letfixit 0.1.0 → 0.1.2

package/.env.example

@@ -17,9 +17,9 @@ DASHBOARD_PORT=8081
 FLUTTER_VM_URL=
 
 # ── Ultron n0-beta model download (encrypted chunks) ───────────────────────────
-# Decryption passphrase for the model chunks. NEVER commit this — set it locally
-# and store it as a GitHub Actions secret for CI releases. Without it, `npm run
-# setup` skips the automatic download and prints instructions.
+# Normally you DON'T set this — `npm run setup` prompts you to paste the model
+# decryption key interactively (input hidden). Set it here ONLY for
+# non-interactive / CI installs. NEVER commit a real key.
 PARITYFIX_MODEL_KEY=
 # Optional: path to a chunk manifest (defaults to config/model.manifest.json).
 PARITYFIX_MODEL_MANIFEST=

package/README.md

@@ -10,10 +10,13 @@ A lightweight developer tool that connects to a running Flutter or Android app,
 
 **From npm (published):**
 ```bash
-npm install -g letfixit      # or: npx letfixit
-export PARITYFIX_MODEL_KEY=…  # the decryption passphrase (enables the local model)
+npm install -g letfixit      # postinstall runs setup and PROMPTS for the model key
+                             # → paste the Ultron n0-beta key you were given (input hidden)
 letfixit                     # branded startup → "Ultron n0-beta initializing…" → analyze menu
 ```
+The decryption key is **never bundled** — setup asks for it interactively, so only
+users you give the key to can decrypt the model. For CI/non-interactive installs,
+set `PARITYFIX_MODEL_KEY` in the environment instead of typing it.
 
 **From source (clone):**
 ```bash

package/package.json

@@ -1,8 +1,18 @@
 {
   "name": "letfixit",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "LetFixIt — AI-based realtime performance analysis & suggestions for Flutter, Android & iOS, powered by the local Ultron n0-beta model.",
-  "keywords": ["flutter", "android", "ios", "performance", "profiler", "devtools", "observability", "llm", "local-ai"],
+  "keywords": [
+    "flutter",
+    "android",
+    "ios",
+    "performance",
+    "profiler",
+    "devtools",
+    "observability",
+    "llm",
+    "local-ai"
+  ],
   "license": "MIT",
   "author": "JahidDev24",
   "main": "server/index.js",

package/scripts/setup-model.js

@@ -12,6 +12,7 @@ const path = require('path');
 const crypto = require('crypto');
 const https = require('https');
 const http = require('http');
+const readline = require('readline');
 const { fileURLToPath } = require('url');
 require('./load-env')();   // pull PARITYFIX_MODEL_KEY etc. from .env (root has no dotenv)
 const mc = require('../server/model_config');
@@ -132,6 +133,29 @@ async function fetchChunk(ch, encPath, baseLabel) {
   throw lastErr || new Error(`chunk ${ch.index} download failed`);
 }
 
+// ── Key resolution (interactive) ──────────────────────────────────────────────
+// The decryption key is NEVER bundled or committed. It's resolved at setup time
+// from, in order: an explicit env var (CI/automation), else an interactive
+// prompt where the user pastes the key they were given. Non-interactive with no
+// env key → null (skip, non-fatal). The key is only needed once — after a
+// successful setup the decrypted model is on disk and later runs skip this.
+async function resolveKey() {
+  if (process.env.PARITYFIX_MODEL_KEY) return process.env.PARITYFIX_MODEL_KEY.trim();
+  if (!process.stdin.isTTY) return null; // can't prompt (postinstall in CI, piped stdin)
+  const k = await promptHidden(`  🔑 Enter the ${mc.MODEL_NAME} decryption key: `);
+  return k || null;
+}
+
+// Read a line from stdin without echoing it (so the key isn't shown on screen).
+function promptHidden(query) {
+  return new Promise((resolve) => {
+    process.stdout.write(c(C.mag, query));
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    rl._writeToOutput = () => {}; // mute echo of typed characters
+    rl.question('', (answer) => { rl.close(); process.stdout.write('\n'); resolve(answer.trim()); });
+  });
+}
+
 function sha256File(p) {
   return new Promise((resolve, reject) => {
     const h = crypto.createHash('sha256');
@@ -186,12 +210,17 @@ async function setup() {
   }
 
   const manifest = mc.loadManifest();
-  const key = process.env.PARITYFIX_MODEL_KEY;
-  if (!manifest || !key) {
-    console.log(c(C.yel, '  ⚠️  Model chunks not configured — skipping automatic download.\n'));
-    if (!manifest) console.log(`     • No chunk manifest found. Copy ${c(C.cyan, 'config/model.manifest.example.json')} → ${c(C.cyan, 'config/model.manifest.json')} and fill in the chunk URLs.`);
-    if (!key)      console.log(`     • Set ${c(C.cyan, 'PARITYFIX_MODEL_KEY')} (the decryption passphrase) in your environment.`);
-    console.log(`\n     Then run ${c(C.cyan, 'npm run setup')} again. (You can also use the legacy ${c(C.cyan, './setup.sh')} to pull from HuggingFace.)\n`);
+  if (!manifest) {
+    console.log(c(C.yel, '  ⚠️  No chunk manifest found — skipping automatic download.'));
+    console.log(`     Copy ${c(C.cyan, 'config/model.manifest.example.json')} → ${c(C.cyan, 'config/model.manifest.json')} and fill in the chunk URLs, then run ${c(C.cyan, 'npm run setup')}.\n`);
+    return; // non-fatal
+  }
+
+  const key = await resolveKey();
+  if (!key) {
+    console.log(c(C.yel, '  ⚠️  No decryption key provided — skipping model download.'));
+    console.log(`     Run ${c(C.cyan, 'npm run setup')} in a terminal and paste the ${mc.MODEL_NAME} key when prompted`);
+    console.log(`     (or set ${c(C.cyan, 'PARITYFIX_MODEL_KEY')} for non-interactive/CI installs).\n`);
     return; // non-fatal
   }
 
@@ -213,7 +242,12 @@ async function setup() {
     if (!haveValid) await fetchChunk(ch, encPath, label);
 
     process.stdout.write(`  ${c(C.dim, `↳ decrypting chunk ${ch.index + 1}…`)}\r`);
-    await decryptChunk(encPath, decPath, derivedKey, ch.iv, ch.authTag);
+    try {
+      await decryptChunk(encPath, decPath, derivedKey, ch.iv, ch.authTag);
+    } catch (e) {
+      // GCM auth failure = the key doesn't match the ciphertext → wrong key.
+      throw new Error(`WRONG_KEY: decryption failed on chunk ${ch.index} — the ${mc.MODEL_NAME} key is incorrect.`);
+    }
     process.stdout.write(' '.repeat(40) + '\r');
     decParts.push(decPath);
   }
@@ -260,8 +294,13 @@ function wrap(text, width, indent) {
 
 if (require.main === module) {
   setup().catch((err) => {
-    console.log('\n' + c(C.red, `  ❌ Model setup failed: ${err.message}`));
-    console.log(c(C.dim, '     You can retry with `npm run setup`, or use ./setup.sh for the HuggingFace source.\n'));
+    if (String(err.message).startsWith('WRONG_KEY:')) {
+      console.log('\n' + c(C.red, `  ❌ ${err.message.replace('WRONG_KEY: ', '')}`));
+      console.log(c(C.dim, `     Double-check the key you were given and run ${'`npm run setup`'} to try again.\n`));
+    } else {
+      console.log('\n' + c(C.red, `  ❌ Model setup failed: ${err.message}`));
+      console.log(c(C.dim, '     You can retry with `npm run setup`, or use ./setup.sh for the HuggingFace source.\n'));
+    }
     process.exit(isPostinstall ? 0 : 1); // never break `npm install`
   });
 }

package/server/index.js

@@ -29,7 +29,7 @@ const ENABLE_LOCAL_AI = process.env.ENABLE_LOCAL_AI !== 'false';
 const MODEL_PATH = model.MODEL_PATH;
 
 // ── Terminal styling + branded startup ─────────────────────────────────────────
-const C = { reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m', mag: '\x1b[95m', grn: '\x1b[92m', yel: '\x1b[93m', cyan: '\x1b[96m' };
+const C = { reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m', mag: '\x1b[95m', grn: '\x1b[92m', yel: '\x1b[93m', red: '\x1b[91m', cyan: '\x1b[96m' };
 const col = (x, s) => `${x}${s}${C.reset}`;
 const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, '');
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -42,10 +42,11 @@ function bannerBox(lines) {
 }
 
 function printWelcome() {
+  const v = require('../package.json').version;
   console.log('');
   bannerBox([
     '',
-    col(C.bold + C.mag, '✦  P A R I T Y F I X') + col(C.dim, '                      v0.1.0'),
+    col(C.bold + C.mag, '✦  P A R I T Y F I X') + col(C.dim, `                      v${v}`),
     col(C.reset, 'AI-based realtime performance analysis & suggestions'),
     col(C.dim, 'Flutter  ·  Android  ·  iOS      powered by Ultron n0-beta'),
     '',
@@ -53,32 +54,40 @@ function printWelcome() {
   console.log('');
 }
 
-// "Ultron n0-beta initializing…" — starts the local model and waits briefly for
-// it to answer, without blocking the whole boot on weight loading.
+// Boot the local model. On first run (model not installed) this RUNS the setup
+// — download + key prompt + decrypt + merge — then starts the model. Returns
+// true if AI is available (local model ready, or a cloud provider configured).
 async function initUltron() {
   if (!ENABLE_LOCAL_AI) {
     console.log('  ' + col(C.dim, 'Ultron n0-beta is disabled (ENABLE_LOCAL_AI=false) — using cloud fallback if configured.\n'));
-    return;
+    return aiStatus().anyAvailable;
   }
+
+  // First-time setup: install the model (prompts for the decryption key).
   if (!model.isReady()) {
-    console.log('  ' + col(C.yel, '⚠  Ultron n0-beta not installed.') + ' Run ' + col(C.cyan, 'npm run setup') + ' to download it.');
-    const s = aiStatus();
-    console.log('  ' + col(C.dim, s.anyAvailable ? 'A cloud fallback key is set — analysis will use it for now.\n' : 'No AI provider yet — findings will show without suggestions until setup.\n'));
-    return;
+    console.log('  ' + col(C.mag, '✦ First-time setup') + col(C.dim, ` — installing ${model.MODEL_NAME}. This runs once.\n`));
+    try {
+      await require('../scripts/setup-model').setup();
+    } catch (e) {
+      const msg = String(e.message || e);
+      if (msg.startsWith('WRONG_KEY:')) console.log('\n  ' + col(C.red, '❌ ' + msg.replace('WRONG_KEY: ', '')));
+      else console.log('\n  ' + col(C.red, '❌ Setup failed: ' + msg));
+    }
+    console.log('');
   }
 
-  process.stdout.write('  ' + col(C.mag, '✦ Ultron n0-beta') + col(C.dim, ' initializing'));
-  startLlamafile();
-  // Poll health for a few seconds; don't hang the boot if weights are still loading.
-  let ok = false;
-  for (let i = 0; i < 8 && !ok; i++) { process.stdout.write(col(C.dim, '.')); ok = await isLlamaHealthy(); if (!ok) await sleep(500); }
-  process.stdout.write('\n');
-  if (ok) {
-    console.log('  ' + col(C.grn, '✓ ready') + col(C.dim, `  — ${model.MODEL_NAME} running locally on :${LOCAL_AI_PORT} (${model.sizeGB()} GB, private)`));
-  } else {
-    console.log('  ' + col(C.yel, '… still loading') + col(C.dim, '  — weights load in the background (first start can take ~20s).'));
+  if (model.isReady()) {
+    process.stdout.write('  ' + col(C.mag, '✦ Ultron n0-beta') + col(C.dim, ' initializing'));
+    startLlamafile();
+    let ok = false;
+    for (let i = 0; i < 8 && !ok; i++) { process.stdout.write(col(C.dim, '.')); ok = await isLlamaHealthy(); if (!ok) await sleep(500); }
+    process.stdout.write('\n');
+    if (ok) console.log('  ' + col(C.grn, '✓ ready') + col(C.dim, `  — ${model.MODEL_NAME} running locally on :${LOCAL_AI_PORT} (${model.sizeGB()} GB, private)`));
+    else    console.log('  ' + col(C.yel, '… still loading') + col(C.dim, '  — weights load in the background (first start can take ~20s).'));
+    console.log('  ' + col(C.dim, model.DISCLAIMER.split(' — ')[0] + ' — treat suggestions as hints.\n'));
   }
-  console.log('  ' + col(C.dim, model.DISCLAIMER.split(' — ')[0] + ' — treat suggestions as hints.\n'));
+
+  return aiStatus().anyAvailable; // local ready OR cloud key present
 }
 
 // ── Interactive startup ───────────────────────────────────────────────────────
@@ -569,9 +578,16 @@ server.on('error', (err) => {
 // ── Startup ───────────────────────────────────────────────────────────────────
 async function main() {
   printWelcome();
-  // "Ultron n0-beta initializing…" — warms the local model up front (idempotent)
-  // so it's ready by the time analysis needs it, and owns the AI startup output.
-  await initUltron();
+  // First-run: install + start the model. Returns true only if AI is available.
+  const aiReady = await initUltron();
+
+  // AI is required to analyze — don't show the menu without it.
+  if (!aiReady) {
+    console.log('  ' + col(C.red, '⚠  AI is required to run analysis, and it isn\'t set up yet.'));
+    console.log('  ' + col(C.dim, `Re-run ${col(C.cyan, 'letfixit')} and paste your ${model.MODEL_NAME} key when prompted,`));
+    console.log('  ' + col(C.dim, `or add a cloud key (GROQ/GEMINI/CLAUDE) to .env, then start again.\n`));
+    process.exit(0);
+  }
 
   const setup = await interactiveSetup();
 
@@ -616,4 +632,39 @@ function shutdown() {
 process.on('SIGINT',  shutdown);
 process.on('SIGTERM', shutdown);
 
-main();
+// ── CLI dispatch ────────────────────────────────────────────────────────────
+function printHelp() {
+  const v = require('../package.json').version;
+  console.log(`
+  ${col(C.bold + C.mag, 'LetFixIt')} v${v} ${col(C.dim, '— AI-based realtime performance analysis for Flutter, Android & iOS')}
+
+  ${col(C.bold, 'Usage')}
+    ${col(C.cyan, 'letfixit')}              Launch the analyzer (first run installs ${model.MODEL_NAME})
+    ${col(C.cyan, 'letfixit setup')}        Download & set up the model (prompts for the decryption key)
+    ${col(C.cyan, 'letfixit setup --force')} Re-download / reinstall the model
+    ${col(C.cyan, 'letfixit version')}      Print the installed version (or --version / -v)
+    ${col(C.cyan, 'letfixit --help')}       Show this help
+
+  ${col(C.bold, 'Environment')}
+    ${col(C.dim, 'PARITYFIX_MODEL_KEY')}   decryption key for non-interactive / CI installs
+    ${col(C.dim, 'DASHBOARD_PORT')}        dashboard port (default 8081)
+    ${col(C.dim, 'LOCAL_AI_PORT')}         local model port (default 8080)
+    ${col(C.dim, 'ENABLE_LOCAL_AI')}       set to "false" to use cloud fallback only
+`);
+}
+
+const cmd = process.argv[2];
+if (cmd === '--version' || cmd === '-v') {
+  console.log(require('../package.json').version);            // bare number (scripts)
+} else if (cmd === 'version') {
+  console.log(`letfixit v${require('../package.json').version}`); // friendly line
+} else if (cmd === '--help' || cmd === '-h' || cmd === 'help') {
+  printHelp();
+} else if (cmd === 'setup') {
+  // Explicit setup: run the installer directly and exit (like `npm run setup`).
+  require('../scripts/setup-model').setup()
+    .then(() => process.exit(0))
+    .catch((e) => { console.error('  ❌ setup failed:', e.message); process.exit(1); });
+} else {
+  main(); // default: launch the analyzer
+}

package/server/model_config.js

@@ -29,6 +29,7 @@ function isReady() {
   catch { return false; }
 }
 
+
 function sizeGB() {
   try { return parseFloat((fs.statSync(MODEL_PATH).size / (1024 ** 3)).toFixed(2)); }
   catch { return 0; }