);
+            return c.json({ ready, status });
+        });
+        // 5) Completion (is-AC-10): invalidate the token (delete the file + set the memory flag), 204.
+        app.post("/api/onboarding/complete", (c) => {
+            const rejection = guardInstallerRequest(c, tokenStore, "always");
+            if (rejection !== null)
+                return rejection;
+            tokenStore.invalidate();
+            return c.body(null, 204);
+        });
+        // 6) Funnel events (PRD-009c): validate token + closed UI event set, emit through chokepoint.
+        app.post("/api/onboarding/event", async (c) => {
+            const rejection = guardInstallerRequest(c, tokenStore, "always");
+            if (rejection !== null)
+                return rejection;
+            const body = await readJsonBody(c);
+            const parsed = OnboardingEventBodySchema.safeParse(body);
+            if (!parsed.success)
+                return jsonError(c, 400, "invalid_body");
+            funnel.recordUiEvent(parsed.data);
+            const authenticated = await fetchSetupAuthenticated(setupAuthFetch, { signal: c.req.raw.signal });
+            funnel.observeAuthenticated(authenticated);
+            return c.body(null, 202);
+        });
+    };
+    return { register, config, store, tokenStore, manifest, funnel };
+}
+//# sourceMappingURL=routes.js.map

package/dist/daemon/installer/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/daemon/installer/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG9D,OAAO,EAAE,uBAAuB,EAA0B,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAwB,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAyB,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAmB,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EAE1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAA2B,MAAM,kBAAkB,CAAC;AACpF,OAAO,EACL,gBAAgB,EAChB,YAAY,EAEb,MAAM,oBAAoB,CAAC;AA0B5B,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE5D,SAAS,SAAS,CAAC,CAAU,EAAE,MAA6B,EAAE,KAAa;IACzE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,CAAU;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,sBAAsB,CAAC,UAAmC,EAAE;IAC1E,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE5C,6FAA6F;IAC7F,IAAI,aAAa,GAAkC,IAAI,CAAC;IACxD,MAAM,MAAM,GAAoB;QAC9B,GAAG,IAAI;QACP,gBAAgB,EAAE,GAAG,EAAE;YACrB,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;YACzG,CAAC;YACD,OAAO,aAAa,CAAC;QACvB,CAAC;KACF,CAAC;IAEF,MAAM,MAAM,GAAG,qBAAqB,CAAC;QACnC,MAAM;QACN,QAAQ,EAAE,OAAO,CAAC,cAAc;QAChC,QAAQ,EAAE,OAAO,CAAC,cAAc;KACjC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,uBAAuB,CAAC,MAAM,EAAE;QAC5C,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,2BAA2B,CAAC,OAAO,CAAC;QAC1E,kBAAkB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,6BAA6B,CAAC,OAAO,CAAC;QAC9E,eAAe,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC;KACvF,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAEhD,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC3D,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;IACvD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,iBAAiB,CAAC;IAErE,MAAM,QAAQ,GAAG,CAAC,GAAS,EAAQ,EAAE;QACnC,gGAAgG;QAChG,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC5C,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACzC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,qGAAqG;QACrG,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC9C,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YAEzC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YAE9D,2FAA2F;YAC3F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;YACpC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAEhF,iGAAiG;YACjG,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,UAAU,CAAC,IAAI,KAAK,aAAa;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;YAC/E,IAAI,UAAU,CAAC,IAAI,KAAK,qBAAqB;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;YAE/F,uFAAuF;YACvF,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,IAAI,eAAe,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;YACtD,CAAC;YAED,iGAAiG;YACjG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;gBACnB,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,6FAA6F;QAC7F,sFAAsF;QACtF,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,CAAC,EAAE,EAAE;YACvD,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YAEzC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAEhF,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,cAAc,CAAa;gBAC5C,KAAK,CAAC,UAAU;oBACd,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;oBAClC,IAAI,MAAM,GAAG,KAAK,CAAC;oBACnB,MAAM,UAAU,GAAuB;wBACrC,IAAI,CAAC,KAAK;4BACR,IAAI,MAAM;gCAAE,OAAO;4BACnB,IAAI,CAAC;gCACH,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;4BAC3E,CAAC;4BAAC,MAAM,CAAC;gCACP,MAAM,GAAG,IAAI,CAAC;4BAChB,CAAC;wBACH,CAAC;wBACD,KAAK;4BACH,IAAI,MAAM;gCAAE,OAAO;4BACnB,MAAM,GAAG,IAAI,CAAC;4BACd,IAAI,CAAC;gCACH,UAAU,CAAC,KAAK,EAAE,CAAC;4BACrB,CAAC;4BAAC,MAAM,CAAC;gCACP,0EAA0E;4BAC5E,CAAC;wBACH,CAAC;qBACF,CAAC;oBAEF,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;oBACzD,MAAM,OAAO,GAAG,GAAS,EAAE;wBACzB,WAAW,EAAE,CAAC;wBACd,UAAU,CAAC,KAAK,EAAE,CAAC;oBACrB,CAAC,CAAC;oBACF,mFAAmF;oBACnF,IAAI,MAAM,CAAC,OAAO;wBAAE,OAAO,EAAE,CAAC;;wBACzB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjE,CAAC;aACF,CAAC,CAAC;YAEH,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;gBAC1B,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,mBAAmB;oBACnC,eAAe,EAAE,UAAU;oBAC3B,UAAU,EAAE,YAAY;iBACzB;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,4FAA4F;QAC5F,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC5C,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;YACzE,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAClG,MAAM,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;YAC3C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,+FAA+F;QAC/F,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,CAAC,CAAC,EAAE,EAAE;YACzC,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACzC,UAAU,CAAC,UAAU,EAAE,CAAC;YACxB,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,8FAA8F;QAC9F,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC5C,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACzC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YAC9D,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAClG,MAAM,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;YAC3C,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACnE,CAAC"}

package/dist/daemon/installer/security.d.ts

@@ -0,0 +1,33 @@
+/**
+ * PRD-009a: the three non-negotiable installer mitigations (is-AC-7/8/9/10).
+ *
+ * A loopback endpoint that shells out to `npm install` is a drive-by target: any page the operator
+ * visits can `fetch` or form-POST at `127.0.0.1:3853`. Every installer request therefore passes:
+ *   - HOST validation (is-AC-8, DNS-rebinding defense): a rebound hostname that resolves to
+ *     127.0.0.1 still fails because its `Host` header is not the portal's own host.
+ *   - ORIGIN validation (is-AC-7): a foreign Origin is rejected 403; a missing Origin on a
+ *     state-changing (non-GET) request is rejected too.
+ *   - TOKEN validation (is-AC-9): the one-time bootstrap token, constant-time compared. State-
+ *     changing endpoints always require it; read-only detection requires it only while a session is
+ *     active, staying available token-free after completion for the re-entry short-circuit (is-AC-10).
+ */
+import type { Context } from "hono";
+import type { TokenStore } from "./token.js";
+/** The request header carrying the onboarding token (the SSE path uses the `t` query param instead). */
+export declare const TOKEN_HEADER: "x-onboarding-token";
+/** Whether detection-style read endpoints require the token unconditionally or only while active. */
+export type TokenMode = "always" | "detect";
+/** True iff the `Host` header is the portal's own host (is-AC-8). */
+export declare function hostAllowed(host: string | undefined): boolean;
+/**
+ * Origin policy (is-AC-7): a present Origin must be the portal's own; a missing Origin is allowed
+ * only on a safe (GET) request and rejected on any state-changing method.
+ */
+export declare function originAllowed(method: string, origin: string | undefined): boolean;
+/** Read the presented token from the header, falling back to the `t` query param only for EventSource. */
+export declare function extractToken(c: Context): string | null;
+/**
+ * Run the full guard for an installer request. Returns a rejection {@link Response} to short-circuit
+ * the handler, or `null` when the request passed all three checks. Never logs or echoes the token.
+ */
+export declare function guardInstallerRequest(c: Context, tokenStore: TokenStore, tokenMode: TokenMode): Response | null;

package/dist/daemon/installer/security.js

@@ -0,0 +1,80 @@
+/**
+ * PRD-009a: the three non-negotiable installer mitigations (is-AC-7/8/9/10).
+ *
+ * A loopback endpoint that shells out to `npm install` is a drive-by target: any page the operator
+ * visits can `fetch` or form-POST at `127.0.0.1:3853`. Every installer request therefore passes:
+ *   - HOST validation (is-AC-8, DNS-rebinding defense): a rebound hostname that resolves to
+ *     127.0.0.1 still fails because its `Host` header is not the portal's own host.
+ *   - ORIGIN validation (is-AC-7): a foreign Origin is rejected 403; a missing Origin on a
+ *     state-changing (non-GET) request is rejected too.
+ *   - TOKEN validation (is-AC-9): the one-time bootstrap token, constant-time compared. State-
+ *     changing endpoints always require it; read-only detection requires it only while a session is
+ *     active, staying available token-free after completion for the re-entry short-circuit (is-AC-10).
+ */
+import { HIVE_HOST, HIVE_PORT } from "../../shared/constants.js";
+/** The portal's own hosts (is-AC-8). Only these `Host` header values are accepted. */
+const ALLOWED_HOSTS = new Set([`${HIVE_HOST}:${HIVE_PORT}`, `localhost:${HIVE_PORT}`]);
+/** The portal's own origins (is-AC-7). Only these `Origin` header values are accepted. */
+const ALLOWED_ORIGINS = new Set([`http://${HIVE_HOST}:${HIVE_PORT}`, `http://localhost:${HIVE_PORT}`]);
+/** The request header carrying the onboarding token (the SSE path uses the `t` query param instead). */
+export const TOKEN_HEADER = "x-onboarding-token";
+/** True iff the `Host` header is the portal's own host (is-AC-8). */
+export function hostAllowed(host) {
+    return host !== undefined && ALLOWED_HOSTS.has(host);
+}
+/**
+ * Origin policy (is-AC-7): a present Origin must be the portal's own; a missing Origin is allowed
+ * only on a safe (GET) request and rejected on any state-changing method.
+ */
+export function originAllowed(method, origin) {
+    if (origin === undefined)
+        return method === "GET" || method === "HEAD";
+    return ALLOWED_ORIGINS.has(origin);
+}
+function forbidden() {
+    return new Response(JSON.stringify({ error: "forbidden" }), {
+        status: 403,
+        headers: { "content-type": "application/json" }
+    });
+}
+function unauthorized() {
+    return new Response(JSON.stringify({ error: "unauthorized" }), {
+        status: 401,
+        headers: { "content-type": "application/json" }
+    });
+}
+function allowsQueryToken(c) {
+    const path = new URL(c.req.url).pathname;
+    return c.req.method === "GET" && /^\/api\/onboarding\/install\/[^/]+\/events$/.test(path);
+}
+/** Read the presented token from the header, falling back to the `t` query param only for EventSource. */
+export function extractToken(c) {
+    const header = c.req.header(TOKEN_HEADER);
+    if (header !== undefined && header.length > 0)
+        return header;
+    if (!allowsQueryToken(c))
+        return null;
+    const query = c.req.query("t");
+    return query !== undefined && query.length > 0 ? query : null;
+}
+/**
+ * Run the full guard for an installer request. Returns a rejection {@link Response} to short-circuit
+ * the handler, or `null` when the request passed all three checks. Never logs or echoes the token.
+ */
+export function guardInstallerRequest(c, tokenStore, tokenMode) {
+    if (!hostAllowed(c.req.header("host")))
+        return forbidden();
+    if (!originAllowed(c.req.method, c.req.header("origin")))
+        return forbidden();
+    const provided = extractToken(c);
+    if (tokenMode === "always") {
+        if (!tokenStore.requireValid(provided))
+            return unauthorized();
+        return null;
+    }
+    // "detect": token required only while an onboarding session is active (is-AC-10 carve-out).
+    if (tokenStore.isActive() && !tokenStore.requireValid(provided))
+        return unauthorized();
+    return null;
+}
+//# sourceMappingURL=security.js.map

package/dist/daemon/installer/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/daemon/installer/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAGjE,sFAAsF;AACtF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,SAAS,IAAI,SAAS,EAAE,EAAE,aAAa,SAAS,EAAE,CAAC,CAAC,CAAC;AAE/F,0FAA0F;AAC1F,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS,CAAC,UAAU,SAAS,IAAI,SAAS,EAAE,EAAE,oBAAoB,SAAS,EAAE,CAAC,CAAC,CAAC;AAE/G,wGAAwG;AACxG,MAAM,CAAC,MAAM,YAAY,GAAG,oBAA6B,CAAC;AAK1D,qEAAqE;AACrE,MAAM,UAAU,WAAW,CAAC,IAAwB;IAClD,OAAO,IAAI,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,MAA0B;IACtE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;IACvE,OAAO,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE;QAC1D,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE;QAC7D,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAU;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IACzC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5F,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAC7D,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAU,EAAE,UAAsB,EAAE,SAAoB;IAC5F,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,SAAS,EAAE,CAAC;IAC3D,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,SAAS,EAAE,CAAC;IAE7E,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC;YAAE,OAAO,YAAY,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4FAA4F;IAC5F,IAAI,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC;QAAE,OAAO,YAAY,EAAE,CAAC;IACvF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/daemon/installer/spawn.d.ts

@@ -0,0 +1,49 @@
+/**
+ * PRD-009a: the argv-safe child-process seam (is-AC-6).
+ *
+ * Every npm invocation and every product registration verb runs through {@link SpawnFn}, whose
+ * signature is structurally injection-proof: the command and its arguments are ALWAYS an argv
+ * array, so there is no code path that can concatenate request-derived data into a shell string.
+ * The default node implementation ({@link createNodeSpawn}) passes `shell: false` explicitly.
+ *
+ * Windows footgun this design side-steps: `npm.cmd` cannot be spawned with `shell:false` on
+ * Node >= 20 (EINVAL). Callers therefore never spawn a `.cmd`; they spawn `process.execPath`
+ * with a resolved `*.js` entry as the first argv element (see `bin-resolver.ts`), so no `.cmd`
+ * and no shell is ever involved.
+ */
+import type { ChildProcess } from "node:child_process";
+/** The bounded tail we keep of each stream (is-AC-17: a bounded stderr excerpt, ~2 KB). */
+export declare const SPAWN_TAIL_LIMIT = 2048;
+/** The terminal outcome of a spawned process: its exit code plus bounded stdout/stderr tails. */
+export interface SpawnOutcome {
+    /** The process exit code, or `null` when it was terminated by a signal without a code. */
+    readonly code: number | null;
+    readonly stdoutTail: string;
+    readonly stderrTail: string;
+}
+/** Optional streaming hooks + an abort signal for a single spawn. */
+export interface SpawnInvocationOptions {
+    readonly signal?: AbortSignal;
+    /** Called for each stdout chunk (used to derive observable stage milestones, is-AC-12). */
+    readonly onStdout?: (chunk: string) => void;
+    /** Called for each stderr chunk. */
+    readonly onStderr?: (chunk: string) => void;
+}
+/**
+ * The injectable spawn surface. `command` + `args` are an argv array by construction; a shell
+ * string is not expressible. Resolves with the terminal {@link SpawnOutcome}; rejects only on a
+ * spawn-level error (ENOENT, EINVAL), which callers translate into a `failed` stage.
+ */
+export type SpawnFn = (command: string, args: readonly string[], options?: SpawnInvocationOptions) => Promise<SpawnOutcome>;
+/** The low-level node spawn seam, injected by tests to assert `shell:false` + the argv array. */
+export type RawSpawn = (command: string, args: readonly string[], options: {
+    readonly shell: false;
+    readonly signal?: AbortSignal;
+    readonly env?: NodeJS.ProcessEnv;
+}) => ChildProcess;
+/**
+ * Build the default {@link SpawnFn} over node's `child_process.spawn`, pinned to `shell: false`.
+ * A test injects `rawSpawn` to assert the argv array and the disabled shell without touching a
+ * real process.
+ */
+export declare function createNodeSpawn(rawSpawn?: RawSpawn): SpawnFn;

package/dist/daemon/installer/spawn.js

@@ -0,0 +1,63 @@
+/**
+ * PRD-009a: the argv-safe child-process seam (is-AC-6).
+ *
+ * Every npm invocation and every product registration verb runs through {@link SpawnFn}, whose
+ * signature is structurally injection-proof: the command and its arguments are ALWAYS an argv
+ * array, so there is no code path that can concatenate request-derived data into a shell string.
+ * The default node implementation ({@link createNodeSpawn}) passes `shell: false` explicitly.
+ *
+ * Windows footgun this design side-steps: `npm.cmd` cannot be spawned with `shell:false` on
+ * Node >= 20 (EINVAL). Callers therefore never spawn a `.cmd`; they spawn `process.execPath`
+ * with a resolved `*.js` entry as the first argv element (see `bin-resolver.ts`), so no `.cmd`
+ * and no shell is ever involved.
+ */
+import { spawn as nodeSpawn } from "node:child_process";
+import { delimiter, dirname } from "node:path";
+/** The bounded tail we keep of each stream (is-AC-17: a bounded stderr excerpt, ~2 KB). */
+export const SPAWN_TAIL_LIMIT = 2048;
+/**
+ * The child env: the daemon's env with the SPAWNED BINARY's directory prepended to PATH. Under a
+ * service manager (launchd/systemd) the daemon inherits a minimal PATH without node's bin dir,
+ * and npm >= 9 no longer prepends node's directory when running lifecycle scripts — so a package
+ * postinstall invoking plain `node` dies with `sh: node: command not found` (exit 127). The
+ * command here is always `process.execPath`, so prepending its dir puts the RIGHT node first.
+ */
+function childEnv(command) {
+    const basePath = process.env.PATH ?? "";
+    return { ...process.env, PATH: `${dirname(command)}${delimiter}${basePath}` };
+}
+/** Keep only the last `limit` characters of `current + chunk` so a chatty child cannot grow memory. */
+function appendTail(current, chunk, limit) {
+    const next = current + chunk;
+    return next.length > limit ? next.slice(next.length - limit) : next;
+}
+/**
+ * Build the default {@link SpawnFn} over node's `child_process.spawn`, pinned to `shell: false`.
+ * A test injects `rawSpawn` to assert the argv array and the disabled shell without touching a
+ * real process.
+ */
+export function createNodeSpawn(rawSpawn = nodeSpawn) {
+    return (command, args, options = {}) => new Promise((resolve, reject) => {
+        let stdoutTail = "";
+        let stderrTail = "";
+        // The whole point of is-AC-6: an argv array and `shell: false`, never a shell string.
+        const child = rawSpawn(command, [...args], { shell: false, signal: options.signal, env: childEnv(command) });
+        child.stdout?.on("data", (data) => {
+            const chunk = String(data);
+            stdoutTail = appendTail(stdoutTail, chunk, SPAWN_TAIL_LIMIT);
+            options.onStdout?.(chunk);
+        });
+        child.stderr?.on("data", (data) => {
+            const chunk = String(data);
+            stderrTail = appendTail(stderrTail, chunk, SPAWN_TAIL_LIMIT);
+            options.onStderr?.(chunk);
+        });
+        child.on("error", (error) => {
+            reject(error);
+        });
+        child.on("close", (code) => {
+            resolve({ code, stdoutTail, stderrTail });
+        });
+    });
+}
+//# sourceMappingURL=spawn.js.map

package/dist/daemon/installer/spawn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn.js","sourceRoot":"","sources":["../../../src/daemon/installer/spawn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE/C,2FAA2F;AAC3F,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAqCrC;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,OAAe;IAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACxC,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,GAAG,QAAQ,EAAE,EAAE,CAAC;AAChF,CAAC;AAED,uGAAuG;AACvG,SAAS,UAAU,CAAC,OAAe,EAAE,KAAa,EAAE,KAAa;IAC/D,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,CAAC;IAC7B,OAAO,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,WAAqB,SAAgC;IACnF,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE,CACrC,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC5C,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,UAAU,GAAG,EAAE,CAAC;QAEpB,sFAAsF;QACtF,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAE7G,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAa,EAAE,EAAE;YACzC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,UAAU,GAAG,UAAU,CAAC,UAAU,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;YAC7D,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAa,EAAE,EAAE;YACzC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,UAAU,GAAG,UAAU,CAAC,UAAU,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;YAC7D,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;YACjC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE;YACxC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/daemon/installer/token.d.ts

@@ -0,0 +1,23 @@
+/**
+ * PRD-009a: the daemon side of the one-time onboarding token contract (is-AC-9/10).
+ *
+ * The bootstrap mints the token and writes it to `~/.honeycomb/hive/onboarding-token` at mode
+ * 0600 BEFORE the daemon starts (PRD-009d). The daemon reads it LAZILY at request time, not at
+ * startup, because on re-entry the daemon may already be running when a fresh bootstrap writes a
+ * new token. Comparison is constant time (`crypto.timingSafeEqual`). Completion invalidates the
+ * token: the file is deleted and an in-memory flag is set, so state-changing endpoints refuse all
+ * requests until a fresh bootstrap mints a new one (is-AC-10). The token is never logged, never
+ * returned, and never placed in an error body.
+ */
+import type { InstallerConfig } from "./config.js";
+/** The token gate: whether onboarding is active, whether a presented token is valid, and invalidation. */
+export interface TokenStore {
+    /** True while a token file exists and has not been invalidated (an active onboarding session). */
+    isActive(): boolean;
+    /** True iff `provided` matches the on-disk token in constant time and the token is not invalidated. */
+    requireValid(provided: string | null | undefined): boolean;
+    /** Invalidate the token: delete the file and set the in-memory flag (idempotent). */
+    invalidate(): void;
+}
+/** Build the token store over the injected config seams. */
+export declare function createTokenStore(config: InstallerConfig): TokenStore;