@agentsdock/server 1.0.10-beta.1 → 1.0.10-beta.6

package/README.md

@@ -20,6 +20,12 @@ the same prerequisites as the source installer: a trusted `uv`, Linux with a
 working user systemd session or Apple silicon macOS with a GUI launchd session,
 and the desired provider CLIs. It runs as the current user without `sudo`.
 
+Installation and recovery exclude temporary npm lifecycle `.bin` paths, npm
+`_npx` cache paths and npm node-gyp shims from the inherited PATH. Stable absolute
+user/provider/Node locations remain ordered; empty and relative entries are
+excluded. This lexical filter is not executable or symlink authorization and
+does not repair the persisted PATH of an existing installation.
+
 The npm entrypoint only permits a fresh default installation. It refuses an
 existing managed installation, legacy service, or custom installation roots;
 changing directories does not create a second service. Use AgentsDock's managed

package/npm/cli.cjs

@@ -23,6 +23,27 @@ No installation hooks run when this npm package is installed.
 `
 const ROOT_SELECTORS = ['AGENTS_SERVER_INSTALL_DIR', 'AGENTS_SERVER_CONFIG_DIR', 'AGENTS_SERVER_STATE_DIR', 'AGENTSDOCK_STATE_DIR', 'ZENITHBOT_AGENT_DIR', 'XDG_CONFIG_HOME', 'XDG_DATA_HOME']
 
+function persistentPath(value) {
+  if (value === undefined) return undefined
+  // npm adds package/ancestor .bin directories and node-gyp shims to lifecycle
+  // PATH; npx additionally exposes its disposable cache. These must not become
+  // dependencies of a long-lived native service. Keep stable absolute user,
+  // provider and Node paths in order; do not trust npm env as an "original PATH".
+  // This is a lexical persistence filter, not executable/symlink authorization.
+  const entries = new Set()
+  for (const entry of String(value).split(path.delimiter)) {
+    if (!path.isAbsolute(entry) || /[\x00-\x1f\x7f]/.test(entry)) continue
+    const normalized = path.normalize(entry).replace(/\/$/, '') || '/'
+    if (/\/node_modules\/\.bin$/.test(normalized) ||
+        /\/_npx\/[^/]+(?:\/|$)/.test(normalized) ||
+        /\/node_modules\/(?:npm\/bin|@npmcli\/run-script\/lib)\/node-gyp-bin$/.test(normalized)) continue
+    // Do not rewrite retained paths across symlink/.. boundaries: lexical
+    // normalization is only for recognizing npm entries, not resolving paths.
+    entries.add(entry)
+  }
+  return entries.size ? [...entries].join(path.delimiter) : '/usr/bin:/bin:/usr/sbin:/sbin'
+}
+
 function parse(argv) {
   const [command = 'help', ...args] = argv
   if (['help', '--help', '-h', '--version'].includes(command)) {
@@ -66,7 +87,8 @@ function ensureFreshInstall(context) {
   if (context.uid === 0) throw new Error('Run as the user who will own the server, without sudo.')
   if (!['darwin', 'linux'].includes(context.platform)) throw new Error('Server installation requires Linux or Apple silicon macOS.')
   for (const name of ROOT_SELECTORS) if (context.env[name]) throw new Error(`Custom installation selector ${name} is unsupported by the fresh-install CLI. Use the existing server's managed updater.`)
-  const existingInstall = () => new Error('An existing server installation or state was found. Use AgentsDock or agentsdock-server update; no installer was started.')
+  const existingInstall = (message = 'An existing server installation or state was found. Use AgentsDock or agentsdock-server update; no installer was started.') =>
+    Object.assign(new Error(message), { code: 'AGENTSDOCK_EXISTING_INSTALLATION' })
   const safeDirectory = info => info.isDirectory() && !info.isSymbolicLink() && info.uid === context.uid && (info.mode & 0o022) === 0 && (info.mode & 0o500) === 0o500
   const allowEmptyScaffold = (relative, child) => {
     const root = path.join(context.home, relative)
@@ -100,11 +122,14 @@ function ensureFreshInstall(context) {
   }
   if (context.platform === 'darwin') {
     const check = context.spawn('/bin/launchctl', ['print', `gui/${context.uid}/com.agentsdock.server`], { encoding: 'utf8', timeout: 10000 })
-    if (check.status === 0) throw new Error('An AgentsServer service already exists. Use its managed updater.')
+    if (check.status === 0) throw existingInstall('An AgentsServer service already exists. Use its managed updater.')
     if (check.error || !/could not find service|service.*not found/i.test(`${check.stdout || ''} ${check.stderr || ''}`)) throw new Error('Could not verify the user service is absent. No installer was started.')
   } else {
     for (const unit of ['agents-server.service', 'zenithbot-agent.service']) {
       const check = context.spawn('systemctl', ['--user', 'show', unit, '--property=LoadState', '--value'], { encoding: 'utf8', timeout: 10000 })
+      if (!check.error && check.status === 0 && String(check.stdout).trim() && String(check.stdout).trim() !== 'not-found') {
+        throw existingInstall('An existing user service was found. Use its managed updater.')
+      }
       if (check.error || String(check.stdout).trim() !== 'not-found') throw new Error('An existing user service was found or its absence could not be verified. Use its managed updater.')
     }
   }
@@ -232,6 +257,7 @@ async function run(argv, overrides = {}) {
   const payload = path.join(context.packageRoot, 'server')
   const payloadVersion = readRegular(path.join(payload, 'VERSION'), 200).toString('utf8').trim()
   if (payloadVersion !== metadata.version) throw new Error('Package and server payload versions do not match.')
+  if (Object.hasOwn(context.env, 'PATH')) context.env = { ...context.env, PATH: persistentPath(context.env.PATH) }
   if (command === 'recover') {
     const recovery = recoveryContext(context)
     if (!recovery) { context.print('No unfinished default server migration was found. No changes were made.'); return 0 }
@@ -286,4 +312,4 @@ async function run(argv, overrides = {}) {
 }
 
 if (require.main === module) run(process.argv.slice(2)).then(code => { process.exitCode = code }).catch(error => { process.stderr.write(`agentsdock-server: ${error.message}\n`); process.exitCode = 1 })
-module.exports = { parse, readRegular, ensureFreshInstall, recoveryContext, validateOrigin, run }
+module.exports = { parse, readRegular, ensureFreshInstall, recoveryContext, validateOrigin, persistentPath, run }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentsdock/server",
-  "version": "1.0.10-beta.1",
+  "version": "1.0.10-beta.6",
   "description": "AgentsDock's self-hosted Python server and explicit installation CLI",
   "license": "Apache-2.0",
   "repository": {

package/server/VERSION

@@ -1 +1 @@
-1.0.10-beta.1
+1.0.10-beta.6