npm - @aiworker/web - Versions diffs - 1.23.2 → 1.23.3 - Mend

@aiworker/web 1.23.2 → 1.23.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (72) hide show

package/dist/index.html CHANGED Viewed

@@ -509,16 +509,16 @@
         pointer-events: none;
       }
     </style>
-    <script type="module" crossorigin src="/assets/main-BgfXQ-4g.js"></script>
+    <script type="module" crossorigin src="/assets/main-BeWvA5d9.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/vendor-vite-runtime-DD1OZmLC.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zod-B6551dwG.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-scheduler-7OC5HNn7.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-BUCujlKS.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-BAGL70zf.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-sdk-BJ73u-bH.js">
-    <link rel="modulepreload" crossorigin href="/assets/index-BD8ILbxF.js">
+    <link rel="modulepreload" crossorigin href="/assets/index-BvwlOZOg.js">
     <link rel="modulepreload" crossorigin href="/assets/contextPanelEmbeddedChat-BdA6bdky.js">
-    <link rel="stylesheet" crossorigin href="/assets/index-zhgg-SDz.css">
+    <link rel="stylesheet" crossorigin href="/assets/index-n5p3SnES.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <div id="root" class="h-full">

package/dist/mini-chat.html CHANGED Viewed

@@ -74,15 +74,15 @@
       }
     </style>
-    <script type="module" crossorigin src="/assets/miniChat-DHKXp-_I.js"></script>
+    <script type="module" crossorigin src="/assets/miniChat-DzMGD1Hv.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/vendor-vite-runtime-DD1OZmLC.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zod-B6551dwG.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-scheduler-7OC5HNn7.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-BUCujlKS.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-BAGL70zf.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-sdk-BJ73u-bH.js">
-    <link rel="modulepreload" crossorigin href="/assets/index-BD8ILbxF.js">
-    <link rel="stylesheet" crossorigin href="/assets/index-zhgg-SDz.css">
+    <link rel="modulepreload" crossorigin href="/assets/index-BvwlOZOg.js">
+    <link rel="stylesheet" crossorigin href="/assets/index-n5p3SnES.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <div id="root" class="h-full">

package/dist/mobile.html CHANGED Viewed

@@ -63,15 +63,15 @@
       })();
     </script>
-    <script type="module" crossorigin src="/assets/mobile-lXQ08VnX.js"></script>
+    <script type="module" crossorigin src="/assets/mobile-CrDSF4dQ.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/vendor-vite-runtime-DD1OZmLC.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zod-B6551dwG.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-scheduler-7OC5HNn7.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-BUCujlKS.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-BAGL70zf.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-sdk-BJ73u-bH.js">
-    <link rel="modulepreload" crossorigin href="/assets/index-BD8ILbxF.js">
-    <link rel="stylesheet" crossorigin href="/assets/index-zhgg-SDz.css">
+    <link rel="modulepreload" crossorigin href="/assets/index-BvwlOZOg.js">
+    <link rel="stylesheet" crossorigin href="/assets/index-n5p3SnES.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <div id="root" class="h-full"></div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@aiworker/web",
-  "version": "1.23.2",
+  "version": "1.23.03",
   "private": false,
   "type": "module",
   "main": "./server/index.js",
@@ -25,7 +25,7 @@
   "dependencies": {
     "@clack/prompts": "^1.1.0",
     "@octokit/rest": "^22.0.1",
-    "@opencode-ai/sdk": "1.18.30",
+    "@opencode-ai/sdk": "1.18.31",
     "@simplewebauthn/server": "13.3.1",
     "bun-pty": "^0.4.5",
     "compression": "^1.8.1",

package/server/lib/opencode/DOCUMENTATION.md CHANGED Viewed

@@ -389,6 +389,20 @@ within a ten-minute overall deadline.
     - Foreground servers running under a systemd user unit queue installation in
       a separate transient unit and restart the configured service afterwards.
       `AIWORKER_SYSTEMD_UNIT` overrides the default `aiworker.service`.
+    - On Windows the install-and-restart script is written to
+      `<data dir>/update-install.cmd` before the response and run with
+      `cmd.exe /c <file>`. A newline ends a `cmd.exe /c` command line, so the
+      same script passed as an argument ran nothing and exited 0; the batch
+      file keeps every line. The package-manager line is `call`ed because
+      npm, pnpm and yarn are `.cmd` shims that would otherwise end the script,
+      the pre-install pause is a loopback `ping` because `timeout` rejects a
+      detached child's stdin, and the file deletes itself on its last line
+      because the restart command carries the server's flags. If the file
+      cannot be written the route answers 500 and the server keeps running.
+      The listener is closed before the batch is spawned: on Windows the
+      detached child inherits the listening socket and would hold the port
+      for the whole batch, so the restart inside it failed with "port already
+      in use" and the update ended with no server.
   - `GET /api/openchamber/models-metadata`
   - `GET /api/zen/models`

package/server/lib/opencode/openchamber-routes.js CHANGED Viewed

@@ -16,6 +16,43 @@ function quotePosixShell(value) {
   return `'${String(value).replace(/'/g, "'\\''")}'`;
 }
+/**
+ * `echo` in batch treats `& | < > ( ) ^` as syntax and `%var%` as expansion,
+ * so a line of the log preamble is escaped before it becomes an `echo`.
+ */
+const escapeBatchEchoLine = (line) => {
+  if (!line) return 'echo.';
+  return `echo ${line.replace(/%/g, '%%').replace(/[&|<>()^]/g, '^$&')}`;
+};
+/**
+ * The Windows update runs as a batch file, one command per line, so the
+ * `if ... else` block and the multi-line log preamble keep their structure.
+ */
+const buildWindowsUpdateScript = ({ logPreamble, updateCmd, restartCmd }) => [
+  '@echo off',
+  ...logPreamble.split('\n').map(escapeBatchEchoLine),
+  // `timeout` refuses redirected stdin, which is what a detached child has;
+  // a ping to loopback waits about two seconds without a console.
+  'ping -n 3 127.0.0.1 >nul',
+  // npm, pnpm and yarn are .cmd shims on Windows. Without `call`, a batch
+  // file hands control to them for good and the restart below never runs.
+  // Read from a file, cmd expands `%x%` and drops a lone `%`, so a `%` in a
+  // host or UI password would change the restart command. Doubling keeps it.
+  `call ${updateCmd.replace(/%/g, '%%')}`,
+  'if %ERRORLEVEL% EQU 0 (',
+  '  echo Update successful, restarting AiWorker...',
+  `  ${restartCmd ? restartCmd.replace(/%/g, '%%') : 'echo Service manager will restart AiWorker.'}`,
+  ') else (',
+  '  echo Update failed',
+  ')',
+  // The restart command carries the server's own flags, `--ui-password`
+  // included, so the file does not outlive the run. Deleting the running
+  // batch file on its last line is safe: cmd has already read it.
+  'del "%~f0"',
+  '',
+].join('\r\n');
 export const registerAiWorkerRoutes = (app, dependencies) => {
   const {
     fs,
@@ -300,6 +337,26 @@ export const registerAiWorkerRoutes = (app, dependencies) => {
         `logPath=${updateLogPath}`,
       ].join('\n');
+      const shell = isWindows ? (process.env.ComSpec || 'cmd.exe') : 'sh';
+      const shellFlag = isWindows ? '/c' : '-c';
+      // cmd.exe /c takes one command line: a newline inside it ends the
+      // command, so a multi-line script passed as the argument ran nothing
+      // and exited 0, and the server shut itself down believing the update
+      // was under way (#3084). Batch runs from a file instead, written before
+      // the client is told to expect a restart.
+      const windowsScriptPath = path.join(aiworkerDataDir, 'update-install.cmd');
+      if (isWindows) {
+        try {
+          fs.mkdirSync(path.dirname(windowsScriptPath), { recursive: true });
+          fs.writeFileSync(windowsScriptPath, buildWindowsUpdateScript({ logPreamble, updateCmd, restartCmd }), 'utf8');
+        } catch (scriptError) {
+          console.error('Failed to write the update script, update not started:', scriptError);
+          return res.status(500).json({
+            error: `Could not write the update script at ${windowsScriptPath}: ${scriptError instanceof Error ? scriptError.message : String(scriptError)}`,
+          });
+        }
+      }
       res.json({
         success: true,
         message: 'Update starting, server will restart shortly',
@@ -314,21 +371,8 @@ export const registerAiWorkerRoutes = (app, dependencies) => {
           console.log(`Running: ${updateCmd}`);
           console.log(logPreamble);
-          const shell = isWindows ? (process.env.ComSpec || 'cmd.exe') : 'sh';
-          const shellFlag = isWindows ? '/c' : '-c';
           const script = isWindows
-            ? `
-            echo ${quoteCmd(logPreamble)}
-            timeout /t 2 /nobreak >nul
-            ${updateCmd}
-            if %ERRORLEVEL% EQU 0 (
-              echo Update successful, restarting AiWorker...
-              ${restartCmd || 'echo Service manager will restart AiWorker.'}
-            ) else (
-              echo Update failed
-              exit /b 1
-            )
-            `
+            ? windowsScriptPath
           : `
             printf '%s\n' ${quotePosix(logPreamble)}
             sleep 2
@@ -350,10 +394,24 @@ export const registerAiWorkerRoutes = (app, dependencies) => {
           console.warn('Failed to open update log file, continuing without log capture:', logError);
         }
+        if (isWindows) {
+          // On Windows the detached child inherits this process's listening
+          // socket, and keeps the port for as long as the batch runs. The
+          // restart inside that batch then fails with "port already in use",
+          // and the update ends with no server. Closing the listener first
+          // leaves nothing to inherit; the process exits right after anyway.
+          try {
+            server.close();
+          } catch (closeError) {
+            console.warn('Failed to close the listener before the update script:', closeError);
+          }
+        }
         const child = spawnChild(shell, [shellFlag, script], {
           detached: true,
           stdio: logFd !== null ? ['ignore', logFd, logFd] : 'ignore',
           env: process.env,
+          windowsHide: true,
         });
         child.unref();

package/server/lib/opencode/openchamber-routes.test.js CHANGED Viewed

@@ -18,11 +18,15 @@ const childProcess = await import('child_process');
 const packageManager = await import('../package-manager.js');
 const { registerAiWorkerRoutes } = await import('./openchamber-routes.js');
-const createApp = ({ environment = {}, storedOptions = {}, desktopUpdater } = {}) => {
+const createApp = ({ environment = {}, storedOptions = {}, desktopUpdater, platform = 'linux', execPath = '/usr/bin/node' } = {}) => {
   const app = express();
   const dependencies = {
     fs: {
       existsSync: vi.fn(() => false),
+      mkdirSync: vi.fn(),
+      writeFileSync: vi.fn(),
+      openSync: vi.fn(() => 7),
+      closeSync: vi.fn(),
       promises: {
         readFile: vi.fn(async () => JSON.stringify({
           launchMode: 'foreground',
@@ -34,11 +38,13 @@ const createApp = ({ environment = {}, storedOptions = {}, desktopUpdater } = {}
     path,
     process: {
       env: environment,
-      platform: 'linux',
-      execPath: '/usr/bin/node',
+      platform,
+      execPath,
+      exit: vi.fn(),
     },
     server: {
       address: () => ({ port: 7897 }),
+      close: vi.fn(),
     },
     __dirname: '/opt/openchamber/server',
     aiworkerDataDir: '/tmp/openchamber',
@@ -266,3 +272,65 @@ describe('AiWorker foreground update route', () => {
     });
   });
 });
+describe('AiWorker web update route on Windows', () => {
+  it('runs the install-and-restart script from a batch file instead of a cmd.exe /c argument', async () => {
+    const { app, dependencies } = createApp({
+      platform: 'win32',
+      execPath: 'C:\\Program Files\\nodejs\\node.exe',
+      environment: { ComSpec: 'C:\\Windows\\system32\\cmd.exe' },
+      storedOptions: { launchMode: 'daemon', port: 7897, uiPassword: 'pa%ss' },
+    });
+    childProcess.spawn.mockReturnValue({ unref: vi.fn() });
+    vi.spyOn(console, 'log').mockImplementation(() => {});
+    await request(app).post('/api/openchamber/update-install').expect(200);
+    await new Promise((resolve) => setTimeout(resolve, 1300));
+    const scriptPath = path.join('/tmp/openchamber', 'update-install.cmd');
+    expect(dependencies.fs.writeFileSync).toHaveBeenCalledWith(scriptPath, expect.any(String), 'utf8');
+    const script = dependencies.fs.writeFileSync.mock.calls[0][1];
+    const lines = script.split('\r\n');
+    expect(lines[0]).toBe('@echo off');
+    // Every preamble line is an echo; none is left to run as a command.
+    expect(lines.filter((line) => line.startsWith('currentVersion=') || line.startsWith('restartCommand='))).toEqual([]);
+    expect(lines).toContain('echo packageManager=npm');
+    expect(lines).toContain('echo restartCommand=^("C:\\Program Files\\nodejs\\node.exe" "/opt/openchamber/bin/cli.js" serve --port 7897 --ui-password "pa%%ss"^) ^|^| ^(aiworker serve --port 7897 --ui-password "pa%%ss"^)');
+    // A .cmd shim (npm, pnpm, yarn) must be `call`ed or the script ends there.
+    expect(lines).toContain('call npm install -g @aiworker/web@latest');
+    expect(lines).toContain('ping -n 3 127.0.0.1 >nul');
+    expect(lines.some((line) => line.startsWith('timeout '))).toBe(false);
+    expect(lines).toContain('if %ERRORLEVEL% EQU 0 (');
+    expect(lines.at(-2)).toBe('del "%~f0"');
+    // A `%` in the password survives batch expansion only when doubled.
+    expect(lines).toContain('  ("C:\\Program Files\\nodejs\\node.exe" "/opt/openchamber/bin/cli.js" serve --port 7897 --ui-password "pa%%ss") || (aiworker serve --port 7897 --ui-password "pa%%ss")');
+    expect(childProcess.spawn).toHaveBeenCalledWith(
+      'C:\\Windows\\system32\\cmd.exe',
+      ['/c', scriptPath],
+      expect.objectContaining({ detached: true, windowsHide: true }),
+    );
+    // The listener is closed before the batch is spawned, so the detached
+    // child cannot inherit the socket and hold the port against the restart.
+    expect(dependencies.server.close).toHaveBeenCalledOnce();
+    expect(dependencies.server.close.mock.invocationCallOrder[0]).toBeLessThan(childProcess.spawn.mock.invocationCallOrder[0]);
+    expect(dependencies.process.exit).toHaveBeenCalledWith(0);
+  });
+  it('answers 500 and keeps the server up when the batch file cannot be written', async () => {
+    const { app, dependencies } = createApp({ platform: 'win32', storedOptions: { launchMode: 'daemon', port: 7897 } });
+    dependencies.fs.writeFileSync.mockImplementation(() => { throw new Error('EACCES'); });
+    vi.spyOn(console, 'log').mockImplementation(() => {});
+    const logError = vi.spyOn(console, 'error').mockImplementation(() => {});
+    const response = await request(app).post('/api/openchamber/update-install').expect(500);
+    await new Promise((resolve) => setTimeout(resolve, 1300));
+    expect(response.body.error).toContain('update-install.cmd');
+    expect(response.body.error).toContain('EACCES');
+    expect(childProcess.spawn).not.toHaveBeenCalled();
+    expect(dependencies.process.exit).not.toHaveBeenCalled();
+    expect(logError).toHaveBeenCalledOnce();
+  });
+});

package/server/lib/opencode/settings-helpers.js CHANGED Viewed

@@ -233,6 +233,11 @@ export const createSettingsHelpers = (dependencies) => {
     if (typeof candidate.workStatusHiddenSectionsExplicit === 'boolean') {
       result.workStatusHiddenSectionsExplicit = candidate.workStatusHiddenSectionsExplicit;
     }
+    if (Array.isArray(candidate.workStatusSectionOrder)) {
+      result.workStatusSectionOrder = [
+        ...new Set(candidate.workStatusSectionOrder.filter((entry) => typeof entry === 'string' && entry.length > 0)),
+      ];
+    }
     if (typeof candidate.desktopLanAccessEnabled === 'boolean') {
       result.desktopLanAccessEnabled = candidate.desktopLanAccessEnabled;
     }

package/server/lib/opencode/settings-helpers.test.js CHANGED Viewed

@@ -69,6 +69,18 @@ const createTestHelpersWithRealSanitizers = () => {
 };
 describe('settings helpers', () => {
+  it('round-trips section order and preserves it across unrelated writes', () => {
+    const helpers = createTestHelpers();
+    const changes = helpers.sanitizeSettingsUpdate({ workStatusSectionOrder: ['mcp', 'session', 'mcp', null, ''] });
+    expect(changes.workStatusSectionOrder).toEqual(['mcp', 'session']);
+    const saved = helpers.mergePersistedSettings({}, changes);
+    const reloaded = helpers.formatSettingsResponse(JSON.parse(JSON.stringify(saved)));
+    expect(reloaded.workStatusSectionOrder).toEqual(['mcp', 'session']);
+    const next = helpers.mergePersistedSettings(reloaded, helpers.sanitizeSettingsUpdate({ workStatusPanelEnabled: false }));
+    expect(helpers.formatSettingsResponse(next).workStatusSectionOrder).toEqual(['mcp', 'session']);
+    expect(helpers.sanitizeSettingsUpdate({ workStatusSectionOrder: 'bad' }).workStatusSectionOrder).toBeUndefined();
+    expect(helpers.sanitizeSettingsUpdate({ workStatusSectionOrder: [] }).workStatusSectionOrder).toEqual([]);
+  });
   it('round-trips telemetry opt-in with the hidden list and preserves it across unrelated writes', () => {
     const helpers = createTestHelpers();
     const legacy = helpers.sanitizeSettingsUpdate({ workStatusHiddenSections: [] });
@@ -762,7 +774,7 @@ describe('settings registry gate', () => {
     managedRemoteTunnelHostname: 'x.example', managedRemoteTunnelToken: 'token', managedRemoteTunnelPresets: [{ id: 'a', name: 'A', hostname: 'a.example' }],
     managedRemoteTunnelSelectedPresetId: 'a', managedRemoteTunnelPresetTokens: { a: 'token' },
     sidebarProjectDisplayMode: 'all', sidebarSessionGroupingMode: 'flat', sidebarProjectSortOrder: 'manual', sidebarShowRecentSection: true,
-    workStatusPanelEnabled: true, workStatusHiddenSections: ['mcp'], workStatusHiddenSectionsExplicit: true,
+    workStatusPanelEnabled: true, workStatusHiddenSections: ['mcp'], workStatusHiddenSectionsExplicit: true, workStatusSectionOrder: ['mcp', 'session'],
     showReasoningTraces: true, streamingAutoFollowEnabled: true, collapsibleThinkingBlocks: true, showTextJustificationActivity: true,
     chatRenderMode: 'live', activityRenderMode: 'summary', mermaidRenderingMode: 'svg', userMessageRenderingMode: 'markdown', collapsibleUserMessages: true,
     stickyUserHeader: true, promptNavigatorEnabled: true, wideChatLayoutEnabled: true, showSplitAssistantMessageActions: true, showToolFileIcons: true,

package/server/lib/opencode/settings-registry.json CHANGED Viewed

@@ -217,6 +217,9 @@
     "sidebarShowRecentSection": {
       "scope": "profile"
     },
+    "workStatusSectionOrder": {
+      "scope": "profile"
+    },
     "workStatusPanelEnabled": {
       "scope": "profile"
     },