ework-aio 0.2.0 → 0.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-aio",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "All-in-one installer for ework (issue tracker) + ework-daemon (AI bridge) + opencode-ework (plugin). One command: npm i -g ework-aio && ework-aio install.",
   "type": "module",
   "license": "MIT",

package/src/cli.ts

@@ -110,6 +110,22 @@ function defaultOpts(): GlobalOptions {
 // on unknown flags / missing values. The shape is stable so tests can
 // exercise it without touching process.argv.
 export function parseArgs(argv: string[]): ParsedArgs {
+  // G1: normalize `--flag=value` (Unix-conventional equals form) into
+  // `--flag value` so the rest of the parser only handles the space
+  // form. Short flags (-h, -v, -y) don't get this treatment (they never
+  // take `=` syntax). Plain `--` (end-of-options marker) and tokens
+  // without `--` prefix are left alone.
+  const expanded: string[] = [];
+  for (const tok of argv) {
+    if (tok.length > 3 && tok.startsWith("--") && tok.indexOf("=") > 2) {
+      const eqIdx = tok.indexOf("=");
+      expanded.push(tok.slice(0, eqIdx), tok.slice(eqIdx + 1));
+    } else {
+      expanded.push(tok);
+    }
+  }
+  argv = expanded;
+
   const opts = defaultOpts();
   const positionals: string[] = [];
   const configArgs: ConfigArgs = { subcommand: "list" };
@@ -286,6 +302,27 @@ function parseServiceTarget(arg: string | undefined): ServiceTarget {
   );
 }
 
+// stripAsUserFlag: return argv without `--as-user <login>` (the flag and
+// its value), so the sudo'd child doesn't re-enter handleAsUser and loop.
+//
+// Iterates by index, NOT Array.filter on value. If the username happens to
+// appear in another argument (path component, common word like "install",
+// or a --bot-name matching the operator login), filter-on-value would
+// silently drop that token and corrupt the child's argv.
+export function stripAsUserFlag(argv: readonly string[]): string[] {
+  const out: string[] = [];
+  for (let i = 0; i < argv.length; i++) {
+    const tok = argv[i];
+    if (tok === undefined) break;
+    if (tok === "--as-user") {
+      i++; // also skip the value
+      continue;
+    }
+    out.push(tok);
+  }
+  return out;
+}
+
 // handleAsUser: when invoked with --as-user (typically via sudo), re-exec
 // the install as the named user after enabling linger. Skipped if not root
 // or no --as-user flag.
@@ -319,9 +356,9 @@ function handleAsUser(opts: GlobalOptions, argv: string[]): void {
     );
   }
 
-  // Re-exec as target user with --as-user stripped from argv.
+  // Re-exec as target user.
   const self = process.argv[1]!;
-  const newArgs = argv.filter((a) => a !== "--as-user" && a !== opts.asUser!);
+  const newArgs = stripAsUserFlag(argv);
   const result = spawnSync("sudo", ["-u", target, "--login", self, ...newArgs], {
     stdio: "inherit",
     env: process.env,

package/src/commands/install.ts

@@ -194,7 +194,6 @@ export async function runInstall(
       // this, `install systemd --user` produces units that die when the
       // user logs out — defeating the point of systemd mode. Best-effort.
       if (opts.scope === "user") {
-        const userInfo = os.userInfo();
         const linger = Bun.spawnSync(["loginctl", "enable-linger", userInfo.username], {
           env: process.env,
           stdout: "pipe", stderr: "pipe",
@@ -509,7 +508,12 @@ interface BootstrapBotOpts {
 // bootstrapBot: faithful port of install.sh's bot user + PAT flow.
 // Uses the operator's token-derived cookie to drive ework-web's admin API,
 // then logs in as the bot to mint a PAT. Step-by-step idempotence:
-//   - create user: HTTP 303 = created, 400/409 = already exists (continue)
+//   - create user: HTTP 303 = created (password is what we sent)
+//     HTTP 400/409 = already exists → force-reset password via admin API
+//     so the subsequent /login is guaranteed to work. Without this reset,
+//     a bot user left over from a previous failed install keeps its OLD
+//     random password (which we don't know), and /login returns 401 —
+//     the install can never recover without manual DB surgery.
 //   - login as bot: required to get a session cookie for /me/tokens/create
 //   - mint PAT: scrape the token out of the HTML response (the only way
 //     ework-web exposes clear-text tokens, matching install.sh)
@@ -529,8 +533,28 @@ async function bootstrapBot(opts: BootstrapBotOpts): Promise<string> {
     }).toString(),
     redirect: "manual",
   });
-  // 303 = created, 400/409 = already exists. Anything else = abort.
-  if (![303, 400, 409].includes(createRes.status)) {
+  if (createRes.status === 400 || createRes.status === 409) {
+    // Bot user already exists from a previous install attempt. The
+    // password we just sent was IGNORED by ework-web (create only writes
+    // it on first creation). Without resetting, /login below uses the
+    // fresh botPassword which doesn't match the stored hash → 401.
+    // Force-reset via admin endpoint so the password we hold is real.
+    const resetRes = await fetchImpl(
+      `${opts.baseUrl}/admin/users/${encodeURIComponent(opts.botLogin)}/reset-password`,
+      {
+        method: "POST",
+        headers: { Cookie: opts.adminCookie, "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ password: botPassword }).toString(),
+        redirect: "manual",
+      },
+    );
+    if (resetRes.status !== 303) {
+      const body = await resetRes.text();
+      throw new InstallError(
+        `bot user exists but password reset failed (HTTP ${resetRes.status}): ${body.slice(0, 200)}`,
+      );
+    }
+  } else if (createRes.status !== 303) {
     const body = await createRes.text();
     throw new InstallError(`create bot user failed (HTTP ${createRes.status}): ${body.slice(0, 200)}`);
   }
@@ -576,8 +600,12 @@ async function bootstrapBot(opts: BootstrapBotOpts): Promise<string> {
     );
   }
   const patBody = await patRes.text();
-  const match = patBody.match(/<input[^>]*id="t"[^>]*value="([a-f0-9]{40})"/)
-    ?? patBody.match(/<input[^>]*value="([a-f0-9]{40})"[^>]*id="t"/);
+  // S-2: scrape regex is attribute-order-independent — accepts both
+  // `<input id="t" value="...">` and `<input value="..." id="t">`.
+  // Case-insensitive (i flag) so XHTML-style `<INPUT VALUE="...">` from
+  // ework-web template tweaks doesn't silently break scraping.
+  const match = patBody.match(/<input[^>]*id="t"[^>]*value="([a-f0-9]{40})"/i)
+    ?? patBody.match(/<input[^>]*value="([a-f0-9]{40})"[^>]*id="t"/i);
   if (!match || !match[1]) {
     throw new InstallError(`could not extract PAT from token-create response`);
   }

package/src/env.ts

@@ -8,6 +8,7 @@
 
 import fs from "node:fs";
 import path from "node:path";
+import { randomBytes } from "node:crypto";
 import { keysForFile, type EnvFile, type InstallContext } from "./config.ts";
 
 export interface EnvMap {
@@ -46,12 +47,26 @@ export function parseEnvFile(content: string): ParsedEnvFile {
     if (eqIdx === -1) continue;
     const key = line.slice(0, eqIdx).trim();
     let value = line.slice(eqIdx + 1);
-    // Strip matching surrounding quotes if present.
+    // Strip matching surrounding quotes if present. Also unescape common
+    // backslash sequences (\\, \", \') so embedded quotes survive the
+    // round-trip. Without unescaping, a value written as KEY="a\"b"
+    // parses as `a\"b` (literal backslash) — silent data corruption
+    // when an env value contains an embedded quote (URLs with apostrophes,
+    // file paths with spaces, etc).
     if (
       (value.startsWith('"') && value.endsWith('"')) ||
       (value.startsWith("'") && value.endsWith("'"))
     ) {
+      const quote = value[0]!;
       value = value.slice(1, -1);
+      if (quote === '"') {
+        value = value.replace(/\\(.)/g, (_m, ch: string) => {
+          if (ch === "n") return "\n";
+          if (ch === "t") return "\t";
+          if (ch === "r") return "\r";
+          return ch; // \\, \", \', \$, etc → drop the backslash
+        });
+      }
     }
     if (key) entries.set(key, value);
   }
@@ -119,7 +134,11 @@ export async function readEnvFile(filePath: string): Promise<ParsedEnvFile | nul
 export async function writeEnvFileAtomic(filePath: string, content: string): Promise<void> {
   const dir = path.dirname(filePath);
   await fs.promises.mkdir(dir, { recursive: true });
-  const tmp = path.join(dir, `.env.tmp.${process.pid}.${Date.now()}`);
+  // Include randomBytes in the tmp name so two concurrent writes (e.g.
+  // install + config set racing on the same .env) don't clobber each
+  // other's tmp file. Date.now alone collides if both happen in the same ms.
+  const suffix = `${process.pid}.${Date.now()}.${randomBytes(4).toString("hex")}`;
+  const tmp = path.join(dir, `.env.tmp.${suffix}`);
   await fs.promises.writeFile(tmp, content, { mode: 0o600 });
   try {
     await fs.promises.rename(tmp, filePath);

package/src/log.ts

@@ -12,7 +12,12 @@ interface WritableStreamLike {
 }
 
 function colorEnabled(stream: WritableStreamLike): boolean {
-  if (process.env.NO_COLOR) return false;
+  // Per no-color.org spec: ANY presence of NO_COLOR in the environment
+  // (including empty string) disables color. The truthy check
+  // `if (process.env.NO_COLOR)` treats `NO_COLOR=` as "not set", which
+  // violates the spec and surprises users who export the empty value
+  // explicitly (e.g. shell rc files).
+  if ("NO_COLOR" in process.env) return false;
   if (process.env.FORCE_COLOR) return true;
   return stream.isTTY ?? false;
 }

package/src/paths.ts

@@ -50,7 +50,14 @@ export interface ResolvePathsOptions {
 export function resolvePaths(opts: ResolvePathsOptions): PathConfig {
   const home = os.homedir();
   const xdgDataHome = process.env.XDG_DATA_HOME || path.join(home, ".local", "share");
-  const xdgConfigHome = process.env.XDG_CONFIG_HOME || opts.configHome || path.join(home, ".config");
+  // opts.configHome takes precedence over XDG_CONFIG_HOME so tests can
+  // pin a config dir without polluting or reading the user's real
+  // ~/.config. The previous precedence (env || opts || default) meant
+  // a developer with XDG_CONFIG_HOME set couldn't override it from tests,
+  // and test runs would leak into the real config dir.
+  const xdgConfigHome = opts.configHome
+    || process.env.XDG_CONFIG_HOME
+    || path.join(home, ".config");
 
   const dataDir = opts.dataDir || path.join(xdgDataHome, "ework-aio");
   const webDataDir = path.join(dataDir, "ework-web");

package/src/pidfile.ts

@@ -8,6 +8,7 @@
 import { spawn, type ChildProcess } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
+import { randomBytes } from "node:crypto";
 
 export interface StartProcessOptions {
   cmd: string;
@@ -83,7 +84,8 @@ export async function startProcess(opts: StartProcessOptions): Promise<StartProc
 export async function writePidFileAtomic(pidFile: string, pid: number): Promise<void> {
   const dir = path.dirname(pidFile);
   await fs.promises.mkdir(dir, { recursive: true });
-  const tmp = path.join(dir, `.pid.tmp.${process.pid}.${Date.now()}`);
+  const suffix = `${process.pid}.${Date.now()}.${randomBytes(4).toString("hex")}`;
+  const tmp = path.join(dir, `.pid.tmp.${suffix}`);
   await fs.promises.writeFile(tmp, `${pid}\n`, { mode: 0o644 });
   try {
     await fs.promises.rename(tmp, pidFile);