@rubytech/create-siteoffice-code 0.1.256

package/dist/snap-chromium.js

@@ -0,0 +1,88 @@
+// pure decision: should the laptop installer replace snap-confined
+// Chromium with Google Chrome stable, and which absolute binary path should
+// vnc.sh / writeChromiumWrapper / the Playwright env var resolve to?
+//
+// Mirrors apt-resolve.ts and port-resolution.ts: inputs
+// in, decision out, no I/O. The installer wraps this with the actual
+// `command -v` and `realpath` spawnSync calls and the side-effecting
+// apt-repo-add → apt-get install → writeFileSync sequence.
+//
+// Snap detection: on Ubuntu Noble (the only currently-supported snap-confined
+// distro for Maxy/Real Agent) `readlink -f /usr/bin/chromium` resolves to
+// `/usr/bin/snap` — the snap launcher binary, which then re-execs into
+// `/snap/chromium/<rev>/usr/lib/chromium/chromium` under AppArmor. The
+// AppArmor `home` interface profile excludes hidden top-level paths under
+// `$HOME`, so any write to `~/.maxy/chromium-profile/SingletonLock` (and the
+// equivalent realagent path) hits EACCES regardless of UID. The fix is binary
+// replacement at install time; runtime patches are forbidden by
+// `feedback_no_admin_upgrade_path.md`.
+/**
+ * True iff the realpath resolves to the snap launcher (`/usr/bin/snap`) or
+ * lives anywhere under `/snap/`. Splitting on `/` and checking for a literal
+ * `snap` segment catches all three real-world shapes:
+ *   - `/snap/bin/chromium`               (intermediate snap wrapper symlink)
+ *   - `/snap/chromium/2924/usr/...`      (squashfs-mounted snap revision)
+ *   - `/usr/bin/snap`                    (snap launcher — `readlink -f` terminus on Noble)
+ *
+ * Empty / null inputs return false so callers can pass through `realpathSync`
+ * results without an explicit guard.
+ */
+export function isSnapConfinedPath(realpath) {
+    if (!realpath)
+        return false;
+    return realpath.split("/").includes("snap");
+}
+/**
+ * Pure decision. Resolution order:
+ *   1. Non-linux platform → skip-non-linux. Darwin Maxy uses Playwright's
+ *      managed Chromium (brew-install.ts), Pi-only chromium-binary.path
+ *      logic does not apply. No file is written.
+ *   2. A non-snap `google-chrome-stable` is on PATH → use it. Covers re-run
+ *      installs on a previously-fixed laptop and operator-supplied Chrome.
+ *   3. A non-snap `chromium` is on PATH → use it. Covers Pi Bookworm where
+ *      `apt-get install chromium` lands a real .deb, not a snap symlink.
+ *   4. `chromium` is on PATH but realpath is snap-confined, and no
+ *      google-chrome-stable is present → install-google-chrome. The caller
+ *      adds Google's signed apt repo + installs google-chrome-stable, then
+ *      writes the resolved path.
+ *   5. Neither chromium nor google-chrome-stable is on PATH → fail. The VNC
+ *      apt step ran before this decision, so chromium absence here means
+ *      `apt-get install chromium` did not land its binary — a contract
+ *      breach the installer must surface loudly.
+ */
+export function decideChromiumAction(input) {
+    const { platform, whichChromium, realpathChromium, whichGoogleChrome, realpathGoogleChrome } = input;
+    if (platform !== "linux") {
+        return {
+            action: "skip-non-linux",
+            resolvedPath: null,
+            reason: `platform=${platform} — chromium-binary.path is linux-only`,
+        };
+    }
+    if (whichGoogleChrome && !isSnapConfinedPath(realpathGoogleChrome)) {
+        return {
+            action: "use",
+            resolvedPath: whichGoogleChrome,
+            reason: `google-chrome-stable already installed (realpath=${realpathGoogleChrome})`,
+        };
+    }
+    if (whichChromium && !isSnapConfinedPath(realpathChromium)) {
+        return {
+            action: "use",
+            resolvedPath: whichChromium,
+            reason: `chromium is non-snap (realpath=${realpathChromium})`,
+        };
+    }
+    if (whichChromium && isSnapConfinedPath(realpathChromium)) {
+        return {
+            action: "install-google-chrome",
+            resolvedPath: null,
+            reason: `chromium is snap-confined (realpath=${realpathChromium}) — installing google-chrome-stable`,
+        };
+    }
+    return {
+        action: "fail",
+        resolvedPath: null,
+        reason: "neither chromium nor google-chrome-stable is on PATH after VNC apt install — contract breach",
+    };
+}

package/dist/specialist-registration.js

@@ -0,0 +1,78 @@
+// Task 165 — bundled-specialist registration.
+//
+// Claude Code resolves `--agent <name>` by reading
+// `$CLAUDE_CONFIG_DIR/agents/<name>.md`. The installer ships every
+// bundled specialist as a file under
+// `<INSTALL_DIR>/platform/templates/specialists/agents/*.md`; this
+// module symlinks each into the per-brand `$CLAUDE_CONFIG_DIR/agents/`
+// so `claude --agent database-operator` resolves on first call.
+//
+// Idempotent. Re-running the installer after a template change
+// refreshes stale symlinks. A regular file at the destination is a
+// collision — never silently overwritten; the operator must remove it
+// explicitly (we throw and the caller decides whether to exit).
+//
+// Lives outside index.ts so unit tests can import the function without
+// triggering index.ts top-level installer code (which fatals on missing
+// brand.json in a test environment).
+import { existsSync, mkdirSync, readdirSync, lstatSync, readlinkSync, symlinkSync, unlinkSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+export class SpecialistSymlinkCollision extends Error {
+    linkPath;
+    constructor(linkPath) {
+        super(`${linkPath} collision (regular file) — remove and re-run`);
+        this.linkPath = linkPath;
+        this.name = "SpecialistSymlinkCollision";
+    }
+}
+export function registerSpecialistAgentsAt(templatesDir, agentsDir, log = () => { }) {
+    if (!existsSync(templatesDir)) {
+        log(`  [specialist-registration] SKIPPED reason=templates-dir-missing path=${templatesDir}`);
+        return { registered: [], skipped: 'no-templates-dir' };
+    }
+    mkdirSync(agentsDir, { recursive: true });
+    const entries = readdirSync(templatesDir).filter((n) => n.endsWith(".md"));
+    if (entries.length === 0) {
+        log(`  [specialist-registration] SKIPPED reason=no-bundled-specialists path=${templatesDir}`);
+        return { registered: [], skipped: 'no-bundled-specialists' };
+    }
+    const registered = [];
+    for (const file of entries.sort()) {
+        const targetAbs = join(templatesDir, file);
+        const linkPath = join(agentsDir, file);
+        const name = file.replace(/\.md$/, "");
+        replaceSpecialistSymlink(linkPath, targetAbs);
+        registered.push(name);
+        log(`  [specialist-registration] installer-specialist-registered name=${name} link=${targetAbs}`);
+    }
+    return { registered, skipped: null };
+}
+export function replaceSpecialistSymlink(linkPath, targetAbs) {
+    let lstat = null;
+    try {
+        lstat = lstatSync(linkPath);
+    }
+    catch (err) {
+        const code = err.code;
+        if (code !== "ENOENT")
+            throw err;
+    }
+    if (lstat === null) {
+        symlinkSync(targetAbs, linkPath);
+        return;
+    }
+    if (!lstat.isSymbolicLink()) {
+        throw new SpecialistSymlinkCollision(linkPath);
+    }
+    let resolvedTarget;
+    try {
+        resolvedTarget = resolve(dirname(linkPath), readlinkSync(linkPath));
+    }
+    catch {
+        resolvedTarget = "<unreadable>";
+    }
+    if (resolvedTarget === targetAbs)
+        return;
+    unlinkSync(linkPath);
+    symlinkSync(targetAbs, linkPath);
+}

package/dist/tier-flag.js

@@ -0,0 +1,85 @@
+// Pure validation + path helpers for the founder-side tier-set installer flags
+// (Task 240). Two flags wired into the installer at src/index.ts:
+//   --tier <solo|family|pro>      personal-mode (brand.commercialMode === false)
+//   --entitlement-base64 <b64>    commercial-mode (brand.commercialMode === true)
+//
+// Both helpers throw on invalid input; the caller exits non-zero and surfaces the
+// thrown message. No filesystem or console side effects — index.ts owns those.
+import { resolve } from "node:path";
+const VALID_TIERS = new Set(["solo", "family", "pro"]);
+export function isValidTier(value) {
+    return VALID_TIERS.has(value);
+}
+/**
+ * Validate the `--tier <enum>` argv value and the brand mode.
+ *
+ * Throws when:
+ *   - raw is missing / starts with `--` (no value supplied after the flag)
+ *   - raw is not in {solo, family, pro}
+ *   - brand is commercial-mode (operator must use --entitlement-base64 instead)
+ */
+export function validateTierFlag(raw, commercialMode) {
+    if (commercialMode) {
+        throw new Error("--tier is for personal mode. Commercial mode — use --entitlement-base64 to deliver a signed payload.");
+    }
+    if (!raw || raw.startsWith("--")) {
+        throw new Error("--tier requires a value (one of: solo, family, pro).");
+    }
+    if (!isValidTier(raw)) {
+        throw new Error(`--tier value must be one of: solo, family, pro (got: ${raw}).`);
+    }
+    return raw;
+}
+/**
+ * Validate the `--entitlement-base64 <b64>` argv value and the brand mode.
+ *
+ * Round-trips through Buffer to detect malformed base64 — Buffer.from is loose
+ * (silently drops invalid chars), so an explicit re-encode comparison is the
+ * cheapest way to confirm the input is real base64. Whitespace (newlines from
+ * SSH transit, stray \r) is stripped first.
+ *
+ * Throws when:
+ *   - brand is personal-mode (operator must use --tier instead)
+ *   - raw is missing / starts with `--`
+ *   - stripped base64 fails the round-trip check (malformed chars)
+ *   - decoded bytes are empty
+ *
+ * Returns the decoded Buffer; caller writes it to entitlement.json verbatim.
+ * No JSON parse, no signature validation — that's the verifier's job at session
+ * start. The installer is a dumb delivery channel.
+ */
+export function validateEntitlementBase64(raw, commercialMode) {
+    if (!commercialMode) {
+        throw new Error("--entitlement-base64 is for commercial mode. Personal mode — use --tier <enum> to set tier directly.");
+    }
+    if (!raw || raw.startsWith("--")) {
+        throw new Error("--entitlement-base64 requires a base64-encoded value.");
+    }
+    const stripped = raw.replace(/\s/g, "");
+    if (stripped.length === 0) {
+        throw new Error("--entitlement-base64 value is empty after whitespace stripping.");
+    }
+    const decoded = Buffer.from(stripped, "base64");
+    if (decoded.toString("base64") !== stripped) {
+        throw new Error("--entitlement-base64 value is not valid base64.");
+    }
+    if (decoded.length === 0) {
+        throw new Error("--entitlement-base64 decoded to zero bytes.");
+    }
+    return decoded;
+}
+/**
+ * Build the absolute path where the installer writes entitlement.json. Matches
+ * the verifier's `resolve(brand.configDir, "entitlement.json")` (entitlement
+ * lib src/index.ts:140) so writer + reader agree on a single location.
+ */
+export function entitlementPath(homeDir, configDir) {
+    return resolve(homeDir, configDir, "entitlement.json");
+}
+/**
+ * Stamp the validated tier onto an account.json config object. Pure merge;
+ * preserves every other key (enabledPlugins, outputStyle, thinkingView, etc.).
+ */
+export function applyTierToAccountConfig(config, tier) {
+    return { ...config, tier };
+}