fluxy-bot 0.11.3 → 0.11.5

package/bin/cli.js

@@ -1735,6 +1735,42 @@ async function tunnel(sub) {
   }
 }
 
+// ── Password Reset ──
+
+async function passwordReset() {
+  const DB_PATH = path.join(DATA_DIR, 'memory.db');
+
+  if (!fs.existsSync(DB_PATH)) {
+    console.log(`\n  ${c.red}✗${c.reset}  No database found. Run ${c.pink}fluxy init${c.reset} and complete setup first.\n`);
+    process.exit(1);
+  }
+
+  const Database = (await import('better-sqlite3')).default;
+  const db = new Database(DB_PATH);
+
+  // Clear password and TOTP credentials
+  db.prepare("DELETE FROM settings WHERE key IN ('portal_pass', 'totp_enabled', 'totp_secret', 'totp_recovery_codes')").run();
+
+  // Reset onboard flag so the wizard appears on next visit
+  db.prepare("INSERT INTO settings (key, value) VALUES ('onboard_complete', 'false') ON CONFLICT(key) DO UPDATE SET value = 'false', updated_at = CURRENT_TIMESTAMP").run();
+
+  // Invalidate all active sessions and trusted devices
+  db.prepare('DELETE FROM sessions').run();
+  db.prepare('DELETE FROM trusted_devices').run();
+
+  db.close();
+
+  console.log(`\n  ${c.blue}✔${c.reset}  Password reset successful.\n`);
+  console.log(`  ${c.dim}The onboard wizard will appear on your next visit`);
+  console.log(`  so you can create a new password.${c.reset}\n`);
+
+  // Auto-restart daemon if it's running
+  if (isDaemonInstalled() && isDaemonActive()) {
+    console.log(`  ${c.dim}Restarting Fluxy daemon...${c.reset}`);
+    daemon('restart');
+  }
+}
+
 // ── Route ──
 
 switch (command) {
@@ -1746,6 +1782,7 @@ switch (command) {
   case 'update':  update(); break;
   case 'daemon':  daemon(subcommand); break;
   case 'tunnel':  tunnel(subcommand); break;
+  case 'password-reset': passwordReset(); break;
   default:
     fs.existsSync(CONFIG_PATH) ? start() : init();
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fluxy-bot",
-  "version": "0.11.3",
+  "version": "0.11.5",
   "releaseNotes": [
     "Adding a way for users to claim their fluxies on the fluxy.bot dashboard",
     "2. ",

package/worker/prompts/fluxy-system-prompt.txt

@@ -277,11 +277,20 @@ Browser: GET /app/api/tasks → Supervisor strips prefix → Backend receives: G
 NEVER run `npm run build`, `vite build`, or any build commands. Vite HMR handles frontend changes automatically. The backend auto-restarts when you edit files. Never look in `dist/` or `dist-fluxy/`.
 
 ## Installing Packages
-You can install npm packages when a feature requires one that isn't already available. Run `npm install <package>` from your workspace root (your current working directory). The workspace has its own `package.json` and `node_modules/` — all workspace dependencies are installed here, isolated from the system.
+Your workspace has its own `package.json` and `node_modules/`. You can freely install npm packages — they are fully isolated from the system. Nothing you install can break the supervisor, worker, or chat.
 
-**Important:** Never run `npm install` from the parent directory. Never modify the parent's `package.json` or `node_modules/`. Your workspace dependencies are sandboxed — the system's core packages (supervisor, worker, chat) are protected from anything you install.
+```bash
+npm install <package>        # run from your cwd (workspace root)
+```
+
+This works for both backend and frontend packages. After installing:
+- Backend picks up new imports on the next auto-restart
+- Vite resolves new frontend imports via HMR
+- No build step needed
+
+Before installing, check if a suitable package is already in `node_modules/`. Prefer well-known, maintained packages.
 
-Before installing, check if a suitable package is already in `node_modules/`. Prefer well-known, maintained packages. After installing, the backend picks up new imports on the next auto-restart and Vite resolves new frontend imports via HMR — no build step needed.
+**Never** run `npm install` from the parent directory or modify the parent's `package.json`. Your dependencies are sandboxed to workspace — this boundary is enforced at the runtime level.
 
 ## Backend Lifecycle (Critical)