ework-aio 0.5.34 → 0.5.36

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-aio",
-  "version": "0.5.34",
+  "version": "0.5.36",
   "description": "All-in-one installer for ework (issue tracker) + ework-daemon (AI bridge) + opencode-ework (plugin). One command: npm i -g ework-aio && ework-aio install.",
   "type": "module",
   "license": "MIT",
@@ -38,7 +38,7 @@
     "access": "public"
   },
   "scripts": {
-    "start": "bun bin/ework-aio.js",
+    "start": "bun bin/ework-aio",
     "check": "tsc --noEmit",
     "test": "bun test",
     "test:e2e": "bash scripts/e2e-install.sh",

package/src/commands/install.ts

@@ -347,8 +347,27 @@ export async function runInstall(
   if (webStarted && exists(botTokenFile)) {
     botToken = (await fs.promises.readFile(botTokenFile, "utf8")).trim();
     if (botToken) {
-      logger.ok(`reusing saved bot token from ${botTokenFile}`);
-      botBootstrapped = true;
+      // Saved token may be orphaned if the DB was wiped/replaced (fresh MySQL,
+      // sqlite→mysql migration). Verify before trusting — a stale token causes
+      // silent 401s on every daemon call. Any non-401 status means auth passed
+      // (404 = route missing but token valid); network error = web starting up.
+      const fetchImpl = hooks.fetchImpl ?? fetch;
+      try {
+        const verifyRes = await fetchImpl(`${baseUrl}/api/v1/user`, {
+          headers: { Authorization: `token ${botToken}` },
+          redirect: "manual",
+        });
+        if (verifyRes.status !== 401) {
+          logger.ok(`reusing saved bot token from ${botTokenFile} (verified)`);
+          botBootstrapped = true;
+        } else {
+          logger.warn(`saved bot token is stale (db has no matching PAT), re-bootstrapping`);
+          botToken = "";
+        }
+      } catch {
+        logger.warn(`cannot verify saved bot token, will re-bootstrap`);
+        botToken = "";
+      }
     }
   }
   if (webStarted && !botBootstrapped) {

package/src/preflight.ts

@@ -41,6 +41,13 @@ export function resolveCommand(cmd: string): string | null {
 // the user to "install ework-web first" even though it was already bundled
 // (B-1). Returns the absolute bin path, or null if not bundled.
 export function resolveBundledBin(pkgName: string, binRelPath: string): string | null {
+  // Explicit override wins everywhere (tests + non-standard install prefix).
+  // Without this, the dev-repo branch below would ignore AIO_PACKAGE_ROOT and
+  // the "empty dir → null" contract couldn't be exercised from a git checkout.
+  if (process.env.AIO_PACKAGE_ROOT) {
+    const candidate = path.join(process.env.AIO_PACKAGE_ROOT, "node_modules", pkgName, binRelPath);
+    return fs.existsSync(candidate) ? candidate : null;
+  }
   if (isDevRepo()) {
     const r = spawnSync("npm", ["root", "-g"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], env: process.env });
     const npmRoot = (r.stdout ?? "").trim();
@@ -50,8 +57,7 @@ export function resolveBundledBin(pkgName: string, binRelPath: string): string |
     }
     return null;
   }
-  const root = process.env.AIO_PACKAGE_ROOT || DEFAULT_PACKAGE_ROOT;
-  const candidate = path.join(root, "node_modules", pkgName, binRelPath);
+  const candidate = path.join(DEFAULT_PACKAGE_ROOT, "node_modules", pkgName, binRelPath);
   return fs.existsSync(candidate) ? candidate : null;
 }