@addai/node 0.18.0 → 0.19.0

package/dist/command-runner.js

@@ -64,6 +64,7 @@ const docker_1 = require("./desktop/docker");
 const manager_1 = require("./desktop/manager");
 const creds_1 = require("./desktop/creds");
 const install_engine_1 = require("./desktop/install-engine");
+const engine_1 = require("./desktop/engine");
 const COMMAND_TIMEOUT_MS = 10 * 60 * 1000;
 /** Own version, read the same way index.ts does. Resolved here rather than
  *  imported from index.ts, which already imports this module. */
@@ -692,7 +693,11 @@ async function runInstallEngine(cmd) {
     };
     await update(cmd.id, 'running', { log });
     try {
-        await (0, install_engine_1.installEngine)(onLog, async () => {
+        // Installed but unreachable is a permissions problem, not a missing one -
+        // the same button must repair rather than reinstall.
+        const before = await (0, engine_1.detectEngine)();
+        const blocked = !!before && !before.running;
+        const outcome = await (0, install_engine_1.installEngine)(onLog, async () => {
             // Park the command and let Studio collect it, exactly as a harness
             // login collects a paste-back code.
             await update(cmd.id, 'awaiting_input', { needs: 'sudo_password', log });
@@ -720,8 +725,19 @@ async function runInstallEngine(cmd) {
                 await new Promise(r => setTimeout(r, INPUT_POLL_MS));
             }
             return null;
-        });
+        }, blocked);
         (0, docker_1.resetProviderCache)();
+        if (outcome.needsRestart) {
+            // Group membership only applies to new processes, so this daemon still
+            // cannot reach the socket. Say so plainly and bounce it.
+            onLog('\nPermissions fixed. Restarting this machine\'s node so it picks up the new group…\n');
+            await update(cmd.id, 'completed', { log, restarting: true });
+            await (0, heartbeat_1.beat)();
+            if (restartHook) {
+                await restartHook({ commandId: cmd.id, version: VERSION, restartOnly: true });
+            }
+            return;
+        }
         const engine = await (0, docker_1.getProvider)(true);
         if (!engine) {
             await update(cmd.id, 'failed', { log }, 'Installed, but no engine is answering yet. On macOS, Docker Desktop has to be opened once before its daemon runs.');

package/dist/desktop/install-engine.d.ts

@@ -8,6 +8,16 @@ export interface InstallPlan {
 }
 /** Pure, so the choice is testable on any machine. */
 export declare function installPlan(platform: NodeJS.Platform, isRoot: boolean): InstallPlan;
+/** Docker is there but this user cannot reach its socket. The fix is group
+ *  membership, not another install — and it needs root, so it takes the same
+ *  password round trip. */
+export declare function repairPlan(user: string): {
+    inner: string;
+    manual: string;
+};
+/** Group membership is fixed for FUTURE processes only, so the daemon that
+ *  asked for the fix still cannot reach the socket until it restarts. */
+export declare const REPAIR_NEEDS_RESTART = true;
 export declare function runningAsRoot(): boolean;
 /** Build the argv for a privileged install. The password NEVER goes in argv —
  *  argv is world-readable through /proc on Linux, so anyone with a shell on
@@ -17,4 +27,9 @@ export declare function sudoArgv(inner: string): {
     file: string;
     args: string[];
 };
-export declare function installEngine(onLog: (s: string) => void, askPassword?: () => Promise<string | null>): Promise<void>;
+/** Install if it is missing; fix permissions if it is merely unreachable.
+ *  One button, because from the outside they are the same complaint: this
+ *  machine cannot host desktops. Returns whether a restart is now needed. */
+export declare function installEngine(onLog: (s: string) => void, askPassword?: () => Promise<string | null>, alreadyInstalledButBlocked?: boolean): Promise<{
+    needsRestart: boolean;
+}>;

package/dist/desktop/install-engine.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.REPAIR_NEEDS_RESTART = void 0;
 exports.installPlan = installPlan;
+exports.repairPlan = repairPlan;
 exports.runningAsRoot = runningAsRoot;
 exports.sudoArgv = sudoArgv;
 exports.installEngine = installEngine;
@@ -37,6 +39,19 @@ function installPlan(platform, isRoot) {
         manual: 'curl -fsSL https://get.docker.com | sudo sh', needsRoot: true,
     };
 }
+/** Docker is there but this user cannot reach its socket. The fix is group
+ *  membership, not another install — and it needs root, so it takes the same
+ *  password round trip. */
+function repairPlan(user) {
+    const u = user.replace(/[^A-Za-z0-9._-]/g, '');
+    return {
+        inner: `usermod -aG docker ${u}`,
+        manual: `sudo usermod -aG docker ${u}`,
+    };
+}
+/** Group membership is fixed for FUTURE processes only, so the daemon that
+ *  asked for the fix still cannot reach the socket until it restarts. */
+exports.REPAIR_NEEDS_RESTART = true;
 function runningAsRoot() {
     return typeof process.getuid === 'function' && process.getuid() === 0;
 }
@@ -47,11 +62,37 @@ function runningAsRoot() {
 function sudoArgv(inner) {
     return { file: 'sudo', args: ['-S', '-p', '', 'sh', '-c', inner] };
 }
-async function installEngine(onLog, askPassword) {
+/** Install if it is missing; fix permissions if it is merely unreachable.
+ *  One button, because from the outside they are the same complaint: this
+ *  machine cannot host desktops. Returns whether a restart is now needed. */
+async function installEngine(onLog, askPassword, alreadyInstalledButBlocked) {
     const plan = installPlan(process.platform, runningAsRoot());
     let file = plan.file;
     let args = plan.args;
     let password = null;
+    // Docker present but the socket is refused: repair, do not reinstall.
+    const repair = alreadyInstalledButBlocked
+        ? repairPlan(process.env.USER || process.env.LOGNAME || 'root')
+        : null;
+    if (repair) {
+        if (runningAsRoot()) {
+            onLog(`fixing permissions\n  ${repair.inner}\n\n`);
+            file = 'sh';
+            args = ['-c', repair.inner];
+        }
+        else if (askPassword) {
+            onLog(`This machine needs a sudo password to fix Docker permissions.\n  ${repair.manual}\n\n`);
+            password = await askPassword();
+            if (!password)
+                throw new Error(`No password given. Run it on the machine instead:\n  ${repair.manual}`);
+            const sudo = sudoArgv(repair.inner);
+            file = sudo.file;
+            args = sudo.args;
+        }
+        else {
+            throw new Error(`Needs root. Run this on the machine:\n  ${repair.manual}`);
+        }
+    }
     if (!file && plan.needsRoot && askPassword) {
         onLog('This machine needs a sudo password to install Docker.\n');
         password = await askPassword();
@@ -86,6 +127,7 @@ async function installEngine(onLog, askPassword) {
         child.on('error', err => reject(new Error(`${file} is not available here. Install it by hand:\n  ${plan.manual}\n(${err.message})`)));
         child.on('exit', code => code === 0
             ? resolve()
-            : reject(new Error(`install failed (exit ${code}). Try by hand:\n  ${plan.manual}\n${tail.slice(-400)}`)));
+            : reject(new Error(`${repair ? 'permission fix' : 'install'} failed (exit ${code}). Try by hand:\n  ${repair ? repair.manual : plan.manual}\n${tail.slice(-400)}`)));
     });
+    return { needsRestart: !!repair && exports.REPAIR_NEEDS_RESTART };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@addai/node",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Daemon that pairs a machine with your +Ai account and runs Claude / Codex / Kimi / Gemini agents on its behalf. Reachable via Supabase from Vault, Entity Studio, or any other +Ai surface.",
   "license": "MIT",
   "keywords": [