axonrouter 2.0.2 → 2.0.3

package/scripts/service.js

@@ -2,6 +2,7 @@
 
 import { execSync, spawnSync } from "node:child_process";
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 
 const SERVICE_NAME = "axonrouter";
@@ -83,12 +84,112 @@ export function getNodePath() {
   return process.execPath;
 }
 
+/**
+ * Resolve the home directory for a given user.
+ * When SUDO_USER is set, tries /etc/passwd lookup, then falls back to /home/<user>.
+ * For root, returns /root. Otherwise falls back to os.homedir().
+ */
+export function getInstallingUserHome(user) {
+  if (user === "root") {
+    return "/root";
+  }
+
+  // Try to read from /etc/passwd
+  try {
+    const passwd = fs.readFileSync("/etc/passwd", "utf-8");
+    const lines = passwd.split("\n");
+    for (const line of lines) {
+      const fields = line.split(":");
+      if (fields[0] === user && fields[5]) {
+        return fields[5];
+      }
+    }
+  } catch {
+    // /etc/passwd not readable, fall through
+  }
+
+  // Fall back to /home/<user> if SUDO_USER is set
+  if (process.env.SUDO_USER) {
+    return `/home/${user}`;
+  }
+
+  return os.homedir();
+}
+
+/**
+ * Detect the real (non-root) user who invoked the install command.
+ * When run via sudo, reads SUDO_USER and SUDO_GID for the original user.
+ * Otherwise uses os.userInfo() for the current user.
+ * Returns { user, group, home }.
+ */
+export function getInstallingUser() {
+  const sudoUser = process.env.SUDO_USER;
+
+  if (sudoUser) {
+    let group = process.env.SUDO_GID || String(os.userInfo().gid);
+    // Try to resolve group name from GID via /etc/group
+    try {
+      const groupFile = fs.readFileSync("/etc/group", "utf-8");
+      const lines = groupFile.split("\n");
+      for (const line of lines) {
+        const fields = line.split(":");
+        if (fields[2] === group) {
+          group = fields[0];
+          break;
+        }
+      }
+    } catch {
+      // If we can't resolve the group name, use the username as group
+      group = sudoUser;
+    }
+
+    // If group is still numeric (GID didn't resolve), fall back to username
+    if (/^\d+$/.test(group)) {
+      group = sudoUser;
+    }
+
+    const home = getInstallingUserHome(sudoUser);
+    return { user: sudoUser, group, home };
+  }
+
+  const info = os.userInfo();
+  const user = info.username;
+  let group = String(info.gid);
+
+  // Try to resolve group name from GID via /etc/group
+  try {
+    const groupFile = fs.readFileSync("/etc/group", "utf-8");
+    const lines = groupFile.split("\n");
+    for (const line of lines) {
+      const fields = line.split(":");
+      if (fields[2] === group) {
+        group = fields[0];
+        break;
+      }
+    }
+  } catch {
+    // Fall back to username as group
+    group = user;
+  }
+
+  // If group is still numeric (GID didn't resolve), fall back to username
+  if (/^\d+$/.test(group)) {
+    group = user;
+  }
+
+  const home = getInstallingUserHome(user);
+  return { user, group, home };
+}
+
 /**
  * Generate systemd unit file content.
  * Uses absolute node path + script path to avoid shebang/PATH issues under systemd.
+ * Accepts an optional userInfo parameter to avoid repeated getInstallingUser() calls.
  */
-export function generateSystemdUnit(execPath) {
+export function generateSystemdUnit(execPath, userInfo) {
   const nodePath = getNodePath();
+  const { user, group, home } = userInfo || getInstallingUser();
+  const workingDirectory = path.resolve(path.dirname(execPath), "..");
   return `[Unit]
 Description=AxonRouter AI Router
 After=network.target
@@ -97,11 +198,15 @@ StartLimitBurst=5
 
 [Service]
 Type=simple
+User=${user}
+Group=${group}
+WorkingDirectory=${workingDirectory}
 ExecStart=${nodePath} ${execPath}
 Restart=always
 RestartSec=5
 Environment=NODE_ENV=production
 Environment=PORT=${DEFAULT_PORT}
+Environment=HOME=${home}
 # Graceful shutdown timeout
 TimeoutStopSec=30
 # Kill remaining child processes (cloudflared, tailscaled) on stop
@@ -115,9 +220,11 @@ WantedBy=multi-user.target
 /**
  * Generate init.d script content (LSB format).
  * Uses absolute node path to avoid PATH issues in init environment.
+ * Accepts an optional userInfo parameter to avoid repeated getInstallingUser() calls.
  */
-export function generateInitdScript(execPath) {
+export function generateInitdScript(execPath, userInfo) {
   const nodePath = getNodePath();
+  const { user, group, home } = userInfo || getInstallingUser();
   return `#!/bin/sh
 ### BEGIN INIT INFO
 # Provides:          ${SERVICE_NAME}
@@ -134,21 +241,24 @@ DAEMON="${execPath}"
 PIDFILE="${PID_FILE}"
 NAME="${SERVICE_NAME}"
 LOG_FILE="/var/log/${SERVICE_NAME}.log"
+USER="${user}"
+GROUP="${group}"
 export NODE_ENV=production
 export PORT=${DEFAULT_PORT}
+export HOME=${home}
 
 start() {
   if [ -f "$PIDFILE" ] && kill -0 "$(cat "$PIDFILE")" 2>/dev/null; then
     echo "$NAME is already running."
     return 1
   fi
-  echo "Starting $NAME..."
+  echo "Starting $NAME as user $USER..."
   # Start with auto-respawn: restart up to 10 times with 5s delay if process exits
   (
     RESTART_COUNT=0
     MAX_RESTARTS=10
     while [ $RESTART_COUNT -lt $MAX_RESTARTS ]; do
-      "$NODE" "$DAEMON" >> "$LOG_FILE" 2>&1
+      su - "$USER" -c "HOME='${home}' NODE_ENV=production PORT=${DEFAULT_PORT} '${nodePath}' '${execPath}'" >> "$LOG_FILE" 2>&1
       EXIT_CODE=$?
       if [ $EXIT_CODE -eq 0 ]; then
         break
@@ -211,12 +321,16 @@ exit 0
 export function installService() {
   const initSystem = detectInitSystem();
   const execPath = getExecPath();
+  const { user, group } = getInstallingUser();
 
   console.log(`[AxonRouter] Detected init system: ${initSystem}`);
   console.log(`[AxonRouter] Executable path: ${execPath}`);
+  console.log(`[AxonRouter] Service will run as user: ${user} (group: ${group})`);
+
+  const userInfo = { user, group, home: getInstallingUserHome(user) };
 
   if (initSystem === "systemd") {
-    const unitContent = generateSystemdUnit(execPath);
+    const unitContent = generateSystemdUnit(execPath, userInfo);
     // Write unit file via sudo tee (since we may not be root)
     const child = spawnSync("sudo", ["tee", SYSTEMD_UNIT_PATH], {
       input: unitContent,
@@ -233,7 +347,7 @@ export function installService() {
     runWithSudo(`systemctl start ${SERVICE_NAME}`);
     console.log(`[AxonRouter] Service installed, enabled, and started.`);
   } else {
-    const scriptContent = generateInitdScript(execPath);
+    const scriptContent = generateInitdScript(execPath, userInfo);
     const child = spawnSync("sudo", ["tee", INITD_SCRIPT_PATH], {
       input: scriptContent,
       stdio: ["pipe", "pipe", "inherit"],
@@ -407,8 +521,14 @@ export function restartService() {
  * Show help message with available commands.
  */
 export function showHelp() {
+  let version = "unknown";
+  try {
+    const pkgUrl = new URL("../package.json", import.meta.url);
+    version = JSON.parse(fs.readFileSync(pkgUrl, "utf8")).version;
+  } catch {}
+
   console.log(`
-\x1b[1mAxonRouter - AI Router Service Management\x1b[0m
+\x1b[1mAxonRouter v${version} - AI Router\x1b[0m
 
 \x1b[33mUsage:\x1b[0m
   axonrouter <command> [options]

package/scripts/start.js

@@ -10,6 +10,7 @@ import { createRequire } from "node:module";
 
 const require = createRequire(import.meta.url);
 const { defaultPort: DEFAULT_AXONROUTER_PORT } = require("../src/shared/constants/runtimeDefaults.json");
+const { version: APP_VERSION } = require("../package.json");
 
 const SERVICE_COMMAND_NAMES = new Set([
   "install-service",
@@ -95,7 +96,7 @@ function getBaseUrl(port) {
 
 function printStartupSummary({ port, hasStandaloneServer, standaloneServerPath }) {
   const baseUrl = getBaseUrl(port);
-  console.log(`[Start] AxonRouter starting on port ${port}`);
+  console.log(`[Start] AxonRouter v${APP_VERSION} starting on port ${port}`);
   console.log(`[Start] Dashboard: ${baseUrl}/dashboard`);
   console.log(`[Start] API: ${baseUrl}/v1`);
   console.log(
@@ -157,6 +158,18 @@ export async function main() {
     return;
   }
 
+  // Check for unrecognized commands
+  if (args.forwardArgs.length > 0 && args.forwardArgs[0] !== "mcp") {
+    const unknownCmd = args.forwardArgs[0];
+    if (!unknownCmd.startsWith("-") && isNaN(Number(unknownCmd))) {
+      console.error(`\x1b[31m[AxonRouter] Unknown command: ${unknownCmd}\x1b[0m`);
+      console.error("");
+      const { showHelp } = await import("./service.js");
+      showHelp();
+      exit(1);
+    }
+  }
+
   const standaloneServerPath = resolveStandaloneServerPath(projectRoot);
   const requestedPort = args.port || process.env.PORT || DEFAULT_AXONROUTER_PORT;
   const port = normalizePort(requestedPort);
@@ -435,6 +448,15 @@ export function syncStandaloneAssets(projectRoot, standaloneServerPath) {
   const standalonePublicDir = path.join(standaloneRoot, "public");
   const standaloneMitmDir = path.join(standaloneRoot, "src", "mitm");
 
+  // Skip sync if we don't have write permission to the standalone directory
+  // (e.g. global npm install owned by root, running as non-root user)
+  try {
+    fs.accessSync(standaloneRoot, fs.constants.W_OK);
+  } catch {
+    // No write access - assets are already in place from npm publish/install
+    return;
+  }
+
   if (fs.existsSync(sourceStaticDir)) {
     fs.mkdirSync(path.dirname(standaloneStaticDir), { recursive: true });
     fs.rmSync(standaloneStaticDir, { recursive: true, force: true });

package/src/app/login/page.tsx

@@ -3,154 +3,14 @@
 import { useEffect, useState } from "react";
 import { useRouter } from "next/navigation";
 import { useQueryClient } from "@tanstack/react-query";
-import {
-	ArrowRight,
-	Check,
-	LockKeyhole,
-	Server,
-	Waypoints,
-} from "lucide-react";
-import { Label as LabelPrimitive } from "radix-ui";
+import { LockKeyhole } from "lucide-react";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
 import { translate } from "@/i18n/runtime";
 import { fetchJson, queryKeys } from "@/shared/query";
 
-const accessPoints = [
-	{ label: "Router", value: "127.0.0.1", icon: Server },
-	{ label: "Policy", value: "password auth", icon: LockKeyhole },
-	{ label: "Routes", value: "guarded", icon: Waypoints },
-];
-
-const trustChecks = [
-	"Keys stay local",
-	"Routing rules stay private",
-	"Telemetry hydrates after login",
-];
-
-const shell = {
-	page: {
-		minHeight: "100dvh",
-		display: "grid",
-		gridTemplateColumns: "minmax(0, 1.18fr) minmax(360px, 520px)",
-		background: "#09090b",
-		color: "#fafafa",
-		fontFamily:
-			"ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif",
-	},
-	left: {
-		minHeight: "100dvh",
-		padding: "56px",
-		display: "flex",
-		flexDirection: "column" as const,
-		justifyContent: "space-between",
-		gap: "48px",
-		borderRight: "1px solid rgba(255,255,255,0.08)",
-		background:
-			"radial-gradient(circle at 20% 20%, rgba(236,72,153,0.16), transparent 30rem), linear-gradient(135deg, #18181b 0%, #09090b 70%)",
-	},
-	right: {
-		minHeight: "100dvh",
-		display: "grid",
-		placeItems: "center",
-		padding: "32px",
-		background: "#111113",
-	},
-	header: {
-		display: "flex",
-		alignItems: "center",
-		gap: "12px",
-	},
-	iconBox: {
-		width: "42px",
-		height: "42px",
-		display: "grid",
-		placeItems: "center",
-		borderRadius: "14px",
-		border: "1px solid rgba(255,255,255,0.14)",
-		background: "rgba(255,255,255,0.06)",
-		color: "#f5f5f5",
-	},
-	badge: {
-		marginLeft: "auto",
-		borderRadius: "999px",
-		border: "1px solid rgba(236,72,153,0.32)",
-		background: "rgba(236,72,153,0.12)",
-		padding: "6px 10px",
-		fontSize: "12px",
-		fontWeight: 800,
-		color: "#f9a8d4",
-	},
-	eyebrow: {
-		margin: "0 0 14px",
-		fontSize: "12px",
-		fontWeight: 850,
-		letterSpacing: "0.18em",
-		textTransform: "uppercase" as const,
-		color: "#a1a1aa",
-	},
-	title: {
-		margin: 0,
-		maxWidth: "11ch",
-		fontSize: "clamp(52px, 8vw, 104px)",
-		lineHeight: 0.88,
-		letterSpacing: "-0.08em",
-		fontWeight: 900,
-	},
-	subtitle: {
-		margin: "26px 0 0",
-		maxWidth: "680px",
-		fontSize: "17px",
-		lineHeight: 1.75,
-		color: "#d4d4d8",
-	},
-	accessGrid: {
-		display: "grid",
-		gridTemplateColumns: "repeat(3, minmax(0, 1fr))",
-		gap: "12px",
-	},
-	statCard: {
-		borderRadius: "20px",
-		border: "1px solid rgba(255,255,255,0.1)",
-		background: "rgba(255,255,255,0.055)",
-		padding: "18px",
-		boxShadow: "inset 0 1px 0 rgba(255,255,255,0.06)",
-	},
-	authCard: {
-		width: "100%",
-		maxWidth: "420px",
-		borderRadius: "26px",
-		border: "1px solid rgba(255,255,255,0.12)",
-		background: "#18181b",
-		padding: "28px",
-		boxShadow: "0 28px 90px rgba(0,0,0,0.48)",
-	},
-	input: {
-		width: "100%",
-		boxSizing: "border-box" as const,
-		borderRadius: "15px",
-		border: "1px solid rgba(255,255,255,0.14)",
-		background: "#09090b",
-		color: "#fafafa",
-		padding: "15px 16px",
-		fontSize: "16px",
-		outline: "none",
-	},
-	button: {
-		width: "100%",
-		minHeight: "54px",
-		display: "inline-flex",
-		alignItems: "center",
-		justifyContent: "center",
-		gap: "10px",
-		borderRadius: "15px",
-		border: "0",
-		background: "#fafafa",
-		color: "#09090b",
-		fontSize: "15px",
-		fontWeight: 850,
-		cursor: "pointer",
-	},
-};
-
 export default function LoginPage() {
 	const [password, setPassword] = useState("");
 	const [error, setError] = useState("");
@@ -217,124 +77,31 @@ export default function LoginPage() {
 
 	if (hasPassword === null) {
 		return (
-			<main style={shell.right}>
-				<section style={shell.authCard} aria-live="polite">
-					<LockKeyhole size={26} aria-hidden="true" />
-					<p style={{ margin: "16px 0 0", color: "#d4d4d8" }}>
-						{translate("Loading...")}
-					</p>
-				</section>
+			<main className="min-h-dvh bg-background flex items-center justify-center p-4">
+				<Card className="w-full max-w-sm">
+					<CardContent className="flex items-center gap-3 py-6">
+						<LockKeyhole size={20} className="text-muted-foreground" aria-hidden="true" />
+						<p className="text-muted-foreground text-sm">{translate("Loading...")}</p>
+					</CardContent>
+				</Card>
 			</main>
 		);
 	}
 
 	return (
-		<main style={shell.page}>
-			<section style={shell.left}>
-				<header style={shell.header}>
-					<div style={shell.iconBox}>
-						<LockKeyhole size={20} aria-hidden="true" />
-					</div>
-					<div>
-						<p style={{ margin: 0, fontWeight: 850 }}>AxonRouter</p>
-						<p
-							style={{ margin: "2px 0 0", color: "#a1a1aa", fontSize: "13px" }}
-						>
-							provider routing control
-						</p>
-					</div>
-					<span style={shell.badge}>auth.required</span>
-				</header>
-
-				<div>
-					<p style={shell.eyebrow}>secure dashboard access</p>
-					<h1 style={shell.title}>Route AI requests.</h1>
-					<p style={shell.subtitle}>
-						{hasPassword
-							? `${translate("Enter your password to access the dashboard")}. Provider keys, routing policy, and telemetry unlock only after local verification.`
-							: "First-run password is 12345677. Sign in, then change it immediately in Settings -> Security."}
-					</p>
-				</div>
-
-				<div style={shell.accessGrid}>
-					{accessPoints.map((item) => {
-						const Icon = item.icon;
-						return (
-							<article key={item.label} style={shell.statCard}>
-								<div
-									style={{
-										display: "flex",
-										alignItems: "center",
-										justifyContent: "space-between",
-										color: "#a1a1aa",
-										fontSize: "12px",
-										fontWeight: 850,
-										textTransform: "uppercase",
-										letterSpacing: "0.14em",
-									}}
-								>
-									<span>{item.label}</span>
-									<Icon size={16} aria-hidden="true" />
-								</div>
-								<p
-									style={{
-										margin: "20px 0 0",
-										fontSize: "18px",
-										fontWeight: 850,
-									}}
-								>
-									{item.value}
-								</p>
-							</article>
-						);
-					})}
-				</div>
-			</section>
-
-			<section style={shell.right} aria-labelledby="login-title">
-				<div style={shell.authCard}>
-					<div
-						style={{
-							display: "flex",
-							alignItems: "start",
-							justifyContent: "space-between",
-							gap: "16px",
-						}}
-					>
-						<div>
-							<p style={shell.eyebrow}>control plane</p>
-							<h2
-								id="login-title"
-								style={{
-									margin: 0,
-									fontSize: "34px",
-									lineHeight: 1,
-									letterSpacing: "-0.045em",
-								}}
-							>
-								Login
-							</h2>
-						</div>
-						<span style={{ ...shell.iconBox, fontWeight: 900 }}>RR</span>
-					</div>
-
-					<form
-						onSubmit={handleLogin}
-						style={{ marginTop: "32px", display: "grid", gap: "16px" }}
-					>
-						<div>
-							<LabelPrimitive.Root
-								htmlFor="password"
-								style={{
-									display: "block",
-									marginBottom: "8px",
-									fontSize: "14px",
-									fontWeight: 850,
-								}}
-							>
-								{translate("Password")}
-							</LabelPrimitive.Root>
-							<input
+		<main className="min-h-dvh bg-background flex items-center justify-center p-4">
+			<Card className="w-full max-w-sm">
+				<CardHeader>
+					<CardTitle className="flex items-center gap-2">
+						<LockKeyhole size={18} className="text-muted-foreground" aria-hidden="true" />
+						<span className="font-bold">AxonRouter</span>
+					</CardTitle>
+				</CardHeader>
+				<CardContent>
+					<form onSubmit={handleLogin} className="grid gap-4">
+						<div className="grid gap-2">
+							<Label htmlFor="password">{translate("Password")}</Label>
+							<Input
 								id="password"
 								type="password"
 								placeholder={translate("Enter password")}
@@ -344,70 +111,28 @@ export default function LoginPage() {
 								autoFocus
 								aria-invalid={!!error}
 								autoComplete="current-password"
-								style={shell.input}
 							/>
-							<p
-								style={{
-									margin: "10px 0 0",
-									color: error ? "#fca5a5" : "#a1a1aa",
-									fontSize: "13px",
-								}}
-							>
-								{error ||
-									(hasPassword
-										? "Use your configured management password."
-										: "Use default password 12345677, then change it in Settings -> Security.")}
-							</p>
 						</div>
 
 						{error && (
-							<div
-								role="alert"
-								style={{
-									borderRadius: "15px",
-									border: "1px solid rgba(248,113,113,0.28)",
-									background: "rgba(127,29,29,0.28)",
-									padding: "12px 14px",
-									color: "#fecaca",
-								}}
-							>
-								<strong>{translate("Invalid password")}</strong>
-								<p style={{ margin: "4px 0 0" }}>{error}</p>
-							</div>
+							<p className="text-destructive text-sm" role="alert">
+								{error}
+							</p>
 						)}
 
-						<button
-							type="submit"
-							disabled={loading}
-							style={{ ...shell.button, opacity: loading ? 0.72 : 1 }}
-						>
-							<LockKeyhole size={18} aria-hidden="true" />
-							<span>
-								{loading ? "Checking password..." : translate("Login")}
-							</span>
-							{!loading && <ArrowRight size={18} aria-hidden="true" />}
-						</button>
+						<Button type="submit" size="lg" loading={loading} className="w-full">
+							<LockKeyhole size={16} aria-hidden="true" />
+							<span>{translate("Login")}</span>
+						</Button>
 					</form>
 
-					<div style={{ marginTop: "28px", display: "grid", gap: "10px" }}>
-						{trustChecks.map((item) => (
-							<div
-								key={item}
-								style={{
-									display: "flex",
-									alignItems: "center",
-									gap: "8px",
-									color: "#d4d4d8",
-									fontSize: "14px",
-								}}
-							>
-								<Check size={16} aria-hidden="true" />
-								<span>{item}</span>
-							</div>
-						))}
-					</div>
-				</div>
-			</section>
+					{hasPassword === false && (
+						<p className="mt-4 text-muted-foreground text-sm">
+							Default password: 12345677. Change it in Settings after login.
+						</p>
+					)}
+				</CardContent>
+			</Card>
 		</main>
 	);
 }