create-workframe 0.1.1 → 0.1.3

package/README.md

@@ -3,7 +3,7 @@
 Published on npm as **create-workframe**.
 
 ```bash
-npx create-workframe@0.1.1 MyProject
+npx create-workframe@0.1.3 MyProject
 ```
 
 Scaffolds an isolated Workframe + Hermes project on Windows, macOS, and Linux.
@@ -14,14 +14,27 @@ Scaffolds an isolated Workframe + Hermes project on Windows, macOS, and Linux.
 MyProject/
 ├── Agents/
 ├── Files/
+├── scripts/              bootstrap, lifecycle, workframe.mjs CLI
 ├── docker-compose.yml
 ├── workframe-api/
 ├── workframe-ui/
+├── workframe-supervisor/
 └── workframe-manifest.json
 ```
 
+## Project CLI
+
+From the generated project root:
+
+```bash
+node scripts/workframe.mjs doctor
+node scripts/workframe.mjs setup
+```
+
 ## Source
 
 [github.com/npx-workframe/workframe](https://github.com/npx-workframe/workframe)
 
+Documentation: [docs/README.md](https://github.com/npx-workframe/workframe/blob/main/docs/README.md)
+
 Apache-2.0 — see `LICENSE`, `NOTICE`, `SECURITY.md`.

package/SECURITY.md

@@ -16,7 +16,7 @@ direct contact with the repository owner).
 
 Include:
 
-- Affected component (BFF, supervisor, installer, UI, compose)
+- Affected component (workframe-api, supervisor, installer, UI, compose)
 - Steps to reproduce
 - Impact assessment (data exposure, auth bypass, RCE, etc.)
 - Suggested fix if you have one
@@ -25,11 +25,9 @@ We aim to acknowledge reports within a few business days.
 
 ## Scope notes
 
-- **Host Hermes** (`%LOCALAPPDATA%\hermes` on Windows) is personal runtime state and is
-  out of scope for Workframe product security reports unless the issue is in shared
-  Workframe source code that affects all installs.
-- Production deployments should run with `WORKFRAME_MODE=team`, invite-only access, and
-  without `DEV_LOCAL_UNSAFE`.
+- Personal Hermes installs outside a Workframe compose stack are out of scope unless the issue is in shared Workframe source that affects all installs.
+- Production deployments should use `WORKFRAME_DEPLOYMENT_MODE=trusted_team` or
+  `public_multi_user`, invite-only access, and without `DEV_LOCAL_UNSAFE`.
 - BYOK (bring-your-own-key) is the default credential mode; workspace company-pays is an
   explicit admin opt-in.
 

package/bin/create-workframe.js

@@ -2014,15 +2014,15 @@ function nativeConfigYaml(projectName, agentName, personality) {
   const personalityLine = personality ? `# Personality: ${personality}
 ` : "";
   return `${personalityLine}model:
-  default: openrouter/owl-alpha
+  default: google/gemini-2.5-flash
   provider: openrouter
   base_url: https://openrouter.ai/api/v1
   api_mode: chat_completions
 fallback_providers:
 - provider: openrouter
-  model: openrouter/nex-agi
+  model: anthropic/claude-sonnet-4.5
 - provider: openrouter
-  model: openrouter/nvidia/nemotron-3-ultra-550b-a55b:free
+  model: meta-llama/llama-3.3-70b-instruct:free
 providers: {}
 credential_pool_strategies: {}
 toolsets:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-workframe",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Scaffold a Workframe + Hermes workspace with guided onboarding",
   "type": "module",
   "bin": {

package/scripts/apply-update-hermes.sh

@@ -1,17 +1,17 @@
-#!/usr/bin/env bash
-# Safe Hermes update — pull gateway/dashboard images, recreate containers. Preserves runtime/Agents.
-set -euo pipefail
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-# shellcheck source=compose-docker-host.sh
-source "$SCRIPT_DIR/compose-docker-host.sh"
-
-echo "=== Hermes update (gateway + dashboard only) ==="
-workframe_compose_prepare
-echo "Compose dir: $compose_cd"
-echo "Preserves: Agents/, Files/, workframe-api data volumes"
-
-SERVICES=(gateway dashboard)
-workframe_compose pull "${SERVICES[@]}"
-workframe_compose up -d --force-recreate --no-deps "${SERVICES[@]}"
-
-echo "=== Hermes update complete ==="
+#!/usr/bin/env bash
+# Safe Hermes update — pull gateway/dashboard images, recreate containers. Preserves runtime/Agents.
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=compose-docker-host.sh
+source "$SCRIPT_DIR/compose-docker-host.sh"
+
+echo "=== Hermes update (gateway + dashboard only) ==="
+workframe_compose_prepare
+echo "Compose dir: $compose_cd"
+echo "Preserves: Agents/, Files/, workframe-api data volumes"
+
+SERVICES=(gateway dashboard)
+workframe_compose pull "${SERVICES[@]}"
+workframe_compose up -d --force-recreate --no-deps "${SERVICES[@]}"
+
+echo "=== Hermes update complete ==="

package/scripts/apply-update-workframe.sh

@@ -1,77 +1,77 @@
-#!/usr/bin/env bash
-# Safe Workframe update — sync npm template (optional), rebuild API/supervisor/UI containers. Never wipes runtime/DB.
-set -euo pipefail
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-# shellcheck source=compose-docker-host.sh
-source "$SCRIPT_DIR/compose-docker-host.sh"
-
-workframe_compose_prepare
-PROJECT_ROOT="${WORKFRAME_HOST_PROJECT_ROOT:-${WORKFRAME_PROJECT_ROOT:-$compose_cd}}"
-
-echo "=== Workframe update (API + supervisor + UI) ==="
-echo "Project root: $PROJECT_ROOT"
-echo "Preserves: Agents/, Files/, .env, workframe-api/data, gateway/Hermes profiles"
-
-TARGET_VERSION="${WORKFRAME_UPDATE_VERSION:-}"
-NPM_PACKAGE="${WORKFRAME_NPM_PACKAGE:-create-workframe}"
-
-if [[ "${WORKFRAME_UPDATE_SKIP_NPM:-1}" == "1" ]] && [[ "${WORKFRAME_UPDATE_ALLOW_NPM:-}" != "1" ]]; then
-  echo "Skipping npm template sync (WORKFRAME_UPDATE_SKIP_NPM=1; set WORKFRAME_UPDATE_ALLOW_NPM=1 to fetch)"
-elif command -v npm >/dev/null 2>&1; then
-  if [[ "${WORKFRAME_UPDATE_ALLOW_NPM:-}" == "1" ]] && [[ -z "$TARGET_VERSION" ]]; then
-    echo "WORKFRAME_UPDATE_VERSION is required when WORKFRAME_UPDATE_ALLOW_NPM=1" >&2
-    exit 1
-  fi
-  TMP="$(mktemp -d)"
-  trap 'rm -rf "$TMP"' EXIT
-  echo "Fetching ${NPM_PACKAGE}@${TARGET_VERSION:-latest} from npm..."
-  (cd "$TMP" && npm pack "${NPM_PACKAGE}@${TARGET_VERSION:-latest}" --silent)
-  TARBALL="$(ls -1 "$TMP"/${NPM_PACKAGE}-*.tgz 2>/dev/null | head -n1 || true)"
-  if [[ -n "$TARBALL" ]]; then
-    EXPECTED="$(npm view "${NPM_PACKAGE}@${TARGET_VERSION:-latest}" dist.integrity --silent 2>/dev/null || true)"
-    if [[ -n "$EXPECTED" ]]; then
-      ACTUAL="sha512-$(sha512sum "$TARBALL" | awk '{print $1}' | xxd -r -p | base64 | tr -d '\n')"
-      if [[ "$ACTUAL" != "$EXPECTED" ]]; then
-        echo "integrity mismatch for ${NPM_PACKAGE}@${TARGET_VERSION:-latest}" >&2
-        exit 1
-      fi
-      echo "integrity ok: ${NPM_PACKAGE}@${TARGET_VERSION:-latest}"
-    fi
-    tar -xf "$TARBALL" -C "$TMP"
-    PKG="$TMP/package"
-    for dir in workframe-api workframe-supervisor; do
-      if [[ -d "$PKG/$dir" ]]; then
-        echo "Syncing $dir/"
-        mkdir -p "$PROJECT_ROOT/$dir"
-        cp -a "$PKG/$dir/." "$PROJECT_ROOT/$dir/"
-      fi
-    done
-    if [[ -d "$PKG/workframe-ui/public" ]]; then
-      echo "Syncing workframe-ui/public/"
-      mkdir -p "$PROJECT_ROOT/workframe-ui/public"
-      cp -a "$PKG/workframe-ui/public/." "$PROJECT_ROOT/workframe-ui/public/"
-    fi
-    for script in apply-update-hermes.sh apply-update-workframe.sh restart-gateway-hermes.sh compose-docker-host.sh update-hermes.sh; do
-      if [[ -f "$PKG/scripts/$script" ]]; then
-        cp -a "$PKG/scripts/$script" "$PROJECT_ROOT/scripts/workframe/$script"
-        chmod +x "$PROJECT_ROOT/scripts/workframe/$script" 2>/dev/null || true
-      fi
-    done
-  else
-    echo "npm pack produced no tarball — skipping template sync"
-  fi
-else
-  echo "Skipping npm template sync (npm missing or WORKFRAME_UPDATE_SKIP_NPM=1)"
-fi
-
-echo "Rebuilding workframe-api and workframe-supervisor..."
-workframe_compose build workframe-api workframe-supervisor
-workframe_compose up -d --build --no-deps workframe-api workframe-supervisor
-
-if workframe_compose config --services 2>/dev/null | grep -qx workframe-ui; then
-  workframe_compose up -d --no-deps workframe-ui || workframe_compose restart workframe-ui || true
-elif workframe_compose config --services 2>/dev/null | grep -qx workframe; then
-  workframe_compose up -d --no-deps workframe || workframe_compose restart workframe || true
-fi
-
-echo "=== Workframe update complete ==="
+#!/usr/bin/env bash
+# Safe Workframe update — sync npm template (optional), rebuild API/supervisor/UI containers. Never wipes runtime/DB.
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=compose-docker-host.sh
+source "$SCRIPT_DIR/compose-docker-host.sh"
+
+workframe_compose_prepare
+PROJECT_ROOT="${WORKFRAME_HOST_PROJECT_ROOT:-${WORKFRAME_PROJECT_ROOT:-$compose_cd}}"
+
+echo "=== Workframe update (API + supervisor + UI) ==="
+echo "Project root: $PROJECT_ROOT"
+echo "Preserves: Agents/, Files/, .env, workframe-api/data, gateway/Hermes profiles"
+
+TARGET_VERSION="${WORKFRAME_UPDATE_VERSION:-}"
+NPM_PACKAGE="${WORKFRAME_NPM_PACKAGE:-create-workframe}"
+
+if [[ "${WORKFRAME_UPDATE_SKIP_NPM:-1}" == "1" ]] && [[ "${WORKFRAME_UPDATE_ALLOW_NPM:-}" != "1" ]]; then
+  echo "Skipping npm template sync (WORKFRAME_UPDATE_SKIP_NPM=1; set WORKFRAME_UPDATE_ALLOW_NPM=1 to fetch)"
+elif command -v npm >/dev/null 2>&1; then
+  if [[ "${WORKFRAME_UPDATE_ALLOW_NPM:-}" == "1" ]] && [[ -z "$TARGET_VERSION" ]]; then
+    echo "WORKFRAME_UPDATE_VERSION is required when WORKFRAME_UPDATE_ALLOW_NPM=1" >&2
+    exit 1
+  fi
+  TMP="$(mktemp -d)"
+  trap 'rm -rf "$TMP"' EXIT
+  echo "Fetching ${NPM_PACKAGE}@${TARGET_VERSION:-latest} from npm..."
+  (cd "$TMP" && npm pack "${NPM_PACKAGE}@${TARGET_VERSION:-latest}" --silent)
+  TARBALL="$(ls -1 "$TMP"/${NPM_PACKAGE}-*.tgz 2>/dev/null | head -n1 || true)"
+  if [[ -n "$TARBALL" ]]; then
+    EXPECTED="$(npm view "${NPM_PACKAGE}@${TARGET_VERSION:-latest}" dist.integrity --silent 2>/dev/null || true)"
+    if [[ -n "$EXPECTED" ]]; then
+      ACTUAL="sha512-$(sha512sum "$TARBALL" | awk '{print $1}' | xxd -r -p | base64 | tr -d '\n')"
+      if [[ "$ACTUAL" != "$EXPECTED" ]]; then
+        echo "integrity mismatch for ${NPM_PACKAGE}@${TARGET_VERSION:-latest}" >&2
+        exit 1
+      fi
+      echo "integrity ok: ${NPM_PACKAGE}@${TARGET_VERSION:-latest}"
+    fi
+    tar -xf "$TARBALL" -C "$TMP"
+    PKG="$TMP/package"
+    for dir in workframe-api workframe-supervisor; do
+      if [[ -d "$PKG/$dir" ]]; then
+        echo "Syncing $dir/"
+        mkdir -p "$PROJECT_ROOT/$dir"
+        cp -a "$PKG/$dir/." "$PROJECT_ROOT/$dir/"
+      fi
+    done
+    if [[ -d "$PKG/workframe-ui/public" ]]; then
+      echo "Syncing workframe-ui/public/"
+      mkdir -p "$PROJECT_ROOT/workframe-ui/public"
+      cp -a "$PKG/workframe-ui/public/." "$PROJECT_ROOT/workframe-ui/public/"
+    fi
+    for script in apply-update-hermes.sh apply-update-workframe.sh restart-gateway-hermes.sh compose-docker-host.sh update-hermes.sh; do
+      if [[ -f "$PKG/scripts/$script" ]]; then
+        cp -a "$PKG/scripts/$script" "$PROJECT_ROOT/scripts/workframe/$script"
+        chmod +x "$PROJECT_ROOT/scripts/workframe/$script" 2>/dev/null || true
+      fi
+    done
+  else
+    echo "npm pack produced no tarball — skipping template sync"
+  fi
+else
+  echo "Skipping npm template sync (npm missing or WORKFRAME_UPDATE_SKIP_NPM=1)"
+fi
+
+echo "Rebuilding workframe-api and workframe-supervisor..."
+workframe_compose build workframe-api workframe-supervisor
+workframe_compose up -d --build --no-deps workframe-api workframe-supervisor
+
+if workframe_compose config --services 2>/dev/null | grep -qx workframe-ui; then
+  workframe_compose up -d --no-deps workframe-ui || workframe_compose restart workframe-ui || true
+elif workframe_compose config --services 2>/dev/null | grep -qx workframe; then
+  workframe_compose up -d --no-deps workframe || workframe_compose restart workframe || true
+fi
+
+echo "=== Workframe update complete ==="

package/scripts/bootstrap-workspace-link.sh

@@ -1,8 +1,8 @@
-#!/bin/sh
-# Hermes sets HERMES_WRITE_SAFE_ROOT=/opt/data — user artifacts must resolve under it.
-# Bind host Files at /opt/data/workspace; keep /workspace as a symlink for agents and API.
-mkdir -p /opt/data/workspace
-if [ -L /workspace ] || [ ! -e /workspace ]; then
-  rm -rf /workspace 2>/dev/null || true
-  ln -sfn /opt/data/workspace /workspace
-fi
+#!/bin/sh
+# Hermes sets HERMES_WRITE_SAFE_ROOT=/opt/data — user artifacts must resolve under it.
+# Bind host Files at /opt/data/workspace; keep /workspace as a symlink for agents and API.
+mkdir -p /opt/data/workspace
+if [ -L /workspace ] || [ ! -e /workspace ]; then
+  rm -rf /workspace 2>/dev/null || true
+  ln -sfn /opt/data/workspace /workspace
+fi

package/scripts/compose-docker-host.sh

@@ -1,37 +1,37 @@
-#!/usr/bin/env bash
-# Shared docker compose invocation for in-container apply (docker.sock on host).
-set -euo pipefail
-
-workframe_compose_prepare() {
-  compose_cd=""
-  compose_files=()
-
-  # Host-bindings overlay: docker.sock apply from supervisor uses WORKFRAME_HOST_* paths.
-  if [[ -n "${WORKFRAME_HOST_COMPOSE_DIR:-}" && -n "${WORKFRAME_COMPOSE_DIR:-}" \
-        && -f "${WORKFRAME_COMPOSE_DIR}/docker-compose.yml" \
-        && -f "${WORKFRAME_COMPOSE_DIR}/docker-compose.host-bindings.yml" ]]; then
-    compose_cd="${WORKFRAME_COMPOSE_DIR}"
-    compose_files=(-f docker-compose.yml -f docker-compose.host-bindings.yml)
-    return 0
-  fi
-
-  # ponytail: docker Desktop resolves WORKFRAME_HOST_* via socket even when path is not visible in this container.
-  if [[ -n "${WORKFRAME_HOST_COMPOSE_DIR:-}" ]]; then
-    compose_cd="${WORKFRAME_HOST_COMPOSE_DIR}"
-    compose_files=(-f docker-compose.yml)
-    return 0
-  fi
-
-  compose_cd="${WORKFRAME_COMPOSE_DIR:-${WORKFRAME_PROJECT_ROOT:-.}}"
-  compose_files=(-f docker-compose.yml)
-}
-
-workframe_compose() {
-  workframe_compose_prepare
-  cd "$compose_cd"
-  if [[ ! -f docker-compose.yml ]]; then
-    echo "docker-compose.yml not found in $compose_cd" >&2
-    exit 1
-  fi
-  docker compose "${compose_files[@]}" "$@"
-}
+#!/usr/bin/env bash
+# Shared docker compose invocation for in-container apply (docker.sock on host).
+set -euo pipefail
+
+workframe_compose_prepare() {
+  compose_cd=""
+  compose_files=()
+
+  # Host-bindings overlay: docker.sock apply from supervisor uses WORKFRAME_HOST_* paths.
+  if [[ -n "${WORKFRAME_HOST_COMPOSE_DIR:-}" && -n "${WORKFRAME_COMPOSE_DIR:-}" \
+        && -f "${WORKFRAME_COMPOSE_DIR}/docker-compose.yml" \
+        && -f "${WORKFRAME_COMPOSE_DIR}/docker-compose.host-bindings.yml" ]]; then
+    compose_cd="${WORKFRAME_COMPOSE_DIR}"
+    compose_files=(-f docker-compose.yml -f docker-compose.host-bindings.yml)
+    return 0
+  fi
+
+  # ponytail: docker Desktop resolves WORKFRAME_HOST_* via socket even when path is not visible in this container.
+  if [[ -n "${WORKFRAME_HOST_COMPOSE_DIR:-}" ]]; then
+    compose_cd="${WORKFRAME_HOST_COMPOSE_DIR}"
+    compose_files=(-f docker-compose.yml)
+    return 0
+  fi
+
+  compose_cd="${WORKFRAME_COMPOSE_DIR:-${WORKFRAME_PROJECT_ROOT:-.}}"
+  compose_files=(-f docker-compose.yml)
+}
+
+workframe_compose() {
+  workframe_compose_prepare
+  cd "$compose_cd"
+  if [[ ! -f docker-compose.yml ]]; then
+    echo "docker-compose.yml not found in $compose_cd" >&2
+    exit 1
+  fi
+  docker compose "${compose_files[@]}" "$@"
+}

package/scripts/fix-zk-encryption-key.sh

@@ -1,35 +1,35 @@
-#!/usr/bin/env bash
-# Fix ZK_AUTH_ENCRYPTION_KEY when it was generated as hex instead of base64.
-set -euo pipefail
-ENV_FILE="${1:-/opt/workframe/MyBusiness/.env}"
-FORCE="${2:-}"
-python3 - "$ENV_FILE" "$FORCE" <<'PY'
-import base64, os, re, sys
-from pathlib import Path
-env, force = Path(sys.argv[1]), sys.argv[2] == "--force"
-text = env.read_text(encoding="utf-8")
-m = re.search(r"^ZK_AUTH_ENCRYPTION_KEY=(.*)$", text, re.M)
-if not m:
-    print("ZK_AUTH_ENCRYPTION_KEY missing"); sys.exit(1)
-val = m.group(1).strip()
-try:
-    ok = len(base64.b64decode(val)) == 32
-except Exception:
-    ok = False
-if ok:
-    print("ZK_AUTH_ENCRYPTION_KEY already valid"); sys.exit(0)
-
-zk_db = Path(os.environ.get("WORKFRAME_API_DATA_DIR", "/app/data")) / "zk_auth.db"
-if zk_db.is_file() and not force:
-    import sqlite3
-    n = sqlite3.connect(str(zk_db)).execute("SELECT COUNT(*) FROM identities").fetchone()[0]
-    if n > 0:
-        print(f"REFUSING: {n} encrypted identities present. Regenerating the KEK will lock "
-              f"out every existing user. Re-run with --force to proceed.", file=sys.stderr)
-        sys.exit(1)
-
-new_key = base64.b64encode(os.urandom(32)).decode()
-text = re.sub(r"^ZK_AUTH_ENCRYPTION_KEY=.*$", f"ZK_AUTH_ENCRYPTION_KEY={new_key}", text, flags=re.M)
-env.write_text(text, encoding="utf-8")
-print("ZK_AUTH_ENCRYPTION_KEY regenerated (was invalid base64)")
-PY
+#!/usr/bin/env bash
+# Fix ZK_AUTH_ENCRYPTION_KEY when it was generated as hex instead of base64.
+set -euo pipefail
+ENV_FILE="${1:-/opt/workframe/MyBusiness/.env}"
+FORCE="${2:-}"
+python3 - "$ENV_FILE" "$FORCE" <<'PY'
+import base64, os, re, sys
+from pathlib import Path
+env, force = Path(sys.argv[1]), sys.argv[2] == "--force"
+text = env.read_text(encoding="utf-8")
+m = re.search(r"^ZK_AUTH_ENCRYPTION_KEY=(.*)$", text, re.M)
+if not m:
+    print("ZK_AUTH_ENCRYPTION_KEY missing"); sys.exit(1)
+val = m.group(1).strip()
+try:
+    ok = len(base64.b64decode(val)) == 32
+except Exception:
+    ok = False
+if ok:
+    print("ZK_AUTH_ENCRYPTION_KEY already valid"); sys.exit(0)
+
+zk_db = Path(os.environ.get("WORKFRAME_API_DATA_DIR", "/app/data")) / "zk_auth.db"
+if zk_db.is_file() and not force:
+    import sqlite3
+    n = sqlite3.connect(str(zk_db)).execute("SELECT COUNT(*) FROM identities").fetchone()[0]
+    if n > 0:
+        print(f"REFUSING: {n} encrypted identities present. Regenerating the KEK will lock "
+              f"out every existing user. Re-run with --force to proceed.", file=sys.stderr)
+        sys.exit(1)
+
+new_key = base64.b64encode(os.urandom(32)).decode()
+text = re.sub(r"^ZK_AUTH_ENCRYPTION_KEY=.*$", f"ZK_AUTH_ENCRYPTION_KEY={new_key}", text, flags=re.M)
+env.write_text(text, encoding="utf-8")
+print("ZK_AUTH_ENCRYPTION_KEY regenerated (was invalid base64)")
+PY

package/scripts/restart-gateway-hermes.sh

@@ -1,12 +1,12 @@
-#!/usr/bin/env bash
-# Restart Hermes gateway container only — no image pull. Preserves runtime/Agents.
-set -euo pipefail
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-# shellcheck source=compose-docker-host.sh
-source "$SCRIPT_DIR/compose-docker-host.sh"
-
-echo "=== Hermes gateway restart ==="
-workframe_compose_prepare
-echo "Compose dir: $compose_cd"
-workframe_compose up -d --force-recreate --no-deps gateway
-echo "=== Gateway restart complete ==="
+#!/usr/bin/env bash
+# Restart Hermes gateway container only — no image pull. Preserves runtime/Agents.
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=compose-docker-host.sh
+source "$SCRIPT_DIR/compose-docker-host.sh"
+
+echo "=== Hermes gateway restart ==="
+workframe_compose_prepare
+echo "Compose dir: $compose_cd"
+workframe_compose up -d --force-recreate --no-deps gateway
+echo "=== Gateway restart complete ==="

package/scripts/setup-stack-secrets.sh

@@ -1,50 +1,50 @@
-#!/usr/bin/env bash
-# Append production stack secrets to a Workframe .env (idempotent).
-# Usage: bash scripts/workframe/setup-stack-secrets.sh path/to/.env
-set -euo pipefail
-
-ENV_FILE="${1:-/workspace/.env}"
-
-append_if_missing() {
-  local key="$1"
-  local value="$2"
-  local comment="${3:-}"
-  if [[ -f "$ENV_FILE" ]] && grep -q "^${key}=" "$ENV_FILE"; then
-    echo "${key} already exists in ${ENV_FILE}"
-    return 0
-  fi
-  mkdir -p "$(dirname "$ENV_FILE")"
-  {
-    [[ -n "$comment" ]] && printf '\n# %s\n' "$comment"
-    printf '%s=%s\n' "$key" "$value"
-  } >>"$ENV_FILE"
-  echo "${key} generated and appended to ${ENV_FILE}"
-}
-
-rand_hex() {
-  openssl rand -hex 32 2>/dev/null || python3 - <<'PY'
-import secrets
-print(secrets.token_hex(32))
-PY
-}
-
-rand_b64() {
-  python3 - <<'PY'
-import base64, os
-print(base64.b64encode(os.urandom(32)).decode())
-PY
-}
-
-rand_proxy() {
-  python3 - <<'PY'
-import secrets
-print(secrets.token_urlsafe(32))
-PY
-}
-
-append_if_missing WORKFRAME_SUPERVISOR_TOKEN "${WORKFRAME_SUPERVISOR_TOKEN:-$(rand_hex)}" \
-  "Workframe supervisor token. Keep this secret."
-append_if_missing WORKFRAME_PROXY_TOKEN "${WORKFRAME_PROXY_TOKEN:-$(rand_proxy)}" \
-  "Internal LLM/action proxy secret — gateway + API must match."
-append_if_missing WORKFRAME_VAULT_KEK "${WORKFRAME_VAULT_KEK:-$(rand_b64)}" \
-  "Credential vault KEK (32-byte base64). Required for public_multi_user."
+#!/usr/bin/env bash
+# Append production stack secrets to a Workframe .env (idempotent).
+# Usage: bash scripts/workframe/setup-stack-secrets.sh path/to/.env
+set -euo pipefail
+
+ENV_FILE="${1:-/workspace/.env}"
+
+append_if_missing() {
+  local key="$1"
+  local value="$2"
+  local comment="${3:-}"
+  if [[ -f "$ENV_FILE" ]] && grep -q "^${key}=" "$ENV_FILE"; then
+    echo "${key} already exists in ${ENV_FILE}"
+    return 0
+  fi
+  mkdir -p "$(dirname "$ENV_FILE")"
+  {
+    [[ -n "$comment" ]] && printf '\n# %s\n' "$comment"
+    printf '%s=%s\n' "$key" "$value"
+  } >>"$ENV_FILE"
+  echo "${key} generated and appended to ${ENV_FILE}"
+}
+
+rand_hex() {
+  openssl rand -hex 32 2>/dev/null || python3 - <<'PY'
+import secrets
+print(secrets.token_hex(32))
+PY
+}
+
+rand_b64() {
+  python3 - <<'PY'
+import base64, os
+print(base64.b64encode(os.urandom(32)).decode())
+PY
+}
+
+rand_proxy() {
+  python3 - <<'PY'
+import secrets
+print(secrets.token_urlsafe(32))
+PY
+}
+
+append_if_missing WORKFRAME_SUPERVISOR_TOKEN "${WORKFRAME_SUPERVISOR_TOKEN:-$(rand_hex)}" \
+  "Workframe supervisor token. Keep this secret."
+append_if_missing WORKFRAME_PROXY_TOKEN "${WORKFRAME_PROXY_TOKEN:-$(rand_proxy)}" \
+  "Internal LLM/action proxy secret — gateway + API must match."
+append_if_missing WORKFRAME_VAULT_KEK "${WORKFRAME_VAULT_KEK:-$(rand_b64)}" \
+  "Credential vault KEK (32-byte base64). Required for public_multi_user."

package/scripts/sync-canonical-to-package.mjs

@@ -57,6 +57,17 @@ function removeIfExists(p) {
   if (fs.existsSync(p)) fs.rmSync(p, { recursive: true, force: true });
 }
 
+/** Alpine sh breaks on CRLF (then\r). Normalize at pack time — Windows checkout is CRLF. */
+function copyIntoPackage(src, dst) {
+  fs.mkdirSync(path.dirname(dst), { recursive: true });
+  if (dst.endsWith('.sh')) {
+    const text = fs.readFileSync(src, 'utf8').replace(/\r\n/g, '\n').replace(/\r/g, '\n');
+    fs.writeFileSync(dst, text, 'utf8');
+  } else {
+    fs.copyFileSync(src, dst);
+  }
+}
+
 console.log(`Sync canonical BFF: ${CANONICAL_API} -> ${PKG_API}`);
 copyTree(CANONICAL_API, PKG_API);
 
@@ -107,11 +118,17 @@ for (const name of applyScripts) {
   const src = path.join(REPO_ROOT, 'scripts/workframe', name);
   const dst = path.join(PKG_ROOT, 'scripts', name);
   if (!fs.existsSync(src)) throw new Error(`Missing apply script: ${src}`);
-  fs.mkdirSync(path.dirname(dst), { recursive: true });
-  fs.copyFileSync(src, dst);
+  copyIntoPackage(src, dst);
   console.log(`Synced ${name} -> package/scripts/`);
 }
 
+for (const sh of fs.readdirSync(path.join(PKG_ROOT, 'scripts')).filter((n) => n.endsWith('.sh'))) {
+  const p = path.join(PKG_ROOT, 'scripts', sh);
+  if (fs.readFileSync(p).includes(0x0d)) {
+    throw new Error(`CRLF remains in package script after sync: ${sh}`);
+  }
+}
+
 const publicDeploySrc = path.join(REPO_ROOT, 'infra/compose/workframe/PUBLIC_DEPLOY.md');
 const publicDeployDst = path.join(PKG_ROOT, 'docs/PUBLIC_DEPLOY.md');
 if (fs.existsSync(publicDeploySrc)) {