ework-aio 0.2.7 → 0.2.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-aio",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "description": "All-in-one installer for ework (issue tracker) + ework-daemon (AI bridge) + opencode-ework (plugin). One command: npm i -g ework-aio && ework-aio install.",
   "type": "module",
   "license": "MIT",

package/scripts/e2e-install.sh

@@ -1,19 +1,24 @@
 #!/usr/bin/env bash
-# End-to-end install test.
+# End-to-end install + lifecycle + subcommand test.
 #
-# Spawns a clean debian container (via Dockerfile.regression) and runs the
-# FULL `ework-aio install` flow — not a hand-rolled .env like the older
-# regression.sh. This is the test that would have caught every bug we
-# shipped between v0.2.0 and v0.2.6:
+# Spawns a clean debian container (via Dockerfile.regression) and exercises:
+#   1. Install paths: --allow-root + re-install idempotency
+#   2. Service startup: web /login + daemon /api/status
+#   3. Subcommand smoke: status, env, config list/get/set, logs
+#   4. Service lifecycle: stop / start / restart (PIDs change)
+#   5. Issue flow: create project → create issue → daemon receives webhook
+#   6. Cleanup: uninstall removes pidfiles + kills services
 #
-#   - v0.2.4 plugin key fix    → caught by issue-create → daemon receives webhook
-#   - v0.2.5 daemon binary fix → caught by /api/status probe (was printing help)
-#   - v0.2.6 webhook secret    → caught by "no invalid signature in daemon.log"
-#   - v0.2.6 access log        → caught by "no EACCES in web.log"
+# Each block also documents which past bug the assertion prevents:
+#   v0.2.4 plugin key    → issue-create → daemon receives webhook
+#   v0.2.5 daemon binary → /api/status probe (was printing help + exiting 0)
+#   v0.2.6 secret drift  → "no invalid signature in daemon.log"
+#   v0.2.6 access log    → "no EACCES in web.log"
+#   v0.2.7+ regression   → all subcommands exit 0 with expected markers
 #
 # Usage: ./scripts/e2e-install.sh [container-runtime] [npm-tag]
 #   container-runtime: docker (default) | podman
-#   npm-tag:           latest (default) | 0.2.6 | file:.. (for local builds)
+#   npm-tag:           latest (default) | 0.2.7 | file:.. (for local builds)
 
 set -euo pipefail
 
@@ -38,9 +43,12 @@ fi
 info "Using image: $IMAGE  (testing npm tag: $NPM_TAG)"
 
 # Unique ports so we don't collide with a host-side ework stack when run with
-# --network host. Override via env if needed.
-WORK_PORT="${WORK_PORT:-14002}"
-DAEMON_PORT="${DAEMON_PORT:-14101}"
+# --network host. OVERRIDE via env only if you know what you're doing — by
+# default we IGNORE any inherited WORK_PORT/DAEMON_PORT from the host shell
+# (a host running ework-daemon on :3100 would otherwise leak into the test
+# and break assertions about which port the container's daemon binds to).
+WORK_PORT="14002"
+DAEMON_PORT="14101"
 
 # opencode binary is host-specific (path may differ across machines). Mount
 # readonly so the container preflight sees it on PATH. Override via env.
@@ -69,14 +77,96 @@ DAEMON_PORT="${DAEMON_PORT:-14101}"
 NPM_TAG="${NPM_TAG:-latest}"
 DATA_DIR=/tmp/aio-e2e
 
+# Defend against host env leak: the OUTER script always passes -e WORK_PORT
+# and -e DAEMON_PORT, but if the user invokes this heredoc directly from a
+# shell that has DAEMON_PORT set (e.g. their production daemon on :3100),
+# the assertions below will fail mysteriously. The values above are the
+# authoritative defaults; only override via the outer script's env passthrough.
+
+# -----------------------------------------------------------------------------
+# Helpers
+# -----------------------------------------------------------------------------
+
+# Poll a URL until it returns < 500, or fail after N half-seconds.
+wait_for_url() {
+  local url="$1" name="$2" half_seconds="${3:-60}"
+  for i in $(seq 1 "$half_seconds"); do
+    if curl -sf -o /dev/null "$url"; then
+      pass "$name responds (after ${i} half-seconds)"
+      return 0
+    fi
+    sleep 0.5
+  done
+  return 1
+}
+
+# Read .env key value (last match wins — install.ts overwrites keys in place).
+env_val() { grep "^$1=" "$2" | tail -1 | cut -d= -f2-; }
+
+# Build admin auth cookie from web .env.
+build_auth_cookie() {
+  local web_env="$DATA_DIR/ework-web/.env"
+  local token secret sig
+  token=$(env_val WORK_TOKEN "$web_env")
+  secret=$(env_val WORK_COOKIE_SECRET "$web_env")
+  sig=$(printf '%s' "$token" \
+    | openssl dgst -sha256 -hmac "$secret" -binary \
+    | base64 | tr '+/' '-_' | tr -d '=')
+  echo "ework_auth=${token}.${sig}"
+}
+
+# Read PID from pidfile (or echo empty if missing/empty).
+pid_of() {
+  local pf="$DATA_DIR/run/$1.pid"
+  [[ -f "$pf" ]] || { echo ""; return; }
+  echo "$(cat "$pf")"
+}
+
+# Is a PID alive?
+pid_alive() { kill -0 "$1" >/dev/null 2>&1; }
+
+# Wait for a service's pidfile PID to differ from the given "old" PID.
+wait_for_new_pid() {
+  local svc="$1" old_pid="$2" half_seconds="${3:-40}"
+  for i in $(seq 1 "$half_seconds"); do
+    local new_pid
+    new_pid=$(pid_of "$svc")
+    if [[ -n "$new_pid" && "$new_pid" != "$old_pid" ]] && pid_alive "$new_pid"; then
+      pass "$svc pid changed ($old_pid → $new_pid) after ${i} half-seconds"
+      return 0
+    fi
+    sleep 0.5
+  done
+  return 1
+}
+
+# Wait for a service's pidfile to vanish (or PID to die).
+wait_for_no_pid() {
+  local svc="$1" half_seconds="${2:-30}"
+  for i in $(seq 1 "$half_seconds"); do
+    local pid
+    pid=$(pid_of "$svc")
+    if [[ -z "$pid" ]] || ! pid_alive "$pid"; then
+      pass "$svc stopped (no live pid) after ${i} half-seconds"
+      return 0
+    fi
+    sleep 0.5
+  done
+  return 1
+}
+
+echo "====================================================="
+echo "Phase 0: clean state + npm install"
+echo "====================================================="
 info "clean state"
 rm -rf "$DATA_DIR"
 mkdir -p "$DATA_DIR"
 
 info "opencode binary on PATH"
 opencode --version | head -1
+pass "opencode present"
 
-info "npm install -g ework-web@${NPM_TAG} ework-daemon@latest ework-aio@${NPM_TAG}"
+info "npm install -g ework-web@latest ework-daemon@latest opencode-ework@latest ework-aio@${NPM_TAG}"
 # Note: ework-web and ework-daemon aren't version-locked to ework-aio. We
 # always install latest of the services and only parameterize ework-aio so
 # we can E2E-test a PR branch against published services.
@@ -85,13 +175,21 @@ for pkg in ework-web ework-daemon opencode-ework; do
 done
 npm install -g "ework-aio@${NPM_TAG}" 2>&1 | tail -2
 
+# -----------------------------------------------------------------------------
+# Phase 1: install paths
+# -----------------------------------------------------------------------------
+echo
+echo "====================================================="
+echo "Phase 1: install paths"
+echo "====================================================="
+
 info "v0.2.5 regression: all 4 bins on PATH"
 for b in ework-aio ework-web ework-daemon ework-daemon-server; do
   command -v "$b" >/dev/null 2>&1 || fail "$b not on PATH"
   pass "$b -> $(command -v "$b")"
 done
 
-info "run ework-aio install (the real installer — no hand-rolled .env)"
+info "install path A: --allow-root + custom ports + --yes"
 # --allow-root: container runs as root; refusing would test an unrealistic
 # path. The installer's data still lands in /tmp/aio-e2e via --data-dir.
 ework-aio install \
@@ -102,11 +200,33 @@ ework-aio install \
   --bot-name e2e-bot \
   --yes 2>&1 | tee /tmp/install.log
 
-pass "install exited 0"
+pass "install (path A) exited 0"
+
+info "install path B: re-install over existing data dir (idempotency)"
+# Re-running install should not crash on existing .env / pidfiles / webhooks.
+# This catches bugs where install.ts isn't idempotent (e.g. UNIQUE constraint
+# on second bot token, or "file exists" on second .env write).
+ework-aio install \
+  --allow-root \
+  --data-dir "$DATA_DIR" \
+  --port "$WORK_PORT" \
+  --daemon-port "$DAEMON_PORT" \
+  --bot-name e2e-bot \
+  --yes 2>&1 | tee /tmp/install2.log | tail -10
+
+pass "install (path B: idempotent re-install) exited 0"
+
+# -----------------------------------------------------------------------------
+# Phase 2: post-install assertions (regression suite for v0.2.5 / v0.2.6)
+# -----------------------------------------------------------------------------
+echo
+echo "====================================================="
+echo "Phase 2: post-install env / regression assertions"
+echo "====================================================="
 
 info "v0.2.6 regression: webhook secrets match across web and daemon .env"
-WEB_SEC=$(grep ^WORK_DAEMON_WEBHOOK_SECRET= "$DATA_DIR/ework-web/.env" | cut -d= -f2-)
-DAE_SEC=$(grep ^GITEA_WEBHOOK_SECRET= "$DATA_DIR/ework-daemon/.env" | cut -d= -f2-)
+WEB_SEC=$(env_val WORK_DAEMON_WEBHOOK_SECRET "$DATA_DIR/ework-web/.env")
+DAE_SEC=$(env_val GITEA_WEBHOOK_SECRET "$DATA_DIR/ework-daemon/.env")
 [[ -n "$WEB_SEC" ]] || fail "WORK_DAEMON_WEBHOOK_SECRET empty in web .env"
 [[ -n "$DAE_SEC" ]] || fail "GITEA_WEBHOOK_SECRET empty in daemon .env"
 [[ "$WEB_SEC" == "$DAE_SEC" ]] \
@@ -114,31 +234,19 @@ DAE_SEC=$(grep ^GITEA_WEBHOOK_SECRET= "$DATA_DIR/ework-daemon/.env" | cut -d= -f
 pass "secrets match (${#WEB_SEC} chars)"
 
 info "v0.2.6 regression: WORK_ACCESS_LOG set, not defaulting to /tmp/ework-access.log"
-ACCESS_LOG_VAL=$(grep ^WORK_ACCESS_LOG= "$DATA_DIR/ework-web/.env" | cut -d= -f2-)
+ACCESS_LOG_VAL=$(env_val WORK_ACCESS_LOG "$DATA_DIR/ework-web/.env")
 [[ -n "$ACCESS_LOG_VAL" ]] || fail "WORK_ACCESS_LOG missing from web .env"
 [[ "$ACCESS_LOG_VAL" != "/tmp/ework-access.log" ]] \
   || fail "WORK_ACCESS_LOG still defaults to /tmp/ework-access.log"
 pass "WORK_ACCESS_LOG=$ACCESS_LOG_VAL"
 
 info "wait for ework-web /login"
-for i in $(seq 1 60); do
-  if curl -sf -o /dev/null "http://127.0.0.1:$WORK_PORT/login"; then
-    pass "/login responds (after ${i} half-seconds)"
-    break
-  fi
-  sleep 0.5
-  [[ $i -eq 60 ]] && { tail -30 "$DATA_DIR/run/web.log" 2>/dev/null; fail "ework-web did not come up"; }
-done
+wait_for_url "http://127.0.0.1:$WORK_PORT/login" "/login" 60 \
+  || { tail -30 "$DATA_DIR/run/web.log" 2>/dev/null; fail "ework-web did not come up"; }
 
 info "wait for daemon /api/status"
-for i in $(seq 1 60); do
-  if curl -sf -o /dev/null "http://127.0.0.1:$DAEMON_PORT/api/status"; then
-    pass "/api/status responds (after ${i} half-seconds)"
-    break
-  fi
-  sleep 0.5
-  [[ $i -eq 60 ]] && { tail -30 "$DATA_DIR/run/daemon.log" 2>/dev/null; fail "daemon did not come up"; }
-done
+wait_for_url "http://127.0.0.1:$DAEMON_PORT/api/status" "/api/status" 60 \
+  || { tail -30 "$DATA_DIR/run/daemon.log" 2>/dev/null; fail "daemon did not come up"; }
 
 info "v0.2.6 regression: no EACCES in web.log"
 sleep 1
@@ -155,13 +263,170 @@ if grep -q "invalid signature" "$DATA_DIR/run/daemon.log" 2>/dev/null; then
 fi
 pass "no invalid signature yet"
 
+# -----------------------------------------------------------------------------
+# Phase 3: subcommand smoke tests
+# -----------------------------------------------------------------------------
+echo
+echo "====================================================="
+echo "Phase 3: subcommand smoke tests"
+echo "====================================================="
+
+info "status: lists both services, both running, both listening"
+STATUS_OUT=$(ework-aio status --data-dir "$DATA_DIR" 2>&1)
+echo "$STATUS_OUT"
+echo "$STATUS_OUT" | grep -q "ework-web"    || fail "status missing ework-web line"
+echo "$STATUS_OUT" | grep -q "ework-daemon" || fail "status missing ework-daemon line"
+echo "$STATUS_OUT" | grep "ework-web"    | grep -q "✓ running"    || fail "web not reported running"
+echo "$STATUS_OUT" | grep "ework-daemon" | grep -q "✓ running"    || {
+  echo "$STATUS_OUT" | grep "ework-daemon"
+  fail "daemon not reported running (see status output above)"
+}
+pass "status lists both services as running"
+
+info "env: prints key paths"
+ENV_OUT=$(ework-aio env --data-dir "$DATA_DIR" 2>&1)
+echo "$ENV_OUT"
+echo "$ENV_OUT" | grep -q "data dir"   || fail "env missing 'data dir'"
+echo "$ENV_OUT" | grep -q "web env"    || fail "env missing 'web env'"
+echo "$ENV_OUT" | grep -q "daemon env" || fail "env missing 'daemon env'"
+echo "$ENV_OUT" | grep -q "bot token"  || fail "env missing 'bot token'"
+# env.ts globs for bot-token* (install.ts writes bot-token.<botName> when
+# --bot-name isn't default). With --bot-name e2e-bot in this run, the env
+# output MUST list the suffixed file.
+echo "$ENV_OUT" | grep -q "bot-token.e2e-bot" \
+  || fail "env missing bot-token.e2e-bot (install wrote it but env didn't list it)"
+# Sanity: the printed .env paths must actually exist.
+for p in "$DATA_DIR/ework-web/.env" "$DATA_DIR/ework-daemon/.env"; do
+  [[ -f "$p" ]] || fail "env printed non-existent path: $p"
+done
+pass "env prints valid paths (including bot-token suffix)"
+
+info "config list: shows settable keys"
+CONFIG_LIST_OUT=$(ework-aio config list --data-dir "$DATA_DIR" 2>&1)
+echo "$CONFIG_LIST_OUT"
+echo "$CONFIG_LIST_OUT" | grep -q "WORK_PORT"    || fail "config list missing WORK_PORT"
+echo "$CONFIG_LIST_OUT" | grep -q "DAEMON_PORT"  || fail "config list missing DAEMON_PORT"
+# Secrets must NOT appear (enforced by SECRET_ENV_VARS exclusion).
+echo "$CONFIG_LIST_OUT" | grep -q "WORK_TOKEN" \
+  && fail "config list leaks WORK_TOKEN (should be excluded)" || true
+pass "config list shows settable keys, excludes secrets"
+
+info "config get WORK_PORT: prints the port"
+CONFIG_GET_OUT=$(ework-aio config get WORK_PORT --data-dir "$DATA_DIR" 2>&1)
+echo "$CONFIG_GET_OUT"
+[[ "$CONFIG_GET_OUT" == "$WORK_PORT" ]] \
+  || fail "config get WORK_PORT returned '$CONFIG_GET_OUT', expected '$WORK_PORT'"
+pass "config get WORK_PORT = $WORK_PORT"
+
+info "config get on a secret key: rejects"
+if ework-aio config get WORK_TOKEN --data-dir "$DATA_DIR" 2>/dev/null; then
+  fail "config get WORK_TOKEN should have been rejected"
+fi
+pass "config get on secret rejected"
+
+info "config set WORK_TTS_SPEED 1.5 --no-restart: writes .env, no restart"
+ework-aio config set WORK_TTS_SPEED 1.5 --no-restart --data-dir "$DATA_DIR" 2>&1 | tail -5
+TTS_VAL=$(env_val WORK_TTS_SPEED "$DATA_DIR/ework-web/.env")
+[[ "$TTS_VAL" == "1.5" ]] || fail "WORK_TTS_SPEED not persisted in .env (got '$TTS_VAL')"
+pass "config set persisted WORK_TTS_SPEED=1.5"
+
+info "config set with newline value: rejected (env-injection guard)"
+# Pre-v0.2.6, a value like "alice\nWORK_TOKEN=evil" would inject a new key
+# into .env. cli-dispatch.test.ts:138 covers this in unit tests; we cover
+# it here too because the integration surface (bash quoting) differs.
+if ework-aio config set WORK_OPERATOR_LOGIN $'alice\nWORK_TOKEN=evil' \
+     --no-restart --data-dir "$DATA_DIR" 2>/dev/null; then
+  fail "config set accepted a newline value (env-injection regression)"
+fi
+pass "config set rejects newline value"
+# Confirm the injection didn't actually happen.
+if grep -q "^WORK_TOKEN=evil" "$DATA_DIR/ework-web/.env"; then
+  fail "WORK_TOKEN=evil was injected into .env despite rejection"
+fi
+pass "no env injection occurred"
+
+info "logs web: starts tailing, exits on SIGTERM"
+# logs.ts uses fs.watchFile and never resolves — must be killed.
+# Use `timeout` to send SIGTERM after 1s; expect exit 124 (timeout's SIGTERM
+# exit) or 143 (SIGTERM). The point: it started without error (no
+# "log file not found") and produced output.
+set +e
+LOGS_OUT=$(timeout -s TERM 1 ework-aio logs web --data-dir "$DATA_DIR" 2>&1)
+LOGS_RC=$?
+set -e
+[[ $LOGS_RC -eq 124 || $LOGS_RC -eq 143 ]] \
+  || fail "logs web exited $LOGS_RC (expected 124/143 from SIGTERM)"
+# Output should contain SOMETHING (the "tailing" line + recent log content).
+[[ -n "$LOGS_OUT" ]] || fail "logs web produced no output"
+pass "logs web tail started, exited cleanly on SIGTERM"
+
+# -----------------------------------------------------------------------------
+# Phase 4: service lifecycle (stop / start / restart)
+# -----------------------------------------------------------------------------
+echo
+echo "====================================================="
+echo "Phase 4: service lifecycle"
+echo "====================================================="
+
+WEB_PID_BEFORE=$(pid_of web)
+DAEMON_PID_BEFORE=$(pid_of daemon)
+[[ -n "$WEB_PID_BEFORE" ]]    || fail "web pid empty before stop"
+[[ -n "$DAEMON_PID_BEFORE" ]] || fail "daemon pid empty before stop"
+pass "before stop: web pid=$WEB_PID_BEFORE, daemon pid=$DAEMON_PID_BEFORE"
+
+info "stop both services"
+ework-aio stop --data-dir "$DATA_DIR" 2>&1 | tail -5
+wait_for_no_pid web    || fail "web pid still alive after stop"
+wait_for_no_pid daemon || fail "daemon pid still alive after stop"
+
+info "confirm /login stops responding"
+sleep 1
+if curl -sf -o /dev/null "http://127.0.0.1:$WORK_PORT/login" 2>/dev/null; then
+  fail "/login still responds after stop — web did not actually stop"
+fi
+pass "/login stopped responding"
+
+info "start both services"
+ework-aio start --data-dir "$DATA_DIR" 2>&1 | tail -5
+# Wait for both services to bind their ports again.
+wait_for_url "http://127.0.0.1:$WORK_PORT/login" "/login after start" 60 \
+  || { tail -30 "$DATA_DIR/run/web.log"; fail "web did not come up after start"; }
+wait_for_url "http://127.0.0.1:$DAEMON_PORT/api/status" "/api/status after start" 60 \
+  || { tail -30 "$DATA_DIR/run/daemon.log"; fail "daemon did not come up after start"; }
+
+WEB_PID_AFTER_START=$(pid_of web)
+DAEMON_PID_AFTER_START=$(pid_of daemon)
+[[ "$WEB_PID_AFTER_START" != "$WEB_PID_BEFORE" ]] \
+  || fail "web pid unchanged across stop+start ($WEB_PID_BEFORE)"
+[[ "$DAEMON_PID_AFTER_START" != "$DAEMON_PID_BEFORE" ]] \
+  || fail "daemon pid unchanged across stop+start ($DAEMON_PID_BEFORE)"
+pass "PIDs changed after stop+start (web $WEB_PID_BEFORE→$WEB_PID_AFTER_START)"
+
+info "restart both services (config restart both)"
+ework-aio config restart both --data-dir "$DATA_DIR" 2>&1 | tail -5
+wait_for_new_pid web "$WEB_PID_AFTER_START" 60 \
+  || fail "web pid did not change after restart"
+wait_for_new_pid daemon "$DAEMON_PID_AFTER_START" 60 \
+  || fail "daemon pid did not change after restart"
+
+info "confirm services respond after restart"
+wait_for_url "http://127.0.0.1:$WORK_PORT/login" "/login after restart" 60 \
+  || fail "web did not come up after restart"
+wait_for_url "http://127.0.0.1:$DAEMON_PORT/api/status" "/api/status after restart" 60 \
+  || fail "daemon did not come up after restart"
+
+# -----------------------------------------------------------------------------
+# Phase 5: issue flow (the actual product path)
+# -----------------------------------------------------------------------------
+echo
+echo "====================================================="
+echo "Phase 5: issue flow (create project → create issue → webhook)"
+echo "====================================================="
+
 info "build admin auth cookie"
-WORK_TOKEN=$(grep ^WORK_TOKEN= "$DATA_DIR/ework-web/.env" | cut -d= -f2-)
-WORK_COOKIE_SECRET=$(grep ^WORK_COOKIE_SECRET= "$DATA_DIR/ework-web/.env" | cut -d= -f2-)
-COOKIE_SIG=$(printf '%s' "$WORK_TOKEN" \
-  | openssl dgst -sha256 -hmac "$WORK_COOKIE_SECRET" -binary \
-  | base64 | tr '+/' '-_' | tr -d '=')
-AUTH_COOKIE="ework_auth=${WORK_TOKEN}.${COOKIE_SIG}"
+AUTH_COOKIE=$(build_auth_cookie)
+[[ -n "$AUTH_COOKIE" ]] || fail "auth cookie empty"
+pass "auth cookie built"
 
 info "create test project (triggers autoWire webhook registration)"
 PROJ_CODE=$(curl -sS -o /dev/null -w '%{http_code}' -X POST \
@@ -200,8 +465,41 @@ ACTIVE=$(curl -sS "http://127.0.0.1:$DAEMON_PORT/api/status" | jq -r '.issues //
   || fail "daemon did not register the issue (issues=$ACTIVE)"
 pass "daemon registered issue (issues=$ACTIVE)"
 
+# -----------------------------------------------------------------------------
+# Phase 6: uninstall
+# -----------------------------------------------------------------------------
+echo
+echo "====================================================="
+echo "Phase 6: uninstall"
+echo "====================================================="
+
+info "ework-aio uninstall: stops services + removes pidfiles"
+ework-aio uninstall --data-dir "$DATA_DIR" 2>&1 | tail -10
+
+wait_for_no_pid web 15 || fail "web pid still alive after uninstall"
+wait_for_no_pid daemon 15 || fail "daemon pid still alive after uninstall"
+
+# pidfiles should be gone OR empty.
+for svc in web daemon; do
+  pf="$DATA_DIR/run/$svc.pid"
+  if [[ -f "$pf" && -s "$pf" ]]; then
+    fail "$svc.pid still exists and non-empty after uninstall: $(cat "$pf")"
+  fi
+done
+pass "pidfiles cleared"
+
+info "uninstall preserves data dir"
+# uninstall.ts:62 documents "services removed. data preserved at <dir>".
+# Verify the .env files survive so a re-install picks up the same token.
+[[ -f "$DATA_DIR/ework-web/.env" ]]    || fail "web .env deleted by uninstall"
+[[ -f "$DATA_DIR/ework-daemon/.env" ]] || fail "daemon .env deleted by uninstall"
+pass "data preserved (both .env files intact)"
+
+# -----------------------------------------------------------------------------
 echo
-echo "===== E2E PASSED ====="
+echo "====================================================="
+echo "E2E PASSED"
+echo "====================================================="
 echo "  ework-aio version: $(ework-aio --version 2>/dev/null || echo unknown)"
 echo "  data dir:          $DATA_DIR"
 echo "  web:               http://127.0.0.1:$WORK_PORT/login"

package/src/commands/env.ts

@@ -1,6 +1,8 @@
 // `ework-aio env` — print resolved paths (no secrets). Useful for users
 // to find where data, .env files, and the bot token live without grepping.
 
+import fs from "node:fs";
+import path from "node:path";
 import { Logger } from "../log.ts";
 import { resolvePaths } from "../paths.ts";
 import type { GlobalOptions } from "../types.ts";
@@ -12,13 +14,33 @@ export async function runEnv(opts: GlobalOptions, logger: Logger): Promise<void>
     useSystemd: opts.useSystemd,
   });
 
+  // install.ts writes the bot PAT to <dataDir>/bot-token OR
+  // <dataDir>/bot-token.<botName> when --bot-name isn't the default.
+  // paths.botTokenFile only knows the un-suffixed path, so glob for any
+  // bot-token* matches in the data dir rather than confidently printing a
+  // path that may not exist.
+  let botTokenPaths: string[] = [];
+  try {
+    for (const name of await fs.promises.readdir(paths.dataDir)) {
+      if (name === "bot-token" || name.startsWith("bot-token.")) {
+        botTokenPaths.push(path.join(paths.dataDir, name));
+      }
+    }
+  } catch {
+    // data dir doesn't exist yet — fall through to the un-suffixed default
+    // so the user sees what path install.ts WOULD use.
+  }
+  const botTokenLine = botTokenPaths.length === 0
+    ? `${paths.botTokenFile} (not yet created — run ework-aio install)`
+    : botTokenPaths.join(", ");
+
   logger.hr();
   logger.log("ework-aio paths");
   logger.hr();
   logger.log(`  data dir      : ${paths.dataDir}`);
   logger.log(`  web env       : ${paths.webEnvFile}`);
   logger.log(`  daemon env    : ${paths.daemonEnvFile}`);
-  logger.log(`  bot token     : ${paths.botTokenFile}`);
+  logger.log(`  bot token     : ${botTokenLine}`);
   logger.log(`  opencode cfg  : ${paths.opencodeConfigFile}`);
   logger.log(`  scope         : ${opts.scope}`);
   logger.log(`  mode          : ${opts.useSystemd ? "systemd" : "PID-file"}`);