ework-aio 0.2.0 → 0.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-aio",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "All-in-one installer for ework (issue tracker) + ework-daemon (AI bridge) + opencode-ework (plugin). One command: npm i -g ework-aio && ework-aio install.",
   "type": "module",
   "license": "MIT",

package/src/cli.ts

@@ -35,7 +35,7 @@ import {
   type ConfigArgs,
 } from "./commands/config.ts";
 
-const VERSION = "0.2.0-dev";
+const VERSION = "0.2.2-dev";
 
 const USAGE = `ework-aio <command> [options]
 
@@ -110,6 +110,22 @@ function defaultOpts(): GlobalOptions {
 // on unknown flags / missing values. The shape is stable so tests can
 // exercise it without touching process.argv.
 export function parseArgs(argv: string[]): ParsedArgs {
+  // G1: normalize `--flag=value` (Unix-conventional equals form) into
+  // `--flag value` so the rest of the parser only handles the space
+  // form. Short flags (-h, -v, -y) don't get this treatment (they never
+  // take `=` syntax). Plain `--` (end-of-options marker) and tokens
+  // without `--` prefix are left alone.
+  const expanded: string[] = [];
+  for (const tok of argv) {
+    if (tok.length > 3 && tok.startsWith("--") && tok.indexOf("=") > 2) {
+      const eqIdx = tok.indexOf("=");
+      expanded.push(tok.slice(0, eqIdx), tok.slice(eqIdx + 1));
+    } else {
+      expanded.push(tok);
+    }
+  }
+  argv = expanded;
+
   const opts = defaultOpts();
   const positionals: string[] = [];
   const configArgs: ConfigArgs = { subcommand: "list" };
@@ -286,6 +302,27 @@ function parseServiceTarget(arg: string | undefined): ServiceTarget {
   );
 }
 
+// stripAsUserFlag: return argv without `--as-user <login>` (the flag and
+// its value), so the sudo'd child doesn't re-enter handleAsUser and loop.
+//
+// Iterates by index, NOT Array.filter on value. If the username happens to
+// appear in another argument (path component, common word like "install",
+// or a --bot-name matching the operator login), filter-on-value would
+// silently drop that token and corrupt the child's argv.
+export function stripAsUserFlag(argv: readonly string[]): string[] {
+  const out: string[] = [];
+  for (let i = 0; i < argv.length; i++) {
+    const tok = argv[i];
+    if (tok === undefined) break;
+    if (tok === "--as-user") {
+      i++; // also skip the value
+      continue;
+    }
+    out.push(tok);
+  }
+  return out;
+}
+
 // handleAsUser: when invoked with --as-user (typically via sudo), re-exec
 // the install as the named user after enabling linger. Skipped if not root
 // or no --as-user flag.
@@ -319,9 +356,9 @@ function handleAsUser(opts: GlobalOptions, argv: string[]): void {
     );
   }
 
-  // Re-exec as target user with --as-user stripped from argv.
+  // Re-exec as target user.
   const self = process.argv[1]!;
-  const newArgs = argv.filter((a) => a !== "--as-user" && a !== opts.asUser!);
+  const newArgs = stripAsUserFlag(argv);
   const result = spawnSync("sudo", ["-u", target, "--login", self, ...newArgs], {
     stdio: "inherit",
     env: process.env,

package/src/commands/install.ts

@@ -194,7 +194,6 @@ export async function runInstall(
       // this, `install systemd --user` produces units that die when the
       // user logs out — defeating the point of systemd mode. Best-effort.
       if (opts.scope === "user") {
-        const userInfo = os.userInfo();
         const linger = Bun.spawnSync(["loginctl", "enable-linger", userInfo.username], {
           env: process.env,
           stdout: "pipe", stderr: "pipe",
@@ -506,18 +505,30 @@ interface BootstrapBotOpts {
   fetchImpl?: FetchLike;
 }
 
-// bootstrapBot: faithful port of install.sh's bot user + PAT flow.
-// Uses the operator's token-derived cookie to drive ework-web's admin API,
-// then logs in as the bot to mint a PAT. Step-by-step idempotence:
-//   - create user: HTTP 303 = created, 400/409 = already exists (continue)
-//   - login as bot: required to get a session cookie for /me/tokens/create
-//   - mint PAT: scrape the token out of the HTML response (the only way
-//     ework-web exposes clear-text tokens, matching install.sh)
+// bootstrapBot: faithful port of install.sh's bot user + PAT flow, with
+// one critical correctness fix the bash version got wrong too.
+//
+// ework-web's /admin/users/create and /admin/users/<login>/reset-password
+// both follow the PRG (Post/Redirect/Get) pattern: they return HTTP 303
+// for BOTH success and failure, with the outcome encoded in the Location
+// URL's query string (?ok=1 vs ?err=<msg>). Status-code checks are
+// useless; we MUST inspect Location.
+//
+// Idempotence contract:
+//   1. POST /admin/users/create — best-effort. May fail with
+//      "已存在" / "exists" if bot user was left over from a prior install.
+//      Any OTHER error (invalid login, weak password, etc) → abort.
+//   2. POST /admin/users/<login>/reset-password — always. If the user
+//      was just created, this is a redundant no-op. If the user already
+//      existed, this overwrites the OLD random password (which we don't
+//      know) with our fresh one. Either way, /login below is guaranteed.
+//   3. POST /login — uses the password we just set.
+//   4. POST /me/tokens/create — scrape clear-text PAT from HTML.
 async function bootstrapBot(opts: BootstrapBotOpts): Promise<string> {
   const fetchImpl = opts.fetchImpl ?? fetch;
   const botPassword = randomBytes(24).toString("hex");
 
-  // 1. Create bot user via admin API.
+  // 1. Create bot user (best-effort).
   const createRes = await fetchImpl(`${opts.baseUrl}/admin/users/create`, {
     method: "POST",
     headers: { Cookie: opts.adminCookie, "Content-Type": "application/x-www-form-urlencoded" },
@@ -529,10 +540,35 @@ async function bootstrapBot(opts: BootstrapBotOpts): Promise<string> {
     }).toString(),
     redirect: "manual",
   });
-  // 303 = created, 400/409 = already exists. Anything else = abort.
-  if (![303, 400, 409].includes(createRes.status)) {
+  if (createRes.status !== 303) {
     const body = await createRes.text();
-    throw new InstallError(`create bot user failed (HTTP ${createRes.status}): ${body.slice(0, 200)}`);
+    throw new InstallError(`create bot user HTTP ${createRes.status}: ${body.slice(0, 200)}`);
+  }
+  const createErr = locationErrParam(createRes.headers.get("location"));
+  if (createErr && !isAlreadyExistsError(createErr)) {
+    // Real create failure (invalid login, weak password, etc). Don't try
+    // reset — the same problem would surface there too.
+    throw new InstallError(`create bot user rejected by ework-web: ${createErr}`);
+  }
+
+  // 2. Force-reset the password. Idempotent: sets the password to our
+  //    fresh value whether the user was just created or already existed.
+  const resetRes = await fetchImpl(
+    `${opts.baseUrl}/admin/users/${encodeURIComponent(opts.botLogin)}/reset-password`,
+    {
+      method: "POST",
+      headers: { Cookie: opts.adminCookie, "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ password: botPassword }).toString(),
+      redirect: "manual",
+    },
+  );
+  if (resetRes.status !== 303) {
+    const body = await resetRes.text();
+    throw new InstallError(`bot password reset HTTP ${resetRes.status}: ${body.slice(0, 200)}`);
+  }
+  const resetErr = locationErrParam(resetRes.headers.get("location"));
+  if (resetErr) {
+    throw new InstallError(`bot password reset rejected by ework-web: ${resetErr}`);
   }
 
   // 2. Login as bot to get its session cookie.
@@ -576,8 +612,12 @@ async function bootstrapBot(opts: BootstrapBotOpts): Promise<string> {
     );
   }
   const patBody = await patRes.text();
-  const match = patBody.match(/<input[^>]*id="t"[^>]*value="([a-f0-9]{40})"/)
-    ?? patBody.match(/<input[^>]*value="([a-f0-9]{40})"[^>]*id="t"/);
+  // S-2: scrape regex is attribute-order-independent — accepts both
+  // `<input id="t" value="...">` and `<input value="..." id="t">`.
+  // Case-insensitive (i flag) so XHTML-style `<INPUT VALUE="...">` from
+  // ework-web template tweaks doesn't silently break scraping.
+  const match = patBody.match(/<input[^>]*id="t"[^>]*value="([a-f0-9]{40})"/i)
+    ?? patBody.match(/<input[^>]*value="([a-f0-9]{40})"[^>]*id="t"/i);
   if (!match || !match[1]) {
     throw new InstallError(`could not extract PAT from token-create response`);
   }
@@ -607,6 +647,33 @@ function parseFirstCookie(headers: Headers): string | null {
   return null;
 }
 
+// locationErrParam: ework-web's admin POST endpoints use the PRG pattern,
+// returning HTTP 303 with the outcome in the Location URL's query string
+// (?ok=1 on success, ?err=<encoded msg> on failure). Extracts the err
+// value (decoded) or null if absent. Used by bootstrapBot to tell
+// "duplicate user" (recoverable via reset) from real failures (abort).
+function locationErrParam(location: string | null): string | null {
+  if (!location) return null;
+  try {
+    const url = new URL(location, "http://placeholder.invalid");
+    const err = url.searchParams.get("err");
+    return err ?? null;
+  } catch {
+    // Location wasn't a parseable URL — defensive fallback via regex.
+    const m = location.match(/[?&]err=([^&]+)/);
+    return m ? decodeURIComponent(m[1]!) : null;
+  }
+}
+
+// isAlreadyExistsError: ework-web's createUser throws StoreError(409,
+// "用户 X 已存在"). The Location redirect will carry this exact string
+// (URL-encoded). We accept both Chinese and English variants in case
+// ework-web changes its message later.
+function isAlreadyExistsError(err: string): boolean {
+  const lower = err.toLowerCase();
+  return lower.includes("已存在") || lower.includes("already exists") || lower.includes("duplicate");
+}
+
 function printSummary(logger: Logger, o: InstallOutcome): void {
   logger.hr();
   logger.ok(`install complete (${o.mode} mode)`);

package/src/env.ts

@@ -8,6 +8,7 @@
 
 import fs from "node:fs";
 import path from "node:path";
+import { randomBytes } from "node:crypto";
 import { keysForFile, type EnvFile, type InstallContext } from "./config.ts";
 
 export interface EnvMap {
@@ -46,12 +47,26 @@ export function parseEnvFile(content: string): ParsedEnvFile {
     if (eqIdx === -1) continue;
     const key = line.slice(0, eqIdx).trim();
     let value = line.slice(eqIdx + 1);
-    // Strip matching surrounding quotes if present.
+    // Strip matching surrounding quotes if present. Also unescape common
+    // backslash sequences (\\, \", \') so embedded quotes survive the
+    // round-trip. Without unescaping, a value written as KEY="a\"b"
+    // parses as `a\"b` (literal backslash) — silent data corruption
+    // when an env value contains an embedded quote (URLs with apostrophes,
+    // file paths with spaces, etc).
     if (
       (value.startsWith('"') && value.endsWith('"')) ||
       (value.startsWith("'") && value.endsWith("'"))
     ) {
+      const quote = value[0]!;
       value = value.slice(1, -1);
+      if (quote === '"') {
+        value = value.replace(/\\(.)/g, (_m, ch: string) => {
+          if (ch === "n") return "\n";
+          if (ch === "t") return "\t";
+          if (ch === "r") return "\r";
+          return ch; // \\, \", \', \$, etc → drop the backslash
+        });
+      }
     }
     if (key) entries.set(key, value);
   }
@@ -119,7 +134,11 @@ export async function readEnvFile(filePath: string): Promise<ParsedEnvFile | nul
 export async function writeEnvFileAtomic(filePath: string, content: string): Promise<void> {
   const dir = path.dirname(filePath);
   await fs.promises.mkdir(dir, { recursive: true });
-  const tmp = path.join(dir, `.env.tmp.${process.pid}.${Date.now()}`);
+  // Include randomBytes in the tmp name so two concurrent writes (e.g.
+  // install + config set racing on the same .env) don't clobber each
+  // other's tmp file. Date.now alone collides if both happen in the same ms.
+  const suffix = `${process.pid}.${Date.now()}.${randomBytes(4).toString("hex")}`;
+  const tmp = path.join(dir, `.env.tmp.${suffix}`);
   await fs.promises.writeFile(tmp, content, { mode: 0o600 });
   try {
     await fs.promises.rename(tmp, filePath);

package/src/log.ts

@@ -12,7 +12,12 @@ interface WritableStreamLike {
 }
 
 function colorEnabled(stream: WritableStreamLike): boolean {
-  if (process.env.NO_COLOR) return false;
+  // Per no-color.org spec: ANY presence of NO_COLOR in the environment
+  // (including empty string) disables color. The truthy check
+  // `if (process.env.NO_COLOR)` treats `NO_COLOR=` as "not set", which
+  // violates the spec and surprises users who export the empty value
+  // explicitly (e.g. shell rc files).
+  if ("NO_COLOR" in process.env) return false;
   if (process.env.FORCE_COLOR) return true;
   return stream.isTTY ?? false;
 }

package/src/paths.ts

@@ -50,7 +50,14 @@ export interface ResolvePathsOptions {
 export function resolvePaths(opts: ResolvePathsOptions): PathConfig {
   const home = os.homedir();
   const xdgDataHome = process.env.XDG_DATA_HOME || path.join(home, ".local", "share");
-  const xdgConfigHome = process.env.XDG_CONFIG_HOME || opts.configHome || path.join(home, ".config");
+  // opts.configHome takes precedence over XDG_CONFIG_HOME so tests can
+  // pin a config dir without polluting or reading the user's real
+  // ~/.config. The previous precedence (env || opts || default) meant
+  // a developer with XDG_CONFIG_HOME set couldn't override it from tests,
+  // and test runs would leak into the real config dir.
+  const xdgConfigHome = opts.configHome
+    || process.env.XDG_CONFIG_HOME
+    || path.join(home, ".config");
 
   const dataDir = opts.dataDir || path.join(xdgDataHome, "ework-aio");
   const webDataDir = path.join(dataDir, "ework-web");

package/src/pidfile.ts

@@ -8,6 +8,7 @@
 import { spawn, type ChildProcess } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
+import { randomBytes } from "node:crypto";
 
 export interface StartProcessOptions {
   cmd: string;
@@ -83,7 +84,8 @@ export async function startProcess(opts: StartProcessOptions): Promise<StartProc
 export async function writePidFileAtomic(pidFile: string, pid: number): Promise<void> {
   const dir = path.dirname(pidFile);
   await fs.promises.mkdir(dir, { recursive: true });
-  const tmp = path.join(dir, `.pid.tmp.${process.pid}.${Date.now()}`);
+  const suffix = `${process.pid}.${Date.now()}.${randomBytes(4).toString("hex")}`;
+  const tmp = path.join(dir, `.pid.tmp.${suffix}`);
   await fs.promises.writeFile(tmp, `${pid}\n`, { mode: 0o644 });
   try {
     await fs.promises.rename(tmp, pidFile);