@atolis-hq/wake 0.3.92 → 0.3.94

package/dist/src/bootstrap/initialise.js

@@ -366,7 +366,13 @@ ENV WAKE_MAIN_JS=/app/dist/src/main.js
 # for \`docker exec\` (i.e. \`wake sandbox setup\`/\`wake sandbox exec\`) even
 # when WAKE_START_ENABLED's supervised \`wake start\` child keeps crashing —
 # e.g. on first boot, before sandbox auth has been configured.
-ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake; chown -R wake:wake /wake/.wake; if [ -n \\"$WAKE_HOME_INIT_DIRS\\" ]; then printf '%s\\n' \\"$WAKE_HOME_INIT_DIRS\\" | while IFS= read -r directory; do case \\"$directory\\" in \\"$WAKE_HOME_INIT_ROOT\\"/*) mkdir -p \\"$directory\\"; chown wake:wake \\"$directory\\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec node \\"$WAKE_MAIN_JS\\" sandbox-entrypoint --wake-root /wake'"]
+#
+# /wake/.wake is bind-mounted from the host and self-update actively creates
+# and deletes its own lock files there while this container is starting, so
+# a recursive chown can race a file disappearing mid-walk. That single ENOENT
+# must not be fatal under set -eu — it would otherwise crash the container
+# before wake start ever runs.
+ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake; chown -R wake:wake /wake/.wake || true; if [ -n \\"$WAKE_HOME_INIT_DIRS\\" ]; then printf '%s\\n' \\"$WAKE_HOME_INIT_DIRS\\" | while IFS= read -r directory; do case \\"$directory\\" in \\"$WAKE_HOME_INIT_ROOT\\"/*) mkdir -p \\"$directory\\"; chown wake:wake \\"$directory\\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec node \\"$WAKE_MAIN_JS\\" sandbox-entrypoint --wake-root /wake'"]
 `;
 const packagedDockerfile = `# syntax=docker/dockerfile:1
 FROM node:24-bookworm-slim
@@ -418,7 +424,13 @@ EXPOSE 4317
 # sandbox-entrypoint-command.ts) that the CLI should be invoked via the bare
 # \`wake\` binary that \`npm install -g\` puts on PATH, rather than a hardcoded
 # npm global lib path that varies by npm/OS setup.
-ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake; chown -R wake:wake /wake/.wake; if [ -n \\"$WAKE_HOME_INIT_DIRS\\" ]; then printf '%s\\n' \\"$WAKE_HOME_INIT_DIRS\\" | while IFS= read -r directory; do case \\"$directory\\" in \\"$WAKE_HOME_INIT_ROOT\\"/*) mkdir -p \\"$directory\\"; chown wake:wake \\"$directory\\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec wake sandbox-entrypoint'"]
+#
+# /wake/.wake is bind-mounted from the host and self-update actively creates
+# and deletes its own lock files there while this container is starting, so
+# a recursive chown can race a file disappearing mid-walk. That single ENOENT
+# must not be fatal under set -eu — it would otherwise crash the container
+# before wake start ever runs.
+ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake; chown -R wake:wake /wake/.wake || true; if [ -n \\"$WAKE_HOME_INIT_DIRS\\" ]; then printf '%s\\n' \\"$WAKE_HOME_INIT_DIRS\\" | while IFS= read -r directory; do case \\"$directory\\" in \\"$WAKE_HOME_INIT_ROOT\\"/*) mkdir -p \\"$directory\\"; chown wake:wake \\"$directory\\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec wake sandbox-entrypoint'"]
 `;
 /** Creates an immediately-valid, human-readable target Wake root. */
 export async function initialiseWakeRoot(wakeRoot) {

package/dist/src/bootstrap/source-update-port.js

@@ -1,4 +1,6 @@
 import { execFile as nodeExecFile } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
 import { promisify } from 'node:util';
 const execFile = promisify(nodeExecFile);
 export function createSourceUpdatePort(input) {
@@ -18,14 +20,17 @@ export function createSourceUpdatePort(input) {
         },
         async checkout(tag) {
             await execute('git', ['checkout', tag], input.repoRoot);
+            // Dependencies are part of what a tag means; without refreshing them,
+            // node_modules can silently drift from the checked-out
+            // package-lock.json and the health check below only ever proves the
+            // previously-installed dependencies still compile, not this tag's own.
+            await execute('npm', npmInstallArgs(input.repoRoot), input.repoRoot);
         },
         async healthy() {
             try {
                 // Verify the checked-out code can be built (TypeScript compiles).
                 // This is the minimal meaningful health check: the code must at least compile.
-                const buildCommand = 'npm';
-                const buildArgs = ['exec', 'tsc', '--'];
-                await execute(buildCommand, [...buildArgs], input.repoRoot);
+                await execute('npm', ['exec', 'tsc', '--'], input.repoRoot);
                 return true;
             }
             catch {
@@ -34,6 +39,9 @@ export function createSourceUpdatePort(input) {
         },
     };
 }
+function npmInstallArgs(repoRoot) {
+    return existsSync(join(repoRoot, 'package-lock.json')) ? ['ci', '--include=dev'] : ['install'];
+}
 async function candidateTags(execute, repoRoot) {
     await execute('git', ['fetch', '--tags'], repoRoot);
     const output = await execute('git', ['tag', '--list', 'v*', '--sort=-v:refname'], repoRoot);
@@ -43,6 +51,23 @@ async function candidateTags(execute, repoRoot) {
         .filter((line) => line.length > 0);
 }
 async function runProcess(command, args, cwd) {
+    // On Windows, npm resolves to an `npm.cmd` shim: execFile can't spawn it
+    // directly (ENOENT, since it isn't a real executable) and refuses to spawn
+    // it with a separate argument array either (EINVAL, Node's own hardening
+    // after CVE-2024-27980). Routing the whole command through a shell as one
+    // string is the platform-sanctioned way to invoke it without the argument
+    // array's deprecated, unescaped shell concatenation (DEP0190). Every
+    // argument passed to npm here is a fixed literal, never external input, so
+    // that lack of escaping is not a code-injection concern. git is a real
+    // executable and needs none of this.
+    if (process.platform === 'win32' && command === 'npm') {
+        const result = await execFile([command, ...args].join(' '), [], {
+            cwd,
+            encoding: 'utf8',
+            shell: true,
+        });
+        return result.stdout;
+    }
     const result = await execFile(command, args, { cwd, encoding: 'utf8' });
     return result.stdout;
 }

package/dist/src/bootstrap/surface-cli-applications.js

@@ -295,7 +295,12 @@ async function deploySandboxTag(root, docker, tag, image) {
     await port.update();
     const wakeInvocation = sandboxWakeInvocation(root);
     await verifyResidentStart(docker, root.config.host.sandbox.containerName, [...wakeInvocation, 'start', '--wake-root', '/wake'].join(' '));
-    await port.exec(['tick', '--wake-root', `/tmp/wake-self-update-healthcheck-${tag}`]);
+    await port.exec([
+        ...wakeInvocation,
+        'tick',
+        '--wake-root',
+        `/tmp/wake-self-update-healthcheck-${tag}`,
+    ]);
 }
 async function rollbackSandboxTag(root, docker, image) {
     const port = createSandboxDockerPort(docker, sandboxDockerOptions(root, { image }));

package/dist/src/bootstrap/version.js

@@ -108,4 +108,4 @@ export function resolveWakeVersion(options = {}) {
         return `g${headHash.slice(0, 7)}`;
     return '0.1.0-dev';
 }
-export const wakeVersion = "ga760b3e";
+export const wakeVersion = "gf1098b5";

package/dist/src/surfaces/cli/infrastructure/resident-start.js

@@ -1,7 +1,12 @@
 import { DockerProcessError, } from './docker-invocation.js';
 /** Verifies the replacement sandbox has started its resident Wake process. */
 export async function verifyResidentStart(docker, containerName, expectedCmdlineFragment, options) {
-    const attempts = options?.attempts ?? 15;
+    // A mature Wake home's bind-mounted .wake can hold weeks of accumulated
+    // event, projection, and transcript files; the entrypoint's recursive
+    // chown over all of it — especially through Docker Desktop's virtualized
+    // filesystem on Windows — can alone take longer than a short, test-sized
+    // budget before the resident process ever gets to write its PID file.
+    const attempts = options?.attempts ?? 90;
     const intervalMs = options?.intervalMs ?? 1000;
     const check = [
         'pid="$(cat /wake/.wake/logs/start.pid)"',

package/docker/Dockerfile

@@ -64,4 +64,9 @@ EXPOSE 4317
 # that's fine since it's the very first thing that runs.
 ENV WAKE_MAIN_JS=/app/dist/src/main.js
 
-ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake; chown -R wake:wake /wake/.wake; exec su wake -s /bin/sh -c 'if [ \"$WAKE_START_ENABLED\" = \"true\" ]; then exec node /app/dist/src/main.js start --wake-root /wake --no-sandbox; else exec sleep infinity; fi'"]
+# /wake/.wake is bind-mounted from the host and self-update actively creates
+# and deletes its own lock files there while this container is starting, so
+# a recursive chown can race a file disappearing mid-walk. That single ENOENT
+# must not be fatal under set -eu — it would otherwise crash the container
+# before wake start ever runs.
+ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake; chown -R wake:wake /wake/.wake || true; exec su wake -s /bin/sh -c 'if [ \"$WAKE_START_ENABLED\" = \"true\" ]; then exec node /app/dist/src/main.js start --wake-root /wake --no-sandbox; else exec sleep infinity; fi'"]

package/docker/Dockerfile.packaged

@@ -50,4 +50,10 @@ EXPOSE 4317
 # sandbox-entrypoint-command.ts) that the CLI should be invoked via the bare
 # `wake` binary that `npm install -g` puts on PATH, rather than a hardcoded
 # npm global lib path that varies by npm/OS setup.
-ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake; chown -R wake:wake /wake/.wake; exec su wake -s /bin/sh -c 'exec wake sandbox-entrypoint'"]
+#
+# /wake/.wake is bind-mounted from the host and self-update actively creates
+# and deletes its own lock files there while this container is starting, so
+# a recursive chown can race a file disappearing mid-walk. That single ENOENT
+# must not be fatal under set -eu — it would otherwise crash the container
+# before wake start ever runs.
+ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake; chown -R wake:wake /wake/.wake || true; exec su wake -s /bin/sh -c 'exec wake sandbox-entrypoint'"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atolis-hq/wake",
-  "version": "0.3.92",
+  "version": "0.3.94",
   "description": "Local autonomous agent control plane for software development",
   "license": "Apache-2.0",
   "repository": {