zevairouter 1.0.154 → 1.0.155

package/cli/app/.next-cli-build/static/chunks/app/login/page-f7df7d9a053d65b7.js

@@ -0,0 +1 @@
+(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[4520],{7911:(e,t,s)=>{Promise.resolve().then(s.bind(s,83016))},83016:(e,t,s)=>{"use strict";s.r(t),s.d(t,{default:()=>l});var a=s(95155),r=s(12115),i=s(35497),n=s(73321);function l(){let[e,t]=(0,r.useState)(""),[s,l]=(0,r.useState)(""),[d,o]=(0,r.useState)(""),[c,x]=(0,r.useState)(0),[h,u]=(0,r.useState)(!1),[m,p]=(0,r.useState)(null),[b,f]=(0,r.useState)(!1),[g,j]=(0,r.useState)("password"),[w,N]=(0,r.useState)(!1),[v,y]=(0,r.useState)("Sign in with OIDC"),S=(0,n.useRouter)();(0,r.useEffect)(()=>{if(c<=0)return;let e=setInterval(()=>x(e=>e>0?e-1:0),1e3);return()=>clearInterval(e)},[c]),(0,r.useEffect)(()=>{!async function(){let e=new AbortController,t=setTimeout(()=>e.abort(),5e3),s=window.location.origin;try{let a=await fetch(`${s}/api/auth/status`,{signal:e.signal});if(clearTimeout(t),a.ok){let e=await a.json();if(!1===e.requireLogin){S.push("/dashboard"),S.refresh();return}p(!!e.hasPassword),f(!0===e.initialPasswordConfigured),j(e.authMode||"password"),N(!0===e.oidcConfigured),y(e.oidcLoginLabel||"Sign in with OIDC")}else p(!0)}catch(e){clearTimeout(t),p(!0)}}()},[S]);let C=async t=>{t.preventDefault(),u(!0),l(""),o("");try{let t=await fetch("/api/auth/login",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({password:e})});if(t.ok)S.push("/dashboard"),S.refresh();else{let e=await t.json();l(e.error||"Invalid password"),e.resetHint&&o(e.resetHint),e.retryAfter&&x(Number(e.retryAfter))}}catch(e){l("An error occurred. Please try again.")}finally{u(!1)}},k=w&&["oidc","both"].includes(g),O="oidc"!==g||!w;return null===m?(0,a.jsx)("div",{className:"min-h-screen flex items-center justify-center bg-bg p-4",children:(0,a.jsxs)("div",{className:"text-center",children:[(0,a.jsx)("div",{className:"inline-block animate-spin rounded-full h-8 w-8 border-b-2 border-primary"}),(0,a.jsx)("p",{className:"text-text-muted mt-4",children:"Loading..."})]})}):(0,a.jsxs)("div",{className:"min-h-screen flex items-center justify-center bg-bg p-4 relative overflow-hidden",children:[(0,a.jsx)("div",{className:"landing-grid absolute inset-0 pointer-events-none","aria-hidden":"true"}),(0,a.jsxs)("div",{className:"relative z-10 w-full max-w-md",children:[(0,a.jsxs)("div",{className:"text-center mb-8",children:[(0,a.jsx)("h1",{className:"text-3xl font-bold text-primary mb-2",children:"ZevaiRouter"}),(0,a.jsx)("p",{className:"text-text-muted",children:"oidc"===g&&w?"Sign in with your OIDC provider to access the dashboard":"Enter your password to access the dashboard"})]}),(0,a.jsx)(i.Zp,{children:(0,a.jsxs)("div",{className:"flex flex-col gap-4",children:[k&&(0,a.jsx)(i.$n,{type:"button",variant:"primary",className:"w-full",onClick:()=>{window.location.href="/api/auth/oidc/start"},children:v}),k&&O&&(0,a.jsx)("div",{className:"h-px bg-border/60"}),O?(0,a.jsxs)("form",{onSubmit:C,className:"flex flex-col gap-4",children:[("oidc"===g&&!w||"both"===g&&!w)&&(0,a.jsx)("p",{className:"text-xs text-amber-600 dark:text-amber-400 text-center",children:"OIDC login is enabled, but the issuer/client fields are not configured yet. Password login is still available for recovery."}),"both"===g&&w&&(0,a.jsx)("p",{className:"text-xs text-text-muted text-center",children:"Password and OIDC login are both enabled."}),(0,a.jsxs)("div",{className:"flex flex-col gap-2",children:[(0,a.jsx)("label",{className:"text-sm font-medium",children:"Password"}),(0,a.jsx)(i.pd,{type:"password",placeholder:"Enter password",value:e,onChange:e=>t(e.target.value),required:!0,autoFocus:!k}),s&&(0,a.jsx)("p",{className:"text-xs text-red-500",children:s}),c>0&&(0,a.jsxs)("p",{className:"text-xs text-amber-600 dark:text-amber-400",children:["Locked. Retry in ",(0,a.jsxs)("span",{className:"font-mono",children:[c,"s"]}),"."]}),d&&(0,a.jsxs)("p",{className:"text-xs text-text-muted",children:["Forgot password? Open ",(0,a.jsx)("code",{className:"bg-sidebar px-1 rounded",children:"zevai"})," CLI on the host → ",(0,a.jsx)("b",{children:"Settings"})," → ",(0,a.jsx)("b",{children:"Reset Password to Default"}),"."]})]}),(0,a.jsx)(i.$n,{type:"submit",variant:"primary",className:"w-full",loading:h,disabled:c>0,children:c>0?`Wait ${c}s`:"Login"}),!1===m&&(0,a.jsx)("p",{className:"text-xs text-center text-text-muted",children:b?(0,a.jsxs)(a.Fragment,{children:["Use the initial password printed by the installer. On systemd hosts it is stored in the root-only ",(0,a.jsx)("code",{className:"bg-sidebar px-1 rounded",children:"/etc/zevairouter/zevairouter.env"})," file."]}):(0,a.jsxs)(a.Fragment,{children:["Default local password: ",(0,a.jsx)("code",{className:"bg-sidebar px-1 rounded",children:"123456"}),". Change it after signing in."]})})]}):s&&(0,a.jsx)("p",{className:"text-xs text-red-500",children:s})]})})]})]})}}},e=>{e.O(0,[2574,3862,3745,9802,620,5497,8441,3794,7358],()=>e(e.s=7911)),_N_E=e.O()}]);

package/cli/app/CHANGELOG.md

@@ -1,3 +1,32 @@
+# Unreleased
+
+# v1.0.155 (2026-07-28)
+
+## Fixes
+- **Transactional one-command installers**: macOS, Linux, VPS, and Windows installs now validate Node, package identity, health, database readiness, and the exact running build, while preserving a verified rollback until the new runtime passes.
+- **Complete-download public bootstrap**: Unix and Windows one-paste commands stage the entire installer in a temporary file, require a successful transfer, validate its syntax, and clean it up before returning instead of executing a live network stream.
+- **Safer VPS preparation**: piped setup never trusts an `install.sh` from the caller's directory, optional swap creation degrades cleanly on unsupported or low-disk hosts, and the complete Xvfb/Chromium runtime dependency set is verified.
+- **Fast side-effect-free CLI commands**: `zevai --help`, `--version`, and other informational commands no longer initialize optional runtimes or touch the network; normal startup prefers built-in `node:sqlite`, and tray repair runs only for tray launches.
+- **Published runtime completeness**: packaged `npm start` now selects the generated standalone app correctly, custom tray ports persist across desktop autostart, and local server defaults consistently bind to loopback.
+
+## Security
+- **Hardened deployment credentials**: VPS and Docker installs generate persistent first-login secrets and protect them from symlinks, special files, and permissive modes; Docker also runs the application and browser as a non-root user.
+- **Strict publish boundary**: npm releases now use an explicit runtime allowlist, reject secret-like files and machine-local build paths, require critical server assets and executable modes, and run the package audit before any publish or release push.
+- **Dependency advisory gate**: the remaining development-tool advisory is resolved, the lockfile pins the safe transitive release, and full high-severity npm audits now gate CI and both publish paths.
+- **Safer Docker build context**: local agent state, package-manager credentials, runtime data, databases, keys, logs, and generated build trees are excluded from Docker build contexts.
+
+## Improvements
+- **Smaller reproducible npm install**: the published package now has five exact-pinned production dependencies instead of shipping build-only UI dependencies, while CloakBrowser, native SQLite, PTY, and tray components remain bounded optional runtimes.
+- **Isolated production builds**: normal app builds keep home, data, database, backup, credential, and machine-identity writes inside the disposable CLI build workspace.
+- **Single guarded release path**: the nested CLI package is private, release automation rolls Unreleased notes into the versioned changelog, and maintainers cannot bypass the root package audit through nested publish scripts.
+- **Production-ready container runtime**: Docker now uses a glibc Debian base with `tini`, Xvfb, Python, Chromium libraries, persistent user home/cache paths, multi-architecture QEMU builds, and documented shared-memory sizing.
+- **Verified Docker publishing**: release tags must match a stable package version, manual publishes are main-only, credentials stay step-scoped, and an amd64 candidate must pass health and exact-version checks before multi-architecture images are pushed.
+- **Isolated quality gates**: CI runs locked installs, lint, the full test suite, publish-bundle construction, package auditing, and a Docker build; tests use a temporary `DATA_DIR` instead of real user data.
+
+## Documentation
+- **Public-repository onboarding**: install, update, Docker, VPS, credential, port, and Node requirements are aligned across all locales, Docker examples include Chromium-safe shared memory, and `CONTRIBUTING.md` documents safe development and validation practices.
+- **Sanitized product screenshots**: all README dashboard captures now use fresh synthetic state and contain no real accounts, API keys, tunnel URLs, activity history, or stale release identifiers.
+
 # v1.0.154 (2026-07-27)
 
 ## Fixes

package/cli/app/cli/hooks/postinstall.js

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 
 /**
- * Postinstall: warm-up ALL feature runtimes into ~/.zevai/runtime so one
- * `npm i -g zevairouter` leaves bulk import / terminal / SQLite ready.
+ * Postinstall: prepare bounded feature runtimes under ~/.zevai/runtime.
  *
  * Design:
  * - Heavy packages are NOT optionalDependencies of the published tarball
@@ -10,7 +9,11 @@
  * - This script installs them quietly into the user runtime dir instead.
  * - Failure is non-fatal — cli.js / feature code can still retry later.
  *
- * Escape hatch for tiny VPS / CI:
+ * Direct npm installs default to the bounded path so package installation does
+ * not unexpectedly download a browser binary. The official Unix installer
+ * explicitly requests the full warm-up after it has installed the package.
+ *
+ * Explicit bounded mode for installers / CI:
  *   ZEVAI_MINIMAL_POSTINSTALL=1 npm i -g zevairouter
  *   → only SQLite + tray; browsers install on first use.
  */
@@ -26,9 +29,14 @@ process.env.NPM_CONFIG_LOGLEVEL = process.env.NPM_CONFIG_LOGLEVEL || "error";
 const { ensureSqliteRuntime, runNpmInstall, getRuntimeDir } = require("./sqliteRuntime");
 const { ensureTrayRuntime } = require("./trayRuntime");
 const { ensureCloakbrowserRuntime } = require("./cloakbrowserRuntime");
+const { hasBuiltInNodeSqlite } = require("./startupRuntime");
 
-const MINIMAL = process.env.ZEVAI_MINIMAL_POSTINSTALL === "1"
-  || process.env.ZEVAI_MINIMAL_POSTINSTALL === "true";
+const minimalSetting = String(process.env.ZEVAI_MINIMAL_POSTINSTALL || "").toLowerCase();
+// `0`/`false` is an explicit eager request used by install.sh. Everything else
+// stays bounded, including a plain `npm install -g zevairouter`.
+const MINIMAL = minimalSetting !== "0" && minimalSetting !== "false";
+const SKIP_RUNTIME = process.env.ZEVAI_SKIP_RUNTIME_POSTINSTALL === "1"
+  || process.env.ZEVAI_SKIP_RUNTIME_POSTINSTALL === "true";
 
 function log(msg) {
   console.log(`[zevai] ${msg}`);
@@ -80,57 +88,81 @@ function warmNodePty() {
   return { ok: true };
 }
 
-log(MINIMAL
-  ? "Minimal postinstall (ZEVAI_MINIMAL_POSTINSTALL=1) — browsers install on first use"
-  : "Preparing full runtime so all features work after this install…");
+async function main() {
+  if (SKIP_RUNTIME) {
+    log("Runtime warm-up skipped by ZEVAI_SKIP_RUNTIME_POSTINSTALL");
+    return;
+  }
 
-// 1) SQLite speed path
-try {
-  ensureSqliteRuntime({ silent: true });
-  log("✓ SQLite engine ready");
-} catch (e) {
-  warn(`SQLite warm-up skipped: ${e.message}`);
-}
+  log(MINIMAL
+    ? "Minimal postinstall (ZEVAI_MINIMAL_POSTINSTALL=1) — browsers install on first use"
+    : "Preparing full runtime so all features work after this install…");
 
-// 2) Tray icon helper
-try {
-  ensureTrayRuntime({ silent: true });
-  log("✓ System tray helper ready");
-} catch (e) {
-  warn(`Tray warm-up skipped: ${e.message}`);
-}
+  // Avoid a native package install when the selected Node already provides the
+  // database engine. Older supported Node 22 builds retain the fallback warm-up.
+  if (hasBuiltInNodeSqlite()) {
+    log("✓ Built-in node:sqlite engine ready");
+  } else {
+    try {
+      const sqlite = ensureSqliteRuntime({ silent: true });
+      if (sqlite.betterSqlite) log("✓ SQLite native engine ready");
+      else warn("SQLite native engine unavailable — the bundled sql.js fallback will be used");
+    } catch (error) {
+      warn(`SQLite native warm-up skipped: ${error.message} — the bundled fallback remains available`);
+    }
+  }
 
-if (MINIMAL) {
-  log("Done (minimal). Use bulk import / terminal once to finish remaining downloads.");
-  process.exit(0);
-}
+  try {
+    const tray = ensureTrayRuntime({ silent: true });
+    if (tray.systray || tray.skipped) {
+      log(tray.skipped ? "· Native tray helper not required on Windows" : "✓ System tray helper ready");
+    } else {
+      warn("System tray helper unavailable — start with `zevai` in the terminal");
+    }
+  } catch (error) {
+    warn(`Tray warm-up skipped: ${error.message}`);
+  }
 
-// 3) CloakBrowser (sole bulk-import engine — patched Chromium + playwright-core peer)
-try {
-  const cloak = ensureCloakbrowserRuntime({ silent: true });
-  if (cloak.ok) {
-    log("✓ CloakBrowser ready (sole automation browser engine)");
-    linkCloakPeersToStandalone();
-  } else {
-    warn(`CloakBrowser skipped: ${cloak.error?.message || cloak.reason || "unknown"}`);
+  if (MINIMAL) {
+    log("Done (minimal). Automation downloads CloakBrowser on first use.");
+    return;
   }
-} catch (e) {
-  warn(`CloakBrowser skipped: ${e.message}`);
-}
 
-// 4) node-pty (nice terminal; not required)
-try {
-  const pty = warmNodePty();
-  if (pty.ok) {
-    log(pty.already ? "✓ node-pty already available" : "✓ node-pty ready (web terminal)");
-  } else if (pty.skipped) {
-    log(`· node-pty skipped (${pty.skipped})`);
-  } else {
-    warn(`node-pty skipped: ${pty.reason || "unknown"} — terminal still works`);
+  try {
+    const cloak = ensureCloakbrowserRuntime({ silent: true });
+    if (!cloak.ok) {
+      warn(`CloakBrowser packages unavailable: ${cloak.error?.message || cloak.reason || "unknown"}`);
+    } else if (typeof cloak.module?.ensureBinary !== "function") {
+      warn("CloakBrowser package is installed but ensureBinary() is unavailable");
+    } else {
+      const binaryPath = await cloak.module.ensureBinary();
+      if (!binaryPath || !fs.existsSync(binaryPath)) {
+        throw new Error("binary download completed without an executable path");
+      }
+      log(`✓ CloakBrowser binary ready (${binaryPath})`);
+      linkCloakPeersToStandalone();
+    }
+  } catch (error) {
+    warn(`CloakBrowser binary warm-up failed: ${error.message}. Automation will retry on first use.`);
   }
-} catch (e) {
-  warn(`node-pty skipped: ${e.message}`);
+
+  try {
+    const pty = warmNodePty();
+    if (pty.ok) {
+      log(pty.already ? "✓ node-pty already available" : "✓ node-pty ready (web terminal)");
+    } else if (pty.skipped) {
+      log(`· node-pty skipped (${pty.skipped})`);
+    } else {
+      warn(`node-pty skipped: ${pty.reason || "unknown"} — terminal still works`);
+    }
+  } catch (error) {
+    warn(`node-pty skipped: ${error.message}`);
+  }
+
+  log("Runtime warm-up finished. Start with: zevai");
 }
 
-log("Runtime warm-up finished. Start with: zevai");
-process.exit(0);
+main().catch((error) => {
+  console.error(`[zevai] postinstall failed: ${error.stack || error.message}`);
+  process.exitCode = 1;
+});

package/cli/app/cli/hooks/safeGlobalInstall.js

@@ -47,6 +47,7 @@ function resolveNpmForThisNode() {
   const nodeDir = path.dirname(process.execPath);
   const candidates = process.platform === "win32"
     ? [
+        path.join(nodeDir, "node_modules", "npm", "bin", "npm-cli.js"),
         path.join(nodeDir, "npm.cmd"),
         path.join(nodeDir, "npm"),
         "npm.cmd",
@@ -88,6 +89,34 @@ function runNpm(npmBin, args, opts = {}) {
   const cmd = isJsCli ? process.execPath : npmBin;
   const fullArgs = isJsCli ? [npmBin, ...args] : args;
 
+  if (opts.stream) {
+    const resultDir = fs.mkdtempSync(path.join(os.tmpdir(), "zevai-command-"));
+    const resultPath = path.join(resultDir, "result.json");
+    try {
+      const runner = path.join(__dirname, "streamCommand.js");
+      const streamed = spawnSync(process.execPath, [runner, resultPath, cmd, ...fullArgs], {
+        env: {
+          ...env,
+          ZEVAI_STREAM_COMMAND_SHELL: process.platform === "win32" && !isJsCli ? "1" : "0",
+        },
+        stdio: "inherit",
+        timeout: opts.timeout || 600_000,
+        windowsHide: true,
+      });
+      let captured = {};
+      try { captured = JSON.parse(fs.readFileSync(resultPath, "utf8")); } catch {}
+      return {
+        ok: streamed.status === 0 && captured.status === 0,
+        status: captured.status ?? streamed.status,
+        stdout: captured.stdout || "",
+        stderr: captured.stderr || "",
+        error: streamed.error || captured.error || null,
+      };
+    } finally {
+      try { fs.rmSync(resultDir, { recursive: true, force: true }); } catch {}
+    }
+  }
+
   const res = spawnSync(cmd, fullArgs, {
     encoding: "utf8",
     env,
@@ -160,6 +189,66 @@ function forceRemoveBinLinks(globalBin) {
   }
 }
 
+function getBinNames() {
+  return process.platform === "win32"
+    ? [`${BIN_NAME}.cmd`, BIN_NAME, `${BIN_NAME}.ps1`]
+    : [BIN_NAME];
+}
+
+function createInstallRollback(globalRoot, globalBin) {
+  const packageDir = path.join(globalRoot, APP_NAME);
+  if (!fs.existsSync(path.join(packageDir, "package.json"))) return null;
+
+  const backupRoot = fs.mkdtempSync(path.join(os.tmpdir(), "zevai-install-rollback-"));
+  const packageBackup = path.join(backupRoot, APP_NAME);
+  const binBackup = path.join(backupRoot, "bin");
+  try {
+    fs.cpSync(packageDir, packageBackup, {
+      recursive: true,
+      preserveTimestamps: true,
+      verbatimSymlinks: true,
+    });
+    fs.mkdirSync(binBackup, { recursive: true });
+    for (const name of getBinNames()) {
+      const source = path.join(globalBin, name);
+      if (!fs.existsSync(source)) continue;
+      fs.cpSync(source, path.join(binBackup, name), {
+        preserveTimestamps: true,
+        verbatimSymlinks: true,
+      });
+    }
+    return { backupRoot, packageBackup, binBackup };
+  } catch (error) {
+    try { fs.rmSync(backupRoot, { recursive: true, force: true }); } catch {}
+    throw error;
+  }
+}
+
+function restoreInstallRollback(rollback, globalRoot, globalBin) {
+  if (!rollback) return;
+  const packageDir = path.join(globalRoot, APP_NAME);
+  fs.rmSync(packageDir, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 });
+  fs.cpSync(rollback.packageBackup, packageDir, {
+    recursive: true,
+    preserveTimestamps: true,
+    verbatimSymlinks: true,
+  });
+  forceRemoveBinLinks(globalBin);
+  for (const name of getBinNames()) {
+    const source = path.join(rollback.binBackup, name);
+    if (!fs.existsSync(source)) continue;
+    fs.cpSync(source, path.join(globalBin, name), {
+      preserveTimestamps: true,
+      verbatimSymlinks: true,
+    });
+  }
+}
+
+function cleanupInstallRollback(rollback) {
+  if (!rollback) return;
+  try { fs.rmSync(rollback.backupRoot, { recursive: true, force: true }); } catch {}
+}
+
 function readInstalledVersion(globalRoot) {
   try {
     const pkgJson = path.join(globalRoot, APP_NAME, "package.json");
@@ -186,18 +275,48 @@ function packageDirExists(globalRoot) {
  * Default: in-place `npm i -g zevairouter@x` (keeps old build if npm dies).
  * forceClean=true only after ENOTEMPTY, or when package is already missing.
  *
- * @param {{ version?: string, packageSpec?: string, forceClean?: boolean }} opts
- * @returns {{ ok: boolean, version?: string, zevaiPath?: string, nodePath: string, npmPath: string, globalRoot: string, platform: object, error?: string, log?: string }}
+ * @param {{ version?: string, packageSpec?: string, forceClean?: boolean, retainRollback?: boolean, externalRollback?: boolean }} opts
+ * @returns {{ ok: boolean, version?: string, zevaiPath?: string, nodePath: string, npmPath: string, globalRoot: string, platform: object, rollback?: object, previousVersion?: string, error?: string, log?: string }}
  */
 function safeInstallGlobal(opts = {}) {
   const platform = detectPlatform();
-  const version = opts.version || "latest";
+  const version = String(opts.version || "latest").replace(/^v(?=\d)/, "");
   const packageSpec = opts.packageSpec || `${APP_NAME}@${version}`;
+  const validVersion = /^(?:latest|\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)$/.test(version);
+  const validPackageSpec = packageSpec === `${APP_NAME}@${version}`;
+  if (!validVersion || !validPackageSpec) {
+    return {
+      ok: false,
+      nodePath: process.execPath,
+      npmPath: "",
+      globalRoot: "",
+      platform,
+      error: "Version must be 'latest' or an exact semantic version (for example 1.2.3).",
+    };
+  }
   const npmBin = resolveNpmForThisNode();
   const globalRoot = getGlobalRoot(npmBin);
   const globalBin = getGlobalBin(npmBin);
   const hadPackage = packageDirExists(globalRoot);
   const previousVersion = hadPackage ? readInstalledVersion(globalRoot) : null;
+  let rollback = null;
+
+  if (hadPackage && !opts.externalRollback) {
+    try {
+      rollback = createInstallRollback(globalRoot, globalBin);
+      log(`rollback snapshot: ${rollback.backupRoot}`);
+    } catch (error) {
+      return {
+        ok: false,
+        nodePath: process.execPath,
+        npmPath: npmBin,
+        globalRoot,
+        platform,
+        version: previousVersion || undefined,
+        error: `Refusing to update without a rollback snapshot: ${error.message}`,
+      };
+    }
+  }
 
   log(`OS: ${platform.label} (${process.platform}/${process.arch})`);
   log(`Node: ${process.version} @ ${process.execPath}`);
@@ -224,27 +343,42 @@ function safeInstallGlobal(opts = {}) {
     installArgs.push("--registry", process.env.ZEVAI_NPM_REGISTRY);
   }
 
-  let install = runNpm(npmBin, installArgs, { timeout: 600_000 });
+  let install = runNpm(npmBin, installArgs, { timeout: 600_000, stream: true });
 
   // Retry once on ENOTEMPTY / rename — only THEN remove old dir
   let errText = `${install.stderr}\n${install.stdout}\n${install.error || ""}`;
   if (!install.ok && /ENOTEMPTY|directory not empty|rename/i.test(errText)) {
     warn("ENOTEMPTY/rename failed — force-clean and retry once");
-    forceRemoveGlobalPackage(globalRoot);
-    forceRemoveBinLinks(globalBin);
-    install = runNpm(npmBin, installArgs, { timeout: 600_000 });
-    errText = `${install.stderr}\n${install.stdout}\n${install.error || ""}`;
+    try {
+      forceRemoveGlobalPackage(globalRoot);
+      forceRemoveBinLinks(globalBin);
+      install = runNpm(npmBin, installArgs, { timeout: 600_000, stream: true });
+      errText = `${install.stderr}\n${install.stdout}\n${install.error || ""}`;
+    } catch (error) {
+      install = { ok: false, status: null, stderr: error.message, stdout: "", error };
+      errText = `ENOTEMPTY recovery failed: ${error.message}`;
+    }
   }
 
   // OOM / killed mid-install: package may be half-written — try one recovery install
   // without uninstalling again if remnants remain.
   if (!install.ok && /Killed|ENOMEM|JavaScript heap out of memory|signal SIGKILL/i.test(errText)) {
     warn("Install killed (likely OOM). Retrying once — ensure 1–2GB swap on 2GB VPS.");
-    install = runNpm(npmBin, installArgs, { timeout: 600_000 });
+    install = runNpm(npmBin, installArgs, { timeout: 600_000, stream: true });
     errText = `${install.stderr}\n${install.stdout}\n${install.error || ""}`;
   }
 
   if (!install.ok) {
+    let rollbackError = "";
+    if (rollback) {
+      try {
+        restoreInstallRollback(rollback, globalRoot, globalBin);
+        warn(`Install failed; restored ${APP_NAME}@${previousVersion || "?"}.`);
+      } catch (error) {
+        rollbackError = `\nRollback failed: ${error.message}`;
+      }
+    }
+    cleanupInstallRollback(rollback);
     const stillThere = packageDirExists(globalRoot);
     const stillVer = stillThere ? readInstalledVersion(globalRoot) : null;
     return {
@@ -256,6 +390,7 @@ function safeInstallGlobal(opts = {}) {
       version: stillVer || undefined,
       error:
         (errText.slice(0, 1200) || `npm exited ${install.status}`)
+        + rollbackError
         + (stillThere
           ? `\n(Previous install still present: ${APP_NAME}@${stillVer || "?"}. Binary should still work.)`
           : "\n(Package missing after failed install — run: npm i -g zevairouter@latest --prefer-online)"),
@@ -269,6 +404,33 @@ function safeInstallGlobal(opts = {}) {
     ? path.join(globalBin, `${BIN_NAME}.cmd`)
     : path.join(globalBin, BIN_NAME);
 
+  const expectedVersion = version !== "latest" ? String(version).replace(/^v/, "") : null;
+  const versionMismatch = expectedVersion && installedVersion !== expectedVersion;
+  if (!installedVersion || !fs.existsSync(zevaiPath) || versionMismatch) {
+    let rollbackError = "";
+    if (rollback) {
+      try {
+        restoreInstallRollback(rollback, globalRoot, globalBin);
+      } catch (error) {
+        rollbackError = ` Rollback failed: ${error.message}`;
+      }
+    }
+    cleanupInstallRollback(rollback);
+    return {
+      ok: false,
+      nodePath: process.execPath,
+      npmPath: npmBin,
+      globalRoot,
+      platform,
+      version: rollback ? previousVersion || undefined : undefined,
+      error: versionMismatch
+        ? `npm installed ${installedVersion || "an unknown version"}, expected ${expectedVersion}.${rollbackError}`
+        : `npm exited successfully but the installed package or zevai binary is incomplete.${rollbackError}`,
+    };
+  }
+
+  if (!opts.retainRollback) cleanupInstallRollback(rollback);
+
   // Dual-node warning
   try {
     const pathZevai = spawnSync(
@@ -296,6 +458,8 @@ function safeInstallGlobal(opts = {}) {
     globalRoot,
     globalBin,
     platform,
+    rollback: opts.retainRollback ? rollback : null,
+    previousVersion: previousVersion || null,
   };
 }
 
@@ -360,8 +524,9 @@ if (require.main === module) {
   if (args.includes("--latest")) version = "latest";
   // Default: no force-clean (OOM-safe in-place upgrade). Use --force-clean only to nuke.
   const forceClean = args.includes("--force-clean") || args.includes("--clean");
+  const externalRollback = args.includes("--external-rollback");
 
-  const result = safeInstallGlobal({ version, forceClean });
+  const result = safeInstallGlobal({ version, forceClean, externalRollback });
   if (!result.ok) {
     console.error(result.error || "install failed");
     process.exit(1);
@@ -372,10 +537,13 @@ if (require.main === module) {
 }
 
 module.exports = {
+  cleanupInstallRollback,
+  createInstallRollback,
   safeInstallGlobal,
   printDoctor,
   detectPlatform,
   resolveNpmForThisNode,
+  restoreInstallRollback,
   getGlobalRoot,
   APP_NAME,
   BIN_NAME,

package/cli/app/cli/hooks/startupRuntime.js

@@ -0,0 +1,31 @@
+const { builtinModules } = require("node:module");
+
+function hasBuiltInNodeSqlite(modules = builtinModules) {
+  return modules.includes("node:sqlite") || modules.includes("sqlite");
+}
+
+function prepareStartupRuntime({
+  trayMode = false,
+  modules = builtinModules,
+  loadSqliteRuntime = () => require("./sqliteRuntime"),
+  loadTrayRuntime = () => require("./trayRuntime"),
+} = {}) {
+  const sqliteRuntime = loadSqliteRuntime();
+
+  // Modern Node already supplies the preferred database driver. Installing the
+  // optional native fallback here adds latency and a network dependency.
+  if (!hasBuiltInNodeSqlite(modules)) {
+    try { sqliteRuntime.ensureSqliteRuntime({ silent: true }); } catch {}
+  }
+
+  if (trayMode) {
+    try { loadTrayRuntime().ensureTrayRuntime({ silent: true }); } catch {}
+  }
+
+  return { buildEnvWithRuntime: sqliteRuntime.buildEnvWithRuntime };
+}
+
+module.exports = {
+  hasBuiltInNodeSqlite,
+  prepareStartupRuntime,
+};

package/cli/app/cli/hooks/streamCommand.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+"use strict";
+
+const { spawn } = require("child_process");
+const fs = require("fs");
+
+const [, , resultPath, command, ...args] = process.argv;
+const useShell = process.env.ZEVAI_STREAM_COMMAND_SHELL === "1";
+const captureLimit = 128 * 1024;
+let stdout = "";
+let stderr = "";
+let finished = false;
+
+function appendTail(current, chunk) {
+  const next = current + chunk.toString();
+  return next.length <= captureLimit ? next : next.slice(-captureLimit);
+}
+
+function writeResult(status, error) {
+  if (finished) return;
+  finished = true;
+  fs.writeFileSync(resultPath, JSON.stringify({
+    status,
+    stdout,
+    stderr,
+    error: error ? String(error.message || error) : "",
+  }));
+}
+
+if (!resultPath || !command) {
+  process.stderr.write("streamCommand requires a result path and command\n");
+  process.exit(2);
+}
+
+const child = spawn(command, args, {
+  env: process.env,
+  shell: useShell,
+  stdio: ["ignore", "pipe", "pipe"],
+  windowsHide: true,
+});
+
+child.stdout.on("data", (chunk) => {
+  stdout = appendTail(stdout, chunk);
+  process.stdout.write(chunk);
+});
+child.stderr.on("data", (chunk) => {
+  stderr = appendTail(stderr, chunk);
+  process.stderr.write(chunk);
+});
+child.on("error", (error) => {
+  writeResult(null, error);
+  process.exitCode = 1;
+});
+child.on("close", (status, signal) => {
+  writeResult(status, signal ? new Error(`terminated by ${signal}`) : null);
+  process.exitCode = Number.isInteger(status) && status >= 0 ? status : 1;
+});
+
+for (const signal of ["SIGINT", "SIGTERM"]) {
+  process.once(signal, () => {
+    try { child.kill(signal); } catch {}
+  });
+}