@agent-idle/cli 0.1.1 → 0.1.3

package/index.js

@@ -170,7 +170,7 @@ function persistedConvexUrl() {
   }
 }
 var BUILD_CONVEX_URL = "https://handsome-camel-783.convex.cloud";
-var BUILD_AUTH_URL = "https://agent-idle-app.vercel.app";
+var BUILD_AUTH_URL = "https://agent-idle.com";
 var LOCAL_CONVEX_URL = "http://127.0.0.1:3210";
 function resolveConvexUrl() {
   return process.env.CONVEX_URL ?? persistedConvexUrl() ?? BUILD_CONVEX_URL ?? LOCAL_CONVEX_URL;
@@ -210,6 +210,54 @@ function clearToken() {
   }
 }
 
+// src/daemonControl.ts
+import { spawn } from "child_process";
+import { statSync } from "fs";
+import { fileURLToPath } from "url";
+function buildFingerprint() {
+  const script = fileURLToPath(new URL("./index.js", import.meta.url));
+  try {
+    return { script, mtimeMs: statSync(script).mtimeMs };
+  } catch {
+    return { script, mtimeMs: 0 };
+  }
+}
+function isNewerBuild(callerMtimeMs, own) {
+  return own.mtimeMs > 0 && Number.isFinite(callerMtimeMs) && callerMtimeMs > own.mtimeMs + 1;
+}
+function spawnDaemon() {
+  const indexPath = fileURLToPath(new URL("./index.js", import.meta.url));
+  const child = spawn(process.execPath, [indexPath, "daemon"], {
+    detached: true,
+    stdio: "ignore"
+  });
+  child.unref();
+}
+async function pingDaemon() {
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 500);
+    const res = await fetch(`${DAEMON_URL}/token`, { signal: controller.signal });
+    clearTimeout(timer);
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+async function daemonToken() {
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 800);
+    const res = await fetch(`${DAEMON_URL}/token`, { signal: controller.signal });
+    clearTimeout(timer);
+    if (!res.ok) return null;
+    const { token } = await res.json();
+    return token ?? null;
+  } catch {
+    return null;
+  }
+}
+
 // src/outbox.ts
 import { appendFileSync, chmodSync as chmodSync2, existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 function tighten() {
@@ -332,6 +380,7 @@ var RENEW_MS = 12e3;
 var HELPER_CREDIT_FLUSH_MS = 2e3;
 var HELPER_RETAIN_MS = 6e3;
 var LIVENESS_POLL_MS = 5e3;
+var OWN_BUILD = buildFingerprint();
 var DEBUG = Boolean(process.env.AGENT_IDLE_DEBUG) || process.argv.includes("--debug");
 function debug(...args) {
   if (DEBUG) console.log("[agent-idle]", ...args);
@@ -492,8 +541,17 @@ var ALLOWED_ORIGINS = (() => {
     // Vite dev / Tauri dev webview
     "tauri://localhost",
     "http://tauri.localhost",
-    "https://tauri.localhost"
+    "https://tauri.localhost",
     // Tauri production webview schemes (platform-dependent)
+    // ALL first-party hosted-app origins, unconditionally. The daemon that owns the port
+    // is not always the build that opened the auth page (a dev daemon vs the npm CLI's
+    // prod page, or an old install vs a newer canonical domain) — if it only trusted its
+    // OWN AUTH_URL origin, the page's token post would 403 and `login` would hang. These
+    // endpoints only RECEIVE a token / serve local display hints; the secret-reading
+    // /token stays browser-denied regardless of origin.
+    "https://agent-idle.com",
+    "https://www.agent-idle.com",
+    "https://agent-idle-app.vercel.app"
   ]);
   try {
     out.add(new URL(AUTH_URL).origin);
@@ -874,6 +932,15 @@ function startDaemon() {
       res.end(JSON.stringify({ token: readToken() }));
       return;
     }
+    if (req.method === "GET" && req.url === "/build") {
+      if (req.headers.origin) {
+        res.writeHead(403).end();
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ ...OWN_BUILD, pid: process.pid }));
+      return;
+    }
     if (req.method === "GET" && req.url === "/sessions") {
       res.writeHead(200, { ...cors, "Content-Type": "application/json" });
       res.end(JSON.stringify(Object.fromEntries(sessionMeta)));
@@ -899,6 +966,11 @@ function startDaemon() {
       setTimeout(() => process.exit(0), 50);
       return;
     }
+    const callerBuild = Number(req.headers["x-agent-idle-build"]);
+    if (isNewerBuild(callerBuild, OWN_BUILD)) {
+      debug(`caller build ${callerBuild} > own ${OWN_BUILD.mtimeMs} \u2014 retiring after this request`);
+      setTimeout(() => process.exit(0), 250);
+    }
     if (req.method !== "POST") {
       res.writeHead(404, cors).end();
       return;
@@ -920,7 +992,59 @@ function startDaemon() {
       res.writeHead(204, cors).end();
     });
   });
-  server.on("error", () => process.exit(0));
+  async function isOurPreGuardDaemon() {
+    try {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), 800);
+      const res = await fetch(`${DAEMON_URL}/token`, { signal: controller.signal });
+      clearTimeout(timer);
+      if (!res.ok) return false;
+      const body = await res.json();
+      return "token" in body;
+    } catch {
+      return false;
+    }
+  }
+  async function takeoverIfStale() {
+    try {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), 800);
+      const res = await fetch(`${DAEMON_URL}/build`, { signal: controller.signal });
+      clearTimeout(timer);
+      if (res.ok) {
+        const incumbent = await res.json();
+        if (!isNewerBuild(OWN_BUILD.mtimeMs, { script: "", mtimeMs: incumbent.mtimeMs ?? 0 })) {
+          process.exit(0);
+        }
+        debug(`incumbent build ${incumbent.mtimeMs} is stale \u2014 asking it to retire`);
+      } else {
+        if (!await isOurPreGuardDaemon()) process.exit(0);
+        debug("incumbent predates the build guard \u2014 asking it to retire");
+      }
+      await fetch(`${DAEMON_URL}/shutdown`, { method: "POST" }).catch(() => {
+      });
+      for (let i = 0; i < 20; i++) {
+        await new Promise((r) => setTimeout(r, 200));
+        if (!await pingDaemon()) {
+          server.listen(DAEMON_PORT, "127.0.0.1", () => {
+            console.log(`agent-idle daemon took over port ${DAEMON_PORT} from a stale build`);
+          });
+          return;
+        }
+      }
+    } catch {
+    }
+    process.exit(0);
+  }
+  let takeoverAttempted = false;
+  server.on("error", (err) => {
+    if (err.code === "EADDRINUSE" && !takeoverAttempted) {
+      takeoverAttempted = true;
+      void takeoverIfStale();
+      return;
+    }
+    process.exit(0);
+  });
   server.listen(DAEMON_PORT, "127.0.0.1", () => {
     console.log(`agent-idle daemon listening on http://127.0.0.1:${DAEMON_PORT}`);
     console.log(
@@ -934,44 +1058,6 @@ function startDaemon() {
 
 // src/hook.ts
 import { execFileSync as execFileSync2 } from "child_process";
-
-// src/daemonControl.ts
-import { spawn } from "child_process";
-import { fileURLToPath } from "url";
-function spawnDaemon() {
-  const indexPath = fileURLToPath(new URL("./index.js", import.meta.url));
-  const child = spawn(process.execPath, [indexPath, "daemon"], {
-    detached: true,
-    stdio: "ignore"
-  });
-  child.unref();
-}
-async function pingDaemon() {
-  try {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), 500);
-    const res = await fetch(`${DAEMON_URL}/token`, { signal: controller.signal });
-    clearTimeout(timer);
-    return res.ok;
-  } catch {
-    return false;
-  }
-}
-async function daemonToken() {
-  try {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), 800);
-    const res = await fetch(`${DAEMON_URL}/token`, { signal: controller.signal });
-    clearTimeout(timer);
-    if (!res.ok) return null;
-    const { token } = await res.json();
-    return token ?? null;
-  } catch {
-    return null;
-  }
-}
-
-// src/hook.ts
 var SHELL_COMMS = /* @__PURE__ */ new Set([
   "sh",
   "bash",
@@ -1052,7 +1138,13 @@ async function postToDaemon(url, body) {
     const timer = setTimeout(() => controller.abort(), 800);
     await fetch(url, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        "Content-Type": "application/json",
+        // Stale-daemon guard: the hook is spawned fresh per event, so this mtime always
+        // reflects the build ON DISK. A daemon seeing a newer caller retires itself and
+        // the next hook respawns the new build — no manual `kill` after updates.
+        "x-agent-idle-build": String(buildFingerprint().mtimeMs)
+      },
       body,
       signal: controller.signal
     });
@@ -1205,10 +1297,9 @@ async function signIn() {
     );
     return;
   }
-  if (!await pingDaemon()) {
-    spawnDaemon();
-    await sleep3(700);
-  }
+  spawnDaemon();
+  const settleBy = Date.now() + 5e3;
+  while (Date.now() < settleBy && !await pingDaemon()) await sleep3(250);
   console.log(`
 Opening ${AUTH_URL} to sign in (GitHub or email + password)\u2026`);
   console.log(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-idle/cli",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "agent-idle CLI: setup, ui, and the headless sensor daemon.",
   "license": "AGPL-3.0-only",
   "type": "module",