fluxy-bot 0.11.2 → 0.11.4

package/cli/commands/password-reset.ts

@@ -0,0 +1,44 @@
+import { Command } from 'commander';
+import fs from 'node:fs';
+import path from 'node:path';
+import pc from 'picocolors';
+import Database from 'better-sqlite3';
+
+import { DATA_DIR } from '../core/config.js';
+
+const DB_PATH = path.join(DATA_DIR, 'memory.db');
+
+export function registerPasswordResetCommand(program: Command) {
+  program
+    .command('password-reset')
+    .description('Reset your portal password via the onboard wizard')
+    .action(() => {
+      if (!fs.existsSync(DB_PATH)) {
+        console.log(pc.red('✗ No database found. Run ' + pc.magenta('fluxy init') + ' first.'));
+        process.exit(1);
+      }
+
+      const db = new Database(DB_PATH);
+
+      // Clear password and TOTP credentials
+      db.prepare("DELETE FROM settings WHERE key IN ('portal_pass', 'totp_enabled', 'totp_secret', 'totp_recovery_codes')").run();
+
+      // Reset onboard flag so the wizard appears on next visit
+      db.prepare("INSERT INTO settings (key, value) VALUES ('onboard_complete', 'false') ON CONFLICT(key) DO UPDATE SET value = 'false', updated_at = CURRENT_TIMESTAMP").run();
+
+      // Invalidate all active sessions
+      db.prepare('DELETE FROM sessions').run();
+      db.prepare('DELETE FROM trusted_devices').run();
+
+      db.close();
+
+      console.log();
+      console.log(pc.green('✓ Password reset successful.'));
+      console.log();
+      console.log(pc.dim('  The onboard wizard will appear on your next visit'));
+      console.log(pc.dim('  so you can create a new password.'));
+      console.log();
+      console.log(pc.dim('  Restart Fluxy if it\'s running: ') + pc.magenta('fluxy stop && fluxy start'));
+      console.log();
+    });
+}

package/cli/index.ts

@@ -9,6 +9,7 @@ import { registerStartCommand } from './commands/start.js';
 import { registerTunnelCommand } from './commands/tunnel.js';
 import { registerUpdateCommand } from './commands/update.js';
 import { registerInitCommand } from './commands/init.js';
+import { registerPasswordResetCommand } from './commands/password-reset.js';
 
 const program = new Command();
 
@@ -22,6 +23,7 @@ registerDaemonCommand(program);
 registerTunnelCommand(program);
 registerUpdateCommand(program);
 registerInitCommand(program);
+registerPasswordResetCommand(program);
 
 // Aliases for convenience matching the old CLI
 program

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fluxy-bot",
-  "version": "0.11.2",
+  "version": "0.11.4",
   "releaseNotes": [
     "Adding a way for users to claim their fluxies on the fluxy.bot dashboard",
     "2. ",

package/scripts/postinstall.js

@@ -51,6 +51,15 @@ if (fs.existsSync(wsSrc) && !fs.existsSync(wsDst)) {
   fs.cpSync(wsSrc, wsDst, { recursive: true });
 }
 
+// Ensure workspace has its own package.json and .npmrc (handles upgrades from older versions)
+for (const f of ['package.json', '.npmrc']) {
+  const src = path.join(PKG_ROOT, 'workspace', f);
+  const dst = path.join(FLUXY_HOME, 'workspace', f);
+  if (fs.existsSync(src) && !fs.existsSync(dst)) {
+    fs.copyFileSync(src, dst);
+  }
+}
+
 for (const file of CODE_FILES) {
   const src = path.join(PKG_ROOT, file);
   if (!fs.existsSync(src)) continue;
@@ -68,6 +77,17 @@ try {
   // Non-fatal: deps may already exist from a previous install
 }
 
+// ── Install workspace dependencies (isolated from system deps) ──
+
+try {
+  execSync('npm install --omit=dev', {
+    cwd: path.join(FLUXY_HOME, 'workspace'),
+    stdio: 'ignore',
+  });
+} catch {
+  // Non-fatal: workspace deps may already exist
+}
+
 // ── Copy pre-built UI if available, otherwise build ──
 
 const distSrc = path.join(PKG_ROOT, 'dist-fluxy');

package/supervisor/backend.ts

@@ -26,11 +26,31 @@ export function spawnBackend(port: number): ChildProcess {
   try { fs.writeFileSync(LOG_FILE, ''); } catch {}
 
   // Wrap the backend in an inline loader that:
-  // 1. Dynamically imports the user's backend (tsx handles .ts compilation)
-  // 2. Adds a keepalive timer so the event loop never drains (fixes exit code 0 under systemd)
-  // 3. Catches and logs import errors instead of silently exiting
+  // 1. Registers module resolution hooks to prevent walk-up to parent node_modules
+  // 2. Dynamically imports the user's backend (tsx handles .ts compilation)
+  // 3. Adds a keepalive timer so the event loop never drains (fixes exit code 0 under systemd)
+  // 4. Catches and logs import errors instead of silently exiting
   const backendUrl = 'file://' + backendPath.replace(/\\/g, '/');
+  const boundary = WORKSPACE_DIR + path.sep;
   const wrapper = [
+    // Workspace isolation: block module resolution outside workspace/node_modules.
+    // tsx loads via --import BEFORE this code runs, so it resolves from root (correct).
+    // All subsequent imports (the backend code) are restricted to workspace.
+    `const nodeModule = await import('node:module');`,
+    `const { fileURLToPath } = await import('node:url');`,
+    `if (nodeModule.registerHooks) {`,
+    `  const BOUNDARY = ${JSON.stringify(boundary)};`,
+    `  nodeModule.registerHooks({`,
+    `    resolve(specifier, context, nextResolve) {`,
+    `      const result = nextResolve(specifier, context);`,
+    `      if (result.url.startsWith('node:') || result.url.startsWith('data:')) return result;`,
+    `      if (fileURLToPath(result.url).startsWith(BOUNDARY)) return result;`,
+    `      throw new Error('[workspace-isolate] "' + specifier + '" resolved outside workspace: ' + fileURLToPath(result.url));`,
+    `    }`,
+    `  });`,
+    `} else {`,
+    `  console.warn('[backend] Node 22.15+ required for workspace isolation — running without module boundaries');`,
+    `}`,
     `import('${backendUrl}')`,
     `  .catch(e => { console.error('[backend] Fatal:', e); process.exit(1); });`,
     `setInterval(() => {}, 60000);`,

package/vite.config.ts

@@ -13,6 +13,8 @@ export default defineConfig({
         ? path.join(process.env.FLUXY_WORKSPACE, 'client/src')
         : path.resolve(__dirname, 'workspace/client/src'),
     },
+    // Prevent React dual-instance when workspace/node_modules has its own copy
+    dedupe: ['react', 'react-dom'],
   },
   build: {
     outDir: '../../dist',

package/worker/prompts/fluxy-system-prompt.txt

@@ -277,9 +277,20 @@ Browser: GET /app/api/tasks → Supervisor strips prefix → Backend receives: G
 NEVER run `npm run build`, `vite build`, or any build commands. Vite HMR handles frontend changes automatically. The backend auto-restarts when you edit files. Never look in `dist/` or `dist-fluxy/`.
 
 ## Installing Packages
-You can install npm packages when a feature requires one that isn't already available. Run `npm install <package>` from the **project root** (`$PKG_DIR` / the parent of `workspace/`). Do NOT create a `package.json` inside `workspace/` — all dependencies live at the root level.
+Your workspace has its own `package.json` and `node_modules/`. You can freely install npm packages — they are fully isolated from the system. Nothing you install can break the supervisor, worker, or chat.
 
-Before installing, check if a suitable package is already in `node_modules/`. Prefer well-known, maintained packages. After installing, the backend picks up new imports on the next auto-restart and Vite resolves new frontend imports via HMR — no build step needed.
+```bash
+npm install <package>        # run from your cwd (workspace root)
+```
+
+This works for both backend and frontend packages. After installing:
+- Backend picks up new imports on the next auto-restart
+- Vite resolves new frontend imports via HMR
+- No build step needed
+
+Before installing, check if a suitable package is already in `node_modules/`. Prefer well-known, maintained packages.
+
+**Never** run `npm install` from the parent directory or modify the parent's `package.json`. Your dependencies are sandboxed to workspace — this boundary is enforced at the runtime level.
 
 ## Backend Lifecycle (Critical)