ework-aio 0.2.5 → 0.2.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-aio",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "All-in-one installer for ework (issue tracker) + ework-daemon (AI bridge) + opencode-ework (plugin). One command: npm i -g ework-aio && ework-aio install.",
   "type": "module",
   "license": "MIT",
@@ -41,6 +41,8 @@
     "start": "bun bin/ework-aio.js",
     "check": "tsc --noEmit",
     "test": "bun test",
+    "test:e2e": "bash scripts/e2e-install.sh",
+    "test:regression": "bash scripts/regression.sh",
     "postinstall": "echo '\\n  ework-aio installed. Run \\033[1mework-aio install\\033[0m to set up services.\\n  Help: ework-aio --help\\n'"
   },
   "dependencies": {

package/scripts/e2e-install.sh

@@ -0,0 +1,213 @@
+#!/usr/bin/env bash
+# End-to-end install test.
+#
+# Spawns a clean debian container (via Dockerfile.regression) and runs the
+# FULL `ework-aio install` flow — not a hand-rolled .env like the older
+# regression.sh. This is the test that would have caught every bug we
+# shipped between v0.2.0 and v0.2.6:
+#
+#   - v0.2.4 plugin key fix    → caught by issue-create → daemon receives webhook
+#   - v0.2.5 daemon binary fix → caught by /api/status probe (was printing help)
+#   - v0.2.6 webhook secret    → caught by "no invalid signature in daemon.log"
+#   - v0.2.6 access log        → caught by "no EACCES in web.log"
+#
+# Usage: ./scripts/e2e-install.sh [container-runtime] [npm-tag]
+#   container-runtime: docker (default) | podman
+#   npm-tag:           latest (default) | 0.2.6 | file:.. (for local builds)
+
+set -euo pipefail
+
+RUNTIME="${1:-docker}"
+NPM_TAG="${2:-latest}"
+IMAGE="${IMAGE:-ework-aio:e2e}"
+
+c_grn=$'\033[32m'; c_red=$'\033[31m'; c_ylw=$'\033[33m'; c_rst=$'\033[0m'
+pass() { printf '%sPASS%s %s\n' "$c_grn" "$c_rst" "$*"; }
+fail() { printf '%sFAIL%s %s\n' "$c_red" "$c_rst" "$*"; exit 1; }
+info() { printf '%s…%s %s\n' "$c_ylw" "$c_rst" "$*" >&2; }
+
+if ! "$RUNTIME" image inspect "$IMAGE" >/dev/null 2>&1; then
+  info "Building $IMAGE"
+  # Build context = repo root (this script's parent dir + ..). Lets us invoke
+  # the script from anywhere (npm run test:e2e, CI, etc.) without cwd issues.
+  REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+  "$RUNTIME" build --network=host -f "$REPO_ROOT/Dockerfile.regression" \
+    -t "$IMAGE" "$REPO_ROOT"
+fi
+
+info "Using image: $IMAGE  (testing npm tag: $NPM_TAG)"
+
+# Unique ports so we don't collide with a host-side ework stack when run with
+# --network host. Override via env if needed.
+WORK_PORT="${WORK_PORT:-14002}"
+DAEMON_PORT="${DAEMON_PORT:-14101}"
+
+# opencode binary is host-specific (path may differ across machines). Mount
+# readonly so the container preflight sees it on PATH. Override via env.
+OPENCODE_HOST_BIN="${OPENCODE_HOST_BIN:-/home/dog/.local/bin/opencode}"
+
+"$RUNTIME" run --rm -i --network host \
+  -v "$OPENCODE_HOST_BIN:/usr/local/bin/opencode:ro" \
+  -e WORK_PORT="$WORK_PORT" \
+  -e DAEMON_PORT="$DAEMON_PORT" \
+  -e NPM_TAG="$NPM_TAG" \
+  -e HTTP_PROXY="${HTTP_PROXY:-}" \
+  -e HTTPS_PROXY="${HTTPS_PROXY:-}" \
+  -e http_proxy="${HTTP_PROXY:-}" \
+  -e https_proxy="${HTTPS_PROXY:-}" \
+  -e NO_PROXY="127.0.0.1,localhost" \
+  "$IMAGE" bash -euo pipefail <<'EOSCRIPT'
+set -euo pipefail
+
+c_grn=$'\033[32m'; c_red=$'\033[31m'; c_ylw=$'\033[33m'; c_rst=$'\033[0m'
+pass() { printf '%sPASS%s %s\n' "$c_grn" "$c_rst" "$*"; }
+fail() { printf '%sFAIL%s %s\n' "$c_red" "$c_rst" "$*"; exit 1; }
+info() { printf '%s…%s %s\n' "$c_ylw" "$c_rst" "$*" >&2; }
+
+WORK_PORT="${WORK_PORT:-14002}"
+DAEMON_PORT="${DAEMON_PORT:-14101}"
+NPM_TAG="${NPM_TAG:-latest}"
+DATA_DIR=/tmp/aio-e2e
+
+info "clean state"
+rm -rf "$DATA_DIR"
+mkdir -p "$DATA_DIR"
+
+info "opencode binary on PATH"
+opencode --version | head -1
+
+info "npm install -g ework-web@${NPM_TAG} ework-daemon@latest ework-aio@${NPM_TAG}"
+# Note: ework-web and ework-daemon aren't version-locked to ework-aio. We
+# always install latest of the services and only parameterize ework-aio so
+# we can E2E-test a PR branch against published services.
+for pkg in ework-web ework-daemon opencode-ework; do
+  npm install -g "$pkg@latest" 2>&1 | tail -2
+done
+npm install -g "ework-aio@${NPM_TAG}" 2>&1 | tail -2
+
+info "v0.2.5 regression: all 4 bins on PATH"
+for b in ework-aio ework-web ework-daemon ework-daemon-server; do
+  command -v "$b" >/dev/null 2>&1 || fail "$b not on PATH"
+  pass "$b -> $(command -v "$b")"
+done
+
+info "run ework-aio install (the real installer — no hand-rolled .env)"
+# --allow-root: container runs as root; refusing would test an unrealistic
+# path. The installer's data still lands in /tmp/aio-e2e via --data-dir.
+ework-aio install \
+  --allow-root \
+  --data-dir "$DATA_DIR" \
+  --port "$WORK_PORT" \
+  --daemon-port "$DAEMON_PORT" \
+  --bot-name e2e-bot \
+  --yes 2>&1 | tee /tmp/install.log
+
+pass "install exited 0"
+
+info "v0.2.6 regression: webhook secrets match across web and daemon .env"
+WEB_SEC=$(grep ^WORK_DAEMON_WEBHOOK_SECRET= "$DATA_DIR/ework-web/.env" | cut -d= -f2-)
+DAE_SEC=$(grep ^GITEA_WEBHOOK_SECRET= "$DATA_DIR/ework-daemon/.env" | cut -d= -f2-)
+[[ -n "$WEB_SEC" ]] || fail "WORK_DAEMON_WEBHOOK_SECRET empty in web .env"
+[[ -n "$DAE_SEC" ]] || fail "GITEA_WEBHOOK_SECRET empty in daemon .env"
+[[ "$WEB_SEC" == "$DAE_SEC" ]] \
+  || fail "webhook secrets differ (web=$WEB_SEC daemon=$DAE_SEC)"
+pass "secrets match (${#WEB_SEC} chars)"
+
+info "v0.2.6 regression: WORK_ACCESS_LOG set, not defaulting to /tmp/ework-access.log"
+ACCESS_LOG_VAL=$(grep ^WORK_ACCESS_LOG= "$DATA_DIR/ework-web/.env" | cut -d= -f2-)
+[[ -n "$ACCESS_LOG_VAL" ]] || fail "WORK_ACCESS_LOG missing from web .env"
+[[ "$ACCESS_LOG_VAL" != "/tmp/ework-access.log" ]] \
+  || fail "WORK_ACCESS_LOG still defaults to /tmp/ework-access.log"
+pass "WORK_ACCESS_LOG=$ACCESS_LOG_VAL"
+
+info "wait for ework-web /login"
+for i in $(seq 1 60); do
+  if curl -sf -o /dev/null "http://127.0.0.1:$WORK_PORT/login"; then
+    pass "/login responds (after ${i} half-seconds)"
+    break
+  fi
+  sleep 0.5
+  [[ $i -eq 60 ]] && { tail -30 "$DATA_DIR/run/web.log" 2>/dev/null; fail "ework-web did not come up"; }
+done
+
+info "wait for daemon /api/status"
+for i in $(seq 1 60); do
+  if curl -sf -o /dev/null "http://127.0.0.1:$DAEMON_PORT/api/status"; then
+    pass "/api/status responds (after ${i} half-seconds)"
+    break
+  fi
+  sleep 0.5
+  [[ $i -eq 60 ]] && { tail -30 "$DATA_DIR/run/daemon.log" 2>/dev/null; fail "daemon did not come up"; }
+done
+
+info "v0.2.6 regression: no EACCES in web.log"
+sleep 1
+if grep -q "EACCES" "$DATA_DIR/run/web.log" 2>/dev/null; then
+  fail "EACCES in web.log:"
+  grep EACCES "$DATA_DIR/run/web.log" | head -3
+fi
+pass "no EACCES in web.log"
+
+info "v0.2.6 regression: no invalid signature in daemon.log (pre-issue-create)"
+if grep -q "invalid signature" "$DATA_DIR/run/daemon.log" 2>/dev/null; then
+  fail "invalid signature BEFORE issue create — autoWire webhook must have fired"
+  grep "invalid signature" "$DATA_DIR/run/daemon.log" | head -3
+fi
+pass "no invalid signature yet"
+
+info "build admin auth cookie"
+WORK_TOKEN=$(grep ^WORK_TOKEN= "$DATA_DIR/ework-web/.env" | cut -d= -f2-)
+WORK_COOKIE_SECRET=$(grep ^WORK_COOKIE_SECRET= "$DATA_DIR/ework-web/.env" | cut -d= -f2-)
+COOKIE_SIG=$(printf '%s' "$WORK_TOKEN" \
+  | openssl dgst -sha256 -hmac "$WORK_COOKIE_SECRET" -binary \
+  | base64 | tr '+/' '-_' | tr -d '=')
+AUTH_COOKIE="ework_auth=${WORK_TOKEN}.${COOKIE_SIG}"
+
+info "create test project (triggers autoWire webhook registration)"
+PROJ_CODE=$(curl -sS -o /dev/null -w '%{http_code}' -X POST \
+  "http://127.0.0.1:$WORK_PORT/projects" \
+  -H "Cookie: $AUTH_COOKIE" \
+  --data-urlencode 'owner=e2e' \
+  --data-urlencode 'name=test')
+[[ "$PROJ_CODE" == "303" || "$PROJ_CODE" == "302" ]] \
+  || fail "project create failed: HTTP $PROJ_CODE"
+pass "project create -> $PROJ_CODE"
+
+info "create issue (triggers webhook POST to daemon)"
+ISSUE_HEAD=$(curl -sS -i -X POST \
+  "http://127.0.0.1:$WORK_PORT/e2e/test/issues" \
+  -H "Cookie: $AUTH_COOKIE" \
+  --data-urlencode 'title=e2e test' \
+  --data-urlencode 'body=trigger webhook')
+ISSUE_STATUS=$(printf '%s\n' "$ISSUE_HEAD" | head -1 | awk '{print $2}')
+[[ "$ISSUE_STATUS" == "303" ]] \
+  || fail "issue create did not return 303: $ISSUE_STATUS"
+pass "issue create -> 303"
+
+info "wait for webhook delivery + daemon processing"
+sleep 5
+
+info "v0.2.6 regression: webhook was accepted (no invalid signature after issue create)"
+if grep -q "invalid signature" "$DATA_DIR/run/daemon.log" 2>/dev/null; then
+  fail "invalid signature AFTER issue create — webhook secret mismatch"
+  grep "invalid signature" "$DATA_DIR/run/daemon.log" | head -5
+fi
+pass "no invalid signature after issue create"
+
+info "daemon received the issue event"
+ACTIVE=$(curl -sS "http://127.0.0.1:$DAEMON_PORT/api/status" | jq -r '.issues // 0')
+[[ "$ACTIVE" -ge 1 ]] \
+  || fail "daemon did not register the issue (issues=$ACTIVE)"
+pass "daemon registered issue (issues=$ACTIVE)"
+
+echo
+echo "===== E2E PASSED ====="
+echo "  ework-aio version: $(ework-aio --version 2>/dev/null || echo unknown)"
+echo "  data dir:          $DATA_DIR"
+echo "  web:               http://127.0.0.1:$WORK_PORT/login"
+echo "  daemon:            http://127.0.0.1:$DAEMON_PORT/api/status"
+echo "  logs:              $DATA_DIR/run/{web,daemon}.log"
+EOSCRIPT
+
+echo
+echo "${c_grn}E2E COMPLETE${c_rst}"

package/src/cli.ts

@@ -35,7 +35,7 @@ import {
   type ConfigArgs,
 } from "./commands/config.ts";
 
-const VERSION = "0.2.5-dev";
+const VERSION = "0.2.7-dev";
 
 const USAGE = `ework-aio <command> [options]
 

package/src/commands/install.ts

@@ -357,6 +357,25 @@ export async function runInstall(
     await patchEnvKey(paths.daemonEnvFile, "GITEA_TOKEN", botToken);
   }
 
+  // 10.5 Reconcile webhook secret across web and daemon .env files.
+  // Pre-v0.2.6 installs generated two independent hex(20) values for
+  // WORK_DAEMON_WEBHOOK_SECRET (web) and GITEA_WEBHOOK_SECRET (daemon),
+  // so signature verification always failed. Forward-fill won't fix this
+  // because both keys already exist. We treat web as the source of truth
+  // (ework-web's DB has webhook rows signed with whatever
+  // WORK_DAEMON_WEBHOOK_SECRET was at creation time) and overwrite daemon.
+  {
+    const webSecret = await readEnvKey(paths.webEnvFile, "WORK_DAEMON_WEBHOOK_SECRET");
+    const daemonSecret = await readEnvKey(paths.daemonEnvFile, "GITEA_WEBHOOK_SECRET");
+    if (webSecret && daemonSecret && webSecret !== daemonSecret) {
+      await patchEnvKey(paths.daemonEnvFile, "GITEA_WEBHOOK_SECRET", webSecret);
+      logger.warn(`webhook secret mismatch — overwrote daemon GITEA_WEBHOOK_SECRET to match web`);
+    } else if (webSecret && !daemonSecret) {
+      await patchEnvKey(paths.daemonEnvFile, "GITEA_WEBHOOK_SECRET", webSecret);
+      logger.ok(`propagated WORK_DAEMON_WEBHOOK_SECRET → GITEA_WEBHOOK_SECRET`);
+    }
+  }
+
   // 11. (Systemd only) Write + install daemon unit.
   if (opts.useSystemd && paths.daemonUnitFile && systemdOk && !opts.noStart) {
     const userInfo = os.userInfo();

package/src/config.ts

@@ -38,6 +38,26 @@ export interface EnvKeySpec {
 
 const hex = (bytes: number): string => randomBytes(bytes).toString("hex");
 
+// ework-web signs outgoing webhook POSTs with WORK_DAEMON_WEBHOOK_SECRET
+// and ework-daemon verifies them with GITEA_WEBHOOK_SECRET. They MUST be
+// the same value — pre-v0.2.6 each key had an independent hex(20) generator,
+// so the two secrets never matched and every webhook was rejected with
+// "invalid signature" on the daemon side.
+//
+// The closure-memoized `sharedWebhookSecret` returns the same value across
+// both calls within a single install run, so first install is correct.
+// Reconciliation for already-broken installs lives in install.ts (it reads
+// both .env files and, if they differ, overwrites the daemon side from the
+// web side — web is the source of truth because ework-web's DB has webhooks
+// signed with whatever WORK_DAEMON_WEBHOOK_SECRET was at creation time).
+let _sharedWebhookSecret: string | null = null;
+function sharedWebhookSecret(): string {
+  if (_sharedWebhookSecret === null) {
+    _sharedWebhookSecret = hex(20);
+  }
+  return _sharedWebhookSecret;
+}
+
 export const WEB_ENV_KEYS: readonly EnvKeySpec[] = [
   { envVar: "WORK_PORT",                   file: "web", generate: (c) => String(c.workPort) },
   { envVar: "WORK_HOST",                   file: "web", generate: () => "127.0.0.1" },
@@ -48,9 +68,13 @@ export const WEB_ENV_KEYS: readonly EnvKeySpec[] = [
   { envVar: "WORK_DB_PATH",                file: "web", generate: (c) => c.paths.webDbPath },
   { envVar: "WORK_ATTACHMENT_ROOT",        file: "web", generate: (c) => c.paths.webAttachmentRoot },
   { envVar: "WORK_FILE_ROOTS",             file: "web", generate: (c) => `/tmp,${c.paths.dataDir}` },
+  // Without this, ework-web falls back to /tmp/ework-access.log which is
+  // owned by whichever user touched it first. On shared boxes the runtime
+  // user can't append → "EACCES: permission denied" on every request.
+  { envVar: "WORK_ACCESS_LOG",             file: "web", generate: (c) => `${c.paths.runDir}/web-access.log` },
   { envVar: "WORK_DAEMON_BOT_LOGIN",       file: "web", generate: (c) => c.botName },
   { envVar: "WORK_DAEMON_WEBHOOK_URL",     file: "web", generate: (c) => `http://127.0.0.1:${c.daemonPort}` },
-  { envVar: "WORK_DAEMON_WEBHOOK_SECRET",  file: "web", secret: true, generate: () => hex(20) },
+  { envVar: "WORK_DAEMON_WEBHOOK_SECRET",  file: "web", secret: true, generate: sharedWebhookSecret },
 ] as const;
 
 export const DAEMON_ENV_KEYS: readonly EnvKeySpec[] = [
@@ -62,7 +86,7 @@ export const DAEMON_ENV_KEYS: readonly EnvKeySpec[] = [
   // These tokens come from the bot bootstrap flow — empty placeholder here,
   // filled in by write_daemon_env after PAT is minted.
   { envVar: "GITEA_TOKEN",            file: "daemon", secret: true, generate: () => "" },
-  { envVar: "GITEA_WEBHOOK_SECRET",   file: "daemon", secret: true, generate: (c) => hex(20) },
+  { envVar: "GITEA_WEBHOOK_SECRET",   file: "daemon", secret: true, generate: sharedWebhookSecret },
   { envVar: "BOT_USERNAME",           file: "daemon", generate: (c) => c.botName },
   { envVar: "BOT_TOKEN",              file: "daemon", secret: true, generate: () => "" },
   { envVar: "OPENCODE_BINARY",        file: "daemon", generate: (c) => c.opencodeBin },