fraim-hub 2.0.305 → 2.0.306

package/dist/src/ai-hub/cert-store.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports._internal = void 0;
 exports.certPaths = certPaths;
 exports.loadOrCreateCert = loadOrCreateCert;
 exports.trustCert = trustCert;
@@ -49,6 +50,15 @@ async function loadOrCreateCert() {
     // HTTPS loopback certificate to be trusted before it can render the task pane.
     return { key: pem.private, cert: pem.cert };
 }
+/**
+ * Test seam (issue #1589): the real OS command invocation goes through this mutable,
+ * module-owned indirection point instead of a bare `spawnSync` call, so a test can swap in
+ * a fake implementation and assert on the exact command/arguments `trustCert()`/`untrustCert()`
+ * would invoke, without spawning a process, touching PATH, or mutating the real trust store.
+ * Swapping the export on Node's built-in `child_process` module itself is not reliable for
+ * this (confirmed empirically while fixing this issue) - this repo-owned seam is.
+ */
+exports._internal = { spawnSync: child_process_1.spawnSync };
 /**
  * Installs the cert as a trusted root CA in the user's OS certificate store.
  * ONLY call this for explicit Word-Online support — it prompts a Windows security
@@ -59,7 +69,7 @@ async function loadOrCreateCert() {
  */
 function trustCert(certPath) {
     if (process.platform === 'win32') {
-        const result = (0, child_process_1.spawnSync)('certutil', ['-addstore', '-user', 'Root', certPath], { encoding: 'utf8' });
+        const result = exports._internal.spawnSync('certutil', ['-addstore', '-user', 'Root', certPath], { encoding: 'utf8' });
         if (result.status !== 0) {
             console.warn('[fraim] could not trust localhost certificate:', result.stderr || result.stdout);
         }
@@ -67,17 +77,17 @@ function trustCert(certPath) {
     }
     if (process.platform === 'darwin') {
         const keychain = path_1.default.join(os_1.default.homedir(), 'Library', 'Keychains', 'login.keychain-db');
-        (0, child_process_1.spawnSync)('security', ['add-trusted-cert', '-r', 'trustRoot', '-k', keychain, certPath], { stdio: 'ignore' });
+        exports._internal.spawnSync('security', ['add-trusted-cert', '-r', 'trustRoot', '-k', keychain, certPath], { stdio: 'ignore' });
     }
 }
 /** Removes a specific cert from the trust store, by fingerprint. Test-only helper. */
 function untrustCert(fingerprint) {
     if (process.platform === 'win32') {
-        (0, child_process_1.spawnSync)('certutil', ['-delstore', '-user', 'Root', fingerprint], { encoding: 'utf8' });
+        exports._internal.spawnSync('certutil', ['-delstore', '-user', 'Root', fingerprint], { encoding: 'utf8' });
         return;
     }
     if (process.platform === 'darwin') {
-        (0, child_process_1.spawnSync)('security', ['delete-certificate', '-Z', fingerprint], { stdio: 'ignore' });
+        exports._internal.spawnSync('security', ['delete-certificate', '-Z', fingerprint], { stdio: 'ignore' });
     }
 }
 /**

package/dist/src/ai-hub/office-sideload.js

@@ -22,6 +22,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports._internal = exports.WEF_DEVELOPER_KEY = void 0;
 exports.manifestXmlForPort = manifestXmlForPort;
 exports.shouldSkipSideloadForFlag = shouldSkipSideloadForFlag;
 exports.winDeveloperManifestSubkey = winDeveloperManifestSubkey;
@@ -32,7 +33,7 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const child_process_1 = require("child_process");
-const WEF_DEVELOPER_KEY = 'HKCU\\SOFTWARE\\Microsoft\\Office\\16.0\\WEF\\Developer';
+exports.WEF_DEVELOPER_KEY = 'HKCU\\SOFTWARE\\Microsoft\\Office\\16.0\\WEF\\Developer';
 const MANIFESTS = [
     {
         guid: 'd1090951-50cf-4cf2-9d12-b0f8541d265c',
@@ -93,7 +94,7 @@ function prepareManifestForSideload(entry, sourcePath, options) {
 // Windows registry helpers
 // ---------------------------------------------------------------------------
 function winDeveloperManifestSubkey(guid) {
-    return `${WEF_DEVELOPER_KEY}\\{${guid}}`;
+    return `${exports.WEF_DEVELOPER_KEY}\\{${guid}}`;
 }
 function parseRegSzValue(stdout) {
     const line = stdout.split(/\r?\n/).find(l => l.includes('REG_SZ'));
@@ -103,7 +104,7 @@ function parseRegSzValue(stdout) {
     return line.slice(idx + 'REG_SZ'.length).trim() || null;
 }
 function winRegisteredRootValue(guid) {
-    const r = (0, child_process_1.spawnSync)('reg', ['query', WEF_DEVELOPER_KEY, '/v', guid], { encoding: 'utf8' });
+    const r = (0, child_process_1.spawnSync)('reg', ['query', exports.WEF_DEVELOPER_KEY, '/v', guid], { encoding: 'utf8' });
     if (r.status !== 0 || !r.stdout.includes('REG_SZ'))
         return null;
     // Output line looks like: "    <guid>    REG_SZ    C:\path\to\manifest.xml"
@@ -122,14 +123,21 @@ function winRegisteredValue(guid) {
     // but treat the root value as the effective discovery registration.
     return winRegisteredRootValue(guid) ?? winRegisteredDefaultValue(guid);
 }
+/**
+ * Test seam (issue #1589): the registry-write invocations go through this mutable,
+ * module-owned indirection point instead of a bare `spawnSync` call, so a test can swap in a
+ * fake implementation and assert on the exact `reg` command/arguments `sideloadManifest()`
+ * would invoke, without spawning a process, touching PATH, or mutating the real registry.
+ */
+exports._internal = { spawnSync: child_process_1.spawnSync };
 function winWriteRegisteredValue(guid, manifestPath) {
-    const root = (0, child_process_1.spawnSync)('reg', [
-        'add', WEF_DEVELOPER_KEY,
+    const root = exports._internal.spawnSync('reg', [
+        'add', exports.WEF_DEVELOPER_KEY,
         '/v', guid, '/t', 'REG_SZ', '/d', manifestPath, '/f',
     ], { encoding: 'utf8' });
     if (root.status !== 0)
         return { ok: false, reason: root.stderr || `reg add failed for ${guid}` };
-    const r = (0, child_process_1.spawnSync)('reg', [
+    const r = exports._internal.spawnSync('reg', [
         'add', winDeveloperManifestSubkey(guid),
         '/ve', '/t', 'REG_SZ', '/d', manifestPath, '/f',
     ], { encoding: 'utf8' });
@@ -137,7 +145,7 @@ function winWriteRegisteredValue(guid, manifestPath) {
         return { ok: false, reason: r.stderr || `reg add failed for ${guid}` };
     // Remove an accidental unbraced subkey left by older debugger settings. This
     // is different from the root named value above, which Word needs.
-    (0, child_process_1.spawnSync)('reg', ['delete', `${WEF_DEVELOPER_KEY}\\${guid}`, '/f'], { encoding: 'utf8' });
+    exports._internal.spawnSync('reg', ['delete', `${exports.WEF_DEVELOPER_KEY}\\${guid}`, '/f'], { encoding: 'utf8' });
     return { ok: true };
 }
 // ---------------------------------------------------------------------------
@@ -195,8 +203,8 @@ function sideloadManifest(projectPath, options = {}) {
 function removeSideload() {
     for (const entry of MANIFESTS) {
         if (process.platform === 'win32') {
-            (0, child_process_1.spawnSync)('reg', ['delete', WEF_DEVELOPER_KEY, '/v', entry.guid, '/f'], { encoding: 'utf8' });
-            (0, child_process_1.spawnSync)('reg', ['delete', `${WEF_DEVELOPER_KEY}\\${entry.guid}`, '/f'], { encoding: 'utf8' });
+            (0, child_process_1.spawnSync)('reg', ['delete', exports.WEF_DEVELOPER_KEY, '/v', entry.guid, '/f'], { encoding: 'utf8' });
+            (0, child_process_1.spawnSync)('reg', ['delete', `${exports.WEF_DEVELOPER_KEY}\\${entry.guid}`, '/f'], { encoding: 'utf8' });
             (0, child_process_1.spawnSync)('reg', ['delete', winDeveloperManifestSubkey(entry.guid), '/f'], { encoding: 'utf8' });
         }
         else if (process.platform === 'darwin') {

package/dist/src/cli/setup/user-level-sync.js

@@ -69,6 +69,7 @@ const script_sync_utils_1 = require("../utils/script-sync-utils");
  */
 const USER_LEVEL_RUNTIME_DEPS = {
     'node-edge-tts': '*', // used by scripts/author-audio.js
+    'adm-zip': '^0.6.0', // used by scripts/communication/*.js (DOCX review layer) — matches root/packages/* manifests
 };
 /**
  * Ensure the user-level FRAIM directory structure exists.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fraim-hub",
-  "version": "2.0.305",
+  "version": "2.0.306",
   "description": "FRAIM Hub local companion package.",
   "author": "Sid Mathur <sid.mathur@gmail.com>",
   "homepage": "https://github.com/mathursrus/FRAIM#readme",
@@ -211,7 +211,7 @@
     "electron-updater": "^6.8.9",
     "express": "^5.2.1",
     "extract-zip": "^2.0.1",
-    "fraim": "2.0.305",
+    "fraim": "2.0.306",
     "mongodb": "^7.0.0",
     "node-cron": "4.2.1",
     "node-edge-tts": "^1.2.10",

package/public/ai-hub/script.js

@@ -13560,41 +13560,38 @@ function tfMostRecentMatch(convs, predicate) {
   return convs.filter(predicate).sort((a, b) => (b.lastUpdatedAt || 0) - (a.lastUpdatedAt || 0))[0] || null;
 }
 
-// Issue #1124: only look in the @company bucket. Scanning all buckets caused project-scoped
-// org-learning-synthesis runs to hijack the Company tab.
-function tfActiveOrgConv() {
-  const orgJobs = new Set(['organization-onboarding', 'organizational-learning-synthesis']);
-  const convs = ((state.conversations || {})[COMPANY_CONV_KEY] || []).filter((c) => orgJobs.has(c.jobId));
-  // Prefer running > waiting (needs coaching) > most recently updated completed.
+// #1601: tfActiveMgrConv() (#1408) and tfActiveOrgConv() (#1124/#1601) both resolve
+// "the one most-active conversation for this scope" — running > waiting > has real
+// content — differing only in which scope they select. Shared here instead of two
+// near-identical copies. convScope() reads an explicit scope/invokedArea tag rather
+// than jobId or bucket location, so a project-scoped run (no scope field, e.g. a
+// legacy manager-agreements or organizational-learning-synthesis record) always
+// resolves to 'project' and is correctly excluded here regardless of which bucket
+// it lives in — scanning all buckets by scope is safe for both callers.
+function tfActiveScopedConv(scope) {
+  const convs = Object.values(state.conversations || {}).flat().filter((c) => c && convScope(c) === scope);
   return (
     tfMostRecentMatch(convs, (c) => c.status === 'running') ||
     tfMostRecentMatch(convs, (c) => c.status === 'waiting') ||
-    tfMostRecentMatch(convs, () => true) ||
+    // #782/#1408/#1601: only a conversation with real content should replace the
+    // area's info view. A message-less completed conv (e.g. a provisional freeform
+    // run that emitted nothing) is a phantom, not a conversation to surface.
+    tfMostRecentMatch(convs, (c) => (c.messages || []).length > 0) ||
     null
   );
 }
 
+// Issue #1124: return the company-scoped conversation to show in the Company area.
+function tfActiveOrgConv() {
+  return tfActiveScopedConv('company');
+}
+
 // #594 R2: return the manager-scoped conversation to show in Manager area.
 // #702/#1408: manager-tab runs are those invoked from the manager area (any persona job,
-// including manager-agreements), decided by scope alone. A pre-scope-tracking legacy
-// manager-agreements record with no scope field falls back to convScope()'s 'project'
-// default and won't be picked here; it's still reachable, just not as this tab's
-// single "most active" spotlight. An active manager-invoked run surfaces in the
-// Manager conversation host (Coach panel included).
+// including manager-agreements), decided by scope alone. An active manager-invoked run
+// surfaces in the Manager conversation host (Coach panel included).
 function tfActiveMgrConv() {
-  // Issue #1408: no job-id exception — a manager-agreements run only counts here if it
-  // was genuinely invoked from the Manager tab (convScope(c) === 'manager').
-  const convs = Object.values(state.conversations || {}).flat().filter((c) => c && convScope(c) === 'manager');
-  return (
-    tfMostRecentMatch(convs, (c) => c.status === 'running') ||
-    tfMostRecentMatch(convs, (c) => c.status === 'waiting') ||
-    // #782: only a conversation with real content should replace the Manager info
-    // view (Context / Rules / Learnings). A message-less completed conv (e.g. a
-    // provisional __freeform__ run that emitted nothing) is a phantom, not a
-    // conversation to surface — ignoring it keeps the info view as the tab's home.
-    tfMostRecentMatch(convs, (c) => (c.messages || []).length > 0) ||
-    null
-  );
+  return tfActiveScopedConv('manager');
 }
 
 // #1397: resolve one stable destination for an area. Polling may refresh the