@alfe.ai/gateway 0.8.1 → 0.8.3

package/dist/health.js

@@ -23814,7 +23814,10 @@ async function startDaemon() {
 		await mcpManager.loadIntoBundler(mcpBundler);
 		const warmBundler = (reason) => {
 			if (!mcpBundler) return;
-			mcpBundler.warmup().catch((err) => {
+			const target = mcpBundler;
+			target.warmup().then(() => {
+				warnFailedMcpServers(target, logger$1, reason);
+			}).catch((err) => {
 				logger$1.warn({
 					err: err instanceof Error ? err.message : String(err),
 					reason
@@ -24442,6 +24445,28 @@ function handleMcpListTools(bundler) {
 	};
 }
 /**
+* Observability backstop for the INTEGRATION warm path. `applyForIntegration`
+* registers MCP servers into the store and the daemon warms them silently via
+* the store-change `onChange` hook — so a server that fails its connect (e.g.
+* an MCP server whose backing account/credential wasn't resolvable at warm
+* time, like ctrader-mcp `exit(1)`-ing on empty accounts) leaves NO trace,
+* making the black hole undiagnosable. After a warm, read `bundler.statuses()`
+* and warn once per still-failed server so the failure is visible. These
+* self-heal on the bundler's background retry sweep once the dependency
+* appears. Returns the servers it warned about (for tests / callers).
+*/
+function warnFailedMcpServers(bundler, log, reason) {
+	if (!bundler) return [];
+	const failed = bundler.statuses().filter((s) => !s.connected && s.lastError !== void 0);
+	for (const status of failed) log.warn({
+		server: status.name,
+		reason,
+		consecutiveFailures: status.consecutiveFailures,
+		lastError: status.lastError
+	}, `MCP server "${status.name}" failed to connect: ${status.lastError ?? ""}`);
+	return failed;
+}
+/**
 * Route a tool call to the appropriate MCP child via the daemon-hosted
 * bundler. `name` is the prefixed (`mcp__<server>__<tool>`) name; args is
 * the raw JSON object the LLM produced.

package/dist/src/index.d.ts

@@ -1,5 +1,9 @@
 import pino from "pino";
 
+//#region src/logger.d.ts
+
+declare const logger: pino.Logger<never, boolean>;
+//#endregion
 //#region src/protocol.d.ts
 
 interface IPCRequest {
@@ -335,9 +339,6 @@ declare function queryDaemonHealth(socketPath: string, timeoutMs?: number): Prom
  */
 declare function formatHealthReport(health: DaemonHealth): string;
 //#endregion
-//#region src/logger.d.ts
-declare const logger: pino.Logger<never, boolean>;
-//#endregion
 //#region src/process-manager.d.ts
 /**
  * Install the service unit for the current platform.

package/dist/upgrade.js

@@ -30,7 +30,7 @@ import { existsSync } from "node:fs";
 * This module holds only pure decision logic + a thin exec wrapper so the
 * decision can be unit-tested without a real install on disk.
 */
-const execFileAsync$1 = promisify(execFile);
+const execFileAsync$2 = promisify(execFile);
 /**
 * Pure verification decision. Given a probe of the install on disk, decide
 * whether it is intact. When `expectedVersion` is provided, the reported
@@ -96,7 +96,7 @@ async function resolveCliEntryPath(fromUrl) {
 */
 async function tryVersion(cmd, args) {
 	try {
-		const { stdout } = await execFileAsync$1(cmd, args, { timeout: 15e3 });
+		const { stdout } = await execFileAsync$2(cmd, args, { timeout: 15e3 });
 		const out = stdout.trim();
 		return out.length > 0 ? out : null;
 	} catch {
@@ -127,6 +127,121 @@ async function verifyCliInstall(expectedVersion, entryPath) {
 	}, expectedVersion);
 }
 //#endregion
+//#region src/orphan-cleanup.ts
+/**
+* Orphan npm-reify temp-dir cleanup — makes CLI self-upgrade ENOTEMPTY-safe.
+*
+* When npm installs a global package it uses `reify`, which RENAMES the existing
+* package dir to a `.`-prefixed temp sibling before swapping in the new tree:
+*
+*   /usr/lib/node_modules/@alfe.ai/cli  →  /usr/lib/node_modules/@alfe.ai/.cli-<hash>
+*
+* If that install is KILLED mid-reify — exactly what happens when the daemon
+* self-updates by running `npm install -g @alfe.ai/cli@<v>` out of its OWN live
+* dir and systemd SIGKILLs it — the `.cli-<hash>` temp is left ORPHANED. The next
+* install then fails with:
+*
+*   ENOTEMPTY: rename '.../@alfe.ai/cli' → '.../@alfe.ai/.cli-<hash>'
+*
+* because npm's rename TARGET already exists. This bricked GoldRush's upgrade
+* (see `.claude/agent-memory/agent-runtime-engineer/incident_2026_07_13_...`).
+*
+* Fix: sweep stale `.`-prefixed reify temps for our package BEFORE running the
+* install. Guarded to only ever remove `.`-prefixed temp SIBLINGS of the real
+* package (`.cli-*`), never the real `cli` dir and never unrelated packages.
+*
+* This module keeps the SELECTION logic pure (`findOrphanReifyTempDirs`) so it is
+* unit-testable without touching the filesystem; the side-effecting sweep is a
+* thin wrapper.
+*/
+const execFileAsync$1 = promisify(execFile);
+/** The npm scope dir the CLI + gateway live under (`@alfe.ai`). */
+const CLI_SCOPE = "@alfe.ai";
+/**
+* Pure: given the directory entries SIBLING to the real package dir, return the
+* `.`-prefixed reify temps that belong to `<packageBasename>` — i.e. entries
+* matching `.<packageBasename>-*`. Excludes the real dir (`<packageBasename>`),
+* the bare `.<packageBasename>` (no `-<hash>` suffix — never a reify temp), and
+* any temp for a different package.
+*/
+function findOrphanReifyTempDirs(siblings, packageBasename) {
+	const prefix = `.${packageBasename}-`;
+	return siblings.filter((name) => name.startsWith(prefix));
+}
+/**
+* Resolve the npm global scope dir (`<globalNodeModules>/@alfe.ai`) that holds
+* the CLI package and, potentially, its orphaned reify temps.
+*
+* Detection order (robust — never hardcode `/usr/lib`):
+*   1. `npm root -g` → the global `node_modules` root. Authoritative on the box.
+*   2. Derive from the resolved CLI entry path (`.../node_modules/@alfe.ai/cli/
+*      dist/index.js`) by walking up to the `node_modules` segment.
+*
+* Returns undefined when neither resolves (dev checkout / non-global run); the
+* caller then skips the sweep (there is no global install to clean).
+*/
+async function resolveGlobalScopeDir(cliEntryPath) {
+	const { join, sep } = await import("node:path");
+	try {
+		const { stdout } = await execFileAsync$1("npm", ["root", "-g"], { timeout: 15e3 });
+		const root = stdout.trim();
+		if (root.length > 0) return join(root, CLI_SCOPE);
+	} catch {}
+	if (cliEntryPath) {
+		const marker = `${sep}node_modules${sep}`;
+		const idx = cliEntryPath.lastIndexOf(marker);
+		if (idx !== -1) return join(cliEntryPath.slice(0, idx + marker.length - 1), CLI_SCOPE);
+	}
+}
+/**
+* Sweep orphaned `.cli-*` reify temp dirs from the CLI's global scope dir before
+* a self-upgrade. Best-effort and non-throwing: a cleanup failure must never
+* block the upgrade (worst case, the install ENOTEMPTYs and we're no worse off
+* than before this defense existed).
+*
+* @param scopeDir  the `<globalNodeModules>/@alfe.ai` dir (from
+*                  {@link resolveGlobalScopeDir}). When undefined, no-op.
+*/
+async function sweepOrphanReifyTempDirs(scopeDir) {
+	if (!scopeDir) {
+		logger.debug("Orphan sweep skipped — could not resolve global scope dir");
+		return;
+	}
+	try {
+		const { readdir, rm } = await import("node:fs/promises");
+		const { join } = await import("node:path");
+		let siblings;
+		try {
+			siblings = await readdir(scopeDir);
+		} catch {
+			return;
+		}
+		const orphans = findOrphanReifyTempDirs(siblings, "cli");
+		if (orphans.length === 0) return;
+		logger.warn({
+			scopeDir,
+			orphans
+		}, "Removing orphaned npm reify temp dirs before upgrade (ENOTEMPTY guard)");
+		for (const orphan of orphans) {
+			const target = join(scopeDir, orphan);
+			try {
+				await rm(target, {
+					recursive: true,
+					force: true
+				});
+				logger.info({ target }, "Removed orphaned reify temp dir");
+			} catch (err) {
+				logger.warn({
+					err: err instanceof Error ? err.message : String(err),
+					target
+				}, "Failed to remove orphaned reify temp dir (non-fatal)");
+			}
+		}
+	} catch (err) {
+		logger.warn({ err: err instanceof Error ? err.message : String(err) }, "Orphan reify temp-dir sweep failed (non-fatal)");
+	}
+}
+//#endregion
 //#region src/upgrade.ts
 /**
 * CLI upgrade — runs npm install inline then exits.
@@ -160,6 +275,11 @@ const execFileAsync = promisify(execFile);
 */
 async function upgradeAndExit(version) {
 	logger.info({ version }, "Upgrading CLI...");
+	try {
+		await sweepOrphanReifyTempDirs(await resolveGlobalScopeDir(await resolveCliEntryPath(import.meta.url)));
+	} catch (err) {
+		logger.warn({ err: err instanceof Error ? err.message : String(err) }, "Orphan reify-temp sweep threw unexpectedly — proceeding with upgrade anyway");
+	}
 	try {
 		const { stdout, stderr } = await execFileAsync("npm", [
 			"install",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/gateway",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "description": "Alfe local gateway daemon — persistent control plane for agent integrations",
   "type": "module",
   "bin": {
@@ -27,8 +27,8 @@
     "@alfe.ai/ai-proxy-local": "^0.0.13",
     "@alfe.ai/config": "^0.3.0",
     "@alfe.ai/integration-manifest": "^0.3.2",
-    "@alfe.ai/integrations": "^0.5.1",
-    "@alfe.ai/mcp-bundler": "^0.3.1"
+    "@alfe.ai/integrations": "^0.5.2",
+    "@alfe.ai/mcp-bundler": "^0.3.2"
   },
   "license": "UNLICENSED",
   "homepage": "https://alfe.ai",