feat: install command + webchat cron fix + gateway TurnCount persist

[hrygo]

Summary

• Add hotplex install command to install binary to PATH with security hardening
• Fix React error P1: Admin HTTP handlers 缺少 panic recovery — 单个 handler panic 崩整个服务 #31 in webchat admin cron pages — CronSchedule object rendered as child
• Persist TurnCount across gateway restarts

Changes

Install Command (#553)

• internal/cli/install/install.go — shared binary install utilities with security hardening
• internal/cli/install/install_test.go — 10 table-driven tests
• cmd/hotplex/install.go — hotplex install cobra command (--path, --force)
• cmd/hotplex/main.go — register newInstallCmd()
• internal/cli/onboard/wizard.go — use shared package, remove duplicate functions
• internal/updater/updater.go — findChecksum tolerates path-prefixed filenames
• .github/workflows/release.yml — consolidate checksum generation

WebChat Cron Admin Fix

• webchat/lib/types/admin.ts — add CronSchedule interface, fix type from string to object
• webchat/app/admin/cron/page.tsx — add formatSchedule() / formatDuration() helpers
• webchat/app/admin/cron/detail/page.tsx — proper schedule object handling in edit/display

Gateway Fix

• Persist TurnCount across gateway restarts

Test plan

• make build compiles
• go test ./internal/cli/... -race — all pass including 10 new tests
• hotplex install — installs to ~/.local/bin
• hotplex install (again) — detects "already installed"
• hotplex install --force — forces reinstall
• WebChat next build — TypeScript check passes
• Pre-push validation pass (lint, vet, build, tests, mod verify)

Closes #553

[hotplex-ai]

Code Review — hotplex-ai

Verdict: APPROVE | P0:0 P1:0 P2:0 P3:1

Summary

PR 包含三个独立功能：install 命令（~100 行重复代码提取）、webchat cron 类型修复、gateway TurnCount 持久化。代码质量高，安全加固到位（PowerShell 单引号转义、shell 参数转义、filepath.Clean 归一化）。

Findings

• [P3] internal/updater/updater.go:311 — findChecksum 中 filepath.Base(parts[1]) 检查放在 parts[1] == filename 之前，将更常见的精确匹配作为快速路径放前面更优：parts[1] == filename || filepath.Base(parts[1]) == filename。纯微优化，无功能影响。

Observations (non-blocking)

• SQLiteStore 缺少 var _ TurnQuerier = (*SQLiteStore)(nil) 编译时接口检查（pgStore 已有）。预存问题，非此 PR 引入，建议后续补上。
• formatDuration 在 page.tsx 和 detail/page.tsx 中重复定义（~20 行），可考虑提取为共享 util。非阻断。

Verified

• ✅ TurnQuerier 接口已添加 LatestTurnNum，SQLite/PG/mock 三实现均更新
• ✅ SQL 查询含 generation 过滤，避免跨代污染
• ✅ AppliedResetGen 字段已添加到 sessionAccumulator，bridge.go + bridge_forward.go 幂等逻辑一致
• ✅ PowerShell -notcontains + 单引号转义防止通配符/注入
• ✅ shellEscape() + strings.NewReplacer 处理 Unix shell 注入
• ✅ CronSchedule 类型修复与后端 API 对齐
• ✅ findChecksum 容忍路径前缀，向后兼容旧 checksums.txt
• ✅ Release workflow checksum 合并为单步，cd dist 避免路径前缀

[hotplex-ai]

Code Review — hotplex-ai

Verdict: REQUEST_CHANGES | P0:1 P1:0 P2:1 P3:0

P0 — Must Fix

[P0] PowerShell AddToUserPath double-negative logic inversion — PATH never added (confidence: 92)

internal/cli/install/install.go AddToUserPath (Windows branch):

if(-not ($p -split ';' -notcontains 'DIR'))

Trace:

1. $p -split ';' → array of PATH entries
2. $array -notcontains 'DIR' → $true when DIR absent, $false when present
3. -not ($true) → $false → if-block skipped when DIR absent
4. -not ($false) → $true → if-block runs when DIR present

Result: PATH is modified (re-added) when dir is already present, and NOT modified when dir is absent. Completely inverted.

Fix: Remove outer -not:

`if($p -split ';' -notcontains '%s'){`

Reference: https://github.com/hrygo/hotplex/blob/9a96b68b3aafa2cd2f7c3166ef44e26eeb642288/internal/cli/install/install.go#L196-L199

P2 — Nit

[P2] formatDuration duplicated between cron page and detail page (confidence: 90)

Identical formatDuration(ms: number): string defined in both:

• webchat/app/admin/cron/page.tsx
• webchat/app/admin/cron/detail/page.tsx

Extract to shared utility (e.g., webchat/lib/utils/cron.ts).

Positive Notes

• Install command package is well-structured with proper atomic copy, SHA256 verification, and cross-platform support
• DRY improvement: wizard.go duplicate functions replaced by install.* package
• Webchat CronJob types now correctly match Go backend struct (CronSchedule object, payload nesting, epoch ms timestamps)
• TurnCount persistence with LatestTurnNum + AppliedResetGen idempotent guard is solid
• updater.go findChecksum now tolerates path-prefixed filenames (aligns with release.yml consolidation)
• shellEscape for Unix PATH manipulation is correct

[hotplex-ai]

Code Review — hotplex-ai

Verdict: APPROVE | P0:0 P1:0 P2:2 P3:0

4-agent parallel review completed (Bug/Security + Compliance + History/Compat + SOLID/Perf).

Findings

[P2] formatDuration duplicated in two cron admin pages — webchat/app/admin/cron/page.tsx and webchat/app/admin/cron/detail/page.tsx both define identical formatDuration(ms) helpers. Extract to a shared utility (e.g., webchat/lib/utils/format-duration.ts) to prevent divergence. [CONFIDENCE:85]

[P2] Silent error discard on new LatestTurnNum DB call (internal/gateway/bridge_forward.go) — tn, _ := b.turnsQuerier.LatestTurnNum(...) discards DB errors without logging. While consistent with the existing LatestGeneration pattern nearby, a b.log.Debug("turns: restore turn num", "error", err) would aid diagnostics for rare DB failures. [CONFIDENCE:78]

Summary

Clean PR with well-structured changes. The install command correctly extracts shared utilities from the onboard wizard with proper atomic binary copy and cross-platform PATH management. The cron admin type fixes properly resolve React error #31 with correct TypeScript interfaces matching the Go backend. TurnCount persistence uses a sound AppliedResetGen idempotency guard. Release workflow consolidation is correct. No security, concurrency, or data integrity issues found.

[hotplex-ai]

Code Review — hotplex-ai

Verdict: REQUEST_CHANGES | P0:0 P1:1 P2:6 P3:0

P1 — 必须修复

• [P1] cron detail 编辑保存时 schedule 序列化为 string 而非 CronSchedule object (webchat/app/admin/cron/detail/page.tsx:116)
  handleSave 将 schedule state（已被 formatScheduleStr 转为 "cron:0 9 * * *" 字符串）直接作为 updates.schedule 发送到 API。但后端 CronJob.schedule 类型已变更为 CronSchedule object ({kind, expr, ...})。
  影响: 用户通过 admin UI 编辑 cron job 的 schedule 后，API 会收到 string 而非 object，导致保存失败或数据损坏。
  修复建议: state 中保持 CronSchedule object，仅在渲染层调用 formatScheduleStr。

P2 — 建议修复

• [P2] sessionAccumulator data race 扩展 (internal/gateway/bridge_forward.go:141-146)
  本 PR 将 AppliedResetGen 加入 processForwardedEvent 中 lock 外的 mutation（预存模式）。 返回裸指针后，字段修改不在 accumMu 保护内。非本 PR 引入根因，但扩大了竞态面。

• [P2] LatestTurnNum 失败仅 Debug 日志 (internal/gateway/bridge_forward.go:91-95)
  DB 查询失败时 acc.TurnCount 保持 0，静默丢失 turn 计数。建议提升到 Warn 级别。

• [P2] wizard.go error wrapping 丢弃 %w 链 (internal/cli/onboard/wizard.go:1272,1299,1319)
  重构后 wizard.go 用 "update failed: " + err.Error() 拼接错误，丢失了 install 包内部的 fmt.Errorf("%w") 错误链。应改为 fmt.Errorf("update failed: %w", err)。

• [P2] 测试中硬编码路径分隔符 / (internal/cli/install/install_test.go:2121-2122,2143,2163-2165,2200)
  多处使用 dir+"/dst" 而非 filepath.Join(dir, "dst")，Windows 测试会失败。

• [P2] duplicate formatSchedule 函数 (webchat/app/admin/cron/detail/page.tsx:36 vs webchat/app/admin/cron/page.tsx:17)
  两个近似的 schedule 格式化函数，应提取到共享 utility。

• [P2] adminFetch 丢弃 202 响应 body (webchat/lib/api/admin-client.ts:77)
  HTTP 202 现在与 204 同等处理返回 undefined。需确认无 admin endpoint 返回 202+body。

[hotplex-ai]

[P1] schedule serialization bug: handleSave sends schedule as a formatted string (e.g. "cron:0 9 * * *") but the backend API expects a CronSchedule object ({kind: "cron", expr: "0 9 * * *"}).

Fix: Keep the original CronSchedule object in state, use formatScheduleStr only for display:

const [scheduleObj, setScheduleObj] = useState<CronSchedule>(...)
// render: {formatScheduleStr(scheduleObj)}
// save: updates.schedule = scheduleObj

[hotplex-ai]

Code Review — hotplex-ai

Verdict: APPROVE | P0:0 P1:0 P2:1 P3:0

P2

• [P2] 架构 HTML 引用已移除的 Codex CLI 适配器 (docs/architecture/hotplex_architecture.html:1182-1184) — CLAUDE.md 明确标注 OpenCode CLI 已被 OCS 替代，但新增的架构交互图仍展示 Codex CLI 和 worker/codexcli 节点。建议移除或合并为 OCS 说明。

审查摘要

PR 包含三大功能块，整体质量良好：

1. hotplex install 命令 — 从 wizard.go 提取共享 install 包，DRY 改善显著。原子文件复制（temp+rename）、SHA256 内容校验、跨平台 PATH 管理（zsh/bash/fish/PowerShell）实现稳健。10 个 table-driven 测试覆盖关键路径。

2. Webchat CronSchedule 修复 — CronJob 类型从扁平 string 字段正确迁移到嵌套结构（CronSchedule/CronPayload/CronJobState），修复 React #31 错误。parseScheduleStr + formatScheduleStr 双向转换正确处理了序列化问题。

3. TurnCount 持久化 — LatestTurnNum SQL 查询正确使用 COALESCE(MAX(), 0) 避免 sql.ErrNoRows。AppliedResetGen 幂等保护确保 ResetSession 和 processForwardedEvent 两路径均安全。SQL placeholder 通过已有 Rebind 机制兼容 PG。

已验证的安全项

• PowerShell 单引号字符串阻止表达式注入 ✓
• shellEscape 正确处理单引号转义 ✓
• CopyBinary temp 文件失败时正确清理 ✓
• findChecksum filepath.Base 兼容新旧 checksum 格式 ✓
• context.Background() 与 forwardEvents 已有模式一致 ✓