reflectt-node 0.1.4 → 0.1.6

package/dist/cli.js

@@ -5,8 +5,9 @@
  * reflectt CLI - Command line interface for reflectt-node
  */
 import { Command } from 'commander';
-import { existsSync, mkdirSync, writeFileSync, readFileSync, unlinkSync } from 'fs';
+import { existsSync, mkdirSync, writeFileSync, readFileSync, unlinkSync, statSync, chmodSync } from 'fs';
 import { collectDoctorReport, formatDoctorHuman } from './doctor.js';
+import { hostConnectGuard } from './hostConnectGuard.js';
 import { homedir, hostname } from 'os';
 import { join, dirname } from 'path';
 import { spawn, execSync } from 'child_process';
@@ -18,6 +19,7 @@ const PID_FILE = join(REFLECTT_HOME, 'server.pid');
 function loadConfig() {
     if (existsSync(CONFIG_PATH)) {
         try {
+            migrateConfigPermissions();
             return JSON.parse(readFileSync(CONFIG_PATH, 'utf-8'));
         }
         catch (err) {
@@ -27,7 +29,21 @@ function loadConfig() {
     return { port: 4445, host: '127.0.0.1' };
 }
 function saveConfig(config) {
-    writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2));
+    writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), { mode: 0o600 });
+}
+/** Tighten config.json permissions if too open (contains cloud credentials). */
+function migrateConfigPermissions() {
+    if (!existsSync(CONFIG_PATH))
+        return;
+    try {
+        const stat = statSync(CONFIG_PATH);
+        const mode = stat.mode & 0o777;
+        if (mode !== 0o600) {
+            chmodSync(CONFIG_PATH, 0o600);
+            console.log(`🔒 Tightened ${CONFIG_PATH} permissions: ${mode.toString(8)} → 600 (contains credentials)`);
+        }
+    }
+    catch { /* best-effort */ }
 }
 function ensureReflecttHome() {
     mkdirSync(REFLECTT_HOME, { recursive: true });
@@ -149,6 +165,44 @@ async function enrollHostWithApiKey(input) {
     }
     throw new Error(`API key enrollment failed: ${payload?.error || `${response.status} ${response.statusText}`}`);
 }
+/**
+ * Try to reconnect using existing persisted credentials.
+ * Returns the existing registration if the host is still valid, null otherwise.
+ */
+async function tryReconnectExistingHost(cloudUrl) {
+    try {
+        const config = loadConfig();
+        const cloud = config.cloud;
+        if (!cloud?.hostId || !cloud?.credential)
+            return null;
+        // Verify the host still exists by hitting the heartbeat endpoint
+        const cloudBase = cloudUrl.replace(/\/+$/, '');
+        const response = await fetch(`${cloudBase}/api/hosts/${cloud.hostId}/heartbeat`, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                authorization: `Bearer ${cloud.credential}`,
+            },
+            body: JSON.stringify({
+                contractVersion: 1,
+                status: 'online',
+                agents: [],
+                activeTasks: [],
+                timestamp: Date.now(),
+                source: {},
+            }),
+        });
+        if (response.ok) {
+            console.log(`   ♻️  Reusing existing host (${cloud.hostId})`);
+            return { hostId: cloud.hostId, credential: cloud.credential };
+        }
+        console.log(`   ⚠️  Existing host ${cloud.hostId} no longer valid (${response.status}), will register new`);
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
 async function registerHostWithCloud(input) {
     const cloudBase = input.cloudUrl.replace(/\/+$/, '');
     // New cloud API path (reflectt-cloud): /api/hosts/claim
@@ -267,10 +321,20 @@ function printStep(name, pass, detail) {
     console.log(`${icon} ${name} — ${detail}`);
 }
 const program = new Command();
+// Read version from package.json at runtime
+const PKG_VERSION = (() => {
+    try {
+        const pkgPath = join(import.meta.dirname ?? __dirname, '..', 'package.json');
+        return JSON.parse(readFileSync(pkgPath, 'utf-8')).version ?? '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+})();
 program
     .name('reflectt')
     .description('CLI for reflectt-node - local agent communication server')
-    .version('0.1.0');
+    .version(PKG_VERSION);
 // ============ INIT COMMAND ============
 program
     .command('init')
@@ -403,8 +467,17 @@ program
     .option('-d, --detach', 'Run in background')
     .action(async (options) => {
     if (!existsSync(REFLECTT_HOME)) {
-        console.error('❌ reflectt not initialized. Run: reflectt init');
-        process.exit(1);
+        console.log('📦 First run — initializing reflectt...');
+        // Auto-init: create directories and default config
+        mkdirSync(REFLECTT_HOME, { recursive: true });
+        mkdirSync(DATA_DIR, { recursive: true });
+        mkdirSync(join(DATA_DIR, 'inbox'), { recursive: true });
+        if (!existsSync(CONFIG_PATH)) {
+            saveConfig({ port: 4445, host: '127.0.0.1' });
+            console.log('  ✅ config.json');
+        }
+        console.log('  ✅ ~/.reflectt/ created');
+        console.log('');
     }
     // Check if already running
     if (existsSync(PID_FILE)) {
@@ -423,6 +496,27 @@ program
         }
     }
     const config = loadConfig();
+    // Port-level guard: refuse to start if something is already listening
+    // (catches LaunchAgent-managed instances that don't leave a PID file)
+    const clientHost = (config.host === '0.0.0.0' || config.host === '::') ? '127.0.0.1' : config.host;
+    try {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 2000);
+        const res = await fetch(`http://${clientHost}:${config.port}/health/deploy`, { signal: controller.signal });
+        clearTimeout(timeout);
+        if (res.ok) {
+            const deploy = await res.json().catch(() => ({}));
+            const pid = deploy.pid ?? 'unknown';
+            const sha = deploy.gitSha ?? 'unknown';
+            console.error(`❌ Server already running on port ${config.port} (PID: ${pid}, sha: ${sha})`);
+            console.error('   If managed by LaunchAgent: launchctl kickstart -k gui/$(id -u)/com.reflectt.node');
+            console.error('   Otherwise: reflectt stop && reflectt start');
+            process.exit(1);
+        }
+    }
+    catch {
+        // Port not responding — safe to start
+    }
     const { projectRoot, serverPath, useNode } = getRuntimePaths();
     if (!existsSync(serverPath)) {
         console.error(`❌ Server file not found: ${serverPath}`);
@@ -432,11 +526,57 @@ program
     const cmd = useNode ? 'node' : 'npx';
     const args = useNode ? [serverPath] : ['tsx', serverPath];
     if (options.detach) {
+        // Ephemeral container warning: detach is a trap in docker run --rm
+        const isContainer = existsSync('/.dockerenv') || existsSync('/run/.containerenv');
+        if (isContainer) {
+            console.warn('⚠️  Detected container environment. Using --detach here is risky:');
+            console.warn('   The server will stop when the container exits.');
+            console.warn('   Consider: reflectt start (foreground) or use Docker CMD directly.');
+            console.warn('');
+        }
         const pid = startServerDetached(config);
-        console.log('✅ Server started in background');
+        const clientHost = (config.host === '0.0.0.0' || config.host === '::') ? '127.0.0.1' : config.host;
+        console.log(`⏳ Starting reflectt server (PID: ${pid})...`);
+        // Health check: wait up to 10s for server to respond
+        let healthy = false;
+        for (let i = 0; i < 20; i++) {
+            await new Promise(r => setTimeout(r, 500));
+            try {
+                const controller = new AbortController();
+                const timeout = setTimeout(() => controller.abort(), 2000);
+                const res = await fetch(`http://${clientHost}:${config.port}/health`, { signal: controller.signal });
+                clearTimeout(timeout);
+                if (res.ok) {
+                    healthy = true;
+                    break;
+                }
+            }
+            catch { /* not ready yet */ }
+        }
+        if (healthy) {
+            console.log('✅ Server is running!');
+            // Show deploy info for verification
+            try {
+                const controller = new AbortController();
+                const timeout = setTimeout(() => controller.abort(), 2000);
+                const dRes = await fetch(`http://${clientHost}:${config.port}/health/deploy`, { signal: controller.signal });
+                clearTimeout(timeout);
+                if (dRes.ok) {
+                    const deploy = await dRes.json();
+                    if (deploy.gitSha)
+                        console.log(`   Commit: ${String(deploy.gitSha).slice(0, 12)}`);
+                    if (deploy.startedAt)
+                        console.log(`   Started: ${deploy.startedAt}`);
+                }
+            }
+            catch { /* deploy endpoint not available */ }
+        }
+        else {
+            console.log('⚠️  Server started but not responding yet (may still be booting)');
+        }
         console.log(`   PID: ${pid}`);
-        console.log(`   URL: http://${config.host}:${config.port}`);
-        console.log(`   Dashboard: http://${config.host}:${config.port}/dashboard`);
+        console.log(`   URL: http://${clientHost}:${config.port}`);
+        console.log(`   Dashboard: http://${clientHost}:${config.port}/dashboard`);
         if (config.cloud) {
             console.log(`   Cloud: ${config.cloud.cloudUrl} (host: ${config.cloud.hostName})`);
         }
@@ -491,41 +631,211 @@ program
         }
     }
 });
+// ============ UPGRADE COMMAND ============
+program
+    .command('upgrade')
+    .description('Upgrade reflectt-node to the latest version and restart')
+    .action(async () => {
+    const { execSync } = await import('child_process');
+    // 1. Get current version
+    console.log('📦 Checking for updates...');
+    const currentVersion = PKG_VERSION;
+    // 2. Update via npm
+    try {
+        console.log('⬆️  Updating reflectt-node...');
+        execSync('npm update -g reflectt-node', { stdio: 'inherit' });
+    }
+    catch {
+        console.error('❌ npm update failed. Try: npm install -g reflectt-node@latest');
+        process.exit(1);
+    }
+    // 3. Check new version
+    try {
+        const newVersion = execSync('node -e "console.log(require(\'reflectt-node/package.json\').version)"', { encoding: 'utf-8' }).trim();
+        if (newVersion === currentVersion) {
+            console.log(`✅ Already on latest version (${currentVersion})`);
+        }
+        else {
+            console.log(`✅ Updated: ${currentVersion} → ${newVersion}`);
+        }
+    }
+    catch {
+        console.log('✅ Update complete');
+    }
+    // 4. Restart if running
+    if (existsSync(PID_FILE)) {
+        const pid = readFileSync(PID_FILE, 'utf-8').trim();
+        try {
+            process.kill(Number(pid), 'SIGTERM');
+            console.log('⏹️  Server stopped');
+            unlinkSync(PID_FILE);
+            await new Promise(resolve => setTimeout(resolve, 1500));
+        }
+        catch (err) {
+            if (err.code === 'ESRCH')
+                unlinkSync(PID_FILE);
+        }
+        const { spawn } = await import('child_process');
+        console.log('🚀 Starting server...');
+        const child = spawn(process.execPath, [process.argv[1], 'start'], {
+            stdio: 'inherit',
+            detached: false,
+            cwd: process.cwd(),
+        });
+        child.on('exit', (code) => process.exit(code ?? 0));
+    }
+    else {
+        console.log('ℹ️  Server not running. Start with: reflectt start');
+    }
+});
+// ============ RESTART COMMAND ============
+program
+    .command('restart')
+    .description('Restart the reflectt server (stop + start)')
+    .action(async () => {
+    // Stop if running
+    if (existsSync(PID_FILE)) {
+        const pid = readFileSync(PID_FILE, 'utf-8').trim();
+        try {
+            process.kill(Number(pid), 'SIGTERM');
+            console.log('⏹️  Server stopped (PID ' + pid + ')');
+            unlinkSync(PID_FILE);
+            // Wait for port to free up
+            await new Promise(resolve => setTimeout(resolve, 1500));
+        }
+        catch (err) {
+            if (err.code === 'ESRCH') {
+                console.log('⚠️  Previous process not found, cleaning up');
+                unlinkSync(PID_FILE);
+            }
+        }
+    }
+    else {
+        console.log('ℹ️  No running server found, starting fresh');
+    }
+    // Start
+    const { spawn } = await import('child_process');
+    const child = spawn(process.execPath, [process.argv[1], 'start'], {
+        stdio: 'inherit',
+        detached: false,
+        cwd: process.cwd(),
+    });
+    child.on('exit', (code) => process.exit(code ?? 0));
+});
 // ============ STATUS COMMAND ============
 program
     .command('status')
     .description('Check server health and status')
     .action(async () => {
     const config = loadConfig();
+    const DEFAULT_PORT = 4445;
+    const configHost = (config.host === '0.0.0.0' || config.host === '::') ? '127.0.0.1' : config.host;
     // Check PID file
     const isRunning = existsSync(PID_FILE);
     const pid = isRunning ? readFileSync(PID_FILE, 'utf-8').trim() : null;
     console.log('📊 reflectt Status');
     console.log(`   Config: ${CONFIG_PATH}`);
-    console.log(`   URL: http://${config.host}:${config.port}`);
+    // Try config port first, then default port as fallback
+    let health = null;
+    let activePort = config.port;
+    let activeUrl = `http://${configHost}:${config.port}`;
+    async function tryPort(port) {
+        try {
+            const url = `http://${configHost}:${port}/health`;
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), 3000);
+            const res = await fetch(url, { signal: controller.signal });
+            clearTimeout(timeout);
+            if (res.ok)
+                return await res.json();
+        }
+        catch { /* not responding on this port */ }
+        return null;
+    }
+    health = await tryPort(config.port);
+    if (!health && config.port !== DEFAULT_PORT) {
+        // Config port failed — try default port (common drift: config says 4446, server runs on 4445)
+        health = await tryPort(DEFAULT_PORT);
+        if (health) {
+            activePort = DEFAULT_PORT;
+            activeUrl = `http://${configHost}:${DEFAULT_PORT}`;
+            console.log(`   ⚠️  Config port ${config.port} not responding, found server on default port ${DEFAULT_PORT}`);
+            // Auto-fix config port to match reality
+            try {
+                config.port = DEFAULT_PORT;
+                saveConfig(config);
+                console.log(`   🔧 Auto-fixed config.json → port ${DEFAULT_PORT}`);
+            }
+            catch {
+                console.log(`   💡 Fix: update ${CONFIG_PATH} → "port": ${DEFAULT_PORT}`);
+            }
+        }
+    }
+    console.log(`   URL: ${activeUrl}`);
     if (pid) {
         try {
             process.kill(Number(pid), 0); // Check if process exists
-            console.log(`   Process: Running (PID: ${pid})`);
+            if (health) {
+                console.log(`   Process: Running (PID: ${pid})`);
+            }
+            else {
+                console.log(`   Process: PID ${pid} exists but /health not responding — server may be unhealthy`);
+            }
         }
         catch (err) {
-            console.log(`   Process: Not found (stale PID file)`);
-            return;
+            if (health) {
+                console.log(`   Process: PID file stale, but server is responding on port ${activePort}`);
+            }
+            else {
+                console.log(`   Process: Not found (stale PID file)`);
+                return;
+            }
         }
     }
     else {
-        console.log(`   Process: Not running`);
-        return;
+        if (health) {
+            console.log(`   Process: No PID file, but server is responding on port ${activePort}`);
+        }
+        else {
+            console.log(`   Process: Not running`);
+            return;
+        }
     }
-    // Try to get health status
-    try {
-        const health = await apiRequest('/health');
+    // Show health status
+    if (health) {
         console.log('\n✅ Server Health');
         console.log(`   Status: ${health.status}`);
+        console.log(`   Version: ${health.version || 'unknown'}`);
+        // Fetch deploy info (commit SHA + startedAt) for done_criteria #3
+        try {
+            const deployUrl = `http://${configHost}:${activePort}/health/deploy`;
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), 3000);
+            const dRes = await fetch(deployUrl, { signal: controller.signal });
+            clearTimeout(timeout);
+            if (dRes.ok) {
+                const deploy = await dRes.json();
+                if (deploy.gitSha)
+                    console.log(`   Commit: ${String(deploy.gitSha).slice(0, 12)}`);
+                if (deploy.startedAt)
+                    console.log(`   Started: ${deploy.startedAt}`);
+                if (deploy.pid)
+                    console.log(`   Server PID: ${deploy.pid}`);
+            }
+        }
+        catch { /* deploy endpoint not available */ }
         console.log(`   Chat messages: ${health.chat?.messageCount || 0}`);
-        console.log(`   Tasks: ${health.tasks?.taskCount || 0}`);
+        const tasks = health.tasks;
+        console.log(`   Tasks: ${tasks?.total || 0}`);
+        if (health.openclaw) {
+            const oc = health.openclaw;
+            console.log(`   OpenClaw: ${oc.status}${oc.gateway ? ` (${oc.gateway})` : ''}`);
+        }
+        if (health.cloud) {
+            console.log(`   Cloud: connected`);
+        }
     }
-    catch (err) {
+    else {
         console.log('\n⚠️  Server process exists but not responding');
     }
 });
@@ -720,7 +1030,7 @@ dogfood
     .description('Run end-to-end cloud enrollment chain verification')
     .requiredOption('--team-id <id>', 'Cloud team id to target')
     .requiredOption('--token <jwt>', 'Bearer token for cloud API auth (team admin/owner)')
-    .option('--cloud-url <url>', 'Cloud API base URL', process.env.REFLECTT_CLOUD_URL || 'https://api.reflectt.ai')
+    .option('--cloud-url <url>', 'Cloud API base URL', process.env.REFLECTT_CLOUD_URL || 'https://app.reflectt.ai')
     .option('--dashboard-url <url>', 'Dashboard base URL', process.env.REFLECTT_APP_URL || 'https://app.reflectt.ai')
     .option('--host-name <name>', 'Host name to register', `dogfood-${process.pid}`)
     .option('--capability <value...>', 'Host capabilities', ['openclaw', 'dogfood-smoke'])
@@ -815,7 +1125,7 @@ program
     .description('One-shot setup: init + connect to cloud + start server. Fastest way to get running.')
     .option('--join-token <token>', 'Cloud host join token (get one at app.reflectt.ai)')
     .option('--api-key <key>', 'Team API key')
-    .option('--cloud-url <url>', 'Cloud API base URL', 'https://api.reflectt.ai')
+    .option('--cloud-url <url>', 'Cloud API base URL', 'https://app.reflectt.ai')
     .option('--name <hostName>', 'Host display name', hostname())
     .option('--type <hostType>', 'Host type', 'openclaw')
     .action(async (options) => {
@@ -860,8 +1170,10 @@ program
         console.log(`   ✅ Home: ${REFLECTT_HOME}`);
         // Step 2: Connect
         console.log('☁️  Step 2/3: Connecting to Reflectt Cloud...');
-        const cloudUrl = String(options.cloudUrl || 'https://api.reflectt.ai').replace(/\/+$/, '');
-        const registered = options.apiKey
+        const cloudUrl = String(options.cloudUrl || 'https://app.reflectt.ai').replace(/\/+$/, '');
+        // Try to reconnect existing host first (preserves hostId across re-enrollments)
+        const existingHost = await tryReconnectExistingHost(cloudUrl);
+        const registered = existingHost || (options.apiKey
             ? await enrollHostWithApiKey({
                 cloudUrl,
                 apiKey: options.apiKey,
@@ -873,7 +1185,7 @@ program
                 joinToken: options.joinToken,
                 hostName: options.name,
                 hostType: options.type,
-            });
+            }));
         const config = loadConfig();
         const nextConfig = {
             ...config,
@@ -941,10 +1253,11 @@ host
     .description('Enroll this reflectt-node host with Reflectt Cloud')
     .option('--join-token <token>', 'Cloud host join token (from dashboard)')
     .option('--api-key <key>', 'Team API key for agent-friendly enrollment (no browser needed)')
-    .option('--cloud-url <url>', 'Cloud API base URL', 'https://api.reflectt.ai')
+    .option('--cloud-url <url>', 'Cloud API base URL', 'https://app.reflectt.ai')
     .option('--name <hostName>', 'Host display name', hostname())
     .option('--type <hostType>', 'Host type', 'openclaw')
     .option('--auth-token <jwt>', 'Temporary user JWT for environments where claim endpoint is JWT-gated')
+    .option('--force', 'Overwrite existing cloud enrollment (destructive)')
     .option('--no-restart', 'Do not restart/start local reflectt server after enrollment')
     .action(async (options) => {
     try {
@@ -960,12 +1273,20 @@ host
         }
         ensureReflecttHome();
         const config = loadConfig();
-        const cloudUrl = String(options.cloudUrl || 'https://api.reflectt.ai').replace(/\/+$/, '');
+        const cloudUrl = String(options.cloudUrl || 'https://app.reflectt.ai').replace(/\/+$/, '');
+        // Guard against destructive overwrite.
+        const decision = hostConnectGuard({ existingCloud: config.cloud, force: Boolean(options.force) });
+        if (!decision.allow) {
+            console.error(decision.warning);
+            process.exit(1);
+        }
         console.log('☁️  Enrolling host with Reflectt Cloud...');
         console.log(`   Cloud: ${cloudUrl}`);
         console.log(`   Host: ${options.name} (${options.type})`);
         console.log(`   Method: ${options.apiKey ? 'API key' : 'join token'}`);
-        const registered = options.apiKey
+        // Try to reconnect existing host first (preserves hostId across re-enrollments)
+        const existingHost = await tryReconnectExistingHost(cloudUrl);
+        const registered = existingHost || (options.apiKey
             ? await enrollHostWithApiKey({
                 cloudUrl,
                 apiKey: options.apiKey,
@@ -978,7 +1299,7 @@ host
                 hostName: options.name,
                 hostType: options.type,
                 authToken: options.authToken,
-            });
+            }));
         const nextConfig = {
             ...config,
             cloud: {