fraim 2.0.318 → 2.0.320

package/dist/src/cli/commands/first-run.js

@@ -1,37 +1,4 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -40,6 +7,9 @@ exports.firstRunCommand = exports.runFirstRun = void 0;
 const commander_1 = require("commander");
 const chalk_1 = __importDefault(require("chalk"));
 const child_process_1 = require("child_process");
+const server_1 = require("../../first-run/server");
+const session_service_1 = require("../../first-run/session-service");
+const ports_1 = require("../../core/utils/ports");
 function openBrowser(url) {
     try {
         if (process.platform === 'win32') {
@@ -63,22 +33,17 @@ function openBrowser(url) {
     }
 }
 const runFirstRun = async (options) => {
-    const [{ FirstRunServer }, { FirstRunSessionService }, { findAvailablePort }] = await Promise.all([
-        Promise.resolve().then(() => __importStar(require('../../first-run/server'))),
-        Promise.resolve().then(() => __importStar(require('../../first-run/session-service'))),
-        Promise.resolve().then(() => __importStar(require('../../core/utils/ports'))),
-    ]);
     // Issue #646: the key is optional. When launched by the no-terminal macOS
     // installer (.pkg), no key is passed — the wizard prompts the user to paste it.
     const key = options.key || process.env.FRAIM_API_KEY || process.env.FRAIM_SETUP_KEY || process.env.FRAIM_INSTALL_KEY || '';
-    const sessionService = new FirstRunSessionService({
+    const sessionService = new session_service_1.FirstRunSessionService({
         key,
         headless: options.headless,
         resume: options.resume,
         projectRoot: options.projectRoot,
     });
-    const server = new FirstRunServer({ sessionService });
-    const port = await findAvailablePort(43120);
+    const server = new server_1.FirstRunServer({ sessionService });
+    const port = await (0, ports_1.findAvailablePort)(43120);
     const url = `http://127.0.0.1:${port}/first-run/`;
     await server.start(port);
     console.log(chalk_1.default.blue('Starting FRAIM first-run...'));

package/dist/src/cli/mcp/command-resolution.js

@@ -73,9 +73,23 @@ exports.getPortableManagedCommandPath = getPortableManagedCommandPath;
 const resolveManagedCommand = (command) => {
     if (!MANAGED_COMMANDS.has(command))
         return command;
-    // Prefer a system-installed CLI so FRAIM doesn't install its own copy when
-    // the machine already has one. Fall back to the FRAIM-managed portable copy
-    // only when no system install is found. Last resort: bare command name.
-    return (0, exports.getSystemCommandPath)(command) || (0, exports.getPortableManagedCommandPath)(command) || command;
+    // Prefer a system-installed CLI so FRAIM doesn't launch its own copy when
+    // the machine already has one. This process's own ambient PATH is checked
+    // first (cheap, no subprocess) — but a Hub launched from a GUI/shortcut
+    // often does NOT inherit the user's full shell PATH, so a miss there does
+    // not yet mean "not installed". Issue: this exact gap let the ambient-PATH
+    // check silently fall through to FRAIM's portable copy — a separate,
+    // unauthenticated install — even when the user's real, logged-in system
+    // CLI was sitting right there, just outside this process's inherited PATH.
+    // The same location-agnostic recovery `fraim doctor` and the Settings
+    // "Check" button already rely on (issue #1256) closes that gap here too,
+    // so "is it on the system" can never again disagree between the launch
+    // path and the status-check path. Fall back to the FRAIM-managed portable
+    // copy only when no system install is found by either check. Last resort:
+    // bare command name.
+    return (0, exports.getSystemCommandPath)(command)
+        || (0, exports.getSystemCommandPath)(command, (0, managed_agent_paths_1.buildRecoveredSystemPath)(process.env.PATH))
+        || (0, exports.getPortableManagedCommandPath)(command)
+        || command;
 };
 exports.resolveManagedCommand = resolveManagedCommand;

package/dist/src/cli/mcp/fraim-mcp-latest-launcher.js

@@ -138,6 +138,16 @@ function runtimeFromEnv(env = process.env) {
         ? { executable: env.FRAIM_PACKAGED_CLI_EXECUTABLE, script: env.FRAIM_PACKAGED_CLI_SCRIPT }
         : null;
 }
+// Regular Node.js (and ELECTRON_RUN_AS_NODE) cannot see inside Electron's
+// .asar archives. For paths like …/app.asar/node_modules/…, verify the
+// archive file itself rather than the internal entry.
+function existsOrAsarExists(filePath) {
+    const normalized = filePath.replace(/\\/g, '/');
+    const asarSep = normalized.indexOf('.asar/');
+    if (asarSep === -1)
+        return fs_1.default.existsSync(filePath);
+    return fs_1.default.existsSync(filePath.slice(0, asarSep + '.asar'.length));
+}
 function getPackagedFraimRuntime(env = process.env) {
     const envRuntime = runtimeFromEnv(env);
     if (envRuntime)
@@ -146,7 +156,7 @@ function getPackagedFraimRuntime(env = process.env) {
         const raw = JSON.parse(fs_1.default.readFileSync(getPackagedFraimRuntimePath(), 'utf8'));
         if (!raw.executable || !raw.script)
             return null;
-        if (!fs_1.default.existsSync(raw.executable) || !fs_1.default.existsSync(raw.script))
+        if (!fs_1.default.existsSync(raw.executable) || !existsOrAsarExists(raw.script))
             return null;
         return { executable: raw.executable, script: raw.script };
     }

package/dist/src/cli/utils/managed-agent-paths.js

@@ -17,6 +17,7 @@ exports.appendManagedAgentBinDirsToProcessPath = appendManagedAgentBinDirsToProc
 exports.__setLoginShellPathResolverForTests = __setLoginShellPathResolverForTests;
 exports.resolveLoginShellPathCached = resolveLoginShellPathCached;
 exports.__clearLoginShellPathCacheForTests = __clearLoginShellPathCacheForTests;
+exports.buildRecoveredSystemPath = buildRecoveredSystemPath;
 exports.buildRecoveredAgentPath = buildRecoveredAgentPath;
 exports.versionFromProbeOutput = versionFromProbeOutput;
 const fs_1 = __importDefault(require("fs"));
@@ -261,7 +262,7 @@ let loginShellPathResolverOverride = null;
 function __setLoginShellPathResolverForTests(resolver) {
     loginShellPathResolverOverride = resolver;
     cachedLoginShellPath = undefined;
-    cachedNpmGlobalBinDirsForRecovery = undefined;
+    cachedNpmGlobalBinDirsForRecovery.clear();
 }
 let cachedLoginShellPath;
 /**
@@ -288,7 +289,7 @@ function resolveLoginShellPathCached() {
 function __clearLoginShellPathCacheForTests() {
     cachedLoginShellPath = undefined;
 }
-let cachedNpmGlobalBinDirsForRecovery;
+const cachedNpmGlobalBinDirsForRecovery = new Map();
 /**
  * Memoized wrapper around resolveNpmGlobalBinDirs(), scoped to buildRecoveredAgentPath()'s
  * own use only — NOT a change to resolveNpmGlobalBinDirs() itself, which fraim doctor and the
@@ -304,17 +305,28 @@ let cachedNpmGlobalBinDirsForRecovery;
  * blocking spawnSync is exactly the event-loop-freezing regression issue #1010 eliminated,
  * reintroduced one layer deeper. Memoizing once per process (like resolveLoginShellPathCached
  * above) restores the bound this repo's own #1010 postmortem requires.
+ *
+ * Keyed by `basePath` (not a single scalar): `resolveManagedCommand()` also routes through this
+ * cache now, and unlike `detectEmployeesAsync()`'s repeated same-ambient-PATH probing, its
+ * callers legitimately pass different constructed PATHs across calls in the same process (e.g.
+ * isolated tests that swap `FRAIM_USER_DIR`/`PATH` per test case). A single scalar cache would
+ * let the FIRST basePath's answer silently leak into every later, differently-scoped lookup —
+ * concretely, a real machine's actual npm-global `codex` shadowing a test's own isolated managed
+ * shim. Per-basePath keys keep the "once per distinct PATH" bound without that cross-contamination.
  */
 function resolveNpmGlobalBinDirsCached(basePath) {
-    if (cachedNpmGlobalBinDirsForRecovery !== undefined)
-        return cachedNpmGlobalBinDirsForRecovery;
+    const cached = cachedNpmGlobalBinDirsForRecovery.get(basePath);
+    if (cached !== undefined)
+        return cached;
+    let dirs;
     try {
-        cachedNpmGlobalBinDirsForRecovery = resolveNpmGlobalBinDirs(basePath);
+        dirs = resolveNpmGlobalBinDirs(basePath);
     }
     catch {
-        cachedNpmGlobalBinDirsForRecovery = [];
+        dirs = [];
     }
-    return cachedNpmGlobalBinDirsForRecovery;
+    cachedNpmGlobalBinDirsForRecovery.set(basePath, dirs);
+    return dirs;
 }
 /**
  * Issue #1256 (AC-A3): the single shared PATH-recovery helper every agent-resolution call
@@ -330,7 +342,15 @@ function resolveNpmGlobalBinDirsCached(basePath) {
  * in npm-global bin dirs resolved against that recovered PATH (covers the npm case even where
  * a login shell is unavailable) → append FRAIM's managed agent bins last, unconditionally.
  */
-function buildRecoveredAgentPath(basePath) {
+// Same recovery as `buildRecoveredAgentPath()` but stops short of appending
+// FRAIM's own managed agent bin dirs (including the legacy flat directory —
+// see `getPortableManagedCommandPath()`'s versioned-dir-only guard against
+// Defect A). Callers that need to distinguish "found on the real machine"
+// from "fell back to FRAIM's bundled copy" — i.e. `resolveManagedCommand()`
+// — resolve against this path for the system-install check, then consult
+// `getPortableManagedCommandPath()` (never the flat dir) as an explicit,
+// separate fallback tier.
+function buildRecoveredSystemPath(basePath) {
     const withoutManaged = stripManagedAgentBinDirsFromPath(basePath);
     const withoutProjectBins = stripProjectLocalNodeBinDirs(withoutManaged);
     const loginShellPath = resolveLoginShellPathCached();
@@ -340,8 +360,10 @@ function buildRecoveredAgentPath(basePath) {
         : withoutProjectBins;
     const withLoginShellClean = stripProjectLocalNodeBinDirs(withLoginShell);
     const npmGlobalBinDirs = resolveNpmGlobalBinDirsCached(withLoginShellClean);
-    const withNpmGlobal = appendBinDirsToPath(withLoginShellClean, npmGlobalBinDirs);
-    return appendBinDirsToPath(withNpmGlobal, getManagedAgentBinDirs());
+    return appendBinDirsToPath(withLoginShellClean, npmGlobalBinDirs);
+}
+function buildRecoveredAgentPath(basePath) {
+    return appendBinDirsToPath(buildRecoveredSystemPath(basePath), getManagedAgentBinDirs());
 }
 // ─── Issue #1256 (slice d): trust stdout, not stderr, for a version answer ───
 //

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fraim",
-  "version": "2.0.318",
+  "version": "2.0.320",
   "description": "FRAIM core CLI and MCP package.",
   "main": "index.js",
   "bin": {