fluxy-bot 0.11.3 → 0.11.4

package/cli/commands/password-reset.ts

@@ -0,0 +1,44 @@
+import { Command } from 'commander';
+import fs from 'node:fs';
+import path from 'node:path';
+import pc from 'picocolors';
+import Database from 'better-sqlite3';
+
+import { DATA_DIR } from '../core/config.js';
+
+const DB_PATH = path.join(DATA_DIR, 'memory.db');
+
+export function registerPasswordResetCommand(program: Command) {
+  program
+    .command('password-reset')
+    .description('Reset your portal password via the onboard wizard')
+    .action(() => {
+      if (!fs.existsSync(DB_PATH)) {
+        console.log(pc.red('✗ No database found. Run ' + pc.magenta('fluxy init') + ' first.'));
+        process.exit(1);
+      }
+
+      const db = new Database(DB_PATH);
+
+      // Clear password and TOTP credentials
+      db.prepare("DELETE FROM settings WHERE key IN ('portal_pass', 'totp_enabled', 'totp_secret', 'totp_recovery_codes')").run();
+
+      // Reset onboard flag so the wizard appears on next visit
+      db.prepare("INSERT INTO settings (key, value) VALUES ('onboard_complete', 'false') ON CONFLICT(key) DO UPDATE SET value = 'false', updated_at = CURRENT_TIMESTAMP").run();
+
+      // Invalidate all active sessions
+      db.prepare('DELETE FROM sessions').run();
+      db.prepare('DELETE FROM trusted_devices').run();
+
+      db.close();
+
+      console.log();
+      console.log(pc.green('✓ Password reset successful.'));
+      console.log();
+      console.log(pc.dim('  The onboard wizard will appear on your next visit'));
+      console.log(pc.dim('  so you can create a new password.'));
+      console.log();
+      console.log(pc.dim('  Restart Fluxy if it\'s running: ') + pc.magenta('fluxy stop && fluxy start'));
+      console.log();
+    });
+}

package/cli/index.ts

@@ -9,6 +9,7 @@ import { registerStartCommand } from './commands/start.js';
 import { registerTunnelCommand } from './commands/tunnel.js';
 import { registerUpdateCommand } from './commands/update.js';
 import { registerInitCommand } from './commands/init.js';
+import { registerPasswordResetCommand } from './commands/password-reset.js';
 
 const program = new Command();
 
@@ -22,6 +23,7 @@ registerDaemonCommand(program);
 registerTunnelCommand(program);
 registerUpdateCommand(program);
 registerInitCommand(program);
+registerPasswordResetCommand(program);
 
 // Aliases for convenience matching the old CLI
 program

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fluxy-bot",
-  "version": "0.11.3",
+  "version": "0.11.4",
   "releaseNotes": [
     "Adding a way for users to claim their fluxies on the fluxy.bot dashboard",
     "2. ",

package/worker/prompts/fluxy-system-prompt.txt

@@ -277,11 +277,20 @@ Browser: GET /app/api/tasks → Supervisor strips prefix → Backend receives: G
 NEVER run `npm run build`, `vite build`, or any build commands. Vite HMR handles frontend changes automatically. The backend auto-restarts when you edit files. Never look in `dist/` or `dist-fluxy/`.
 
 ## Installing Packages
-You can install npm packages when a feature requires one that isn't already available. Run `npm install <package>` from your workspace root (your current working directory). The workspace has its own `package.json` and `node_modules/` — all workspace dependencies are installed here, isolated from the system.
+Your workspace has its own `package.json` and `node_modules/`. You can freely install npm packages — they are fully isolated from the system. Nothing you install can break the supervisor, worker, or chat.
 
-**Important:** Never run `npm install` from the parent directory. Never modify the parent's `package.json` or `node_modules/`. Your workspace dependencies are sandboxed — the system's core packages (supervisor, worker, chat) are protected from anything you install.
+```bash
+npm install <package>        # run from your cwd (workspace root)
+```
+
+This works for both backend and frontend packages. After installing:
+- Backend picks up new imports on the next auto-restart
+- Vite resolves new frontend imports via HMR
+- No build step needed
+
+Before installing, check if a suitable package is already in `node_modules/`. Prefer well-known, maintained packages.
 
-Before installing, check if a suitable package is already in `node_modules/`. Prefer well-known, maintained packages. After installing, the backend picks up new imports on the next auto-restart and Vite resolves new frontend imports via HMR — no build step needed.
+**Never** run `npm install` from the parent directory or modify the parent's `package.json`. Your dependencies are sandboxed to workspace — this boundary is enforced at the runtime level.
 
 ## Backend Lifecycle (Critical)