3 Commits

Include renames

Author	SHA1	Message	Date
enricobuehler	c7c9500e89	fix(windows/scripting): the runner task writes a log file, so a runner that can't reach the host is no longer silent ... Field report 2026-08-18, Windows host on 0.30: PunktfunkScripting task Running, Playnite and Steam plugins installed, library empty, and "no logs at all for plugins" — nowhere on the box. That is by construction, not by accident. The runner's only log door is the log shipper, which tees console output to `POST /plugins/logs` over the mgmt API; the scheduled task itself had no console and no file. So every failure that stops the runner reaching the host — LocalService lost its read grant on plugin-token / native-cert.pem, a moved mgmt bind, a TLS pin miss, a 401 — is exactly the failure the shipper cannot report, and it leaves the same picture: task Running, plugins never registering, an empty grid, and nothing to send when asked for logs. `scripting-run.cmd` now redirects the runner's stdout+stderr to `%ProgramData%\punktfunk\plugin-state\runner.log`, keeping the previous run as `runner.log.1`. plugin-state is the one directory `plugins enable` makes writable for LocalService, and it inherits Users-read from the config dir, so the operator can `type` it from any prompt. Writability is probed with `copy /y nul` first; if the dir is not writable (the task was started by the installer before `plugins enable` ever ran) the runner starts unlogged as before rather than not at all. No `goto`: the file is stored LF and cmd's label scan is unreliable there. The console's empty-Plugins hint (en/de) and the plugin docs now name the file; the log-ship header no longer claims the task writes no file. Verified by reading only — no Windows box reachable from here; the cmd semantics used (`copy nul` as a write probe, `if defined` blocks, leading redirect on `echo`) are the boring ones.	2026-08-18 22:26:08 +02:00
enricobuehlerandClaude Fable 5	84c47cd0a7	feat(security): run the Windows plugin runner as LocalService, not SYSTEM ... The PunktfunkScripting scheduled task ran operator-installed plugin code as SYSTEM with -RunLevel Highest — any plugin defect was a full compromise of the box. The principal is now NT AUTHORITY\LocalService (minimal privileges, no password to manage, exists at boot, loopback networking works), registered without RunLevel: - installer: New-ScheduledTaskPrincipal -UserId 'LocalService' - plugins enable: converges the principal idempotently (migrating tasks an older installer or a dev box registered as SYSTEM) BEFORE starting, then grants LocalService read — via icacls, full-System32-path — on exactly the two SYSTEM/Admins-DACL'd files the runner's connect() needs: the scoped plugin-token and the TLS-pin cert.pem. Never mgmt-token. plugins disable revokes the grants; plugins status now prints the task principal so the migration is verifiable. - build-scripting.ps1 mirrors the convergence + grants on dev deploys. The usage text also mentions the new --allow-public-registry gate that lands with the supply-chain commit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 00:45:27 +02:00
enricobuehlerandClaude Opus 4.8	e7a8cf2bba	feat(packaging): nix web console + plugin/script runner everywhere; fix tray zbus/tokio crash ... Ship the management web console and the plugin/script runner across the packaging matrix, and fix a Linux tray startup crash. - nix: add punktfunk-web (Nitro SSR on bun) and punktfunk-scripting (Effect runner), with services.punktfunk.{web,scripting} modules. Both bun node_modules come from fixed-output derivations pinned to real deps hashes; patchShebangs the web node_modules so orval/paraglide/vite run in the sandbox. Validated on x86_64-linux (nix build .#punktfunk-{web,scripting,tray,host} all green). - punktfunk-scripting now ships for deb/rpm/arch/nix/windows, mirroring the web-console mechanics (vendored bun on deb/rpm/arch, pkgs.bun on nix; one self-contained `bun build --target=bun` bundle). Opt-in: host Recommends it, but the systemd --user unit ships un-started (Windows registers its scheduled task disabled). - fix(tray): build punktfunk-tray in its OWN cargo invocation on nix/rpm/arch. Cargo unifies features across one `cargo build`, so co-building the tray with the host pulls the host's ashpd->zbus/tokio onto the tray's shared zbus and it panics at startup ("there is no reactor running, must be called from the context of a Tokio 1.x runtime"). Isolated, the tray's zbus stays on async-io. The .deb already did this; runtime-verified on nix. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 21:16:34 +02:00