ework-aio 0.2.4 → 0.2.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-aio",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "All-in-one installer for ework (issue tracker) + ework-daemon (AI bridge) + opencode-ework (plugin). One command: npm i -g ework-aio && ework-aio install.",
   "type": "module",
   "license": "MIT",

package/src/cli.ts

@@ -35,7 +35,7 @@ import {
   type ConfigArgs,
 } from "./commands/config.ts";
 
-const VERSION = "0.2.4-dev";
+const VERSION = "0.2.6-dev";
 
 const USAGE = `ework-aio <command> [options]
 

package/src/commands/install.ts

@@ -97,20 +97,35 @@ export async function runInstall(
   logger.ok(`preflight: bun, npm, opencode all on PATH`);
 
   // 2. Resolve ework-web / ework-daemon binaries (npm-installed global bins).
+  //
+  // ework-daemon ships TWO bins: `ework-daemon` (client CLI: status/issues/...)
+  // and `ework-daemon-server` (actual HTTP server). We start the SERVER, not
+  // the client — pre-v0.2.5 we spawned the client, which prints help and
+  // exits, leaving the daemon "looking dead" with a help-text log.
   const webBin = resolveCommand("ework-web");
-  const daemonBin = resolveCommand("ework-daemon");
+  const daemonClientBin = resolveCommand("ework-daemon");
+  const daemonServerBin = resolveCommand("ework-daemon-server");
   if (!webBin) {
     throw new InstallError(
       `ework-web binary not found on PATH. Install with: npm install -g ework-web`,
     );
   }
-  if (!daemonBin) {
+  if (!daemonClientBin && !daemonServerBin) {
+    throw new InstallError(
+      `ework-daemon not installed. Install with: npm install -g ework-daemon`,
+    );
+  }
+  if (!daemonServerBin) {
+    // Client CLI present but server bin missing — old / partial install.
     throw new InstallError(
-      `ework-daemon binary not found on PATH. Install with: npm install -g ework-daemon`,
+      `ework-daemon-server binary not found on PATH, but ework-daemon (client) is present. ` +
+        `Your ework-daemon npm install is incomplete or outdated. Reinstall with: ` +
+        `npm install -g ework-daemon@latest`,
     );
   }
-  logger.ok(`web bin    : ${webBin}`);
-  logger.ok(`daemon bin : ${daemonBin}`);
+  logger.ok(`web bin         : ${webBin}`);
+  logger.ok(`daemon client   : ${daemonClientBin ?? "(not on PATH)"}`);
+  logger.ok(`daemon server   : ${daemonServerBin}`);
 
   // 3. Resolve all filesystem paths.
   const paths = resolvePaths({
@@ -342,6 +357,25 @@ export async function runInstall(
     await patchEnvKey(paths.daemonEnvFile, "GITEA_TOKEN", botToken);
   }
 
+  // 10.5 Reconcile webhook secret across web and daemon .env files.
+  // Pre-v0.2.6 installs generated two independent hex(20) values for
+  // WORK_DAEMON_WEBHOOK_SECRET (web) and GITEA_WEBHOOK_SECRET (daemon),
+  // so signature verification always failed. Forward-fill won't fix this
+  // because both keys already exist. We treat web as the source of truth
+  // (ework-web's DB has webhook rows signed with whatever
+  // WORK_DAEMON_WEBHOOK_SECRET was at creation time) and overwrite daemon.
+  {
+    const webSecret = await readEnvKey(paths.webEnvFile, "WORK_DAEMON_WEBHOOK_SECRET");
+    const daemonSecret = await readEnvKey(paths.daemonEnvFile, "GITEA_WEBHOOK_SECRET");
+    if (webSecret && daemonSecret && webSecret !== daemonSecret) {
+      await patchEnvKey(paths.daemonEnvFile, "GITEA_WEBHOOK_SECRET", webSecret);
+      logger.warn(`webhook secret mismatch — overwrote daemon GITEA_WEBHOOK_SECRET to match web`);
+    } else if (webSecret && !daemonSecret) {
+      await patchEnvKey(paths.daemonEnvFile, "GITEA_WEBHOOK_SECRET", webSecret);
+      logger.ok(`propagated WORK_DAEMON_WEBHOOK_SECRET → GITEA_WEBHOOK_SECRET`);
+    }
+  }
+
   // 11. (Systemd only) Write + install daemon unit.
   if (opts.useSystemd && paths.daemonUnitFile && systemdOk && !opts.noStart) {
     const userInfo = os.userInfo();
@@ -349,7 +383,7 @@ export async function runInstall(
       user: userInfo.username,
       group: userInfo.username,
       binPath: preflight.found.get("bun")!,
-      mainScript: daemonBin,
+      mainScript: daemonServerBin,
       envFile: paths.daemonEnvFile,
       workingDirectory: paths.daemonDataDir,
       logFile: paths.daemonLogFile,
@@ -388,7 +422,7 @@ export async function runInstall(
       logger.log(`starting ework-daemon (PID-file mode)...`);
       const env = await loadEnvIntoProcess(paths.daemonEnvFile);
       const { pid } = await startProcess({
-        cmd: daemonBin,
+        cmd: daemonServerBin,
         args: [],
         cwd: paths.daemonDataDir,
         env,

package/src/commands/lifecycle.ts

@@ -41,7 +41,11 @@ function servicePaths(paths: PathConfig, svc: "web" | "daemon"): ServicePaths {
     };
   }
   return {
-    bin: "ework-daemon",
+    // ework-daemon ships two bins; only `ework-daemon-server` actually starts
+    // the HTTP server. The `ework-daemon` bin is a client CLI that prints help
+    // and exits — spawning it leaves the daemon "looking dead" with help text
+    // in the log. See install.ts preflight for the full rationale.
+    bin: "ework-daemon-server",
     dataDir: paths.daemonDataDir,
     envFile: paths.daemonEnvFile,
     pidFile: paths.daemonPidFile,

package/src/config.ts

@@ -38,6 +38,26 @@ export interface EnvKeySpec {
 
 const hex = (bytes: number): string => randomBytes(bytes).toString("hex");
 
+// ework-web signs outgoing webhook POSTs with WORK_DAEMON_WEBHOOK_SECRET
+// and ework-daemon verifies them with GITEA_WEBHOOK_SECRET. They MUST be
+// the same value — pre-v0.2.6 each key had an independent hex(20) generator,
+// so the two secrets never matched and every webhook was rejected with
+// "invalid signature" on the daemon side.
+//
+// The closure-memoized `sharedWebhookSecret` returns the same value across
+// both calls within a single install run, so first install is correct.
+// Reconciliation for already-broken installs lives in install.ts (it reads
+// both .env files and, if they differ, overwrites the daemon side from the
+// web side — web is the source of truth because ework-web's DB has webhooks
+// signed with whatever WORK_DAEMON_WEBHOOK_SECRET was at creation time).
+let _sharedWebhookSecret: string | null = null;
+function sharedWebhookSecret(): string {
+  if (_sharedWebhookSecret === null) {
+    _sharedWebhookSecret = hex(20);
+  }
+  return _sharedWebhookSecret;
+}
+
 export const WEB_ENV_KEYS: readonly EnvKeySpec[] = [
   { envVar: "WORK_PORT",                   file: "web", generate: (c) => String(c.workPort) },
   { envVar: "WORK_HOST",                   file: "web", generate: () => "127.0.0.1" },
@@ -48,9 +68,13 @@ export const WEB_ENV_KEYS: readonly EnvKeySpec[] = [
   { envVar: "WORK_DB_PATH",                file: "web", generate: (c) => c.paths.webDbPath },
   { envVar: "WORK_ATTACHMENT_ROOT",        file: "web", generate: (c) => c.paths.webAttachmentRoot },
   { envVar: "WORK_FILE_ROOTS",             file: "web", generate: (c) => `/tmp,${c.paths.dataDir}` },
+  // Without this, ework-web falls back to /tmp/ework-access.log which is
+  // owned by whichever user touched it first. On shared boxes the runtime
+  // user can't append → "EACCES: permission denied" on every request.
+  { envVar: "WORK_ACCESS_LOG",             file: "web", generate: (c) => `${c.paths.runDir}/web-access.log` },
   { envVar: "WORK_DAEMON_BOT_LOGIN",       file: "web", generate: (c) => c.botName },
   { envVar: "WORK_DAEMON_WEBHOOK_URL",     file: "web", generate: (c) => `http://127.0.0.1:${c.daemonPort}` },
-  { envVar: "WORK_DAEMON_WEBHOOK_SECRET",  file: "web", secret: true, generate: () => hex(20) },
+  { envVar: "WORK_DAEMON_WEBHOOK_SECRET",  file: "web", secret: true, generate: sharedWebhookSecret },
 ] as const;
 
 export const DAEMON_ENV_KEYS: readonly EnvKeySpec[] = [
@@ -62,7 +86,7 @@ export const DAEMON_ENV_KEYS: readonly EnvKeySpec[] = [
   // These tokens come from the bot bootstrap flow — empty placeholder here,
   // filled in by write_daemon_env after PAT is minted.
   { envVar: "GITEA_TOKEN",            file: "daemon", secret: true, generate: () => "" },
-  { envVar: "GITEA_WEBHOOK_SECRET",   file: "daemon", secret: true, generate: (c) => hex(20) },
+  { envVar: "GITEA_WEBHOOK_SECRET",   file: "daemon", secret: true, generate: sharedWebhookSecret },
   { envVar: "BOT_USERNAME",           file: "daemon", generate: (c) => c.botName },
   { envVar: "BOT_TOKEN",              file: "daemon", secret: true, generate: () => "" },
   { envVar: "OPENCODE_BINARY",        file: "daemon", generate: (c) => c.opencodeBin },