fraim 2.0.288 → 2.0.290

package/dist/src/cli/utils/managed-node-runtime.js

@@ -0,0 +1,269 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MANAGED_NODE_VERSION = void 0;
+exports.npmExecutableName = npmExecutableName;
+exports.nodeExecutableName = nodeExecutableName;
+exports.findExecutableOnPath = findExecutableOnPath;
+exports.hasWorkingNodeAndNpm = hasWorkingNodeAndNpm;
+exports.isManagedNodeVersionComplete = isManagedNodeVersionComplete;
+exports.nodeVersionedDirName = nodeVersionedDirName;
+exports.ensureManagedNpm = ensureManagedNpm;
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const https_1 = __importDefault(require("https"));
+const crypto_1 = __importDefault(require("crypto"));
+const managed_agent_paths_1 = require("./managed-agent-paths");
+// Issue #1415 (extended): a genuinely GUI-only FRAIM Hub install — the native installer
+// downloaded from the website, never a CLI — has no working `npm`/`npx` anywhere. First-run's
+// `embeddedDesktop` branch (session-service.ts) deliberately skips installing one (it only needs
+// Electron's own bundled Node for FRAIM's own CLI/MCP shim, via ELECTRON_RUN_AS_NODE), and the
+// separate CLI installer's portable-Node bootstrap (scripts/installer/fraim-install-win.template.cmd)
+// never runs for a desktop-only user. That left two features silently unable to do their real job
+// on such a machine: `hub-app-materializer.ts`'s npm install (this issue), and agent-CLI
+// installation (`managed-agent-install.ts`), which also shells out to a bare `npm`.
+//
+// This module is the one place that guarantees a real, usable `npm`/`node` exists, for both
+// consumers: prefer whatever is already on system PATH (common for technical users), then an
+// already-downloaded managed runtime (shared with the CLI installer's `~/.fraim/node/` convention
+// via `managed-agent-paths.ts` — reused, not duplicated, so a user who has ever run the `fraim` CLI
+// never pays for a second download), and only download a portable Node.js distribution from
+// nodejs.org as a last resort.
+//
+// `~/.fraim/node/` is a *shared* directory — it already holds agent-CLI shims and their own
+// `node_modules/` (managed-agent-install.ts) — not a directory this module exclusively owns like
+// `electron-dist.ts` owns its versioned Electron dist. So the extract-once-reuse-forever,
+// staging-then-atomic-rename transaction that pattern established is applied here to just the one
+// versioned subfolder a Node.js archive naturally extracts as (`node-v<version>-<platform>-<arch>/`,
+// exactly what `getPortableNodeBinPath()` already knows how to find), never to the shared root
+// itself — so a concurrent or failed download can never disturb sibling content already there.
+exports.MANAGED_NODE_VERSION = '20.11.1'; // matches NODE_VERSION in fraim-install-win.template.cmd
+function npmExecutableName(platform = process.platform) {
+    return platform === 'win32' ? 'npm.cmd' : 'npm';
+}
+function nodeExecutableName(platform = process.platform) {
+    return platform === 'win32' ? 'node.exe' : 'node';
+}
+/** First executable named `name` found by walking `pathValue`'s directories, or null. */
+function findExecutableOnPath(name, pathValue = process.env.PATH) {
+    for (const dir of (pathValue ?? '').split(path_1.default.delimiter).filter(Boolean)) {
+        const candidate = path_1.default.join(dir, name);
+        try {
+            if (fs_1.default.existsSync(candidate) && fs_1.default.statSync(candidate).isFile())
+                return candidate;
+        }
+        catch {
+            // Unreadable entry — treat as absent, not fatal.
+        }
+    }
+    return null;
+}
+/** Whether `dir` already has a real, runnable node+npm — any version; this function's job is "a working npm", not "this exact one". */
+function hasWorkingNodeAndNpm(dir, platform = process.platform) {
+    return fs_1.default.existsSync(path_1.default.join(dir, npmExecutableName(platform))) && fs_1.default.existsSync(path_1.default.join(dir, nodeExecutableName(platform)));
+}
+/** Whether `dir` (a specific versioned bin dir) holds a complete extraction for exactly `version`. */
+function isManagedNodeVersionComplete(dir, version, platform = process.platform) {
+    try {
+        const recorded = fs_1.default.readFileSync(path_1.default.join(dir, 'fraim-managed-node-version'), 'utf8').trim();
+        return recorded === version && hasWorkingNodeAndNpm(dir, platform);
+    }
+    catch {
+        return false;
+    }
+}
+function nodePlatformName(platform) {
+    if (platform === 'darwin')
+        return 'darwin';
+    if (platform === 'win32')
+        return 'win';
+    return 'linux';
+}
+function nodeArchiveExtension(platform) {
+    return platform === 'win32' ? 'zip' : 'tar.gz';
+}
+// `request.version` is always `MANAGED_NODE_VERSION` today, but it is a public option on
+// `ensureManagedNpm`, and this string is joined into a filesystem path below (`nodeRoot/<this>`)
+// that a failed extraction's cleanup recursively deletes. Anchoring on an exact-release shape
+// before it ever reaches a path, same guard shape as `hub-app-materializer.ts`'s
+// `assertPathSafeVersion`, so a hostile or malformed override can never escape `nodeRoot`.
+const SAFE_NODE_VERSION = /^\d+\.\d+\.\d+$/;
+function assertPathSafeNodeVersion(version) {
+    if (!SAFE_NODE_VERSION.test(version)) {
+        throw new Error(`Refusing to use "${version}" as a managed Node.js version: expected an exact release such as 20.11.1.`);
+    }
+    return version;
+}
+/** The exact folder name Node's own official archive extracts as — also this module's versioned subfolder name under the shared `~/.fraim/node/` root. */
+function nodeVersionedDirName(request) {
+    return `node-v${assertPathSafeNodeVersion(request.version)}-${nodePlatformName(request.platform)}-${request.arch}`;
+}
+function nodeArchiveFileName(request) {
+    return `${nodeVersionedDirName(request)}.${nodeArchiveExtension(request.platform)}`;
+}
+function nodeDistBaseUrl(version) {
+    return `https://nodejs.org/dist/v${version}`;
+}
+function httpsGetBuffer(url) {
+    return new Promise((resolve, reject) => {
+        https_1.default.get(url, { headers: { 'user-agent': 'fraim-hub-managed-node-runtime' } }, (res) => {
+            if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+                httpsGetBuffer(res.headers.location).then(resolve, reject);
+                return;
+            }
+            if (res.statusCode !== 200) {
+                res.resume();
+                reject(new Error(`GET ${url} failed: HTTP ${res.statusCode}`));
+                return;
+            }
+            const chunks = [];
+            res.on('data', (chunk) => chunks.push(chunk));
+            res.on('end', () => resolve(Buffer.concat(chunks)));
+            res.on('error', reject);
+        }).on('error', reject);
+    });
+}
+function httpsDownloadToFile(url, destPath) {
+    return new Promise((resolve, reject) => {
+        const file = fs_1.default.createWriteStream(destPath);
+        https_1.default.get(url, { headers: { 'user-agent': 'fraim-hub-managed-node-runtime' } }, (res) => {
+            if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+                file.close();
+                httpsDownloadToFile(res.headers.location, destPath).then(resolve, reject);
+                return;
+            }
+            if (res.statusCode !== 200) {
+                res.resume();
+                file.close();
+                reject(new Error(`GET ${url} failed: HTTP ${res.statusCode}`));
+                return;
+            }
+            res.pipe(file);
+            file.on('finish', () => file.close(() => resolve()));
+        }).on('error', (err) => {
+            file.close();
+            reject(err);
+        });
+    });
+}
+/**
+ * Verify `filePath` against the sha256 line naming `fileName` in the release's own
+ * `SHASUMS256.txt` — the same integrity check `@electron/get` performs for Electron zips
+ * (`electron-dist.ts`), applied to Node's own equivalent publishing convention.
+ */
+async function verifyNodeArchiveChecksum(filePath, fileName, version) {
+    const shasums = (await httpsGetBuffer(`${nodeDistBaseUrl(version)}/SHASUMS256.txt`)).toString('utf8');
+    const line = shasums.split('\n').find((entry) => entry.trim().endsWith(fileName));
+    if (!line) {
+        throw new Error(`SHASUMS256.txt for Node v${version} has no entry for ${fileName}; refusing to trust an unverified download`);
+    }
+    const expected = line.trim().split(/\s+/)[0];
+    const actual = crypto_1.default.createHash('sha256').update(fs_1.default.readFileSync(filePath)).digest('hex');
+    if (actual !== expected) {
+        throw new Error(`checksum mismatch for ${fileName}: expected ${expected}, got ${actual}`);
+    }
+}
+const defaultDownloadNodeArchive = async (request) => {
+    const fileName = nodeArchiveFileName(request);
+    const url = `${nodeDistBaseUrl(request.version)}/${fileName}`;
+    const tempPath = path_1.default.join(os_1.default.tmpdir(), `fraim-managed-node-${process.pid}-${Date.now()}-${fileName}`);
+    await httpsDownloadToFile(url, tempPath);
+    try {
+        await verifyNodeArchiveChecksum(tempPath, fileName, request.version);
+    }
+    catch (error) {
+        fs_1.default.rmSync(tempPath, { force: true });
+        throw error;
+    }
+    return tempPath;
+};
+const defaultExtractNodeArchive = async (archivePath, destDir, request) => {
+    if (request.platform === 'win32') {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        const extract = require('extract-zip');
+        await extract(archivePath, { dir: destDir });
+    }
+    else {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        const tar = require('tar');
+        await tar.x({ file: archivePath, cwd: destDir });
+    }
+};
+/**
+ * Download and extract Node v`request.version` into `nodeRoot/<node-vX.Y.Z-platform-arch>/`,
+ * touching nothing else in `nodeRoot`. Staging-then-atomic-rename, scoped to just that one
+ * versioned subfolder (mirrors `electron-dist.ts`'s transaction, applied to a shared parent
+ * directory instead of one this module exclusively owns): a concurrent download that already
+ * finished is kept rather than clobbered, and a failed extraction never leaves a versioned
+ * subfolder behind that a later launch could mistake for complete.
+ */
+async function downloadAndPromoteVersionedNodeDir(args) {
+    const { nodeRoot, request, downloadArchive, extractArchive } = args;
+    const destDir = path_1.default.join(nodeRoot, nodeVersionedDirName(request));
+    const stagingDir = `${destDir}.staging-${process.pid}`;
+    fs_1.default.mkdirSync(nodeRoot, { recursive: true });
+    fs_1.default.rmSync(stagingDir, { recursive: true, force: true });
+    const archivePath = await downloadArchive(request);
+    try {
+        await extractArchive(archivePath, stagingDir, request);
+        // The archive's own top-level folder (matching nodeVersionedDirName) may land either as the
+        // extraction root itself (tar) or as one nested level inside it (some zip extractors preserve
+        // the archive's internal folder) — handle both without assuming either.
+        const nestedCandidate = path_1.default.join(stagingDir, nodeVersionedDirName(request));
+        const extractedRoot = fs_1.default.existsSync(nestedCandidate) ? nestedCandidate : stagingDir;
+        fs_1.default.writeFileSync(path_1.default.join(extractedRoot, 'fraim-managed-node-version'), request.version, 'utf8');
+        if (!isManagedNodeVersionComplete(extractedRoot, request.version, request.platform)) {
+            throw new Error(`extracted Node v${request.version} is missing ${npmExecutableName(request.platform)}/${nodeExecutableName(request.platform)}; refusing to promote an incomplete install`);
+        }
+        // A concurrent launch may have finished downloading the same version already; the winner
+        // keeps its copy rather than being clobbered by this one.
+        if (!isManagedNodeVersionComplete(destDir, request.version, request.platform)) {
+            fs_1.default.rmSync(destDir, { recursive: true, force: true });
+            try {
+                fs_1.default.renameSync(extractedRoot, destDir);
+            }
+            catch (error) {
+                if (!isManagedNodeVersionComplete(destDir, request.version, request.platform))
+                    throw error;
+            }
+        }
+    }
+    finally {
+        fs_1.default.rmSync(archivePath, { force: true });
+        fs_1.default.rmSync(stagingDir, { recursive: true, force: true });
+    }
+    return destDir;
+}
+/**
+ * Resolve a working `npm` executable, preferring (in order): system PATH, an already-downloaded
+ * managed runtime (shared with the CLI installer's convention, any version — this function's job
+ * is "a working npm", not "this exact one"), or a freshly downloaded one. Only throws for a
+ * genuine download/extraction failure; callers should treat that as "materialization unavailable
+ * this launch," not a hard failure — never for "nothing found," which falls through to download.
+ */
+async function ensureManagedNpm(options = {}) {
+    const version = options.version ?? exports.MANAGED_NODE_VERSION;
+    const platform = options.platform ?? process.platform;
+    const arch = options.arch ?? process.arch;
+    const systemNpm = findExecutableOnPath(npmExecutableName(platform), options.systemPath ?? process.env.PATH);
+    if (systemNpm) {
+        return { npmPath: systemNpm, binDir: path_1.default.dirname(systemNpm), source: 'system' };
+    }
+    const existingBinDir = (0, managed_agent_paths_1.getPortableNodeBinPath)();
+    if (hasWorkingNodeAndNpm(existingBinDir, platform)) {
+        return { npmPath: path_1.default.join(existingBinDir, npmExecutableName(platform)), binDir: existingBinDir, source: 'managed-existing' };
+    }
+    const request = { version, platform, arch };
+    options.onProgress?.('Preparing FRAIM\'s bundled Node.js runtime (one-time, ~30MB)...');
+    const binDir = await downloadAndPromoteVersionedNodeDir({
+        nodeRoot: (0, managed_agent_paths_1.getManagedNodeRoot)(),
+        request,
+        downloadArchive: options.downloadArchive ?? defaultDownloadNodeArchive,
+        extractArchive: options.extractArchive ?? defaultExtractNodeArchive,
+    });
+    options.onProgress?.('FRAIM Node.js runtime ready.');
+    return { npmPath: path_1.default.join(binDir, npmExecutableName(platform)), binDir, source: 'managed-downloaded' };
+}

package/dist/src/config/ai-manager-hiring.js

@@ -64,13 +64,17 @@ function buildSearchQuery(roleKey) {
     const profile = getHumanManagerProfile(roleKey);
     return `${profile.keywords.join(' OR ')} AND ${AI_MANAGER_QUERY_TERMS}`;
 }
+function indefiniteArticle(phrase) {
+    return /^[aeiou]/i.test(phrase.trim()) ? 'an' : 'a';
+}
 function buildJobDescription(roleKey) {
     const profile = getHumanManagerProfile(roleKey);
     const role = persona_hiring_1.PERSONA_HIRE_CATALOG[roleKey]?.role ?? 'AI Employee';
+    const article = indefiniteArticle(role);
     return [
-        `${profile.humanTitle} — manager for an ${role}`,
+        `${profile.humanTitle} — manager for ${article} ${role}`,
         '',
-        `You will manage an ${role} (an autonomous AI agent) and the humans around it, owning the outcomes it ships.`,
+        `You will manage ${article} ${role} (an autonomous AI agent) and the humans around it, owning the outcomes it ships.`,
         '',
         "What you'll do:",
         `- Write crisp specifications and acceptance criteria the ${role} can execute against.`,

package/dist/src/config/persona-capability-bundles.js

@@ -278,7 +278,7 @@ exports.PERSONA_CAPABILITY_BUNDLES = {
         ],
         protectedAliases: ['ai-engineering', 'agent-engineering', 'ai-agents'],
         defaultHireMode: 'job',
-        lockCopy: 'Hire AIda to unlock AI agent design, MCP enablement, eval authoring, and agent evaluation work for this request.'
+        lockCopy: 'Hire AIDa to unlock AI agent design, MCP enablement, eval authoring, and agent evaluation work for this request.'
     }
 };
 const PROTECTED_JOB_TO_PERSONA = new Map();

package/dist/src/config/persona-hiring.js

@@ -20,8 +20,8 @@ exports.getPersonaHireAmountCents = getPersonaHireAmountCents;
  */
 exports.PERSONA_HIRE_CATALOG = {
     aida: {
-        displayName: 'AIda',
-        role: 'AI Engineer',
+        displayName: 'AIDa',
+        role: 'AI Developer',
         emoji: '\u{1F9E0}',
         gradient: 'linear-gradient(135deg, #4f46e5 0%, #06b6d4 50%, #10b981 100%)',
         blurb: 'Designs production AI agents, connects them to tools and data, and proves their behavior with evals before deployment.',
@@ -30,7 +30,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     swen: {
         displayName: 'SWEn',
-        role: 'AI Software Engineer',
+        role: 'Software Engineer',
         emoji: '💻',
         gradient: 'linear-gradient(135deg, #2563eb 0%, #06b6d4 100%)',
         blurb: 'Implements features, refactors code, and drives PR iteration to merge, reviewing design and code as a senior would.',
@@ -39,7 +39,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     qasm: {
         displayName: 'QAsm',
-        role: 'AI QA Engineer',
+        role: 'QA Engineer',
         emoji: '🛡️',
         gradient: 'linear-gradient(135deg, #10b981 0%, #14b8a6 100%)',
         blurb: 'Runs tests, assesses code and test quality, polishes UI, and drives bug bashes with evidence.',
@@ -48,7 +48,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     sekhar: {
         displayName: 'SEChar',
-        role: 'AI Security Engineer',
+        role: 'Security Engineer',
         emoji: '🔒',
         gradient: 'linear-gradient(135deg, #ef4444 0%, #f43f5e 100%)',
         blurb: 'Sets up AI-native security baselines, runs the findings command center, reviews changes for risk, and drives remediation to closure.',
@@ -57,7 +57,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     sreya: {
         displayName: 'SREya',
-        role: 'AI Site Reliability Engineer',
+        role: 'Site Reliability Engineer',
         emoji: '☁️',
         gradient: 'linear-gradient(135deg, #2563eb 0%, #10b981 100%)',
         blurb: 'Manages deployments, monitors uptime, optimizes cloud cost, and keeps infrastructure resilient and observable.',
@@ -66,7 +66,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     sade: {
         displayName: 'SADE',
-        role: 'AI Salesforce Developer',
+        role: 'Salesforce Developer',
         emoji: '☁️',
         gradient: 'linear-gradient(135deg, #0284c7 0%, #0369a1 100%)',
         blurb: 'Deploys Salesforce configuration from ServiceNow tickets, builds reports and dashboards, creates Flows from business requirements, audits org health, and manages users and data at scale.',
@@ -75,7 +75,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     pam: {
         displayName: 'PaM',
-        role: 'AI Product Manager',
+        role: 'Product Manager',
         emoji: '📋',
         gradient: 'linear-gradient(135deg, #8b5cf6 0%, #d946ef 100%)',
         blurb: 'Owns specs, PRDs, technical design, issue prep, and the path from idea to shippable artifact.',
@@ -84,7 +84,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     huxley: {
         displayName: 'hUXley',
-        role: 'AI UX / Brand Designer',
+        role: 'UX / Brand Designer',
         emoji: '🎨',
         gradient: 'linear-gradient(135deg, #ec4899 0%, #f472b6 100%)',
         blurb: 'Builds design systems, prototypes polished user-facing surfaces, and carries brand decisions into shipped product experiences.',
@@ -93,7 +93,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     gautam: {
         displayName: 'GauTaM',
-        role: 'AI GTM & Marketing Manager',
+        role: 'GTM & Marketing Manager',
         emoji: '📣',
         gradient: 'linear-gradient(135deg, #f97316 0%, #f59e0b 100%)',
         blurb: 'Defines marketing strategy, ships content, runs launches, and owns the brand voice in market.',
@@ -102,7 +102,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     sam: {
         displayName: 'SAM',
-        role: 'AI Sales Account Manager',
+        role: 'Sales Account Manager',
         emoji: '📈',
         gradient: 'linear-gradient(135deg, #059669 0%, #0d9488 100%)',
         blurb: 'Surfaces stalled deals, computes pipeline health, and drafts account-specific re-engagement proposals for your top at-risk opportunities.',
@@ -111,7 +111,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     casey: {
         displayName: 'CaSey',
-        role: 'AI Customer Success + Support',
+        role: 'Customer Success + Support',
         emoji: '💬',
         gradient: 'linear-gradient(135deg, #db2777 0%, #9333ea 100%)',
         blurb: 'Scores account churn risk and expansion potential, generates prioritized action plans for CSMs, triages support cases, and routes L1 cases through automated resolution.',
@@ -120,7 +120,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     mona: {
         displayName: 'MONa',
-        role: 'AI Finance Manager',
+        role: 'Finance Manager',
         emoji: '💰',
         gradient: 'linear-gradient(135deg, #10b981 0%, #f59e0b 100%)',
         blurb: 'Models revenue, tracks unit economics, builds financial forecasts, and owns the metrics that drive growth decisions.',
@@ -129,7 +129,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     hari: {
         displayName: 'HaRi',
-        role: 'AI HR Manager',
+        role: 'HR Manager',
         emoji: '👥',
         gradient: 'linear-gradient(135deg, #0d9488 0%, #059669 100%)',
         blurb: 'Manages onboarding, performance reviews, benefits analysis, payroll coordination, and HR business-partner advisory.',
@@ -138,7 +138,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     ricardo: {
         displayName: 'RECardo',
-        role: 'AI Recruiter',
+        role: 'Recruiter',
         emoji: '🤝',
         gradient: 'linear-gradient(135deg, #6366f1 0%, #ec4899 100%)',
         blurb: 'Sources candidates, writes job descriptions, screens pipelines, and manages the hiring loop end-to-end.',
@@ -147,7 +147,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     cela: {
         displayName: 'CELiA',
-        role: 'AI Legal Counsel',
+        role: 'Legal Counsel',
         emoji: '⚖️',
         gradient: 'linear-gradient(135deg, #475569 0%, #6366f1 100%)',
         blurb: 'Drafts and reviews contracts, NDAs, patents, trademarks, and the SaaS legal stack.',
@@ -156,7 +156,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     procella: {
         displayName: 'PROCella',
-        role: 'AI Procurement Manager',
+        role: 'Procurement Manager',
         emoji: '📦',
         gradient: 'linear-gradient(135deg, #0f766e 0%, #7c3aed 100%)',
         blurb: 'Frames procurement strategy, sources suppliers, runs RFx packages, evaluates responses, and keeps purchases acceptance-gated.',
@@ -165,7 +165,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     banke: {
         displayName: 'BANKe',
-        role: 'AI Banking KYC Employee',
+        role: 'Banking KYC Employee',
         emoji: '\u{1F3E6}',
         gradient: 'linear-gradient(135deg, #0f766e 0%, #2563eb 100%)',
         blurb: 'Runs banking KYC cases with consent-aware evidence capture, decision receipts, and stable audit handoff artifacts.',
@@ -174,7 +174,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     auditya: {
         displayName: 'AUDITya',
-        role: 'AI Banking Auditor',
+        role: 'Banking Auditor',
         emoji: '\u{1F50E}',
         gradient: 'linear-gradient(135deg, #7c3aed 0%, #0f172a 100%)',
         blurb: 'Audits AI banking work by tracing decisions back to evidence, receipts, exceptions, and reusable audit reports.',
@@ -183,7 +183,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     deidre: {
         displayName: 'DEIdre',
-        role: 'AI Inclusion Leader',
+        role: 'Inclusion Leader',
         emoji: '🌍',
         gradient: 'linear-gradient(135deg, #9333ea 0%, #d946ef 100%)',
         blurb: 'Audits equity gaps, designs bias-aware AI governance, builds ERG toolkits, and creates inclusion-fluency programs.',
@@ -192,7 +192,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     careena: {
         displayName: 'CAREEna',
-        role: 'AI Career Coach',
+        role: 'Career Coach',
         emoji: '🎓',
         gradient: 'linear-gradient(135deg, #0ea5e9 0%, #6366f1 100%)',
         blurb: 'Runs the candidate-side search loop: role sourcing, application execution, networking, interview prep, and close-stage offer strategy.',
@@ -201,7 +201,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     ashley: {
         displayName: 'AshLey',
-        role: 'AI Executive Assistant',
+        role: 'Executive Assistant',
         emoji: '📅',
         gradient: 'linear-gradient(135deg, #f59e0b 0%, #fbbf24 100%)',
         blurb: 'Owns executive coordination, weekly operating reviews, and portfolio reporting across the workforce.',
@@ -210,7 +210,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     mandy: {
         displayName: 'MANdy',
-        role: 'AI Manager',
+        role: 'Manager',
         emoji: '🎯',
         gradient: 'linear-gradient(135deg, #7c3aed 0%, #4338ca 100%)',
         blurb: 'Plans the job sequence, runs sub-agents in parallel, coaches them through verification loops, and hands back a synthesized DRAFT for your approval.',
@@ -219,7 +219,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     beza: {
         displayName: 'BeZa',
-        role: 'AI Business Strategist',
+        role: 'Business Strategist',
         emoji: '🧭',
         gradient: 'linear-gradient(135deg, #6366f1 0%, #8b5cf6 100%)',
         blurb: 'Turns ideas into structured business plans, validates founder-market fit, and pressure-tests strategy.',
@@ -228,7 +228,7 @@ exports.PERSONA_HIRE_CATALOG = {
     },
     maestro: {
         displayName: 'MAESTRO',
-        role: 'Full-Brained AI Employee',
+        role: 'Full-Brained Employee',
         emoji: '★',
         gradient: 'linear-gradient(135deg, #6366f1 0%, #8b5cf6 50%, #d946ef 100%)',
         blurb: 'One AI employee who can take a job from any function and ship it back with evidence. You set the direction. You sign off on what ships. Maestro does the work.',
@@ -260,7 +260,7 @@ exports.PERSONA_AVATAR_CATALOG = {
     procella: { seed: 'PROCELLA-procurement', bg: 'ccfbf1', style: 'notionists' },
     banke: { seed: 'BANKe-banking-kyc', bg: 'ccfbf1', style: 'notionists' },
     auditya: { seed: 'AUDITya-banking-audit', bg: 'e9d5ff', style: 'notionists' },
-    aida: { seed: 'AIda-ai-engineer', bg: 'c7d2fe', style: 'notionists' },
+    aida: { seed: 'AIDa-ai-developer', bg: 'c7d2fe', style: 'notionists' },
 };
 function buildPersonaAvatarUrl(personaKey) {
     const avatar = exports.PERSONA_AVATAR_CATALOG[personaKey];

package/dist/src/first-run/session-service.js

@@ -52,6 +52,7 @@ const fraim_mcp_latest_launcher_1 = require("../cli/mcp/fraim-mcp-latest-launche
 const script_sync_utils_1 = require("../cli/utils/script-sync-utils");
 const managed_agent_paths_1 = require("../cli/utils/managed-agent-paths");
 const managed_agent_install_1 = require("../cli/utils/managed-agent-install");
+const managed_node_runtime_1 = require("../cli/utils/managed-node-runtime");
 const types_1 = require("./types");
 Object.defineProperty(exports, "FIRST_RUN_ROW_IDS", { enumerable: true, get: function () { return types_1.FIRST_RUN_ROW_IDS; } });
 const install_state_1 = require("./install-state");
@@ -856,9 +857,18 @@ class FirstRunSessionService {
                     loginHint: `Sign in to ${option.label} to activate it. A terminal window will open with the sign-in command — complete sign-in there, then return here and click "Check if Ready".`,
                 };
             }
-            const outcome = await (0, managed_agent_install_1.installManagedAgent)({ label: option.label, installPackage: option.installPackage, launchCommand: option.launchCommand }, systemPath, { runProcess, commandVersion });
+            // Issue #1415 (extended): a genuinely GUI-only install (native installer only, no CLI ever
+            // run) has no working npm on `systemPath` at all — `installManagedAgent`'s "standard" attempt
+            // needs one to run `npm install -g <agent>` in the first place. Ensure one exists (system,
+            // already-managed, or freshly downloaded) and fold its directory into the PATH passed down,
+            // so the standard attempt can actually succeed instead of silently falling through.
+            const npm = await (0, managed_node_runtime_1.ensureManagedNpm)({
+                onProgress: (message) => appendInstallLog(`managed-node: ${message}`),
+            });
+            const pathWithNpm = (0, managed_agent_paths_1.appendBinDirsToPath)(systemPath, [npm.binDir]);
+            const outcome = await (0, managed_agent_install_1.installManagedAgent)({ label: option.label, installPackage: option.installPackage, launchCommand: option.launchCommand }, pathWithNpm, { runProcess, commandVersion });
             if (outcome.outcome === 'standard' && outcome.npmGlobalBinDirs.length > 0) {
-                process.env.PATH = (0, managed_agent_paths_1.appendBinDirsToPath)(systemPath, outcome.npmGlobalBinDirs);
+                process.env.PATH = (0, managed_agent_paths_1.appendBinDirsToPath)(pathWithNpm, outcome.npmGlobalBinDirs);
             }
             this.setAgentInstallStatus(agentId, 'needs-sign-in', `Sign in to ${option.label} to activate it.`);
             appendInstallLog(outcome.outcome === 'standard' ? `agent-installed-standard ${agentId}` : `agent-installed-managed ${agentId}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fraim",
-  "version": "2.0.288",
+  "version": "2.0.290",
   "description": "FRAIM core CLI and MCP package.",
   "main": "index.js",
   "bin": {
@@ -46,6 +46,7 @@
     "cors": "^2.8.5",
     "dotenv": "^16.4.7",
     "express": "^5.2.1",
+    "extract-zip": "^2.0.1",
     "mongodb": "^7.0.0",
     "node-cron": "4.2.1",
     "node-edge-tts": "^1.2.10",
@@ -55,6 +56,7 @@
     "selfsigned": "^5.5.0",
     "semver": "^7.7.4",
     "stripe": "^20.3.1",
+    "tar": "^7.4.3",
     "toml": "^3.0.0",
     "tree-kill": "^1.2.2",
     "xml2js": "^0.6.2"

package/public/first-run/script.js

@@ -717,7 +717,16 @@
       }
     };
     submit.addEventListener('click', onSubmit);
-    input.addEventListener('keydown', (e) => { if (e.key === 'Enter') onSubmit(); });
+    input.addEventListener('keydown', (e) => {
+      if (e.key === 'Enter') {
+        onSubmit();
+        return;
+      }
+      if (e.key === 'Tab' && !e.shiftKey) {
+        e.preventDefault();
+        submit.focus();
+      }
+    });
     card.appendChild(submit);
 
     CHECKLIST_EL.appendChild(card);