@pixelbyte-software/pixcode 1.54.6 → 1.54.8

package/dist-server/server/daemon-manager.js

@@ -221,22 +221,22 @@ function buildDaemonServiceUnit({ appRoot, serverPort, databasePath, nodeExecPat
         nodeExecPath,
         cliEntry,
     });
-    return `[Unit]
-Description=Pixcode Server
-After=network.target
-
-[Service]
-Type=simple
-WorkingDirectory=${appRoot}
-ExecStart=${execStart}
-Environment=HOST=0.0.0.0
-Environment=CI=true
-Environment=PIXCODE_DAEMON_MANAGED=1
-Restart=always
-RestartSec=2
-
-[Install]
-WantedBy=default.target
+    return `[Unit]
+Description=Pixcode Server
+After=network.target
+
+[Service]
+Type=simple
+WorkingDirectory=${appRoot}
+ExecStart=${execStart}
+Environment=HOST=0.0.0.0
+Environment=CI=true
+Environment=PIXCODE_DAEMON_MANAGED=1
+Restart=always
+RestartSec=2
+
+[Install]
+WantedBy=default.target
 `;
 }
 function resolveFrontendDaemonEntry(appRoot, cliEntry) {
@@ -277,22 +277,22 @@ function buildFrontendDaemonServiceUnit({ appRoot, frontendPort, nodeExecPath, c
         nodeExecPath,
         cliEntry,
     });
-    return `[Unit]
-Description=Pixcode Frontend (Vite Dev Server)
-After=network.target
-
-[Service]
-Type=simple
-WorkingDirectory=${appRoot}
-ExecStart=${execStart}
-Environment=HOST=0.0.0.0
-Environment=CI=true
-Environment=PIXCODE_DAEMON_MANAGED=1
-Restart=always
-RestartSec=2
-
-[Install]
-WantedBy=default.target
+    return `[Unit]
+Description=Pixcode Frontend (Vite Dev Server)
+After=network.target
+
+[Service]
+Type=simple
+WorkingDirectory=${appRoot}
+ExecStart=${execStart}
+Environment=HOST=0.0.0.0
+Environment=CI=true
+Environment=PIXCODE_DAEMON_MANAGED=1
+Restart=always
+RestartSec=2
+
+[Install]
+WantedBy=default.target
 `;
 }
 function normalizeState(value) {
@@ -489,38 +489,38 @@ function showDaemonHelp(c, context = {}) {
     const statusExample = buildDaemonCliCommand({ subcommand: 'status', mode: 'system' }, context);
     const doctorExample = buildDaemonCliCommand({ subcommand: 'doctor', mode: 'auto' }, context);
     const logsExample = buildDaemonCliCommand({ subcommand: 'logs', mode: 'system' }, context);
-    console.log(`
-${c.bright('Pixcode Daemon')} - Persistent Linux service manager
-
-Usage:
-  ${usagePrefix} daemon [subcommand] [options]
-
-Subcommands:
-  ${c.bright('install')}      Install/update unit, reload daemon, enable and start now
-  ${c.bright('start')}        Start the service
-  ${c.bright('stop')}         Stop the service (temporary; auto-start remains enabled)
-  ${c.bright('restart')}      Restart the service
-  ${c.bright('status')}       Show active/enabled state
-  ${c.bright('logs')}         Show recent service logs
-  ${c.bright('enable')}       Enable auto-start at boot
-  ${c.bright('disable')}      Disable auto-start at boot
-  ${c.bright('uninstall')}    Stop, disable, and remove the service unit
-  ${c.bright('doctor')}       Run diagnostics (bus, linger, units, state, port, logs)
-  ${c.bright('help')}         Show this help
-
-Options:
-  -p, --port <port>           Set service server port (default: 3001)
-  --frontend-port <port>      Start a separate frontend Vite service on this port (legacy/dev)
-  --single-port, --no-frontend
-                              Serve the built UI from the backend port only (default)
-  -m, --mode <mode>           Service mode: user | system | auto (default: system)
-  --database-path <path>      Set service database path
-
-Examples:
-  $ ${installExample}
-  $ ${statusExample}
-  $ ${doctorExample}
-  $ ${logsExample}
+    console.log(`
+${c.bright('Pixcode Daemon')} - Persistent Linux service manager
+
+Usage:
+  ${usagePrefix} daemon [subcommand] [options]
+
+Subcommands:
+  ${c.bright('install')}      Install/update unit, reload daemon, enable and start now
+  ${c.bright('start')}        Start the service
+  ${c.bright('stop')}         Stop the service (temporary; auto-start remains enabled)
+  ${c.bright('restart')}      Restart the service
+  ${c.bright('status')}       Show active/enabled state
+  ${c.bright('logs')}         Show recent service logs
+  ${c.bright('enable')}       Enable auto-start at boot
+  ${c.bright('disable')}      Disable auto-start at boot
+  ${c.bright('uninstall')}    Stop, disable, and remove the service unit
+  ${c.bright('doctor')}       Run diagnostics (bus, linger, units, state, port, logs)
+  ${c.bright('help')}         Show this help
+
+Options:
+  -p, --port <port>           Set service server port (default: 3001)
+  --frontend-port <port>      Start a separate frontend Vite service on this port (legacy/dev)
+  --single-port, --no-frontend
+                              Serve the built UI from the backend port only (default)
+  -m, --mode <mode>           Service mode: user | system | auto (default: system)
+  --database-path <path>      Set service database path
+
+Examples:
+  $ ${installExample}
+  $ ${statusExample}
+  $ ${doctorExample}
+  $ ${logsExample}
 `);
 }
 export function hasInstalledDaemonUnit() {

package/dist-server/server/index.js

@@ -453,10 +453,20 @@ async function runRuntimeDirUpdateJob(job, runtimeDir, latestVersion, tarballUrl
     });
     return latestVersion;
 }
+function isNodeVersionSupported() {
+    const match = process.version?.match(/^v(\d+)\./);
+    if (!match)
+        return true; // can't detect, assume ok
+    return parseInt(match[1], 10) >= 20;
+}
 async function runCommandUpdateJob(job, updateCommand, updateCwd) {
-    appendUpdateJobLog(job, 'meta', `Running: ${updateCommand}\n`);
-    await new Promise((resolve, reject) => {
-        const child = spawn(updateCommand, {
+    if (!isNodeVersionSupported()) {
+        const msg = `Node.js ${process.version} is too old. Pixcode requires Node.js 20+. Please upgrade Node.js first.\n`;
+        appendUpdateJobLog(job, 'stderr', msg);
+        throw new Error(msg.trim());
+    }
+    const runCommand = (cmd) => new Promise((resolve, reject) => {
+        const child = spawn(cmd, {
             cwd: updateCwd,
             env: process.env,
             shell: true,
@@ -468,15 +478,43 @@ async function runCommandUpdateJob(job, updateCommand, updateCwd) {
         }
         catch { /* noop */ }
         child.stdout?.on('data', (data) => appendUpdateJobLog(job, 'stdout', data.toString()));
-        child.stderr?.on('data', (data) => appendUpdateJobLog(job, 'stderr', data.toString()));
+        let stderrBuf = '';
+        child.stderr?.on('data', (data) => {
+            const chunk = data.toString();
+            stderrBuf += chunk;
+            appendUpdateJobLog(job, 'stderr', chunk);
+        });
         child.on('error', reject);
         child.on('close', (code) => {
             if (code === 0)
                 resolve();
             else
-                reject(new Error(`Update command exited with code ${code}`));
+                reject({ code, stderr: stderrBuf });
         });
     });
+    appendUpdateJobLog(job, 'meta', `Running: ${updateCommand}\n`);
+    try {
+        await runCommand(updateCommand);
+    }
+    catch (err) {
+        // On Linux/macOS, retry with sudo if the initial attempt failed with EACCES.
+        // npm install -g needs write access to /usr/local/lib/node_modules/,
+        // which the running user may not have.
+        if (process.platform !== 'win32' && (err.stderr?.includes('EACCES') || err.stderr?.includes('permission denied'))) {
+            const sudoCmd = `sudo -n ${updateCommand}`;
+            appendUpdateJobLog(job, 'meta', `Permission denied. Retrying with sudo...\n`);
+            try {
+                await runCommand(sudoCmd);
+                return;
+            }
+            catch (sudoErr) {
+                appendUpdateJobLog(job, 'stderr', `Sudo update also failed: ${sudoErr.stderr || sudoErr.code}\n`);
+                appendUpdateJobLog(job, 'meta', 'Tip: Run the update manually with: sudo npm install -g @pixelbyte-software/pixcode@latest\n');
+                throw new Error(`Update command exited with code ${err.code}`);
+            }
+        }
+        throw new Error(`Update command exited with code ${err.code}`);
+    }
 }
 function readCurrentPackageVersion() {
     try {
@@ -1573,32 +1611,17 @@ app.use(cors({
     credentials: true,
     exposedHeaders: ['X-Refreshed-Token'],
 }));
-// Security headers middleware (replaces helmet which isn't installed).
+// Security headers — kept lightweight for self-hosted tool compatibility.
+// CSP removed: it blocked Vite inline modulepreload, Google Fonts, and
+// IP-based WebSocket access. X-Frame-Options + nosniff are the high-value
+// headers that don't break anything.
 app.use((req, res, next) => {
     res.setHeader('X-Content-Type-Options', 'nosniff');
     res.setHeader('X-Frame-Options', 'SAMEORIGIN');
     res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
-    res.setHeader('X-XSS-Protection', '1; mode=block');
-    res.setHeader('Permissions-Policy', 'geolocation=(), microphone=(), camera=()');
-    // Strict-Transport-Security only makes sense over HTTPS; skip for plain HTTP
-    // so local dev doesn't pin an HSTS policy on localhost.
     if (req.secure || req.headers['x-forwarded-proto'] === 'https') {
         res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
     }
-    // CSP for the SPA shell — relaxed for self-hosted tool accessed from
-    // various IPs/hostnames. 'unsafe-inline' + 'unsafe-eval' needed for Vite.
-    // ws:/wss: in connect-src allows WebSocket from any origin (IP access).
-    res.setHeader('Content-Security-Policy', [
-        "default-src 'self'",
-        "script-src 'self' 'unsafe-inline' 'unsafe-eval'",
-        "style-src 'self' 'unsafe-inline'",
-        "img-src 'self' data: blob: https:",
-        "font-src 'self' data:",
-        "connect-src 'self' ws: wss: http: https:",
-        "frame-ancestors 'self'",
-        "base-uri 'self'",
-        "form-action 'self'",
-    ].join('; '));
     next();
 });
 app.use(express.json({
@@ -1621,6 +1644,7 @@ app.get('/health', (req, res) => {
         timestamp: new Date().toISOString(),
         installMode,
         version: SERVER_VERSION,
+        nodeVersion: process.version,
         pendingRestart: updateState.pendingRestart,
         lastAppliedUpdate: updateState.lastAppliedUpdate,
     });
@@ -2334,6 +2358,14 @@ app.post('/api/system/update', authenticateToken, requireAdmin, requireApiScope(
             console.warn('[update] Registry precheck failed:', (err && err.message) || err);
         }
     }
+    // Check Node.js version before starting update
+    if (!isNodeVersionSupported()) {
+        send('log', { stream: 'stderr', chunk: `Node.js ${process.version} is too old. Pixcode requires Node.js 20+.\n` });
+        send('log', { stream: 'meta', chunk: 'Please upgrade Node.js and try again.\n' });
+        send('done', { success: false, error: `Node.js ${process.version} is too old. Pixcode requires Node.js 20+. Please upgrade Node.js first.` });
+        endStream();
+        return;
+    }
     send('log', { stream: 'meta', chunk: `Running: ${updateCommandLabel}\n` });
     // Cross-platform shell invocation. `detached: true` + `unref()` below
     // means the install child survives if this server process gets killed
@@ -2342,7 +2374,7 @@ app.post('/api/system/update', authenticateToken, requireAdmin, requireApiScope(
     // can segfault or the supervisor kills it). Without detachment, a
     // killed parent tears down the npm child too and users end up with
     // a half-installed package and no server at all.
-    const child = spawn(updateCommand, {
+    let child = spawn(updateCommand, {
         cwd: updateCwd,
         env: process.env,
         shell: true,
@@ -2368,7 +2400,9 @@ app.post('/api/system/update', authenticateToken, requireAdmin, requireApiScope(
     child.stdout?.on('data', (data) => {
         send('log', { stream: 'stdout', chunk: data.toString() });
     });
+    let stderrBuf = '';
     child.stderr?.on('data', (data) => {
+        stderrBuf += data.toString();
         send('log', { stream: 'stderr', chunk: data.toString() });
     });
     child.on('error', (error) => {
@@ -2378,7 +2412,7 @@ app.post('/api/system/update', authenticateToken, requireAdmin, requireApiScope(
         send('done', { success: false, error: error.message });
         endStream();
     });
-    child.on('close', (code) => {
+    child.on('close', async (code) => {
         if (ended)
             return;
         if (clientAborted) {
@@ -2391,13 +2425,61 @@ app.post('/api/system/update', authenticateToken, requireAdmin, requireApiScope(
                 version: SERVER_VERSION,
                 message: 'Update completed. Restart the server to apply changes.',
             });
+            endStream();
+            return;
         }
-        else {
-            send('done', {
-                success: false,
-                error: `Update command exited with code ${code}`,
-            });
+        // On Linux/macOS, retry with sudo on EACCES (npm install -g permission error)
+        if (code !== 0 && process.platform !== 'win32' && (stderrBuf.includes('EACCES') || stderrBuf.includes('permission denied'))) {
+            const sudoCmd = `sudo -n ${updateCommand}`;
+            send('log', { stream: 'meta', chunk: 'Permission denied. Retrying with sudo...\n' });
+            try {
+                await new Promise((resolveSudo, rejectSudo) => {
+                    let sudoEnded = false;
+                    const sudoChild = spawn(sudoCmd, {
+                        cwd: updateCwd,
+                        env: process.env,
+                        shell: true,
+                        detached: true,
+                        stdio: ['ignore', 'pipe', 'pipe'],
+                    });
+                    try {
+                        sudoChild.unref();
+                    }
+                    catch { /* noop */ }
+                    sudoChild.stdout?.on('data', (d) => send('log', { stream: 'stdout', chunk: d.toString() }));
+                    let sudoStderr = '';
+                    sudoChild.stderr?.on('data', (d) => { sudoStderr += d.toString(); send('log', { stream: 'stderr', chunk: d.toString() }); });
+                    sudoChild.on('error', (e) => { if (!sudoEnded) {
+                        sudoEnded = true;
+                        rejectSudo(e);
+                    } });
+                    sudoChild.on('close', (sudoCode) => {
+                        if (sudoEnded)
+                            return;
+                        sudoEnded = true;
+                        if (sudoCode === 0)
+                            resolveSudo();
+                        else
+                            rejectSudo(new Error(`Sudo update exited with code ${sudoCode}`));
+                    });
+                });
+                send('done', {
+                    success: true,
+                    version: SERVER_VERSION,
+                    message: 'Update completed (with sudo). Restart the server to apply changes.',
+                });
+                endStream();
+                return;
+            }
+            catch (sudoErr) {
+                send('log', { stream: 'stderr', chunk: `Sudo update failed: ${sudoErr.message}\n` });
+                send('log', { stream: 'meta', chunk: 'Tip: Run the update manually with: sudo npm install -g @pixelbyte-software/pixcode@latest\n' });
+            }
         }
+        send('done', {
+            success: false,
+            error: `Update command exited with code ${code}`,
+        });
         endStream();
     });
 });