onbuzz 4.9.13 → 4.10.0

package/scripts/debug-balance-probe.mjs

@@ -1,35 +1,35 @@
-// Standalone replica of accountRoutes.proxyToBackend, to figure out
-// why the in-process call fails while my curl/node-fetch from the
-// same machine succeed. Run with: node scripts/debug-balance-probe.mjs
-import { readFileSync } from 'fs';
-
-const cfg = JSON.parse(readFileSync('config/default.json', 'utf8'));
-const baseUrl = (cfg.backend?.baseUrl || 'https://autopilot-api.azurewebsites.net').replace(/\/$/, '');
-
-// Pull JWT from the running server (same path /api/auth/status uses).
-const jwt = await (await fetch('http://localhost:8080/api/auth/status')).json().then(d => d.jwt);
-console.log('Using JWT len:', jwt?.length, 'against baseUrl:', baseUrl);
-console.log();
-
-async function proxyLike(path) {
-  const url = `${baseUrl}${path}`;
-  const t0 = Date.now();
-  try {
-    const res = await fetch(url, {
-      method: 'GET',
-      headers: {
-        'Authorization': `Bearer ${jwt}`,
-        'Content-Type': 'application/json',
-      },
-    });
-    const text = await res.text();
-    let parsed; try { parsed = JSON.parse(text); } catch { parsed = { raw: text.slice(0, 200) }; }
-    console.log(`${path}: status=${res.status} ms=${Date.now() - t0} body=${JSON.stringify(parsed).slice(0, 200)}`);
-  } catch (err) {
-    console.log(`${path}: ERR ${err.message}`);
-  }
-}
-
-for (const p of ['/subscription/status', '/account/profile', '/auth/me', '/auth/apikeys']) {
-  await proxyLike(p);
-}
+// Standalone replica of accountRoutes.proxyToBackend, to figure out
+// why the in-process call fails while my curl/node-fetch from the
+// same machine succeed. Run with: node scripts/debug-balance-probe.mjs
+import { readFileSync } from 'fs';
+
+const cfg = JSON.parse(readFileSync('config/default.json', 'utf8'));
+const baseUrl = (cfg.backend?.baseUrl || 'https://autopilot-api.azurewebsites.net').replace(/\/$/, '');
+
+// Pull JWT from the running server (same path /api/auth/status uses).
+const jwt = await (await fetch('http://localhost:8080/api/auth/status')).json().then(d => d.jwt);
+console.log('Using JWT len:', jwt?.length, 'against baseUrl:', baseUrl);
+console.log();
+
+async function proxyLike(path) {
+  const url = `${baseUrl}${path}`;
+  const t0 = Date.now();
+  try {
+    const res = await fetch(url, {
+      method: 'GET',
+      headers: {
+        'Authorization': `Bearer ${jwt}`,
+        'Content-Type': 'application/json',
+      },
+    });
+    const text = await res.text();
+    let parsed; try { parsed = JSON.parse(text); } catch { parsed = { raw: text.slice(0, 200) }; }
+    console.log(`${path}: status=${res.status} ms=${Date.now() - t0} body=${JSON.stringify(parsed).slice(0, 200)}`);
+  } catch (err) {
+    console.log(`${path}: ERR ${err.message}`);
+  }
+}
+
+for (const p of ['/subscription/status', '/account/profile', '/auth/me', '/auth/apikeys']) {
+  await proxyLike(p);
+}

package/scripts/push-image.sh

@@ -1,43 +1,43 @@
-#!/bin/bash
-# =============================================================================
-# Build and push the Loxia Autopilot Docker image to ACR
-# =============================================================================
-
-set -e
-
-REGISTRY_NAME="${ACR_REGISTRY:-loxiaregistry}"
-IMAGE_NAME="loxia-autopilot"
-TAG="${1:-latest}"
-FULL_IMAGE="${REGISTRY_NAME}.azurecr.io/${IMAGE_NAME}:${TAG}"
-
-echo "============================================"
-echo " Building & pushing: ${FULL_IMAGE}"
-echo "============================================"
-echo ""
-
-# Login to ACR
-echo "Logging into ACR..."
-az acr login --name "$REGISTRY_NAME"
-
-# Build the image
-echo ""
-echo "Building Docker image..."
-docker build -t "$FULL_IMAGE" .
-
-# Also tag as latest if a specific tag was provided
-if [ "$TAG" != "latest" ]; then
-  docker tag "$FULL_IMAGE" "${REGISTRY_NAME}.azurecr.io/${IMAGE_NAME}:latest"
-fi
-
-# Push to ACR
-echo ""
-echo "Pushing to ACR..."
-docker push "$FULL_IMAGE"
-if [ "$TAG" != "latest" ]; then
-  docker push "${REGISTRY_NAME}.azurecr.io/${IMAGE_NAME}:latest"
-fi
-
-echo ""
-echo "============================================"
-echo " Image pushed: ${FULL_IMAGE}"
-echo "============================================"
+#!/bin/bash
+# =============================================================================
+# Build and push the Loxia Autopilot Docker image to ACR
+# =============================================================================
+
+set -e
+
+REGISTRY_NAME="${ACR_REGISTRY:-loxiaregistry}"
+IMAGE_NAME="loxia-autopilot"
+TAG="${1:-latest}"
+FULL_IMAGE="${REGISTRY_NAME}.azurecr.io/${IMAGE_NAME}:${TAG}"
+
+echo "============================================"
+echo " Building & pushing: ${FULL_IMAGE}"
+echo "============================================"
+echo ""
+
+# Login to ACR
+echo "Logging into ACR..."
+az acr login --name "$REGISTRY_NAME"
+
+# Build the image
+echo ""
+echo "Building Docker image..."
+docker build -t "$FULL_IMAGE" .
+
+# Also tag as latest if a specific tag was provided
+if [ "$TAG" != "latest" ]; then
+  docker tag "$FULL_IMAGE" "${REGISTRY_NAME}.azurecr.io/${IMAGE_NAME}:latest"
+fi
+
+# Push to ACR
+echo ""
+echo "Pushing to ACR..."
+docker push "$FULL_IMAGE"
+if [ "$TAG" != "latest" ]; then
+  docker push "${REGISTRY_NAME}.azurecr.io/${IMAGE_NAME}:latest"
+fi
+
+echo ""
+echo "============================================"
+echo " Image pushed: ${FULL_IMAGE}"
+echo "============================================"

package/scripts/setup-acr.sh

@@ -1,65 +1,65 @@
-#!/bin/bash
-# =============================================================================
-# Setup Azure Container Registry + Resource Group for Remote Sessions
-# Run once to create the infrastructure.
-# =============================================================================
-
-set -e
-
-# Configuration
-REGISTRY_NAME="loxiaregistry"
-RESOURCE_GROUP="loxia-remote-sessions"
-LOCATION="northeurope"
-SKU="Basic"  # Basic tier is cheapest (~$5/month, 10GB storage)
-
-echo "============================================"
-echo " Loxia Remote Sessions — Azure Infrastructure Setup"
-echo "============================================"
-echo ""
-
-# 1. Create resource group for remote sessions
-echo "Creating resource group: $RESOURCE_GROUP..."
-az group create \
-  --name "$RESOURCE_GROUP" \
-  --location "$LOCATION" \
-  --output table
-
-# 2. Create Azure Container Registry
-echo ""
-echo "Creating Azure Container Registry: $REGISTRY_NAME..."
-az acr create \
-  --name "$REGISTRY_NAME" \
-  --resource-group "$RESOURCE_GROUP" \
-  --location "$LOCATION" \
-  --sku "$SKU" \
-  --admin-enabled true \
-  --output table
-
-# 3. Get registry credentials (for ACI to pull images)
-echo ""
-echo "Registry credentials:"
-az acr credential show \
-  --name "$REGISTRY_NAME" \
-  --output table
-
-echo ""
-echo "Registry login server:"
-az acr show --name "$REGISTRY_NAME" --query loginServer --output tsv
-
-echo ""
-echo "============================================"
-echo " Setup complete!"
-echo ""
-echo " Next steps:"
-echo "   1. Build & push the Docker image:"
-echo "      ./scripts/push-image.sh"
-echo ""
-echo "   2. Set these env vars on the autopilot-backend:"
-echo "      ACI_SUBSCRIPTION_ID=<your-subscription-id>"
-echo "      ACI_RESOURCE_GROUP=$RESOURCE_GROUP"
-echo "      ACI_REGION=$LOCATION"
-echo "      ACI_IMAGE=${REGISTRY_NAME}.azurecr.io/loxia-autopilot:latest"
-echo "      ACI_REGISTRY_SERVER=${REGISTRY_NAME}.azurecr.io"
-echo "      ACI_REGISTRY_USERNAME=<from credentials above>"
-echo "      ACI_REGISTRY_PASSWORD=<from credentials above>"
-echo "============================================"
+#!/bin/bash
+# =============================================================================
+# Setup Azure Container Registry + Resource Group for Remote Sessions
+# Run once to create the infrastructure.
+# =============================================================================
+
+set -e
+
+# Configuration
+REGISTRY_NAME="loxiaregistry"
+RESOURCE_GROUP="loxia-remote-sessions"
+LOCATION="northeurope"
+SKU="Basic"  # Basic tier is cheapest (~$5/month, 10GB storage)
+
+echo "============================================"
+echo " Loxia Remote Sessions — Azure Infrastructure Setup"
+echo "============================================"
+echo ""
+
+# 1. Create resource group for remote sessions
+echo "Creating resource group: $RESOURCE_GROUP..."
+az group create \
+  --name "$RESOURCE_GROUP" \
+  --location "$LOCATION" \
+  --output table
+
+# 2. Create Azure Container Registry
+echo ""
+echo "Creating Azure Container Registry: $REGISTRY_NAME..."
+az acr create \
+  --name "$REGISTRY_NAME" \
+  --resource-group "$RESOURCE_GROUP" \
+  --location "$LOCATION" \
+  --sku "$SKU" \
+  --admin-enabled true \
+  --output table
+
+# 3. Get registry credentials (for ACI to pull images)
+echo ""
+echo "Registry credentials:"
+az acr credential show \
+  --name "$REGISTRY_NAME" \
+  --output table
+
+echo ""
+echo "Registry login server:"
+az acr show --name "$REGISTRY_NAME" --query loginServer --output tsv
+
+echo ""
+echo "============================================"
+echo " Setup complete!"
+echo ""
+echo " Next steps:"
+echo "   1. Build & push the Docker image:"
+echo "      ./scripts/push-image.sh"
+echo ""
+echo "   2. Set these env vars on the autopilot-backend:"
+echo "      ACI_SUBSCRIPTION_ID=<your-subscription-id>"
+echo "      ACI_RESOURCE_GROUP=$RESOURCE_GROUP"
+echo "      ACI_REGION=$LOCATION"
+echo "      ACI_IMAGE=${REGISTRY_NAME}.azurecr.io/loxia-autopilot:latest"
+echo "      ACI_REGISTRY_SERVER=${REGISTRY_NAME}.azurecr.io"
+echo "      ACI_REGISTRY_USERNAME=<from credentials above>"
+echo "      ACI_REGISTRY_PASSWORD=<from credentials above>"
+echo "============================================"

package/scripts/verify-optional-deps.js

@@ -37,6 +37,73 @@ const SOFT_REQUIRED = [
     breaks: 'Integrations page (Composio toolkits/connections, agent composio tool)',
     fixHint: 'npm install @composio/core@^0.6.11   # mirrors commit 1560691 — the previous restore',
   },
+  {
+    name: '@huggingface/transformers',
+    // Used by src/services/embeddings/providers/localProvider.js to run
+    // local ONNX feature-extraction pipelines. Migrated from
+    // @xenova/transformers — same API surface, official maintained
+    // successor, dropped 4 CVEs (1 critical protobufjs + 3 high
+    // onnx/transformers) in one commit. If a future audit-fix
+    // re-introduces @xenova/transformers as a "fix" suggestion,
+    // IGNORE it — the package is abandoned upstream.
+    breaks: 'Local embeddings provider (settings → embeddings = local; agent memory.semantic-search if pointed at local)',
+    fixHint: 'npm install @huggingface/transformers@^4.2.0',
+  },
+  {
+    name: 'pptxgenjs',
+    // Used by src/tools/office/pres/index.js (loaded via sync
+    // localRequire — NOT a try/catch dynamic import). When missing,
+    // any pres.create / pres.read / pres.fill action crashes hard
+    // with MODULE_NOT_FOUND. 8 tests under officeTool.test.js +
+    // presSystem.test.js fail loudly.
+    breaks: 'officeTool pres.create / pres.read / pres.fill (themed presentation builder)',
+    fixHint: 'npm install pptxgenjs@^4.0.1',
+  },
+  {
+    name: 'update-notifier',
+    // Used by src/utilities/updateNotifier.js. Dynamic-imported so the
+    // CLI keeps booting when missing — but the version-update banner
+    // disappears silently and users miss security/feature updates.
+    // The autoUpdateConfig tripwire test catches the regression.
+    breaks: 'CLI startup banner that notifies users when a newer version is on npm',
+    fixHint: 'npm install update-notifier@^7.3.1',
+  },
+  {
+    name: 'electron-updater',
+    // Used by electron/autoUpdate.js. Dynamic-imported so packaging
+    // works without it — but the packaged Electron app then never
+    // self-updates, leaving users on whichever version they downloaded
+    // forever. Lives in optionalDependencies (Electron-only).
+    breaks: 'Electron in-app auto-update dialog + background download',
+    fixHint: 'npm install --save-optional electron-updater@^6.8.3',
+  },
+  {
+    name: 'jsdom',
+    // Required by widget runtime/acceptance tests (84 tests across
+    // 3 suites). They simulate a DOM in Jest's node environment to
+    // exercise LoxiaElement (the web component base class) and the
+    // h/Preact runtime that agent-authored widgets ship against.
+    // No production code path uses jsdom — devDep only.
+    breaks: 'Widget acceptance / runtime / webComponentRuntime tests (Jest jsdom-based DOM simulation)',
+    fixHint: 'npm install --save-dev jsdom@^25.0.1',
+  },
+  {
+    name: 'jest-junit',
+    // Referenced unconditionally by jest.config.js reporters array.
+    // When missing, `npm test` fails to even start with "Could not
+    // resolve a module for a custom reporter". Required for CI JUnit
+    // XML output (CI pipelines parse the file to surface failures).
+    breaks: 'npm test (jest.config.js references jest-junit in reporters array)',
+    fixHint: 'npm install --save-dev jest-junit@^17.0.0',
+  },
+  {
+    name: 'jest-html-reporters',
+    // Same story as jest-junit — referenced in jest.config.js
+    // reporters array. Missing → test run aborts before running
+    // any test.
+    breaks: 'npm test (jest.config.js references jest-html-reporters in reporters array)',
+    fixHint: 'npm install --save-dev jest-html-reporters@^3.1.7',
+  },
 ];
 
 const missing = [];
@@ -50,6 +117,21 @@ for (const dep of SOFT_REQUIRED) {
 
 if (missing.length === 0) process.exit(0);
 
+// --emit-install: print a single composite `npm install ...` command to
+// stdout (separate from the stderr banner). release.bat captures stdout
+// for the [r]estore path. Newline-terminated, no extra logging on stdout.
+if (process.argv.includes('--emit-install')) {
+  const args = missing.map((m) => {
+    // Pull the version pin out of the fixHint ("npm install pkg@^x.y.z   # …").
+    // Falls back to no-pin if the hint doesn't follow the convention.
+    const match = m.fixHint.match(/(@?[\w/.-]+@[\^~]?[\w.-]+)/);
+    return match ? match[1] : m.name;
+  }).join(' ');
+  process.stdout.write(`npm install --save ${args}\n`);
+  // Banner still went to stderr above.
+  process.exit(1);
+}
+
 const bar = '═'.repeat(72);
 process.stderr.write(`\n${bar}\n`);
 process.stderr.write(`  ⚠  Soft-required dependencies missing — Integrations & related UI\n`);
@@ -64,4 +146,17 @@ process.stderr.write(`${bar}\n`);
 process.stderr.write(`  Most common cause: \`npm audit fix --force\` nuked it as collateral.\n`);
 process.stderr.write(`  Restore the deps above, then commit the package.json + lockfile.\n`);
 process.stderr.write(`${bar}\n\n`);
-process.exit(0);  // never fail the install — just shout
+
+// Exit code policy:
+//   default (postinstall use)   → exit 0 — never fail the install
+//                                  the banner above is enough warning
+//   --strict (release.bat use)  → exit 1 when any dep is missing
+//                                  so the release gate can abort
+//                                  *inside the same session* and the
+//                                  operator can restore + retry before
+//                                  any commits land. Without --strict
+//                                  the release.bat audit-fix step
+//                                  silently buries the nuke and only a
+//                                  user complaint surfaces it days later.
+const strict = process.argv.includes('--strict');
+process.exit(strict ? 1 : 0);