fraim-hub 2.0.310 → 2.0.312

package/dist/src/ai-hub/desktop-main.js

@@ -24,6 +24,8 @@ const fraim_mcp_latest_launcher_1 = require("../cli/mcp/fraim-mcp-latest-launche
 const desktop_auto_updater_1 = require("./desktop-auto-updater");
 const hub_app_materializer_1 = require("./hub-app-materializer");
 const hub_instance_reconciliation_1 = require("./hub-instance-reconciliation");
+const hub_main_diagnostics_1 = require("./hub-main-diagnostics");
+const devtools_window_1 = require("./devtools-window");
 // Keep installed, running, and user-pinned Windows shortcuts grouped under the
 // stable identity declared in packages/fraim-hub/package.json.
 electron_1.app.setAppUserModelId('ai.fraim.hub');
@@ -163,7 +165,7 @@ async function resolveLatestHubAppVersion() {
         bundledVersion: runningVersion,
         bundledEntryPath: __filename,
     });
-    return { upgradable: resolved.version !== runningVersion, latest: resolved.version };
+    return { upgradable: resolved.version !== runningVersion, latest: resolved.version, error: resolved.materializationError };
 }
 // Issue #1415: a second-instance activation (the user re-clicking the icon while the Hub is
 // already running) is the common case once login-item autostart + hide-to-tray keep the Hub
@@ -189,9 +191,12 @@ async function checkForHubAppUpdateOnSecondInstance() {
 // response reaches the browser (which uses it to start polling for the new instance) before this
 // process starts tearing down.
 async function restartToLatestNow() {
-    const { upgradable, latest } = await resolveLatestHubAppVersion();
-    if (!upgradable)
-        return { restarting: false, latest };
+    const { upgradable, latest, error } = await resolveLatestHubAppVersion();
+    if (!upgradable) {
+        if (error)
+            console.warn(`[fraim] manual restart requested but could not complete: ${error}`);
+        return { restarting: false, latest, error };
+    }
     console.log(`[fraim] manual restart requested; relaunching to FRAIM Hub ${latest}`);
     setTimeout(() => {
         electron_1.app.relaunch();
@@ -274,6 +279,14 @@ function shouldConfigureOfficeSideload() {
 function displayName(runtimeId = process.env.FRAIM_HUB_RUNTIME_ID || 'hub') {
     return process.env.FRAIM_HUB_DISPLAY_NAME || (runtimeId === 'hub2' ? 'FRAIM Hub 2' : 'FRAIM Hub');
 }
+async function openMainWindowDevTools(hubUrl) {
+    await (0, devtools_window_1.openHubWindowDevTools)({
+        hubUrl,
+        getWindow: () => mainWindow,
+        createWindow,
+        recordOpenRequested: () => (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('hub.devtools.open_requested'),
+    });
+}
 function buildTrayMenu(hubUrl, runtimeId) {
     const name = displayName(runtimeId);
     return electron_1.Menu.buildFromTemplate([
@@ -289,6 +302,14 @@ function buildTrayMenu(hubUrl, runtimeId) {
                 }
             },
         },
+        {
+            label: 'Open DevTools',
+            click: () => {
+                void openMainWindowDevTools(hubUrl).catch((error) => {
+                    console.warn('[fraim] could not open Hub DevTools:', error);
+                });
+            },
+        },
         {
             // #755: surface the running build version so staleness is diagnosable at a glance.
             label: `About ${name}`,
@@ -345,6 +366,36 @@ function createTray(hubUrl, runtimeId) {
 // ---------------------------------------------------------------------------
 // BrowserWindow
 // ---------------------------------------------------------------------------
+function buildDesktopDebugSnapshot(runtimeId) {
+    const win = mainWindow;
+    const windowPresent = Boolean(win);
+    const isDestroyed = win ? win.isDestroyed() : null;
+    const canReadWindow = Boolean(win && !isDestroyed);
+    const safeRead = (reader) => {
+        if (!canReadWindow)
+            return null;
+        try {
+            return reader();
+        }
+        catch {
+            return null;
+        }
+    };
+    return {
+        runtimeId,
+        windowPresent,
+        isDestroyed,
+        isFocused: safeRead(() => win.isFocused()),
+        isVisible: safeRead(() => win.isVisible()),
+        isMinimized: safeRead(() => win.isMinimized()),
+        bounds: safeRead(() => win.getBounds()),
+        title: safeRead(() => win.getTitle()),
+        url: safeRead(() => win.webContents.getURL()),
+        webContentsDestroyed: win ? safeRead(() => win.webContents.isDestroyed()) : null,
+        devToolsOpened: safeRead(() => win.webContents.isDevToolsOpened()),
+        gpuFeatureStatus: electron_1.app.getGPUFeatureStatus(),
+    };
+}
 async function createWindow(url, runtimeId = process.env.FRAIM_HUB_RUNTIME_ID || 'hub') {
     const { width, height } = preferredWindowSize();
     const isMac = process.platform === 'darwin';
@@ -374,6 +425,32 @@ async function createWindow(url, runtimeId = process.env.FRAIM_HUB_RUNTIME_ID ||
         webPreferences: { contextIsolation: true, nodeIntegration: false, sandbox: true },
     });
     electron_1.Menu.setApplicationMenu(null);
+    mainWindow.on('focus', () => (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('window.focus'));
+    mainWindow.on('blur', () => (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('window.blur'));
+    mainWindow.on('show', () => (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('window.show'));
+    mainWindow.on('hide', () => (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('window.hide'));
+    mainWindow.on('close', () => (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('window.close', { isQuitting }));
+    mainWindow.webContents.on('render-process-gone', (_event, details) => {
+        (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('webcontents.render_process_gone', details);
+    });
+    mainWindow.webContents.on('unresponsive', () => (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('webcontents.unresponsive'));
+    mainWindow.webContents.on('responsive', () => (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('webcontents.responsive'));
+    mainWindow.webContents.on('did-finish-load', () => {
+        (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('webcontents.did_finish_load', {
+            url: mainWindow?.webContents.getURL() || '',
+            title: mainWindow?.getTitle() || '',
+        });
+    });
+    mainWindow.webContents.on('did-fail-load', (_event, errorCode, errorDescription, validatedURL, isMainFrame) => {
+        (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('webcontents.did_fail_load', {
+            errorCode,
+            errorDescription,
+            validatedURL,
+            isMainFrame,
+        });
+    });
+    mainWindow.webContents.on('devtools-opened', () => (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('webcontents.devtools_opened'));
+    mainWindow.webContents.on('devtools-closed', () => (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('webcontents.devtools_closed'));
     try {
         await mainWindow.webContents.session.clearCache();
     }
@@ -448,7 +525,10 @@ async function createWindow(url, runtimeId = process.env.FRAIM_HUB_RUNTIME_ID ||
             mainWindow?.hide();
         }
     });
-    mainWindow.on('closed', () => { mainWindow = null; });
+    mainWindow.on('closed', () => {
+        (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('window.closed');
+        mainWindow = null;
+    });
     await mainWindow.loadURL(url);
     mainWindow.webContents.setZoomFactor(1);
 }
@@ -499,6 +579,9 @@ async function launchDesktopShell(options) {
             return result.canceled || result.filePaths.length === 0 ? null : result.filePaths[0];
         },
         restartToLatest: restartToLatestNow,
+        hubMainDiagnostics: {
+            snapshot: () => (0, hub_main_diagnostics_1.getHubMainDiagnosticsSnapshot)(buildDesktopDebugSnapshot(runtimeId)),
+        },
     });
     await server.start(httpPort);
     const resolvedProjectPath = server.getProjectPath();
@@ -566,6 +649,16 @@ async function launchDesktopShell(options) {
 async function bootstrap() {
     const options = parseArgs(process.argv.slice(2));
     applyUserDataOverride();
+    (0, hub_main_diagnostics_1.installHubMainConsoleTee)();
+    (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('hub.startup', {
+        runtimeId: options.runtimeId,
+        preferredPort: options.preferredPort,
+        hasProjectPath: Boolean(options.projectPath),
+    });
+    electron_1.app.on('child-process-gone', (_event, details) => {
+        (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('app.child_process_gone', details);
+    });
+    electron_1.app.on('gpu-info-update', () => (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('app.gpu_info_update'));
     // Single-instance lock — if another instance is already running, focus it
     // and exit rather than spawning a second server + window.
     // Skip when FRAIM_AI_HUB_FAKE_HOST=1 (test mode) so Playwright can launch
@@ -577,6 +670,7 @@ async function bootstrap() {
         return;
     }
     electron_1.app.on('second-instance', () => {
+        (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('hub.second_instance');
         void electron_1.app.whenReady().then(checkForRelaunchAttemptUpdate);
         if (mainWindow) {
             mainWindow.show();
@@ -624,6 +718,7 @@ async function bootstrap() {
         // macOS: clicking dock icon re-shows the window. Unlike Windows/Linux, this never spawns a
         // second process (so 'second-instance' never fires here) — it is macOS's equivalent
         // relaunch-attempt event, so it gets the same npm-latest re-check (#1415).
+        (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('hub.activate');
         checkForRelaunchAttemptUpdate();
         if (mainWindow) {
             mainWindow.show();
@@ -632,6 +727,7 @@ async function bootstrap() {
     });
     electron_1.app.on('before-quit', () => {
         isQuitting = true;
+        (0, hub_main_diagnostics_1.recordHubMainDiagnostic)('hub.shutdown');
         // #755: clear the runtime file so a later `fraim hub` doesn't treat a
         // cleanly-exited instance as live.
         try {

package/dist/src/ai-hub/devtools-window.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openHubWindowDevTools = openHubWindowDevTools;
+async function openHubWindowDevTools(options) {
+    options.recordOpenRequested?.();
+    let window = options.getWindow();
+    if (!window || window.isDestroyed()) {
+        await options.createWindow(options.hubUrl);
+        window = options.getWindow();
+    }
+    if (!window || window.isDestroyed())
+        return 'unavailable';
+    window.show();
+    window.focus();
+    window.webContents.openDevTools({ mode: 'detach' });
+    return 'opened';
+}

package/dist/src/ai-hub/hosts.js

@@ -2501,15 +2501,13 @@ class CliHostRuntime {
         return isEmployeeDetectionRefreshing();
     }
     startRun(hostId, projectPath, message, handlers, sessionId, launchContext) {
-        // R11: start/startDirect mint sessions rather than resuming one, so they
-        // stay outside the continuation queue entirely.
-        return this.spawn(hostId, (0, configured_agents_1.decorateHostPlanWithConfiguredAgent)(buildStartPlan(hostId, message, sessionId), launchContext?.agent, launchContext?.env), projectPath, handlers);
+        return this.spawnStartAndRegister(hostId, projectPath, handlers, sessionId, (0, configured_agents_1.decorateHostPlanWithConfiguredAgent)(buildStartPlan(hostId, message, sessionId), launchContext?.agent, launchContext?.env));
     }
     continueRun(hostId, projectPath, sessionId, message, handlers, launchContext, deliveryIntent) {
         return this.guardedContinue(hostId, sessionId, { projectPath, message, handlers, launchContext, deliveryIntent });
     }
     startDirectRun(hostId, message, projectPath, handlers, sessionId, launchContext) {
-        return this.spawn(hostId, (0, configured_agents_1.decorateHostPlanWithConfiguredAgent)(buildDirectStartPlan(hostId, message, sessionId), launchContext?.agent, launchContext?.env), projectPath, handlers);
+        return this.spawnStartAndRegister(hostId, projectPath, handlers, sessionId, (0, configured_agents_1.decorateHostPlanWithConfiguredAgent)(buildDirectStartPlan(hostId, message, sessionId), launchContext?.agent, launchContext?.env));
     }
     continueDirectRun(hostId, sessionId, message, projectPath, handlers, launchContext, deliveryIntent) {
         // R10: continueDirectRun is protected by the same per-hostId::sessionId
@@ -2538,7 +2536,7 @@ class CliHostRuntime {
         if (active.escalationTimer != null)
             clearTimeout(active.escalationTimer);
         active.pending.splice(0);
-        this.activeContinueRuns.delete(key);
+        this.clearActiveRun(active);
         if (active.child.pid == null)
             return false;
         try {
@@ -2559,7 +2557,7 @@ class CliHostRuntime {
         const key = `${hostId}::${sessionId}`;
         const active = this.activeContinueRuns.get(key);
         if (!active) {
-            return this.spawnAndRegister(key, hostId, sessionId, entry);
+            return this.spawnAndRegister(hostId, sessionId, entry);
         }
         // R3/R31: an ordinary follow-up queues behind existing work; a course
         // correction (deliveryIntent 'stop') jumps to the front of the queue and
@@ -2579,11 +2577,49 @@ class CliHostRuntime {
         // through `entry.handlers` once it is actually dequeued and spawned.
         return active.child;
     }
-    spawnAndRegister(key, hostId, sessionId, entry) {
+    spawnStartAndRegister(hostId, projectPath, handlers, sessionId, plan) {
+        const deferredSessionIds = [];
+        let runEntry = null;
+        const registerSessionId = (value) => {
+            const discoveredSessionId = typeof value === 'string' ? value.trim() : '';
+            if (!discoveredSessionId)
+                return;
+            if (!runEntry) {
+                deferredSessionIds.push(discoveredSessionId);
+                return;
+            }
+            this.registerActiveRun(hostId, discoveredSessionId, runEntry);
+        };
+        const wrappedHandlers = {
+            ...handlers,
+            onEvent: (event, channel) => {
+                registerSessionId(event.sessionId);
+                handlers.onEvent(event, channel);
+            },
+        };
+        const child = this.spawn(hostId, plan, projectPath, wrappedHandlers);
+        runEntry = { child, pending: [], handlers: wrappedHandlers };
+        if (sessionId)
+            registerSessionId(sessionId);
+        for (const discoveredSessionId of deferredSessionIds) {
+            registerSessionId(discoveredSessionId);
+        }
+        child.once('close', () => {
+            if (!runEntry)
+                return;
+            if (runEntry.escalationTimer != null) {
+                clearTimeout(runEntry.escalationTimer);
+                runEntry.escalationTimer = undefined;
+            }
+            this.dequeueNext(hostId, runEntry);
+        });
+        return child;
+    }
+    spawnAndRegister(hostId, sessionId, entry) {
         const plan = (0, configured_agents_1.decorateHostPlanWithConfiguredAgent)(entry.direct ? buildDirectContinuePlan(hostId, sessionId, entry.message) : buildContinuePlan(hostId, sessionId, entry.message), entry.launchContext?.agent, entry.launchContext?.env);
         const child = this.spawn(hostId, plan, entry.projectPath, entry.handlers);
         const runEntry = { child, pending: [], handlers: entry.handlers };
-        this.activeContinueRuns.set(key, runEntry);
+        this.registerActiveRun(hostId, sessionId, runEntry);
         child.once('close', () => {
             // Issue #1570: a redirect kill that eventually takes (just slower than
             // the escalation window) must not leave its retry timer dangling past
@@ -2592,10 +2628,30 @@ class CliHostRuntime {
                 clearTimeout(runEntry.escalationTimer);
                 runEntry.escalationTimer = undefined;
             }
-            this.dequeueNext(key, hostId, sessionId, runEntry);
+            this.dequeueNext(hostId, runEntry);
         });
         return child;
     }
+    registerActiveRun(hostId, sessionId, runEntry) {
+        const key = `${hostId}::${sessionId}`;
+        const existing = this.activeContinueRuns.get(key);
+        if (existing && existing !== runEntry)
+            return;
+        if (!runEntry.keys)
+            runEntry.keys = new Set();
+        runEntry.keys.add(key);
+        runEntry.sessionId = sessionId;
+        this.activeContinueRuns.set(key, runEntry);
+    }
+    clearActiveRun(runEntry) {
+        const keys = runEntry.keys ? Array.from(runEntry.keys) : [];
+        for (const key of keys) {
+            if (this.activeContinueRuns.get(key) === runEntry) {
+                this.activeContinueRuns.delete(key);
+            }
+        }
+        runEntry.keys?.clear();
+    }
     // Issue #1570 (Defect 1): the redirect kill was previously fire-and-forget
     // — `killTree` was called once, with no way to know whether it actually
     // took, and no ceiling on how long the queued correction could sit behind
@@ -2660,11 +2716,14 @@ class CliHostRuntime {
     // batch uses the LAST entry's projectPath/handlers/launchContext unless a
     // 'stop' entry is present, in which case that correction's context wins —
     // it is the manager's most recent, most urgent instruction.
-    dequeueNext(key, hostId, sessionId, runEntry) {
-        this.activeContinueRuns.delete(key);
+    dequeueNext(hostId, runEntry) {
+        const sessionId = runEntry.sessionId;
+        this.clearActiveRun(runEntry);
         const batch = runEntry.pending.splice(0);
         if (!batch.length)
             return;
+        if (!sessionId)
+            return;
         const combinedMessage = batch.map((e) => e.message).join('\n\n');
         const primary = batch.find((e) => e.deliveryIntent === 'stop') ?? batch[batch.length - 1];
         try {
@@ -2674,7 +2733,7 @@ class CliHostRuntime {
             // R19: a synchronous spawn failure must not leave the queue permanently
             // stuck behind this key — clear it so the next continueRun call spawns
             // fresh instead of queueing behind a dead entry.
-            this.activeContinueRuns.delete(key);
+            this.clearActiveRun(runEntry);
         }
     }
 }

package/dist/src/ai-hub/hub-app-materializer.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.HUB_APP_ENTRY_RELATIVE = exports.HUB_APP_PACKAGE_NAME = void 0;
+exports.redactCredentialLikeSubstrings = redactCredentialLikeSubstrings;
 exports.resolvePackagedCliScriptPath = resolvePackagedCliScriptPath;
 exports.planHubAppMaterialization = planHubAppMaterialization;
 exports.resolveHubAppCacheDir = resolveHubAppCacheDir;
@@ -33,6 +34,23 @@ const managed_node_runtime_1 = require("../cli/utils/managed-node-runtime");
 // offline matrix is unit-testable without touching npm, disk, or Electron — the same separation
 // `hub-launch-decision.ts` (#755) and `desktop-auto-updater.ts` (#1387) already established for
 // this exact class of problem.
+// Issue #1627 (security review): the raw materialization failure text below is now surfaced to a
+// new, wider audience than before this issue — a persisted log file and the manual restart-to-
+// latest HTTP response/UI — where previously it was silently discarded. `npm install` output does
+// not normally echo credentials, but a misconfigured corporate registry (a literal token in a
+// `.npmrc` URL, verbose proxy auth errors) is a real enough edge case that this new, wider surface
+// should not forward it as-is. Defense-in-depth only: redact credential-shaped substrings before
+// this text reaches either destination.
+const CREDENTIAL_LIKE_PATTERNS = [
+    /:\/\/[^\s/@]+:[^\s/@]+@/g, // scheme://user:pass@ basic-auth-in-URL
+    /\b(?:_authToken|authToken|Authorization|api[_-]?key|password)\s*[:=]\s*\S+/gi,
+    /\bnpm_[A-Za-z0-9]{20,}\b/g, // npm access-token shape
+    /\bBearer\s+[A-Za-z0-9._-]{10,}\b/gi,
+];
+/** Strip anything that looks like a credential from text before it is logged or surfaced. */
+function redactCredentialLikeSubstrings(text) {
+    return CREDENTIAL_LIKE_PATTERNS.reduce((acc, pattern) => acc.replace(pattern, '[redacted]'), text);
+}
 exports.HUB_APP_PACKAGE_NAME = 'fraim-hub';
 /** Relative path, from a materialized (or bundled) package root, to the Electron main entry. */
 exports.HUB_APP_ENTRY_RELATIVE = path_1.default.join('dist', 'src', 'ai-hub', 'desktop-main.js');
@@ -68,12 +86,14 @@ function planHubAppMaterialization(input) {
                 action: 'use-cached',
                 version: newestCached,
                 reason: 'npm registry unreachable; reusing the newest complete cached version',
+                degraded: false,
             };
         }
         return {
             action: 'use-bundled',
             version: bundledVersion,
             reason: 'npm registry unreachable and no cached version available; falling back to the version bundled with this installer',
+            degraded: true,
         };
     }
     if (latestPublishedVersion === bundledVersion) {
@@ -81,6 +101,7 @@ function planHubAppMaterialization(input) {
             action: 'use-bundled',
             version: bundledVersion,
             reason: 'the installed shell already matches the latest published version',
+            degraded: false,
         };
     }
     const alreadyMaterialized = cachedVersions.some((entry) => entry.complete && entry.version === latestPublishedVersion);
@@ -89,12 +110,14 @@ function planHubAppMaterialization(input) {
             action: 'use-cached',
             version: latestPublishedVersion,
             reason: 'latest published version is already materialized on disk',
+            degraded: false,
         };
     }
     return {
         action: 'materialize',
         version: latestPublishedVersion,
         reason: `latest published version ${latestPublishedVersion} is not yet materialized`,
+        degraded: false,
     };
 }
 // ---------------------------------------------------------------------------
@@ -265,7 +288,11 @@ async function resolveHubAppEntry(options) {
         cachedVersions,
     });
     if (plan.action === 'use-bundled') {
-        return { entryPath: options.bundledEntryPath, source: 'bundled', version: plan.version };
+        const materializationError = plan.degraded ? plan.reason : undefined;
+        if (materializationError) {
+            console.error(`[fraim] FRAIM Hub update check could not complete: ${materializationError}`);
+        }
+        return { entryPath: options.bundledEntryPath, source: 'bundled', version: plan.version, materializationError };
     }
     if (plan.action === 'use-cached') {
         return {
@@ -279,7 +306,10 @@ async function resolveHubAppEntry(options) {
         const entryPath = await ensureMaterializedHubApp(plan.version, { fraimDir, installPackage: options.installPackage });
         return { entryPath, source: 'cached', version: plan.version };
     }
-    catch {
-        return { entryPath: options.bundledEntryPath, source: 'bundled', version: options.bundledVersion };
+    catch (error) {
+        const rawMessage = error instanceof Error ? error.message : String(error);
+        const materializationError = redactCredentialLikeSubstrings(rawMessage);
+        console.error(`[fraim] failed to materialize FRAIM Hub ${plan.version}; falling back to bundled ${options.bundledVersion}: ${materializationError}`);
+        return { entryPath: options.bundledEntryPath, source: 'bundled', version: options.bundledVersion, materializationError };
     }
 }