@addai/node 0.16.0 → 0.19.0

package/dist/command-runner.js

@@ -64,6 +64,7 @@ const docker_1 = require("./desktop/docker");
 const manager_1 = require("./desktop/manager");
 const creds_1 = require("./desktop/creds");
 const install_engine_1 = require("./desktop/install-engine");
+const engine_1 = require("./desktop/engine");
 const COMMAND_TIMEOUT_MS = 10 * 60 * 1000;
 /** Own version, read the same way index.ts does. Resolved here rather than
  *  imported from index.ts, which already imports this module. */
@@ -692,8 +693,51 @@ async function runInstallEngine(cmd) {
     };
     await update(cmd.id, 'running', { log });
     try {
-        await (0, install_engine_1.installEngine)(onLog);
+        // Installed but unreachable is a permissions problem, not a missing one -
+        // the same button must repair rather than reinstall.
+        const before = await (0, engine_1.detectEngine)();
+        const blocked = !!before && !before.running;
+        const outcome = await (0, install_engine_1.installEngine)(onLog, async () => {
+            // Park the command and let Studio collect it, exactly as a harness
+            // login collects a paste-back code.
+            await update(cmd.id, 'awaiting_input', { needs: 'sudo_password', log });
+            const deadline = Date.now() + INPUT_WAIT_MS;
+            while (Date.now() < deadline) {
+                const row = await pollRow(cmd.id);
+                if (!row)
+                    break;
+                if (row.status === 'canceled')
+                    return null;
+                const pw = row.input?.sudo_password;
+                if (pw) {
+                    // Wipe it from the row the moment we hold it. It exists in one
+                    // process's memory from here, and nowhere else.
+                    const t = token();
+                    if (t) {
+                        try {
+                            await (0, supabase_client_1.rpc)('runtime_command_clear_input', { p_token: t, p_id: cmd.id });
+                        }
+                        catch { /* best effort — the install still must not print it */ }
+                    }
+                    await update(cmd.id, 'running', { needs: null, log });
+                    return pw;
+                }
+                await new Promise(r => setTimeout(r, INPUT_POLL_MS));
+            }
+            return null;
+        }, blocked);
         (0, docker_1.resetProviderCache)();
+        if (outcome.needsRestart) {
+            // Group membership only applies to new processes, so this daemon still
+            // cannot reach the socket. Say so plainly and bounce it.
+            onLog('\nPermissions fixed. Restarting this machine\'s node so it picks up the new group…\n');
+            await update(cmd.id, 'completed', { log, restarting: true });
+            await (0, heartbeat_1.beat)();
+            if (restartHook) {
+                await restartHook({ commandId: cmd.id, version: VERSION, restartOnly: true });
+            }
+            return;
+        }
         const engine = await (0, docker_1.getProvider)(true);
         if (!engine) {
             await update(cmd.id, 'failed', { log }, 'Installed, but no engine is answering yet. On macOS, Docker Desktop has to be opened once before its daemon runs.');

package/dist/desktop/docker.js

@@ -35,7 +35,7 @@ class CliProvider {
         });
     }
     async probe() {
-        return { id: this.id, version: this.version };
+        return { id: this.id, version: this.version, running: true };
     }
     async create(row, opts, onLog) {
         // Pull first so the slow, chatty image download streams into the command
@@ -93,7 +93,10 @@ async function getProvider(force = false) {
     if (!force && cached !== undefined)
         return cached;
     const info = await (0, engine_1.detectEngine)();
-    cached = info ? new CliProvider(info.id, info.version) : null;
+    // An engine whose daemon is not answering is not a provider: every call
+    // through it would fail at the socket. Studio reports the reason from the
+    // capability probe instead.
+    cached = info?.running ? new CliProvider(info.id, info.version) : null;
     return cached;
 }
 function resetProviderCache() { cached = undefined; }

package/dist/desktop/engine.d.ts

@@ -1,3 +1,15 @@
 import { EngineInfo } from './provider';
 export declare function parseEngineVersion(stdout: string): string | null;
+/** Why an installed engine still cannot run anything. The three causes are
+ *  worth telling apart, because the fix for each is different and none of
+ *  them is "install Docker". */
+export declare function explainUnreachable(output: string, platform: NodeJS.Platform): string;
+/**
+ * Is there an engine here that can actually RUN something?
+ *
+ * `--version` is not enough: the CLI answers it with no daemon at all, so a
+ * machine where Docker Desktop is installed-but-closed, or where the user is
+ * not in the docker group, would report itself ready and then fail on every
+ * create. `info` is the question that needs the daemon, so it is the one asked.
+ */
 export declare function detectEngine(): Promise<EngineInfo | null>;

package/dist/desktop/engine.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseEngineVersion = parseEngineVersion;
+exports.explainUnreachable = explainUnreachable;
 exports.detectEngine = detectEngine;
 // Which container engine is on this machine? Docker first (the verified
 // path), Podman second. Never installs anything: installing Docker Desktop
@@ -12,33 +13,61 @@ function parseEngineVersion(stdout) {
     const m = /version\s+v?(\d+\.\d+\.\d+)/i.exec(stdout);
     return m ? m[1] : null;
 }
-function runVersion(binary) {
+/** Run a command and hand back exit code + output. */
+function run(binary, args) {
     return new Promise(resolve => {
         try {
-            const inv = (0, win_1.resolveCliInvocation)(binary, ['--version']);
+            const inv = (0, win_1.resolveCliInvocation)(binary, args);
             const child = (0, child_process_1.spawn)(inv.file, inv.args, {
                 env: process.env, windowsHide: true, timeout: 8_000,
             });
             let out = '';
             child.stdout?.on('data', b => { out += b.toString('utf8'); });
-            child.on('error', () => resolve(null));
-            child.on('exit', code => resolve(code === 0 ? out : null));
+            child.stderr?.on('data', b => { out += b.toString('utf8'); });
+            child.on('error', () => resolve({ ok: false, out: '' }));
+            child.on('exit', code => resolve({ ok: code === 0, out }));
         }
         catch {
             // resolveCliInvocation throws when a Windows shim can't be resolved -
             // that is "not installed" as far as this probe is concerned.
-            resolve(null);
+            resolve({ ok: false, out: '' });
         }
     });
 }
+/** Why an installed engine still cannot run anything. The three causes are
+ *  worth telling apart, because the fix for each is different and none of
+ *  them is "install Docker". */
+function explainUnreachable(output, platform) {
+    const t = output.toLowerCase();
+    if (t.includes('permission denied') || t.includes('dial unix')) {
+        return 'Docker is installed but this user cannot reach it. Add the user to the docker group:\n  sudo usermod -aG docker $USER   (then log out and back in)';
+    }
+    if (platform === 'darwin')
+        return 'Docker is installed but not running. Open Docker Desktop once and leave it running.';
+    if (platform === 'win32')
+        return 'Docker is installed but not running. Start Docker Desktop and let it finish starting.';
+    return 'Docker is installed but its daemon is not answering. Start it:\n  sudo systemctl start docker';
+}
+/**
+ * Is there an engine here that can actually RUN something?
+ *
+ * `--version` is not enough: the CLI answers it with no daemon at all, so a
+ * machine where Docker Desktop is installed-but-closed, or where the user is
+ * not in the docker group, would report itself ready and then fail on every
+ * create. `info` is the question that needs the daemon, so it is the one asked.
+ */
 async function detectEngine() {
     for (const id of ['docker', 'podman']) {
-        const out = await runVersion(id);
-        if (!out)
+        const v = await run(id, ['--version']);
+        if (!v.ok)
+            continue;
+        const version = parseEngineVersion(v.out);
+        if (!version)
             continue;
-        const version = parseEngineVersion(out);
-        if (version)
-            return { id, version };
+        const info = await run(id, ['info', '--format', '{{.ServerVersion}}']);
+        if (info.ok)
+            return { id, version, running: true };
+        return { id, version, running: false, reason: explainUnreachable(info.out, process.platform) };
     }
     return null;
 }

package/dist/desktop/install-engine.d.ts

@@ -8,5 +8,28 @@ export interface InstallPlan {
 }
 /** Pure, so the choice is testable on any machine. */
 export declare function installPlan(platform: NodeJS.Platform, isRoot: boolean): InstallPlan;
+/** Docker is there but this user cannot reach its socket. The fix is group
+ *  membership, not another install — and it needs root, so it takes the same
+ *  password round trip. */
+export declare function repairPlan(user: string): {
+    inner: string;
+    manual: string;
+};
+/** Group membership is fixed for FUTURE processes only, so the daemon that
+ *  asked for the fix still cannot reach the socket until it restarts. */
+export declare const REPAIR_NEEDS_RESTART = true;
 export declare function runningAsRoot(): boolean;
-export declare function installEngine(onLog: (s: string) => void): Promise<void>;
+/** Build the argv for a privileged install. The password NEVER goes in argv —
+ *  argv is world-readable through /proc on Linux, so anyone with a shell on
+ *  the box could read it. `-S` makes sudo take it on stdin instead, and
+ *  `-p ''` stops it printing a prompt into the log we stream back. */
+export declare function sudoArgv(inner: string): {
+    file: string;
+    args: string[];
+};
+/** Install if it is missing; fix permissions if it is merely unreachable.
+ *  One button, because from the outside they are the same complaint: this
+ *  machine cannot host desktops. Returns whether a restart is now needed. */
+export declare function installEngine(onLog: (s: string) => void, askPassword?: () => Promise<string | null>, alreadyInstalledButBlocked?: boolean): Promise<{
+    needsRestart: boolean;
+}>;

package/dist/desktop/install-engine.js

@@ -1,7 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.REPAIR_NEEDS_RESTART = void 0;
 exports.installPlan = installPlan;
+exports.repairPlan = repairPlan;
 exports.runningAsRoot = runningAsRoot;
+exports.sudoArgv = sudoArgv;
 exports.installEngine = installEngine;
 // Install a container engine on this machine, on request.
 //
@@ -36,27 +39,95 @@ function installPlan(platform, isRoot) {
         manual: 'curl -fsSL https://get.docker.com | sudo sh', needsRoot: true,
     };
 }
+/** Docker is there but this user cannot reach its socket. The fix is group
+ *  membership, not another install — and it needs root, so it takes the same
+ *  password round trip. */
+function repairPlan(user) {
+    const u = user.replace(/[^A-Za-z0-9._-]/g, '');
+    return {
+        inner: `usermod -aG docker ${u}`,
+        manual: `sudo usermod -aG docker ${u}`,
+    };
+}
+/** Group membership is fixed for FUTURE processes only, so the daemon that
+ *  asked for the fix still cannot reach the socket until it restarts. */
+exports.REPAIR_NEEDS_RESTART = true;
 function runningAsRoot() {
     return typeof process.getuid === 'function' && process.getuid() === 0;
 }
-async function installEngine(onLog) {
+/** Build the argv for a privileged install. The password NEVER goes in argv —
+ *  argv is world-readable through /proc on Linux, so anyone with a shell on
+ *  the box could read it. `-S` makes sudo take it on stdin instead, and
+ *  `-p ''` stops it printing a prompt into the log we stream back. */
+function sudoArgv(inner) {
+    return { file: 'sudo', args: ['-S', '-p', '', 'sh', '-c', inner] };
+}
+/** Install if it is missing; fix permissions if it is merely unreachable.
+ *  One button, because from the outside they are the same complaint: this
+ *  machine cannot host desktops. Returns whether a restart is now needed. */
+async function installEngine(onLog, askPassword, alreadyInstalledButBlocked) {
     const plan = installPlan(process.platform, runningAsRoot());
-    if (!plan.file) {
+    let file = plan.file;
+    let args = plan.args;
+    let password = null;
+    // Docker present but the socket is refused: repair, do not reinstall.
+    const repair = alreadyInstalledButBlocked
+        ? repairPlan(process.env.USER || process.env.LOGNAME || 'root')
+        : null;
+    if (repair) {
+        if (runningAsRoot()) {
+            onLog(`fixing permissions\n  ${repair.inner}\n\n`);
+            file = 'sh';
+            args = ['-c', repair.inner];
+        }
+        else if (askPassword) {
+            onLog(`This machine needs a sudo password to fix Docker permissions.\n  ${repair.manual}\n\n`);
+            password = await askPassword();
+            if (!password)
+                throw new Error(`No password given. Run it on the machine instead:\n  ${repair.manual}`);
+            const sudo = sudoArgv(repair.inner);
+            file = sudo.file;
+            args = sudo.args;
+        }
+        else {
+            throw new Error(`Needs root. Run this on the machine:\n  ${repair.manual}`);
+        }
+    }
+    if (!file && plan.needsRoot && askPassword) {
+        onLog('This machine needs a sudo password to install Docker.\n');
+        password = await askPassword();
+        if (!password) {
+            throw new Error(`No password given. Run it on the machine instead:\n  ${plan.manual}`);
+        }
+        const sudo = sudoArgv(plan.args[1] ?? '');
+        file = sudo.file;
+        args = sudo.args;
+    }
+    if (!file) {
         throw new Error(`This needs root, and the node is not running as root. Run this on ${require('os').hostname()}:\n  ${plan.manual}`);
     }
     onLog(`installing a container engine\n  ${plan.manual}\n\n`);
-    const inv = (0, win_1.resolveCliInvocation)(plan.file, plan.args);
+    const inv = (0, win_1.resolveCliInvocation)(file, args);
     await new Promise((resolve, reject) => {
         const child = (0, child_process_1.spawn)(inv.file, inv.args, {
             env: process.env, windowsHide: true, timeout: 25 * 60_000,
+            stdio: password ? ['pipe', 'pipe', 'pipe'] : ['ignore', 'pipe', 'pipe'],
         });
+        if (password) {
+            // Straight down stdin and gone. It is never echoed, never logged, and
+            // the caller wipes it from the row as soon as it reaches here.
+            child.stdin?.write(`${password}\n`);
+            child.stdin?.end();
+            password = null;
+        }
         let tail = '';
         const cap = (b) => { const s = b.toString('utf8'); tail = (tail + s).slice(-2000); onLog(s); };
         child.stdout?.on('data', cap);
         child.stderr?.on('data', cap);
-        child.on('error', err => reject(new Error(`${plan.file} is not available here. Install it by hand:\n  ${plan.manual}\n(${err.message})`)));
+        child.on('error', err => reject(new Error(`${file} is not available here. Install it by hand:\n  ${plan.manual}\n(${err.message})`)));
         child.on('exit', code => code === 0
             ? resolve()
-            : reject(new Error(`install failed (exit ${code}). Try by hand:\n  ${plan.manual}\n${tail.slice(-400)}`)));
+            : reject(new Error(`${repair ? 'permission fix' : 'install'} failed (exit ${code}). Try by hand:\n  ${repair ? repair.manual : plan.manual}\n${tail.slice(-400)}`)));
     });
+    return { needsRestart: !!repair && exports.REPAIR_NEEDS_RESTART };
 }

package/dist/desktop/provider.d.ts

@@ -2,6 +2,11 @@ import { DesktopRow } from './spec';
 export interface EngineInfo {
     id: 'docker' | 'podman';
     version: string;
+    /** The CLI exists AND its daemon answers. False means installed but
+     *  unusable — a different problem, with a different fix, than missing. */
+    running: boolean;
+    /** Set when running is false: what to do about it, in words. */
+    reason?: string;
 }
 export interface ExecOpts {
     cwd: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@addai/node",
-  "version": "0.16.0",
+  "version": "0.19.0",
   "description": "Daemon that pairs a machine with your +Ai account and runs Claude / Codex / Kimi / Gemini agents on its behalf. Reachable via Supabase from Vault, Entity Studio, or any other +Ai surface.",
   "license": "MIT",
   "keywords": [