@tasksai/install 0.1.15 → 0.1.17

package/README.md

@@ -31,9 +31,28 @@ The installer:
 - prints customer-facing recovery instructions when an AI assistant is blocked
   from writing local config files
 - supports Claude Desktop, Cursor, Windsurf, and Codex
-- runs a local health check
+- runs local runtime, API, and authenticated license health checks
+- reports only a content-free `doctor_passed` activation event after core checks
+  succeed; activation-reporting outages do not fail an otherwise healthy doctor
 - exposes a local save-document tool for finished skill outputs
 
+For known production products, wrapper and remote runtime files are accepted
+only from the registered production source. RealtorTasksAI, FarmerTasksAI,
+LawTasksAI, and TeacherTasksAI are pinned to the `main` branch and product path
+in `TasksAI-Official/tasksai-mcp-wrappers`. Local paths, alternate branches,
+unregistered products, and other repositories are rejected by default.
+
+Developers who intentionally need one of those sources must opt in explicitly:
+
+```bash
+tasksai-install realtor \
+  --source /absolute/path/to/local/realtor-wrapper \
+  --allow-untrusted-development-source
+```
+
+The override is development-only and emits a visible warning. It must not be
+used for customer installs.
+
 TasksAI servers handle authentication, credits, catalog/search metadata, and
 licensed skill delivery. TasksAI does not process user task content.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tasksai/install",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "Shared TasksAI MCP installer CLI",
   "type": "module",
   "bin": {
@@ -33,6 +33,6 @@
   },
   "scripts": {
     "check": "node --check src/index.js",
-    "test": "python3 -m unittest discover -s tests"
+    "test": "node --test tests/*.test.mjs && python3 -m unittest discover -s tests"
   }
 }

package/runtime/server.py

@@ -89,6 +89,27 @@ LICENSE_KEY = os.getenv("TASKSAI_LICENSE_KEY", os.getenv("LAWTASKSAI_LICENSE_KEY
 PRODUCT_ID  = os.getenv("TASKSAI_PRODUCT_ID", "")  # set by installer; used to resolve correct vertical
 INSTALL_ID  = os.getenv("TASKSAI_INSTALL_ID", "")
 
+_VERTICAL_FALLBACKS = {
+    "farmer": {
+        "product_id": "farmer",
+        "product_name": "FarmerTasksAI",
+        "display_name": "FarmerTasksAI",
+        "tool_prefix": "farmertasksai",
+        "occupation": "farmer",
+        "support_email": "hello@farmertasksai.com",
+        "domain": "farmertasksai.com",
+    },
+    "realtor": {
+        "product_id": "realtor",
+        "product_name": "RealtorTasksAI",
+        "display_name": "RealtorTasksAI",
+        "tool_prefix": "realtortasksai",
+        "occupation": "real estate professional",
+        "support_email": "hello@realtortasksai.com",
+        "domain": "realtortasksai.com",
+    },
+}
+
 if not LICENSE_KEY:
     print("ERROR: License key is required. Set TASKSAI_LICENSE_KEY in your .env file.", file=sys.stderr, flush=True)
     print("Find your key in your purchase confirmation email.", file=sys.stderr, flush=True)
@@ -521,23 +542,28 @@ async def report_activation_event(event_name, *, skill_id=None, file_format=None
 
 
 async def load_vertical():
-    """Fetch vertical metadata from /v1/me on startup. Falls back to farmer."""
+    """Fetch vertical metadata from /v1/me without crossing product boundaries."""
     global _vertical
     try:
         path = f"/v1/me?product_id={PRODUCT_ID}" if PRODUCT_ID else "/v1/me"
         _vertical = await api_get(path)
     except Exception:
-        # Fallback: derive from license key prefix client-side
-        prefix = LICENSE_KEY.split("_")[0] + "_" if "_" in LICENSE_KEY else "ft_"
-        _vertical = {
-            "product_id":   "farmer",
-            "product_name": "FarmerTasksAI",
-            "display_name": "FarmerTasksAI",
-            "tool_prefix":  "farmertasksai",
-            "occupation":   "farmer",
-            "support_email":"support@farmertasksai.com",
-            "domain":       "farmertasksai.com",
-        }
+        product_id = PRODUCT_ID.strip().lower() or "tasksai"
+        known = _VERTICAL_FALLBACKS.get(product_id)
+        if known:
+            _vertical = dict(known)
+        else:
+            safe_id = re.sub(r"[^a-z0-9]+", "", product_id) or "tasksai"
+            display_name = f"{safe_id.title()}TasksAI"
+            _vertical = {
+                "product_id": product_id,
+                "product_name": display_name,
+                "display_name": display_name,
+                "tool_prefix": f"{safe_id}tasksai",
+                "occupation": "professional",
+                "support_email": "hello@tasksai.com",
+                "domain": "tasksai.com",
+            }
     return _vertical
 
 

package/src/index.js

@@ -2,6 +2,7 @@
 
 import fs from "node:fs";
 import fsp from "node:fs/promises";
+import { randomUUID } from "node:crypto";
 import https from "node:https";
 import os from "node:os";
 import path from "node:path";
@@ -10,9 +11,23 @@ import { spawnSync } from "node:child_process";
 import { stdin as input, stdout as output } from "node:process";
 import { fileURLToPath } from "node:url";
 
-const INSTALLER_VERSION = "0.1.15";
 const INSTALLER_DIR = path.dirname(fileURLToPath(import.meta.url));
+const INSTALLER_PACKAGE = JSON.parse(fs.readFileSync(path.resolve(INSTALLER_DIR, "..", "package.json"), "utf8"));
+const INSTALLER_VERSION = INSTALLER_PACKAGE.version;
 const BUNDLED_RUNTIME_DIR = path.resolve(INSTALLER_DIR, "..", "runtime");
+const OFFICIAL_WRAPPER_REPO = "https://github.com/TasksAI-Official/tasksai-mcp-wrappers";
+const TRUSTED_PRODUCTION_SOURCES = new Map([
+  ["lawtasksai", { repo: OFFICIAL_WRAPPER_REPO, ref: "main", path: "verticals/lawtasksai" }],
+  ["farmer", { repo: OFFICIAL_WRAPPER_REPO, ref: "main", path: "verticals/farmer" }],
+  ["realtor", { repo: OFFICIAL_WRAPPER_REPO, ref: "main", path: "verticals/realtor" }],
+  ["teacher", { repo: OFFICIAL_WRAPPER_REPO, ref: "main", path: "verticals/teacher" }],
+  ["priorauthai", {
+    repo: "https://github.com/laudoluxDev/priorauthai-mcp",
+    ref: "main",
+    path: "",
+    legacyManifestPathOptional: true
+  }]
+]);
 const DEFAULT_SOURCES = {
   lawtasksai: "https://github.com/TasksAI-Official/tasksai-mcp-wrappers/tree/main/verticals/lawtasksai",
   farmer: "https://github.com/TasksAI-Official/tasksai-mcp-wrappers/tree/main/verticals/farmer",
@@ -64,10 +79,12 @@ const CLIENTS = {
   }
 };
 
-main().catch((error) => {
-  console.error(formatError(error));
-  process.exit(1);
-});
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  main().catch((error) => {
+    console.error(formatError(error));
+    process.exit(1);
+  });
+}
 
 async function main() {
   const options = parseArgs(process.argv.slice(2));
@@ -106,7 +123,8 @@ function parseArgs(argv) {
     installDir: process.env.TASKSAI_INSTALL_DIR || null,
     noBrowser: false,
     yes: false,
-    skipPythonDeps: false
+    skipPythonDeps: false,
+    allowUntrustedDevelopmentSource: false
   };
 
   const positionals = [];
@@ -120,6 +138,7 @@ function parseArgs(argv) {
     else if (arg === "--no-browser") options.noBrowser = true;
     else if (arg === "--yes" || arg === "-y") options.yes = true;
     else if (arg === "--skip-python-deps") options.skipPythonDeps = true;
+    else if (arg === "--allow-untrusted-development-source") options.allowUntrustedDevelopmentSource = true;
     else if (arg === "--help" || arg === "-h") {
       printUsage();
       process.exit(0);
@@ -161,6 +180,10 @@ Examples:
 
 Environment:
   TASKSAI_INSTALL_DIR may be used instead of --install-dir.
+
+Development only:
+  --allow-untrusted-development-source permits a local, non-main, or non-official
+  source for a known production product. Never use it for a customer install.
 `);
 }
 
@@ -169,6 +192,9 @@ async function install(options, { updateOnly = false } = {}) {
   const manifest = await loadJson(source, "agent-install.json");
   const vertical = await loadJson(source, "vertical.json");
   verifySource({ options, source, manifest, vertical });
+  if (options.allowUntrustedDevelopmentSource) {
+    console.warn("WARNING: untrusted development source override enabled; this install is not production-trusted.");
+  }
 
   const installDir = getInstallDir(options.productId, options);
   const runtimeDir = path.join(installDir, "runtime");
@@ -190,6 +216,11 @@ async function install(options, { updateOnly = false } = {}) {
   await downloadRuntime(source, runtimeDir, manifest);
 
   const licenseKey = await resolveLicenseKey(options, vertical, installDir);
+  const existingEnvPath = path.join(installDir, ".env");
+  const existingEnv = fs.existsSync(existingEnvPath)
+    ? parseEnv(await fsp.readFile(existingEnvPath, "utf8"))
+    : {};
+  const installId = firstValue(existingEnv.TASKSAI_INSTALL_ID, process.env.TASKSAI_INSTALL_ID) || randomUUID();
 
   if (!options.skipPythonDeps) {
     installPythonDeps(runtimeDir, vendorDir);
@@ -200,7 +231,8 @@ async function install(options, { updateOnly = false } = {}) {
     LAWTASKSAI_LICENSE_KEY: licenseKey,
     TASKSAI_PRODUCT_ID: vertical.product_id,
     TASKSAI_API_BASE: vertical.api_base_url,
-    LAWTASKSAI_API_BASE: vertical.api_base_url
+    LAWTASKSAI_API_BASE: vertical.api_base_url,
+    TASKSAI_INSTALL_ID: installId
   };
   await writeEnvFile(path.join(installDir, ".env"), envEntries);
   await writeEnvFile(path.join(runtimeDir, ".env"), envEntries);
@@ -224,18 +256,27 @@ async function install(options, { updateOnly = false } = {}) {
   console.log(`After restart, ask: "${vertical.first_prompt}"`);
 }
 
-async function doctor(options, { quietSuccess = false } = {}) {
+async function doctor(options, {
+  quietSuccess = false,
+  clientsOverride = null,
+  requestJsonImpl = requestJson,
+  runtimeHealthImpl = verifyRuntimeHealth
+} = {}) {
   const installDir = getInstallDir(options.productId, options);
   const verticalPath = path.join(installDir, "vertical.json");
   const envPath = path.join(installDir, ".env");
   const serverPath = path.join(installDir, "runtime", "server.py");
-  const clients = resolveClients(options.client);
+  const requirementsPath = path.join(installDir, "runtime", "requirements.txt");
+  const vendorDir = path.join(installDir, "python");
+  const clients = clientsOverride || resolveClients(options.client);
 
   const problems = [];
   if (!fs.existsSync(verticalPath)) problems.push(`Missing ${verticalPath}`);
   if (!fs.existsSync(envPath)) problems.push(`Missing ${envPath}`);
   if (!fs.existsSync(serverPath)) problems.push(`Missing ${serverPath}`);
+  if (!fs.existsSync(requirementsPath)) problems.push(`Missing ${requirementsPath}`);
   const vertical = fs.existsSync(verticalPath) ? await readJson(verticalPath) : { product_id: options.productId };
+  const env = fs.existsSync(envPath) ? parseEnv(await fsp.readFile(envPath, "utf8")) : {};
 
   for (const client of clients) {
     const configPath = client.configPath();
@@ -249,15 +290,98 @@ async function doctor(options, { quietSuccess = false } = {}) {
     }
   }
 
+  if (fs.existsSync(serverPath) && fs.existsSync(requirementsPath)) {
+    try {
+      await runtimeHealthImpl({ serverPath, vendorDir });
+    } catch (error) {
+      problems.push(`Runtime health check failed (${healthErrorSummary(error)})`);
+    }
+  }
+
+  const productId = String(vertical.product_id || options.productId || "").trim().toLowerCase();
+  if (productId !== String(options.productId || "").trim().toLowerCase()) {
+    problems.push(`Installed product ${vertical.product_id} does not match requested product ${options.productId}`);
+  }
+  const configuredProductId = firstValue(process.env.TASKSAI_PRODUCT_ID, env.TASKSAI_PRODUCT_ID);
+  if (configuredProductId && configuredProductId.trim().toLowerCase() !== productId) {
+    problems.push(`Runtime product ${configuredProductId} does not match installed product ${productId}`);
+  }
+
+  const apiBase = firstValue(
+    process.env.TASKSAI_API_BASE,
+    process.env.LAWTASKSAI_API_BASE,
+    env.TASKSAI_API_BASE,
+    env.LAWTASKSAI_API_BASE,
+    vertical.api_base_url
+  )?.replace(/\/$/, "");
+  const licenseKey = firstValue(
+    process.env.TASKSAI_LICENSE_KEY,
+    process.env.LAWTASKSAI_LICENSE_KEY,
+    env.TASKSAI_LICENSE_KEY,
+    env.LAWTASKSAI_LICENSE_KEY
+  );
+  const installId = firstValue(process.env.TASKSAI_INSTALL_ID, env.TASKSAI_INSTALL_ID);
+
+  let apiHealthy = false;
+  if (!apiBase) {
+    problems.push("No TasksAI API base URL is configured");
+  } else {
+    try {
+      const apiHealth = await requestJsonImpl(`${apiBase}/health`, {
+        headers: { "User-Agent": `tasksai-install/${INSTALLER_VERSION}` }
+      });
+      const status = String(apiHealth?.status || "").trim().toLowerCase();
+      if (["error", "failed", "unhealthy"].includes(status)) {
+        problems.push("API health check failed (unhealthy)");
+      } else {
+        apiHealthy = true;
+      }
+    } catch (error) {
+      problems.push(`API health check failed (${healthErrorSummary(error)})`);
+    }
+  }
+
+  if (!licenseKey) {
+    problems.push("No TasksAI license key is configured");
+  } else if (apiBase && apiHealthy) {
+    try {
+      const account = await requestJsonImpl(`${apiBase}/v1/me?product_id=${encodeURIComponent(productId)}`, {
+        headers: authenticatedHeaders({ licenseKey, productId })
+      });
+      const licensedProduct = String(account?.product_id || account?.product?.product_id || "").trim().toLowerCase();
+      if (!licensedProduct) {
+        problems.push("License health response did not identify a product");
+      } else if (licensedProduct !== productId) {
+        problems.push(`License is for ${licensedProduct}, not ${productId}`);
+      }
+    } catch (error) {
+      problems.push(`License health check failed (${healthErrorSummary(error)})`);
+    }
+  }
+
   if (problems.length) {
     throw new Error(`TasksAI doctor found issues:\n- ${problems.join("\n- ")}`);
   }
 
+  const activationReported = await safeReportDoctorPassed({
+    apiBase,
+    licenseKey,
+    productId,
+    installId,
+    client: options.client,
+    requestJsonImpl
+  });
   await safeLogEvent(installDir, "doctor_passed", {
-    productId: options.productId,
-    clients: clients.map((client) => client.id)
+    productId,
+    clients: clients.map((client) => client.id),
+    activationReported
   });
-  if (!quietSuccess) console.log("TasksAI doctor passed.");
+  if (!quietSuccess) {
+    console.log("TasksAI doctor passed.");
+    if (!activationReported) {
+      console.log("Activation reporting is temporarily unavailable; core doctor checks still passed.");
+    }
+  }
 }
 
 async function uninstall(options) {
@@ -729,6 +853,7 @@ function verifySource({ options, source, manifest, vertical }) {
   if (vertical.product_id !== options.productId) {
     throw new Error(`Vertical product_id ${vertical.product_id} does not match requested product ${options.productId}.`);
   }
+  verifyProductionSource({ options, source, manifest });
   if (manifest.official_package !== "@tasksai/install") {
     throw new Error(`Unexpected installer package: ${manifest.official_package}`);
   }
@@ -754,6 +879,46 @@ function verifySource({ options, source, manifest, vertical }) {
   }
 }
 
+function verifyProductionSource({ options, source, manifest }) {
+  if (options.allowUntrustedDevelopmentSource) return;
+  const expected = TRUSTED_PRODUCTION_SOURCES.get(options.productId);
+  if (!expected) {
+    throw new Error(
+      `${options.productId} is not registered as a trusted production source. `
+      + "For deliberate local or untrusted development only, add --allow-untrusted-development-source."
+    );
+  }
+
+  const expectedManifestPath = joinGitPath(expected.path, "agent-install.json");
+  const manifestPathTrusted = expected.legacyManifestPathOptional && !manifest.official_manifest_path
+    ? true
+    : normalizeGitPath(manifest.official_manifest_path) === expectedManifestPath;
+  const trusted = source.kind === "github"
+    && sameRepository(source.repoUrl, expected.repo)
+    && source.ref === expected.ref
+    && normalizeGitPath(source.basePath) === expected.path
+    && sameRepository(manifest.official_github_repo, expected.repo)
+    && manifestPathTrusted;
+
+  if (!trusted) {
+    throw new Error(
+      `${options.productId} production installs must use ${formatTrustedSource(expected)}. `
+      + "For deliberate local or untrusted development only, add --allow-untrusted-development-source."
+    );
+  }
+}
+
+function formatTrustedSource(expected) {
+  return expected.path
+    ? `${expected.repo}/tree/${expected.ref}/${expected.path}`
+    : `${expected.repo} at ref ${expected.ref}`;
+}
+
+function sameRepository(left, right) {
+  return String(left || "").replace(/\.git$/i, "").replace(/\/$/, "").toLowerCase()
+    === String(right || "").replace(/\.git$/i, "").replace(/\/$/, "").toLowerCase();
+}
+
 function getInstaller(manifest) {
   if (manifest.installer?.npm_exec) return manifest.installer.npm_exec;
   if (manifest.installer?.npx) return manifest.installer.npx;
@@ -862,21 +1027,27 @@ function fetchText(url) {
   });
 }
 
-function postJson(url, body) {
-  const payload = JSON.stringify(body || {});
+function requestJson(url, { method = "GET", body, headers = {}, timeoutMs = 7000 } = {}) {
+  const payload = body === undefined ? null : JSON.stringify(body);
   return new Promise((resolve, reject) => {
     const request = https.request(url, {
-      method: "POST",
+      method,
       headers: {
-        "Content-Type": "application/json",
-        "Content-Length": Buffer.byteLength(payload),
-        "User-Agent": `tasksai-install/${INSTALLER_VERSION}`
+        "User-Agent": `tasksai-install/${INSTALLER_VERSION}`,
+        ...(payload === null ? {} : {
+          "Content-Type": "application/json",
+          "Content-Length": Buffer.byteLength(payload)
+        }),
+        ...headers
       }
     }, (response) => {
       let responseBody = "";
       response.setEncoding("utf8");
       response.on("data", (chunk) => {
         responseBody += chunk;
+        if (responseBody.length > 1_000_000) {
+          request.destroy(new Error("TasksAI API response exceeded the safe size limit."));
+        }
       });
       response.on("end", () => {
         let data = {};
@@ -897,12 +1068,120 @@ function postJson(url, body) {
         resolve(data);
       });
     });
+    request.setTimeout(timeoutMs, () => {
+      const error = new Error("TasksAI API request timed out.");
+      error.code = "ETIMEDOUT";
+      request.destroy(error);
+    });
     request.on("error", reject);
-    request.write(payload);
+    if (payload !== null) request.write(payload);
     request.end();
   });
 }
 
+function postJson(url, body) {
+  return requestJson(url, { method: "POST", body });
+}
+
+function authenticatedHeaders({ licenseKey, productId }) {
+  return {
+    Authorization: `Bearer ${licenseKey}`,
+    "Content-Type": "application/json",
+    "X-Product-ID": productId,
+    "X-Client-Type": "tasksai-installer",
+    "X-Client-Version": INSTALLER_VERSION
+  };
+}
+
+async function safeReportDoctorPassed({
+  apiBase,
+  licenseKey,
+  productId,
+  installId,
+  client,
+  requestJsonImpl = requestJson
+}) {
+  if (!apiBase || !licenseKey || !productId) return false;
+  const normalizedClient = String(client || "")
+    .trim()
+    .toLowerCase()
+    .replaceAll("-", "_");
+  const reportableClients = new Set([
+    "claude_desktop", "cursor", "windsurf", "codex", "cline", "openclaw"
+  ]);
+  const payload = {
+    event_name: "doctor_passed",
+    metadata: {
+      source: "installer_doctor",
+      tool_version: INSTALLER_VERSION
+    }
+  };
+  if (reportableClients.has(normalizedClient)) {
+    payload.metadata.client = normalizedClient;
+  }
+  if (installId) payload.install_id = installId;
+
+  try {
+    await requestJsonImpl(`${apiBase}/v1/events/activation`, {
+      method: "POST",
+      body: payload,
+      headers: authenticatedHeaders({ licenseKey, productId })
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function verifyRuntimeHealth({ serverPath, vendorDir }) {
+  const python = findPython();
+  if (!python) throw new Error("Python 3 is unavailable");
+  const pythonPath = [vendorDir, process.env.PYTHONPATH].filter(Boolean).join(path.delimiter);
+  const check = [
+    "import ast, pathlib, sys",
+    "ast.parse(pathlib.Path(sys.argv[1]).read_text(encoding='utf-8'), filename=sys.argv[1])",
+    "import httpx, dotenv, mcp, docx"
+  ].join("; ");
+  const result = spawnSync(python, ["-c", check, serverPath], {
+    encoding: "utf8",
+    timeout: 10000,
+    env: { ...process.env, PYTHONPATH: pythonPath }
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    throw new Error("runtime syntax or Python dependencies are unavailable");
+  }
+}
+
+function parseEnv(text) {
+  const values = {};
+  for (const rawLine of String(text || "").split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) continue;
+    const match = line.match(/^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (!match) continue;
+    let value = match[2].trim();
+    if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+      value = value.slice(1, -1);
+    }
+    values[match[1]] = value;
+  }
+  return values;
+}
+
+function firstValue(...values) {
+  return values.find((value) => typeof value === "string" && value.trim())?.trim() || "";
+}
+
+function healthErrorSummary(error) {
+  if (Number.isInteger(error?.statusCode)) return `HTTP ${error.statusCode}`;
+  if (error?.code === "ETIMEDOUT") return "timeout";
+  if (["ECONNREFUSED", "ENOTFOUND", "EAI_AGAIN", "ECONNRESET"].includes(error?.code)) {
+    return "unreachable";
+  }
+  return "unavailable";
+}
+
 function openExternalUrl(url) {
   const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
   const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
@@ -1034,3 +1313,16 @@ function redact(text) {
     .replace(/Bearer\s+[A-Za-z0-9._-]+/gi, "Bearer [REDACTED]")
     .replace(/gh[opsu]_[A-Za-z0-9_]+/g, "gh_[REDACTED]");
 }
+
+export {
+  INSTALLER_VERSION,
+  authenticatedHeaders,
+  doctor,
+  parseArgs,
+  parseEnv,
+  parseSource,
+  safeReportDoctorPassed,
+  verifyProductionSource,
+  verifyRuntimeHealth,
+  verifySource
+};