Fix local dev dashboard UI build when dist dirs are root-owned.

Sync npm output from the fallback .dev/vite-dist path into go:embed, restore dist permissions via make fix-dev-permissions, and isolate dev secrets under .dev/.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Skillz147

Makefile

@@ -1,7 +1,7 @@
 # TrinityProxy Makefile
 # Easy build and deployment for SOCKS5 proxy network
 
-.PHONY: help build build-main build-dashboard build-dashboard-ui build-windows-agent build-darwin-agent build-linux-amd64 build-linux-arm64 install-agent-macos clean install deps test run-controller start-controller run-agent run-agent-dev docker-agent test-agent-docker docker-agent-down setup-dev check-deps format lint setup-system vps-setup setup-api-controller quickstart debug cleanup install-service install-dashboard-service install-production start-service stop-service start start-dev stop stop-production uninstall-production uninstall dashboard dashboard-dev dashboard-init dashboard-run dashboard-up run-dashboard sync-agent-key sync-deployment-settings setup-domain
+.PHONY: help build build-main build-dashboard build-dashboard-ui build-windows-agent build-darwin-agent build-linux-amd64 build-linux-arm64 install-agent-macos clean install deps test run-controller start-controller run-agent run-agent-dev docker-agent test-agent-docker docker-agent-down setup-dev check-deps format lint setup-system vps-setup setup-api-controller quickstart debug cleanup install-service install-dashboard-service install-production start-service stop-service start start-dev stop stop-production uninstall-production uninstall dashboard dashboard-dev dashboard-init dashboard-run dashboard-up run-dashboard sync-agent-key sync-deployment-settings setup-domain reset-dashboard-admin reset-dashboard-admin-dev fix-dev-permissions
 
 # Catch accidental "make run dashboard" (space) — the target is run-dashboard (hyphen).
 ifneq (,$(filter dashboard,$(MAKECMDGOALS)))
@@ -25,12 +25,16 @@ help:
 	@echo "TrinityProxy"
 	@echo "============"
 	@echo ""
-	@echo "  make start          - PRODUCTION: install + run on VPS (deps, build, secrets, systemd)"
+	@echo "  make start          - PRODUCTION (Linux VPS): install + run via systemd"
+	@echo "                        On macOS: same as make start-dev (local only)"
 	@echo "  make uninstall-production - Remove prod install (systemd, /opt, data, config); fresh: sudo make start"
 	@echo "  make uninstall          - Alias for uninstall-production"
 	@echo "  make setup-domain   - VPS: interactive domain + Cloudflare wildcard SSL (sudo)"
 	@echo "  make start-dev      - LOCAL DEV: Vite :8080, dashboard API :8081, controller :3100"
+	@echo "                        Uses .dev/*.db — never touches production VPS"
 	@echo "  make stop           - Stop local dev servers"
+	@echo "  make reset-dashboard-admin-dev - Reset admin login in .dev/dashboard.db (no sudo)"
+	@echo "  make fix-dev-permissions  - Fix root-owned web/dashboard/dist after sudo make start"
 	@echo "  make run-agent-dev  - macOS/local dev agent (embedded SOCKS :1080, foreground)"
 	@echo "  make build          - Build all binaries"
 
@@ -235,6 +239,21 @@ run: build
 	@echo "[*] Starting TrinityProxy with interactive setup..."
 	@export PATH="/usr/local/go/bin:$$PATH"; ./$(BUILD_DIR)/$(BINARY_NAME)
 
+# Load dev or controller env for agent/controller targets
+define load-dev-env
+set -a; \
+if [ -f scripts/lib/dev-env.sh ]; then \
+	. scripts/lib/dev-env.sh; \
+	dev_env_apply; \
+	if [ -f "$$DEV_CONTROLLER_ENV" ]; then \
+		. "$$DEV_CONTROLLER_ENV"; \
+	fi; \
+elif [ -f .env.controller ]; then \
+	. ./.env.controller; \
+fi; \
+set +a;
+endef
+
 # Load .env.controller (TRINITY_AGENT_KEY) when present — written by make sync-agent-key
 define load-controller-env
 set -a; \
@@ -307,19 +326,11 @@ run-agent-dev: build-main
 	@echo ""
 	@echo "============================================"
 	@echo "  macOS dev mode — embedded SOCKS on :1080 (no Dante)"
+	@echo "  LOCAL ONLY — heartbeats go to localhost"
 	@echo "============================================"
 	@echo ""
-	@if [ -f .env.controller ]; then \
-		echo "[*] Loading .env.controller (TRINITY_AGENT_KEY)"; \
-	else \
-		echo "[!] No .env.controller — run 'make sync-agent-key' after dashboard generates an agent key"; \
-	fi
-	@echo "[*] Controller: $${CONTROLLER_URL:-http://127.0.0.1:3100}"
-	@echo "[*] SOCKS5: :$${TRINITY_SOCKS_PORT:-1080} (user=dev, pass=dev)"
-	@echo "[*] Press Ctrl+C to stop."
-	@echo ""
 	@export PATH="/usr/local/go/bin:$$PATH"; \
-	$(load-controller-env) \
+	$(load-dev-env) \
 	CONTROLLER_URL="$${CONTROLLER_URL:-http://127.0.0.1:3100}" \
 	TRINITY_ROLE=agent \
 	TRINITY_DEV=1 \
@@ -386,7 +397,12 @@ dev-agent: build-main
 	fi
 
 # Production — full VPS bootstrap (deps, build, secrets, systemd, credentials)
+# On macOS, delegates to start-dev (local only).
 start:
+	@if [ "$$(uname -s)" = "Darwin" ]; then \
+		echo "[*] macOS: make start runs LOCAL DEV (same as make start-dev)."; \
+		echo "[*] Do not use sudo. Production runs on your Linux VPS."; \
+	fi
 	@chmod +x scripts/start-production.sh
 	@./scripts/start-production.sh
 
@@ -441,6 +457,17 @@ reset-dashboard-admin reset-admin:
 	@chmod +x scripts/reset-dashboard-admin.sh scripts/lib/production-common.sh
 	@./scripts/reset-dashboard-admin.sh
 
+
+# Fix root-owned dashboard UI dirs after accidental sudo make start (macOS local dev)
+fix-dev-permissions:
+	@chmod +x scripts/fix-dev-permissions.sh scripts/lib/dev-ui-permissions.sh
+	@./scripts/fix-dev-permissions.sh
+
+# Reset admin in local dev database (.dev/dashboard.db) — no sudo
+reset-dashboard-admin-dev:
+	@chmod +x scripts/reset-dashboard-admin.sh scripts/lib/production-common.sh
+	@TRINITY_DEV=1 DASHBOARD_DB_PATH="$(CURDIR)/.dev/dashboard.db" DASHBOARD_URL="http://localhost:8080" ./scripts/reset-dashboard-admin.sh
+
 # Bootstrap initial dashboard admin (prints temp credentials once)
 dashboard-init: build-dashboard
 	@echo "[*] Initializing dashboard admin user..."

cmd/dashboard/main.go

@@ -101,7 +101,11 @@ func main() {
 	}
 	defer deployStore.Close()
 
-	if result, err := deployStore.SyncFromExternal(deploymentSyncOptions(false)); err != nil {
+	if isDevMode() {
+		log.Info("dev mode: skipping external deployment sync (local-only)",
+			"controller_url", cfg.ControllerURL,
+		)
+	} else if result, err := deployStore.SyncFromExternal(deploymentSyncOptions(false)); err != nil {
 		log.Warn("deployment settings sync skipped", "err", err)
 	} else if result.Updated {
 		log.Info("deployment settings synced from host config",
@@ -257,6 +261,14 @@ func registerStaticUI(mux *http.ServeMux, staticDir string, log *slog.Logger) {
 
 
 
+func isDevMode() bool {
+	switch strings.ToLower(strings.TrimSpace(os.Getenv("TRINITY_ENV"))) {
+	case "development", "dev":
+		return true
+	}
+	return strings.TrimSpace(os.Getenv("TRINITY_DEV")) == "1"
+}
+
 func deploymentSyncOptions(force bool) deployment.SyncOptions {
 	return deployment.SyncOptions{
 		Sources: deployment.ExternalSources{

scripts/build-dashboard-ui.sh

@@ -8,57 +8,136 @@ set -euo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$ROOT"
 
+# shellcheck source=scripts/lib/dev-ui-permissions.sh
+source "$ROOT/scripts/lib/dev-ui-permissions.sh"
+
 SRC_DIST="$ROOT/web/dashboard/dist"
 EMBED_DIST="$ROOT/cmd/dashboard/dist"
+FALLBACK_DIST="$ROOT/.dev/vite-dist"
+# Vite runs with cwd web/dashboard — use a path relative to that directory.
+FALLBACK_VITE_OUT="../../.dev/vite-dist"
+
+DID_NPM_BUILD=0
+BUILT_DIST=""
 
 embed_tree_valid() {
 	[[ -f "$EMBED_DIST/index.html" ]]
 }
 
 src_tree_valid() {
-	[[ -f "$SRC_DIST/index.html" ]]
+	local dir="${1:-$SRC_DIST}"
+	[[ -f "$dir/index.html" ]]
+}
+
+resolve_trinity_vite_out_dir() {
+	local raw="${TRINITY_VITE_OUT_DIR:-}"
+	local abs
+	if [[ -z "$raw" ]]; then
+		return 1
+	fi
+	if [[ "$raw" = /* ]]; then
+		abs="$raw"
+	else
+		abs="$ROOT/$raw"
+	fi
+	printf '%s\n' "$abs"
+}
+
+vite_out_rel_from_repo_path() {
+	local repo_rel="${1#./}"
+	printf '../../%s\n' "$repo_rel"
 }
 
 embed_matches_src() {
-	src_tree_valid && embed_tree_valid && cmp -s "$SRC_DIST/index.html" "$EMBED_DIST/index.html"
+	local dir="${1:-$SRC_DIST}"
+	src_tree_valid "$dir" && embed_tree_valid && cmp -s "$dir/index.html" "$EMBED_DIST/index.html"
 }
 
 sync_dist_to_embed() {
-	if embed_matches_src; then
+	local src_dir="${1:-$SRC_DIST}"
+	local force="${2:-0}"
+
+	if [[ "$force" != "1" ]] && embed_matches_src "$src_dir"; then
 		echo "[+] Embed UI already up to date at $EMBED_DIST"
 		touch "$EMBED_DIST/.ui-sync-stamp"
 		return 0
 	fi
 
-	if ! src_tree_valid; then
-		echo "[-] Missing $SRC_DIST/index.html"
+	if ! src_tree_valid "$src_dir"; then
+		echo "[-] Missing $src_dir/index.html"
 		exit 1
 	fi
 
+	if ! dev_ui_dir_writable "$EMBED_DIST"; then
+		dev_ui_fix_dist_permissions "$ROOT" 1 || {
+			echo "[-] Cannot sync UI — $EMBED_DIST is not writable."
+			echo "    Run: make fix-dev-permissions"
+			exit 1
+		}
+	fi
+
 	mkdir -p "$EMBED_DIST"
 	if command -v rsync >/dev/null 2>&1; then
-		rsync -a --delete "$SRC_DIST/" "$EMBED_DIST/"
+		rsync -a --delete "$src_dir/" "$EMBED_DIST/"
 	else
 		rm -rf "${EMBED_DIST:?}"/*
-		cp -a "$SRC_DIST"/. "$EMBED_DIST/"
+		cp -a "$src_dir"/. "$EMBED_DIST/"
 	fi
 	echo "[+] Synced UI assets to $EMBED_DIST (go:embed in cmd/dashboard)"
 	touch "$EMBED_DIST/.ui-sync-stamp"
 }
 
 build_with_npm() {
+	DID_NPM_BUILD=1
+
 	if [[ ! -d "$ROOT/web/dashboard/node_modules" ]]; then
 		echo "[*] Installing dashboard UI dependencies..."
 		(cd "$ROOT/web/dashboard" && npm install)
 	fi
+
+	local vite_out_rel="dist"
+	BUILT_DIST="$SRC_DIST"
+
+	if abs="$(resolve_trinity_vite_out_dir 2>/dev/null || true)" && [[ -n "$abs" ]]; then
+		echo "[*] Using TRINITY_VITE_OUT_DIR=$abs"
+		BUILT_DIST="$abs"
+		if [[ "${TRINITY_VITE_OUT_DIR:-}" = /* ]]; then
+			vite_out_rel="$abs"
+		else
+			vite_out_rel="$(vite_out_rel_from_repo_path "${TRINITY_VITE_OUT_DIR}")"
+		fi
+		rm -rf "$abs"
+	elif [[ -d "$SRC_DIST" ]] && ! rm -rf "$SRC_DIST" 2>/dev/null; then
+		echo "[!] $SRC_DIST is not writable (often root-owned after 'sudo make start')."
+		echo "    Building to $FALLBACK_DIST instead."
+		echo "    To fix permanently: make fix-dev-permissions   (or: sudo rm -rf $SRC_DIST)"
+		BUILT_DIST="$FALLBACK_DIST"
+		vite_out_rel="$FALLBACK_VITE_OUT"
+		rm -rf "$FALLBACK_DIST"
+	fi
+
 	echo "[*] Building dashboard UI (npm run build)..."
-	(cd "$ROOT/web/dashboard" && npm run build)
+	if [[ "$BUILT_DIST" == "$SRC_DIST" ]] && [[ -z "${TRINITY_VITE_OUT_DIR:-}" ]]; then
+		(cd "$ROOT/web/dashboard" && npm run build)
+	else
+		(cd "$ROOT/web/dashboard" && npm run build -- --outDir "$vite_out_rel" --emptyOutDir)
+	fi
+	echo ""
+
+	if ! src_tree_valid "$BUILT_DIST"; then
+		echo "[-] Vite build finished but $BUILT_DIST/index.html is missing."
+		exit 1
+	fi
 }
 
 if command -v npm >/dev/null 2>&1; then
 	build_with_npm
 elif src_tree_valid; then
 	echo "[+] npm not found — using existing $SRC_DIST"
+	BUILT_DIST="$SRC_DIST"
+elif src_tree_valid "$FALLBACK_DIST"; then
+	echo "[+] npm not found — using existing $FALLBACK_DIST"
+	BUILT_DIST="$FALLBACK_DIST"
 elif embed_tree_valid; then
 	echo "[+] npm not found — reusing embedded UI tree at $EMBED_DIST"
 	exit 0
@@ -68,4 +147,9 @@ else
 	exit 1
 fi
 
-sync_dist_to_embed
+if [[ -z "$BUILT_DIST" ]]; then
+	echo "[-] Internal error: UI build output directory not set."
+	exit 1
+fi
+
+sync_dist_to_embed "$BUILT_DIST" "$DID_NPM_BUILD"

scripts/fix-dev-permissions.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+#
+# Restore user ownership on dashboard UI dist dirs (after accidental sudo make start on macOS).
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=scripts/lib/dev-ui-permissions.sh
+source "$ROOT/scripts/lib/dev-ui-permissions.sh"
+
+auto=0
+for arg in "$@"; do
+	case "$arg" in
+	--auto) auto=1 ;;
+	esac
+done
+
+dev_ui_fix_dist_permissions "$ROOT" "$auto"