create-wordjs 2.0.0 → 2.2.0

package/README.md

@@ -31,7 +31,7 @@ That single command takes you from nothing to the browser install wizard:
    clickable URL:
 
    ```
-   → https://localhost:3000/install?token=…
+   → https://localhost:3000/install#token=…
    ```
 
 Open the URL, pick your database, create your admin account, and you're in. The wizard offers
@@ -47,7 +47,7 @@ in CI — plus a pure-JS *SQLite (legacy / WASM)* fallback for hosts where the n
 | Option | Description |
 | --- | --- |
 | `--zip <path-or-url>` | Use a local release ZIP (or a direct ZIP URL) instead of querying the GitHub API. Handy offline or when rate-limited. |
-| `--version <tag>` | Install a specific release (e.g. `--version v1.0.0`) instead of the latest. |
+| `--version <tag>` | Install a specific release (e.g. `--version v2.1.0`) instead of the latest. |
 | `--http` | Serve plain HTTP instead of self-signed HTTPS (sets `WORDJS_HTTP=1`). |
 | `--no-start` | Scaffold and install dependencies only — start the server yourself later. |
 | `--yes`, `-y` | Skip the confirmation prompt (required when `upgrade` runs non-interactively). |
@@ -114,12 +114,16 @@ need `openssl` on the PATH. Full details, port matrix and the manual (source-che
   self-signed certificate. Your browser will warn once ("Your connection is not private") —
   click *Advanced → Proceed*. That is expected for localhost. Prefer plain HTTP? Use `--http`.
 - **Stop / restart**: press `Ctrl+C` to stop. Start again any time with
-  `cd my-site && npm run start:mono`. Until setup is finished, every start prints a fresh
-  one-time install URL, so you never need to keep the original token around.
+  `cd my-site && npm run start:mono`. Until setup is finished, every start mints a fresh one-time
+  install token, so you never need to keep the original around. The server prints it in its boot
+  banner — as a clickable `/install#token=…` URL — only when its stdout is a terminal, which it is
+  when you run that command yourself; off a TTY (systemd, Docker, a pipe) the banner shows the URL
+  without the token. Either way the token is written to `my-site/backend/data/install-token`
+  (mode `0600`), and `WORDJS_PRINT_INSTALL_TOKEN=1` prints it in the banner regardless.
 - **GitHub rate limit / offline**: the release lookup uses the unauthenticated GitHub API. If it
   is rate-limited or you're offline, download `wordjs-v*.zip` from the
   [releases page](https://github.com/jaimemartinez/wordjs/releases) and run
-  `npx create-wordjs@latest my-site --zip ./wordjs-v1.0.0.zip`.
+  `npx create-wordjs@latest my-site --zip ./wordjs-v2.1.0.zip`.
 - **Existing directories**: the target directory must not exist (or must be empty) — the tool
   refuses to overwrite anything.
 

package/index.js

@@ -10,8 +10,12 @@
  *   1. Downloads the latest pre-compiled WordJS release ZIP from GitHub (no build step needed).
  *   2. Extracts it into <dir> and installs the runtime dependencies (npm run release:install).
  *   3. Generates a one-time install token and starts the server (npm run start:mono) with it,
- *      printing a clickable https://localhost:3000/install?token=… URL — the browser install
- *      wizard takes it from there (pick SQLite/PostgreSQL, create your admin, done).
+ *      printing a clickable https://localhost:3000/install#token=… URL — the browser install
+ *      wizard takes it from there (pick SQLite/PostgreSQL, create your admin, done). That URL is
+ *      printed by THIS process, which owns the token, so it is unconditional.
+ *      With --no-start there is no token from here: the server mints its own on its first boot and
+ *      prints it in its banner only when ITS stdout is a TTY (or WORDJS_PRINT_INSTALL_TOKEN=1);
+ *      otherwise it writes it to <dir>/backend/data/install-token (mode 0600) and prints the path.
  *
  * Plain Node, no TypeScript. Only runtime dependency: adm-zip (ZIP extraction).
  */
@@ -49,7 +53,7 @@ Usage:
 
 Options:
   --zip <path-or-url>   Use a local release ZIP (or a direct ZIP URL) instead of asking GitHub.
-  --version <tag>       Install/upgrade to a specific release tag (e.g. v1.0.0) instead of the latest.
+  --version <tag>       Install/upgrade to a specific release tag (e.g. v2.1.0) instead of the latest.
   --http                Serve plain HTTP instead of self-signed HTTPS (sets WORDJS_HTTP=1). (create)
   --no-start            Scaffold + install dependencies only; don't start the server.
   --yes, -y             Skip the confirmation prompt (required when upgrading non-interactively).
@@ -65,7 +69,7 @@ Options:
 
 Examples:
   npx create-wordjs@latest my-site
-  npx create-wordjs@latest my-site --version v1.0.0
+  npx create-wordjs@latest my-site --version v2.1.0
   npx create-wordjs@latest upgrade                     # from inside your site directory
   npx create-wordjs@latest upgrade ./my-site --yes
 
@@ -103,7 +107,7 @@ function parseArgs(argv) {
         const a = argv[i];
         if (a === '-h' || a === '--help') { console.log(HELP); process.exit(0); }
         else if (a === '--zip') { opts.zip = argv[++i] || fail('--zip needs a value (path or URL to a wordjs-*.zip).'); }
-        else if (a === '--version') { opts.version = argv[++i] || fail('--version needs a value (a release tag, e.g. v1.0.0).'); }
+        else if (a === '--version') { opts.version = argv[++i] || fail('--version needs a value (a release tag, e.g. v2.1.0).'); }
         else if (a === '--http') opts.http = true;
         else if (a === '--no-start') opts.start = false;
         else if (a === '--yes' || a === '-y') opts.yes = true;
@@ -130,7 +134,7 @@ function parseArgs(argv) {
         else if (opts.mode === 'join') opts.dir = opts.role ? `wordjs-${opts.role}` : 'wordjs-node';
         else fail('Please specify a directory for your new site.', 'Example: npx create-wordjs@latest my-site');
     }
-    if (opts.version && /^\d/.test(opts.version)) opts.version = 'v' + opts.version;   // accept "1.0.0" for "v1.0.0"
+    if (opts.version && /^\d/.test(opts.version)) opts.version = 'v' + opts.version;   // accept "2.1.0" for "v2.1.0"
     return opts;
 }
 
@@ -729,7 +733,12 @@ async function main() {
         console.log(`      cd ${opts.dir}`);
         console.log(`      npm run start:mono${opts.http ? '        (with WORDJS_HTTP=1 in the environment for plain HTTP)' : ''}`);
         console.log('');
-        console.log(`   The console will print your one-time install URL (${proto}://localhost:3000/install?token=…).`);
+        console.log('   That first boot mints a one-time install token. The server prints it in its');
+        console.log(`   banner as a clickable URL (${proto}://localhost:3000/install#token=…) only when its`);
+        console.log('   stdout is a terminal — which it is if you run the command above yourself. Off a');
+        console.log('   TTY (systemd, Docker, a pipe) the banner shows the URL WITHOUT the token; read it');
+        console.log(`   from ${path.join(opts.dir, 'backend', 'data', 'install-token')} (mode 0600) instead,`);
+        console.log('   or set WORDJS_PRINT_INSTALL_TOKEN=1 to have it printed either way.');
         console.log(line + '\n');
         return;
     }
@@ -743,7 +752,12 @@ async function main() {
     console.log(`\n${line}`);
     console.log('✅ WordJS is ready — finish setup in your browser:');
     console.log('');
-    console.log(`   → ${proto}://localhost:3000/install?token=${token}`);
+    // The token rides in the URL FRAGMENT, not a `?token=` query string: a fragment is never sent to
+    // any server, so this bootstrap secret stays out of access/proxy logs and out of the `Referer` of
+    // every sub-resource the install page loads. The wizard reads `#token=` (and still accepts a
+    // legacy `?token=`) and scrubs it from the address bar. Keep in sync with the backend's own
+    // banner in backend/src/core/install-token.ts.
+    console.log(`   → ${proto}://localhost:3000/install#token=${token}`);
     console.log('');
     console.log('   • The server is starting below — give it ~15–30 seconds, then open the URL.');
     if (!opts.http) {
@@ -753,7 +767,9 @@ async function main() {
     }
     console.log('   • Stop the server:  press Ctrl+C in this window.');
     console.log(`   • Start it later:   cd ${opts.dir} && npm run start:mono`);
-    console.log('     (a fresh install URL is printed on every start until setup is finished)');
+    console.log('     (a fresh token is minted on every start until setup is finished; the server prints');
+    console.log('      it in its banner when stdout is a terminal, and always writes it to');
+    console.log('      backend/data/install-token, mode 0600)');
     if (process.platform === 'linux') {
         console.log('');
         console.log('   • RECEIVING email from the internet? WordJS listens on port 25 (the MX port).');

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "create-wordjs",
-    "version": "2.0.0",
+    "version": "2.2.0",
     "description": "Create a WordJS site with one command — the self-hosted CMS where third-party plugins run in an OS-isolated process with per-capability permission grants. SSR/SEO out of the box, SQLite by default, no PHP.",
     "license": "MIT",
     "author": "Jaime Martinez (https://github.com/jaimemartinez)",