fraim-hub 2.0.249 → 2.0.251

package/dist/src/ai-hub/cert-store.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.certPaths = certPaths;
 exports.loadOrCreateCert = loadOrCreateCert;
 exports.trustCert = trustCert;
 const fs_1 = __importDefault(require("fs"));
@@ -40,27 +41,24 @@ async function loadOrCreateCert() {
     fs_1.default.mkdirSync(path_1.default.dirname(keyPath), { recursive: true });
     fs_1.default.writeFileSync(keyPath, pem.private, { mode: 0o600 });
     fs_1.default.writeFileSync(certPath, pem.cert, { mode: 0o644 });
-    // NOTE: we deliberately do NOT install this into the OS trusted-root store here.
-    // Desktop Word/PowerPoint reach the pane over plain HTTP loopback and need no cert.
-    // Trusting a root CA triggers a Windows security popup on every add/remove and is
-    // invasive, so it is reserved for explicit Word-Online opt-in via trustCert() below.
+    // The caller decides when to trust this certificate. Word Online requires the
+    // HTTPS loopback certificate to be trusted before it can render the task pane.
     return { key: pem.private, cert: pem.cert };
 }
 /**
  * Installs the cert as a trusted root CA in the user's OS certificate store.
  * ONLY call this for explicit Word-Online support — it prompts a Windows security
- * dialog. It is idempotent: it no-ops if a matching localhost cert is already
- * trusted, so it never produces the delete/add popup churn.
- *   Windows: certutil -addstore -user Root  (skipped if already present)
+ * dialog. It never deletes certs; importing the same cert is idempotent in the
+ * user root store and also repairs stale installs when the cached cert changed.
+ *   Windows: certutil -addstore -user Root
  *   macOS:   security add-trusted-cert -r trustRoot -k login.keychain
  */
 function trustCert(certPath) {
     if (process.platform === 'win32') {
-        // Skip if a localhost cert is already trusted — avoids the confirmation popup.
-        const check = (0, child_process_1.spawnSync)('certutil', ['-user', '-store', 'Root', 'localhost'], { encoding: 'utf8' });
-        if (check.status === 0 && /localhost/i.test(check.stdout))
-            return;
-        (0, child_process_1.spawnSync)('certutil', ['-addstore', '-user', 'Root', certPath], { stdio: 'ignore' });
+        const result = (0, child_process_1.spawnSync)('certutil', ['-addstore', '-user', 'Root', certPath], { encoding: 'utf8' });
+        if (result.status !== 0) {
+            console.warn('[fraim] could not trust localhost certificate:', result.stderr || result.stdout);
+        }
         return;
     }
     if (process.platform === 'darwin') {

package/dist/src/ai-hub/desktop-main.js

@@ -105,7 +105,8 @@ function ensureWordSideload(projectPath, httpPort) {
     const FLAG_VERSION = 'v4-dynamic-port';
     const expectedFlag = `${FLAG_VERSION}:${httpPort}`;
     const flagPath = path_1.default.join(electron_1.app.getPath('userData'), 'word-sideloaded.flag');
-    if (fs_1.default.existsSync(flagPath) && fs_1.default.readFileSync(flagPath, 'utf8').trim() === expectedFlag)
+    const existingFlag = fs_1.default.existsSync(flagPath) ? fs_1.default.readFileSync(flagPath, 'utf8') : null;
+    if ((0, office_sideload_1.shouldSkipSideloadForFlag)(existingFlag, expectedFlag, (0, office_sideload_1.isSideloaded)()))
         return;
     if (httpPort > 0) {
         const result = (0, office_sideload_1.sideloadManifest)(projectPath, { httpPort, userDataDir: electron_1.app.getPath('userData') });
@@ -325,6 +326,12 @@ async function launchDesktopShell(options) {
     // Generate (or load cached) self-signed cert for HTTPS.
     // Fast on subsequent launches (file read); ~200ms on first launch (key gen).
     const certBundle = await (0, cert_store_1.loadOrCreateCert)();
+    try {
+        (0, cert_store_1.trustCert)((0, cert_store_1.certPaths)().certPath);
+    }
+    catch (err) {
+        console.warn('[fraim] could not trust localhost certificate:', err);
+    }
     server = new server_1.AiHubServer({
         ...(options.projectPath ? { projectPath: options.projectPath } : {}),
         // Issue #701: no local DB. Persona/manager-team state resolves through the hosted

package/dist/src/ai-hub/office-sideload.js

@@ -23,6 +23,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.manifestXmlForPort = manifestXmlForPort;
+exports.shouldSkipSideloadForFlag = shouldSkipSideloadForFlag;
 exports.winDeveloperManifestSubkey = winDeveloperManifestSubkey;
 exports.isSideloaded = isSideloaded;
 exports.sideloadManifest = sideloadManifest;
@@ -62,7 +63,10 @@ function generatedManifestPath(entry, userDataDir) {
     return path_1.default.join(userDataDir, 'office-manifests', entry.guid, 'manifest.xml');
 }
 function manifestXmlForPort(xml, httpPort) {
-    return xml.replace(/https?:\/\/(?:localhost|127\.0\.0\.1):43091/g, `http://127.0.0.1:${httpPort}`);
+    return xml.replace(/https?:\/\/(?:localhost|127\.0\.0\.1):(43091|43092)/g, `http://127.0.0.1:${httpPort}`);
+}
+function shouldSkipSideloadForFlag(existingFlag, expectedFlag, sideloaded) {
+    return existingFlag?.trim() === expectedFlag && sideloaded;
 }
 function prepareManifestForSideload(entry, sourcePath, options) {
     if (!options.httpPort)

package/extensions/office-word/manifest.xml

@@ -9,8 +9,8 @@
   <DefaultLocale>en-US</DefaultLocale>
   <DisplayName DefaultValue="FRAIM"/>
   <Description DefaultValue="AI Hub for your document - legal, product, engineering, and more in one task pane."/>
-  <IconUrl DefaultValue="http://127.0.0.1:43091/word-taskpane/icon-64.png"/>
-  <HighResolutionIconUrl DefaultValue="http://127.0.0.1:43091/word-taskpane/icon-64.png"/>
+  <IconUrl DefaultValue="https://localhost:43092/word-taskpane/icon-64.png"/>
+  <HighResolutionIconUrl DefaultValue="https://localhost:43092/word-taskpane/icon-64.png"/>
   <AppDomains>
     <AppDomain>https://appsforoffice.microsoft.com</AppDomain>
   </AppDomains>
@@ -26,7 +26,7 @@
   </Requirements>
 
   <DefaultSettings>
-    <SourceLocation DefaultValue="http://127.0.0.1:43091/word-taskpane/"/>
+    <SourceLocation DefaultValue="https://localhost:43092/word-taskpane/"/>
   </DefaultSettings>
 
   <Permissions>ReadWriteDocument</Permissions>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fraim-hub",
-  "version": "2.0.249",
+  "version": "2.0.251",
   "description": "FRAIM Hub local companion package.",
   "bin": {
     "fraim-hub": "bin/fraim-hub.js",
@@ -163,7 +163,7 @@
     "electron": "^41.2.2",
     "electron-updater": "^6.8.9",
     "express": "^5.2.1",
-    "fraim": "2.0.249",
+    "fraim": "2.0.251",
     "mongodb": "^7.0.0",
     "node-cron": "4.2.1",
     "node-edge-tts": "^1.2.10",