axonrouter 2.0.1 → 2.0.3

package/scripts/service.js

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 
-import { execSync } from "node:child_process";
+import { execSync, spawnSync } from "node:child_process";
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 
 const SERVICE_NAME = "axonrouter";
@@ -28,6 +29,27 @@ export function requireRoot() {
   }
 }
 
+/**
+ * Run a command with sudo if not already root.
+ * Prompts for password interactively when needed.
+ */
+export function runWithSudo(command, options = {}) {
+  if (isRoot()) {
+    return execSync(command, { stdio: "inherit", ...options });
+  }
+  return execSync(`sudo ${command}`, { stdio: "inherit", ...options });
+}
+
+/**
+ * Run a command with sudo silently (capture output instead of inheriting stdio).
+ */
+export function runWithSudoSilent(command, options = {}) {
+  if (isRoot()) {
+    return execSync(command, { stdio: "pipe", ...options });
+  }
+  return execSync(`sudo ${command}`, { stdio: "pipe", ...options });
+}
+
 /**
  * Detect the init system available on this machine.
  * Returns "systemd" if systemctl exists, otherwise "initd".
@@ -53,10 +75,121 @@ export function getExecPath() {
   }
 }
 
+/**
+ * Get the full node binary path for use in service files.
+ * systemd does not use the shell to resolve shebangs via env/nvm,
+ * so we need the absolute path to node.
+ */
+export function getNodePath() {
+  return process.execPath;
+}
+
+/**
+ * Resolve the home directory for a given user.
+ * When SUDO_USER is set, tries /etc/passwd lookup, then falls back to /home/<user>.
+ * For root, returns /root. Otherwise falls back to os.homedir().
+ */
+export function getInstallingUserHome(user) {
+  if (user === "root") {
+    return "/root";
+  }
+
+  // Try to read from /etc/passwd
+  try {
+    const passwd = fs.readFileSync("/etc/passwd", "utf-8");
+    const lines = passwd.split("\n");
+    for (const line of lines) {
+      const fields = line.split(":");
+      if (fields[0] === user && fields[5]) {
+        return fields[5];
+      }
+    }
+  } catch {
+    // /etc/passwd not readable, fall through
+  }
+
+  // Fall back to /home/<user> if SUDO_USER is set
+  if (process.env.SUDO_USER) {
+    return `/home/${user}`;
+  }
+
+  return os.homedir();
+}
+
+/**
+ * Detect the real (non-root) user who invoked the install command.
+ * When run via sudo, reads SUDO_USER and SUDO_GID for the original user.
+ * Otherwise uses os.userInfo() for the current user.
+ * Returns { user, group, home }.
+ */
+export function getInstallingUser() {
+  const sudoUser = process.env.SUDO_USER;
+
+  if (sudoUser) {
+    let group = process.env.SUDO_GID || String(os.userInfo().gid);
+    // Try to resolve group name from GID via /etc/group
+    try {
+      const groupFile = fs.readFileSync("/etc/group", "utf-8");
+      const lines = groupFile.split("\n");
+      for (const line of lines) {
+        const fields = line.split(":");
+        if (fields[2] === group) {
+          group = fields[0];
+          break;
+        }
+      }
+    } catch {
+      // If we can't resolve the group name, use the username as group
+      group = sudoUser;
+    }
+
+    // If group is still numeric (GID didn't resolve), fall back to username
+    if (/^\d+$/.test(group)) {
+      group = sudoUser;
+    }
+
+    const home = getInstallingUserHome(sudoUser);
+    return { user: sudoUser, group, home };
+  }
+
+  const info = os.userInfo();
+  const user = info.username;
+  let group = String(info.gid);
+
+  // Try to resolve group name from GID via /etc/group
+  try {
+    const groupFile = fs.readFileSync("/etc/group", "utf-8");
+    const lines = groupFile.split("\n");
+    for (const line of lines) {
+      const fields = line.split(":");
+      if (fields[2] === group) {
+        group = fields[0];
+        break;
+      }
+    }
+  } catch {
+    // Fall back to username as group
+    group = user;
+  }
+
+  // If group is still numeric (GID didn't resolve), fall back to username
+  if (/^\d+$/.test(group)) {
+    group = user;
+  }
+
+  const home = getInstallingUserHome(user);
+  return { user, group, home };
+}
+
 /**
  * Generate systemd unit file content.
+ * Uses absolute node path + script path to avoid shebang/PATH issues under systemd.
+ * Accepts an optional userInfo parameter to avoid repeated getInstallingUser() calls.
  */
-export function generateSystemdUnit(execPath) {
+export function generateSystemdUnit(execPath, userInfo) {
+  const nodePath = getNodePath();
+  const { user, group, home } = userInfo || getInstallingUser();
+  const workingDirectory = path.resolve(path.dirname(execPath), "..");
   return `[Unit]
 Description=AxonRouter AI Router
 After=network.target
@@ -65,11 +198,15 @@ StartLimitBurst=5
 
 [Service]
 Type=simple
-ExecStart=${execPath}
+User=${user}
+Group=${group}
+WorkingDirectory=${workingDirectory}
+ExecStart=${nodePath} ${execPath}
 Restart=always
 RestartSec=5
 Environment=NODE_ENV=production
 Environment=PORT=${DEFAULT_PORT}
+Environment=HOME=${home}
 # Graceful shutdown timeout
 TimeoutStopSec=30
 # Kill remaining child processes (cloudflared, tailscaled) on stop
@@ -82,8 +219,12 @@ WantedBy=multi-user.target
 
 /**
  * Generate init.d script content (LSB format).
+ * Uses absolute node path to avoid PATH issues in init environment.
+ * Accepts an optional userInfo parameter to avoid repeated getInstallingUser() calls.
  */
-export function generateInitdScript(execPath) {
+export function generateInitdScript(execPath, userInfo) {
+  const nodePath = getNodePath();
+  const { user, group, home } = userInfo || getInstallingUser();
   return `#!/bin/sh
 ### BEGIN INIT INFO
 # Provides:          ${SERVICE_NAME}
@@ -95,25 +236,29 @@ export function generateInitdScript(execPath) {
 # Description:       AxonRouter AI Router service
 ### END INIT INFO
 
+NODE="${nodePath}"
 DAEMON="${execPath}"
 PIDFILE="${PID_FILE}"
 NAME="${SERVICE_NAME}"
 LOG_FILE="/var/log/${SERVICE_NAME}.log"
+USER="${user}"
+GROUP="${group}"
 export NODE_ENV=production
 export PORT=${DEFAULT_PORT}
+export HOME=${home}
 
 start() {
   if [ -f "$PIDFILE" ] && kill -0 "$(cat "$PIDFILE")" 2>/dev/null; then
     echo "$NAME is already running."
     return 1
   fi
-  echo "Starting $NAME..."
+  echo "Starting $NAME as user $USER..."
   # Start with auto-respawn: restart up to 10 times with 5s delay if process exits
   (
     RESTART_COUNT=0
     MAX_RESTARTS=10
     while [ $RESTART_COUNT -lt $MAX_RESTARTS ]; do
-      "$DAEMON" >> "$LOG_FILE" 2>&1
+      su - "$USER" -c "HOME='${home}' NODE_ENV=production PORT=${DEFAULT_PORT} '${nodePath}' '${execPath}'" >> "$LOG_FILE" 2>&1
       EXIT_CODE=$?
       if [ $EXIT_CODE -eq 0 ]; then
         break
@@ -174,40 +319,57 @@ exit 0
  * Writes the service file, enables, and starts the service.
  */
 export function installService() {
-  requireRoot();
-
   const initSystem = detectInitSystem();
   const execPath = getExecPath();
+  const { user, group } = getInstallingUser();
 
   console.log(`[AxonRouter] Detected init system: ${initSystem}`);
   console.log(`[AxonRouter] Executable path: ${execPath}`);
+  console.log(`[AxonRouter] Service will run as user: ${user} (group: ${group})`);
+
+  const userInfo = { user, group, home: getInstallingUserHome(user) };
 
   if (initSystem === "systemd") {
-    const unitContent = generateSystemdUnit(execPath);
-    fs.writeFileSync(SYSTEMD_UNIT_PATH, unitContent, { mode: 0o644 });
+    const unitContent = generateSystemdUnit(execPath, userInfo);
+    // Write unit file via sudo tee (since we may not be root)
+    const child = spawnSync("sudo", ["tee", SYSTEMD_UNIT_PATH], {
+      input: unitContent,
+      stdio: ["pipe", "pipe", "inherit"],
+    });
+    if (child.status !== 0) {
+      console.error("[AxonRouter] Failed to write service file. Sudo access required.");
+      process.exit(1);
+    }
     console.log(`[AxonRouter] Service file written to ${SYSTEMD_UNIT_PATH}`);
 
-    execSync("systemctl daemon-reload", { stdio: "inherit" });
-    execSync(`systemctl enable ${SERVICE_NAME}`, { stdio: "inherit" });
-    execSync(`systemctl start ${SERVICE_NAME}`, { stdio: "inherit" });
+    runWithSudo("systemctl daemon-reload");
+    runWithSudo(`systemctl enable ${SERVICE_NAME}`);
+    runWithSudo(`systemctl start ${SERVICE_NAME}`);
     console.log(`[AxonRouter] Service installed, enabled, and started.`);
   } else {
-    const scriptContent = generateInitdScript(execPath);
-    fs.writeFileSync(INITD_SCRIPT_PATH, scriptContent, { mode: 0o755 });
+    const scriptContent = generateInitdScript(execPath, userInfo);
+    const child = spawnSync("sudo", ["tee", INITD_SCRIPT_PATH], {
+      input: scriptContent,
+      stdio: ["pipe", "pipe", "inherit"],
+    });
+    if (child.status !== 0) {
+      console.error("[AxonRouter] Failed to write init script. Sudo access required.");
+      process.exit(1);
+    }
+    runWithSudo(`chmod 755 ${INITD_SCRIPT_PATH}`);
     console.log(`[AxonRouter] Init script written to ${INITD_SCRIPT_PATH}`);
 
     try {
-      execSync(`update-rc.d ${SERVICE_NAME} defaults`, { stdio: "inherit" });
+      runWithSudo(`update-rc.d ${SERVICE_NAME} defaults`);
     } catch {
-      // Some systems use chkconfig instead
       try {
-        execSync(`chkconfig --add ${SERVICE_NAME}`, { stdio: "inherit" });
+        runWithSudo(`chkconfig --add ${SERVICE_NAME}`);
       } catch {
-        console.warn("[AxonRouter] Warning: Could not enable service at boot. Please enable it manually.");
+        console.warn("[AxonRouter] Warning: Could not enable service at boot.");
       }
     }
 
-    execSync(`${INITD_SCRIPT_PATH} start`, { stdio: "inherit" });
+    runWithSudo(`${INITD_SCRIPT_PATH} start`);
     console.log(`[AxonRouter] Service installed, enabled, and started.`);
   }
 }
@@ -216,50 +378,54 @@ export function installService() {
  * Uninstall the service (stop, disable, remove).
  */
 export function uninstallService() {
-  requireRoot();
-
   const initSystem = detectInitSystem();
 
   console.log(`[AxonRouter] Detected init system: ${initSystem}`);
 
   if (initSystem === "systemd") {
     try {
-      execSync(`systemctl stop ${SERVICE_NAME}`, { stdio: "inherit" });
+      runWithSudo(`systemctl stop ${SERVICE_NAME}`);
     } catch {
       // Service might not be running
     }
     try {
-      execSync(`systemctl disable ${SERVICE_NAME}`, { stdio: "inherit" });
+      runWithSudo(`systemctl disable ${SERVICE_NAME}`);
     } catch {
       // Service might not be enabled
     }
-    if (fs.existsSync(SYSTEMD_UNIT_PATH)) {
-      fs.unlinkSync(SYSTEMD_UNIT_PATH);
+    try {
+      runWithSudo(`rm -f ${SYSTEMD_UNIT_PATH}`);
       console.log(`[AxonRouter] Removed ${SYSTEMD_UNIT_PATH}`);
+    } catch {
+      // File might not exist
     }
-    execSync("systemctl daemon-reload", { stdio: "inherit" });
+    runWithSudo("systemctl daemon-reload");
     console.log(`[AxonRouter] Service uninstalled.`);
   } else {
     try {
-      execSync(`${INITD_SCRIPT_PATH} stop`, { stdio: "inherit" });
+      runWithSudo(`${INITD_SCRIPT_PATH} stop`);
     } catch {
       // Service might not be running
     }
     try {
-      execSync(`update-rc.d -f ${SERVICE_NAME} remove`, { stdio: "inherit" });
+      runWithSudo(`update-rc.d -f ${SERVICE_NAME} remove`);
     } catch {
       try {
-        execSync(`chkconfig --del ${SERVICE_NAME}`, { stdio: "inherit" });
+        runWithSudo(`chkconfig --del ${SERVICE_NAME}`);
       } catch {
         // Ignore
       }
     }
-    if (fs.existsSync(INITD_SCRIPT_PATH)) {
-      fs.unlinkSync(INITD_SCRIPT_PATH);
+    try {
+      runWithSudo(`rm -f ${INITD_SCRIPT_PATH}`);
       console.log(`[AxonRouter] Removed ${INITD_SCRIPT_PATH}`);
+    } catch {
+      // File might not exist
     }
-    if (fs.existsSync(PID_FILE)) {
-      fs.unlinkSync(PID_FILE);
+    try {
+      runWithSudo(`rm -f ${PID_FILE}`);
+    } catch {
+      // Ignore
     }
     console.log(`[AxonRouter] Service uninstalled.`);
   }
@@ -310,14 +476,12 @@ export function checkService() {
  * Start the service.
  */
 export function startService() {
-  requireRoot();
-
   const initSystem = detectInitSystem();
 
   if (initSystem === "systemd") {
-    execSync(`systemctl start ${SERVICE_NAME}`, { stdio: "inherit" });
+    runWithSudo(`systemctl start ${SERVICE_NAME}`);
   } else {
-    execSync(`${INITD_SCRIPT_PATH} start`, { stdio: "inherit" });
+    runWithSudo(`${INITD_SCRIPT_PATH} start`);
   }
 
   console.log(`[AxonRouter] Service started.`);
@@ -327,14 +491,12 @@ export function startService() {
  * Stop the service.
  */
 export function stopService() {
-  requireRoot();
-
   const initSystem = detectInitSystem();
 
   if (initSystem === "systemd") {
-    execSync(`systemctl stop ${SERVICE_NAME}`, { stdio: "inherit" });
+    runWithSudo(`systemctl stop ${SERVICE_NAME}`);
   } else {
-    execSync(`${INITD_SCRIPT_PATH} stop`, { stdio: "inherit" });
+    runWithSudo(`${INITD_SCRIPT_PATH} stop`);
   }
 
   console.log(`[AxonRouter] Service stopped.`);
@@ -344,19 +506,61 @@ export function stopService() {
  * Restart the service.
  */
 export function restartService() {
-  requireRoot();
-
   const initSystem = detectInitSystem();
 
   if (initSystem === "systemd") {
-    execSync(`systemctl restart ${SERVICE_NAME}`, { stdio: "inherit" });
+    runWithSudo(`systemctl restart ${SERVICE_NAME}`);
   } else {
-    execSync(`${INITD_SCRIPT_PATH} restart`, { stdio: "inherit" });
+    runWithSudo(`${INITD_SCRIPT_PATH} restart`);
   }
 
   console.log(`[AxonRouter] Service restarted.`);
 }
 
+/**
+ * Show help message with available commands.
+ */
+export function showHelp() {
+  let version = "unknown";
+  try {
+    const pkgUrl = new URL("../package.json", import.meta.url);
+    version = JSON.parse(fs.readFileSync(pkgUrl, "utf8")).version;
+  } catch {}
+
+  console.log(`
+\x1b[1mAxonRouter v${version} - AI Router\x1b[0m
+
+\x1b[33mUsage:\x1b[0m
+  axonrouter <command> [options]
+
+\x1b[33mService Commands:\x1b[0m
+  install-service    Install and start AxonRouter as a system service
+  uninstall-service  Stop and remove the system service
+  check-service      Check current service status
+  start              Start the service
+  stop               Stop the service
+  restart            Restart the service
+
+\x1b[33mOther Commands:\x1b[0m
+  mcp                Start MCP stdio server
+  help, --help       Show this help message
+
+\x1b[33mOptions:\x1b[0m
+  --port <port>      Set the listening port (default: 12711)
+  --hostname <host>  Set the hostname to bind to
+
+\x1b[33mExamples:\x1b[0m
+  axonrouter                     Start in foreground
+  axonrouter install-service     Install as system service (prompts for sudo)
+  axonrouter check-service       Check if service is running
+  axonrouter --port 3000         Start on custom port
+
+\x1b[33mNotes:\x1b[0m
+  Service commands will prompt for sudo password if not running as root.
+  The service auto-restarts on crash (systemd: always, init.d: up to 10 times).
+`);
+}
+
 /**
  * Map of command names to handler functions.
  */
@@ -367,6 +571,8 @@ export const SERVICE_COMMANDS = {
   "start": startService,
   "stop": stopService,
   "restart": restartService,
+  "help": showHelp,
+  "--help": showHelp,
 };
 
 /**

package/scripts/start.js

@@ -10,6 +10,7 @@ import { createRequire } from "node:module";
 
 const require = createRequire(import.meta.url);
 const { defaultPort: DEFAULT_AXONROUTER_PORT } = require("../src/shared/constants/runtimeDefaults.json");
+const { version: APP_VERSION } = require("../package.json");
 
 const SERVICE_COMMAND_NAMES = new Set([
   "install-service",
@@ -18,6 +19,7 @@ const SERVICE_COMMAND_NAMES = new Set([
   "start",
   "stop",
   "restart",
+  "help",
 ]);
 
 export function parseArgs(args) {
@@ -94,7 +96,7 @@ function getBaseUrl(port) {
 
 function printStartupSummary({ port, hasStandaloneServer, standaloneServerPath }) {
   const baseUrl = getBaseUrl(port);
-  console.log(`[Start] AxonRouter starting on port ${port}`);
+  console.log(`[Start] AxonRouter v${APP_VERSION} starting on port ${port}`);
   console.log(`[Start] Dashboard: ${baseUrl}/dashboard`);
   console.log(`[Start] API: ${baseUrl}/v1`);
   console.log(
@@ -156,6 +158,18 @@ export async function main() {
     return;
   }
 
+  // Check for unrecognized commands
+  if (args.forwardArgs.length > 0 && args.forwardArgs[0] !== "mcp") {
+    const unknownCmd = args.forwardArgs[0];
+    if (!unknownCmd.startsWith("-") && isNaN(Number(unknownCmd))) {
+      console.error(`\x1b[31m[AxonRouter] Unknown command: ${unknownCmd}\x1b[0m`);
+      console.error("");
+      const { showHelp } = await import("./service.js");
+      showHelp();
+      exit(1);
+    }
+  }
+
   const standaloneServerPath = resolveStandaloneServerPath(projectRoot);
   const requestedPort = args.port || process.env.PORT || DEFAULT_AXONROUTER_PORT;
   const port = normalizePort(requestedPort);
@@ -434,6 +448,15 @@ export function syncStandaloneAssets(projectRoot, standaloneServerPath) {
   const standalonePublicDir = path.join(standaloneRoot, "public");
   const standaloneMitmDir = path.join(standaloneRoot, "src", "mitm");
 
+  // Skip sync if we don't have write permission to the standalone directory
+  // (e.g. global npm install owned by root, running as non-root user)
+  try {
+    fs.accessSync(standaloneRoot, fs.constants.W_OK);
+  } catch {
+    // No write access - assets are already in place from npm publish/install
+    return;
+  }
+
   if (fs.existsSync(sourceStaticDir)) {
     fs.mkdirSync(path.dirname(standaloneStaticDir), { recursive: true });
     fs.rmSync(standaloneStaticDir, { recursive: true, force: true });