letfixit 0.1.0 → 0.1.1

package/.env.example

@@ -17,9 +17,9 @@ DASHBOARD_PORT=8081
 FLUTTER_VM_URL=
 
 # ── Ultron n0-beta model download (encrypted chunks) ───────────────────────────
-# Decryption passphrase for the model chunks. NEVER commit this — set it locally
-# and store it as a GitHub Actions secret for CI releases. Without it, `npm run
-# setup` skips the automatic download and prints instructions.
+# Normally you DON'T set this — `npm run setup` prompts you to paste the model
+# decryption key interactively (input hidden). Set it here ONLY for
+# non-interactive / CI installs. NEVER commit a real key.
 PARITYFIX_MODEL_KEY=
 # Optional: path to a chunk manifest (defaults to config/model.manifest.json).
 PARITYFIX_MODEL_MANIFEST=

package/README.md

@@ -10,10 +10,13 @@ A lightweight developer tool that connects to a running Flutter or Android app,
 
 **From npm (published):**
 ```bash
-npm install -g letfixit      # or: npx letfixit
-export PARITYFIX_MODEL_KEY=…  # the decryption passphrase (enables the local model)
+npm install -g letfixit      # postinstall runs setup and PROMPTS for the model key
+                             # → paste the Ultron n0-beta key you were given (input hidden)
 letfixit                     # branded startup → "Ultron n0-beta initializing…" → analyze menu
 ```
+The decryption key is **never bundled** — setup asks for it interactively, so only
+users you give the key to can decrypt the model. For CI/non-interactive installs,
+set `PARITYFIX_MODEL_KEY` in the environment instead of typing it.
 
 **From source (clone):**
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "letfixit",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "LetFixIt — AI-based realtime performance analysis & suggestions for Flutter, Android & iOS, powered by the local Ultron n0-beta model.",
   "keywords": ["flutter", "android", "ios", "performance", "profiler", "devtools", "observability", "llm", "local-ai"],
   "license": "MIT",

package/scripts/setup-model.js

@@ -12,6 +12,7 @@ const path = require('path');
 const crypto = require('crypto');
 const https = require('https');
 const http = require('http');
+const readline = require('readline');
 const { fileURLToPath } = require('url');
 require('./load-env')();   // pull PARITYFIX_MODEL_KEY etc. from .env (root has no dotenv)
 const mc = require('../server/model_config');
@@ -132,6 +133,29 @@ async function fetchChunk(ch, encPath, baseLabel) {
   throw lastErr || new Error(`chunk ${ch.index} download failed`);
 }
 
+// ── Key resolution (interactive) ──────────────────────────────────────────────
+// The decryption key is NEVER bundled or committed. It's resolved at setup time
+// from, in order: an explicit env var (CI/automation), else an interactive
+// prompt where the user pastes the key they were given. Non-interactive with no
+// env key → null (skip, non-fatal). The key is only needed once — after a
+// successful setup the decrypted model is on disk and later runs skip this.
+async function resolveKey() {
+  if (process.env.PARITYFIX_MODEL_KEY) return process.env.PARITYFIX_MODEL_KEY.trim();
+  if (!process.stdin.isTTY) return null; // can't prompt (postinstall in CI, piped stdin)
+  const k = await promptHidden(`  🔑 Enter the ${mc.MODEL_NAME} decryption key: `);
+  return k || null;
+}
+
+// Read a line from stdin without echoing it (so the key isn't shown on screen).
+function promptHidden(query) {
+  return new Promise((resolve) => {
+    process.stdout.write(c(C.mag, query));
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    rl._writeToOutput = () => {}; // mute echo of typed characters
+    rl.question('', (answer) => { rl.close(); process.stdout.write('\n'); resolve(answer.trim()); });
+  });
+}
+
 function sha256File(p) {
   return new Promise((resolve, reject) => {
     const h = crypto.createHash('sha256');
@@ -186,12 +210,17 @@ async function setup() {
   }
 
   const manifest = mc.loadManifest();
-  const key = process.env.PARITYFIX_MODEL_KEY;
-  if (!manifest || !key) {
-    console.log(c(C.yel, '  ⚠️  Model chunks not configured — skipping automatic download.\n'));
-    if (!manifest) console.log(`     • No chunk manifest found. Copy ${c(C.cyan, 'config/model.manifest.example.json')} → ${c(C.cyan, 'config/model.manifest.json')} and fill in the chunk URLs.`);
-    if (!key)      console.log(`     • Set ${c(C.cyan, 'PARITYFIX_MODEL_KEY')} (the decryption passphrase) in your environment.`);
-    console.log(`\n     Then run ${c(C.cyan, 'npm run setup')} again. (You can also use the legacy ${c(C.cyan, './setup.sh')} to pull from HuggingFace.)\n`);
+  if (!manifest) {
+    console.log(c(C.yel, '  ⚠️  No chunk manifest found — skipping automatic download.'));
+    console.log(`     Copy ${c(C.cyan, 'config/model.manifest.example.json')} → ${c(C.cyan, 'config/model.manifest.json')} and fill in the chunk URLs, then run ${c(C.cyan, 'npm run setup')}.\n`);
+    return; // non-fatal
+  }
+
+  const key = await resolveKey();
+  if (!key) {
+    console.log(c(C.yel, '  ⚠️  No decryption key provided — skipping model download.'));
+    console.log(`     Run ${c(C.cyan, 'npm run setup')} in a terminal and paste the ${mc.MODEL_NAME} key when prompted`);
+    console.log(`     (or set ${c(C.cyan, 'PARITYFIX_MODEL_KEY')} for non-interactive/CI installs).\n`);
     return; // non-fatal
   }
 
@@ -213,7 +242,12 @@ async function setup() {
     if (!haveValid) await fetchChunk(ch, encPath, label);
 
     process.stdout.write(`  ${c(C.dim, `↳ decrypting chunk ${ch.index + 1}…`)}\r`);
-    await decryptChunk(encPath, decPath, derivedKey, ch.iv, ch.authTag);
+    try {
+      await decryptChunk(encPath, decPath, derivedKey, ch.iv, ch.authTag);
+    } catch (e) {
+      // GCM auth failure = the key doesn't match the ciphertext → wrong key.
+      throw new Error(`WRONG_KEY: decryption failed on chunk ${ch.index} — the ${mc.MODEL_NAME} key is incorrect.`);
+    }
     process.stdout.write(' '.repeat(40) + '\r');
     decParts.push(decPath);
   }
@@ -260,8 +294,13 @@ function wrap(text, width, indent) {
 
 if (require.main === module) {
   setup().catch((err) => {
-    console.log('\n' + c(C.red, `  ❌ Model setup failed: ${err.message}`));
-    console.log(c(C.dim, '     You can retry with `npm run setup`, or use ./setup.sh for the HuggingFace source.\n'));
+    if (String(err.message).startsWith('WRONG_KEY:')) {
+      console.log('\n' + c(C.red, `  ❌ ${err.message.replace('WRONG_KEY: ', '')}`));
+      console.log(c(C.dim, `     Double-check the key you were given and run ${'`npm run setup`'} to try again.\n`));
+    } else {
+      console.log('\n' + c(C.red, `  ❌ Model setup failed: ${err.message}`));
+      console.log(c(C.dim, '     You can retry with `npm run setup`, or use ./setup.sh for the HuggingFace source.\n'));
+    }
     process.exit(isPostinstall ? 0 : 1); // never break `npm install`
   });
 }

package/server/model_config.js

@@ -29,6 +29,7 @@ function isReady() {
   catch { return false; }
 }
 
+
 function sizeGB() {
   try { return parseFloat((fs.statSync(MODEL_PATH).size / (1024 ** 3)).toFixed(2)); }
   catch { return 0; }