v1.3.3 — Rocky Linux Air-Gap Audit Fixes

Changes

Fixed

Air-gap / install

• scripts/build-server.sh — removed unconditional go mod tidy + go mod download; uses -mod=vendor when server/vendor/ is present; exits with a clear message when GOPROXY=off and vendor dir is absent instead of reaching out to the network
• scripts/install-cli.sh — no longer calls git submodule update when prebuilt/ is already populated; warns and continues in air-gap rather than hard failing

Server API

• server/internal/api/auth.go — GET /auth/bootstrap reads ?devkit_token= (was ?token=); the documented query parameter now correctly sets the session cookie
• server/internal/api/handlers.go — prefixOverridePath moved to ~/.config/airgap-cpp-devkit/prefix via os.UserConfigDir(); previously pointed at the nonexistent manager/src/… path, causing POST /api/prefix to always return 500
• packages/pip-packages/devkit.json — corrected setup path; GET /install/pip-packages no longer fails with "No such file or directory"
• server/internal/config/config.go — SetupComplete defaults to true when no devkit.config.json exists; fresh installs are no longer blocked by the setup wizard

Tool installs

• tools/dev-tools/vscode-extensions/setup.sh — VSIX_DIR now tries multiple candidate paths to locate .vsix files
• tools/toolchains/ninja/setup.sh — tar member changed to ./ninja to match archive entry format; no longer fails with "Not found in archive"
• tools/toolchains/gcc/setup.sh — non-root Linux install now uses rpm2cpio | cpio into $PREFIX instead of hard-exiting with "Root required"

Launch script

• scripts/launch.sh — default port corrected 8080 → 9090; _free_port() uses ss/lsof on Linux; --yes, --profile, --prefix flags forwarded to install-cli.sh on fallback
• scripts/status.sh — stale tools/toolchains/clang/… paths updated to tools/toolchains/llvm/…
• scripts/install-cli.sh — header updated: removed stale Python 3.8+ requirement, corrected port to 9090

Install

pip install airgap-devkit==1.3.3