@hivemagnus/magnus-agent 1.1.0 → 1.1.2

package/dist/executors/cron-manager.js

@@ -11,6 +11,7 @@ import { hash } from './execution-supervisor-state.js';
 import { HOST_FQDN, NODE_MANAGER_SECRET, RESULT_SIGNING_SECRET } from '../env.js';
 import { readdir, readFile } from 'node:fs/promises';
 import { createHash, createHmac, timingSafeEqual } from 'node:crypto';
+import { stableCodePath } from '../upgrade/stable-path.js';
 export const cronRoutes = new Hono();
 const scheduler = new ManagedScheduler();
 const execFileAsync = promisify(execFile);
@@ -53,7 +54,7 @@ export function removeCronEntry(raw, name) {
     }
     return result.join('\n');
 }
-export function managedCronLine(job, nodePath = process.execPath, runnerPath = fileURLToPath(new URL('./scheduler-runner.js', import.meta.url))) {
+export function managedCronLine(job, nodePath = process.execPath, runnerPath = stableCodePath(fileURLToPath(new URL('./scheduler-runner.js', import.meta.url)))) {
     for (const path of [nodePath, runnerPath])
         if (!path.startsWith('/') || /[\x00-\x1f\x7f%]/.test(path))
             throw new Error('Unsafe fixed cron runner path');

package/dist/executors/hermes-manager.d.ts

@@ -85,8 +85,8 @@ declare const configurationSchema: z.ZodObject<{
         token: z.ZodOptional<z.ZodString>;
         workspaceId: z.ZodDefault<z.ZodString>;
         defaultScope: z.ZodDefault<z.ZodEnum<{
-            private: "private";
             shared: "shared";
+            private: "private";
         }>>;
         recallMode: z.ZodDefault<z.ZodEnum<{
             context: "context";

package/dist/hermes-sync.js

@@ -2,14 +2,22 @@
 import { config } from 'dotenv';
 import { createHash, randomUUID } from 'node:crypto';
 import { spawn } from 'node:child_process';
-import { constants, createReadStream } from 'node:fs';
+import { constants, createReadStream, realpathSync } from 'node:fs';
 import { access, chown, chmod, lstat, mkdir, mkdtemp, readFile, readlink, readdir, rename, rm, stat, symlink, writeFile } from 'node:fs/promises';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { childEnvironment } from './utils/child-env.js';
 import { armChildTimeout } from './utils/child-timeout.js';
-const invokedAsService = Boolean(process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url));
+// Compare real paths: the service may start this file through a link (node_modules -> current/node_modules).
+const invokedAsService = (() => {
+    try {
+        return Boolean(process.argv[1] && realpathSync(resolve(process.argv[1])) === realpathSync(fileURLToPath(import.meta.url)));
+    }
+    catch {
+        return false;
+    }
+})();
 if (invokedAsService)
     config({ path: join(process.env['AGENT_INSTALL_DIR'] ?? '/opt/magnus-agent', '.env'), quiet: true });
 const api = new URL('/api/v1/hermes-registry/', process.env['CONTROL_API_URL'] ?? 'https://localhost:4000');

package/dist/upgrade/install-service.js

@@ -12,7 +12,7 @@
  * root for it and never calls sudo.
  */
 import { execFileSync } from 'node:child_process';
-import { copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from 'node:fs';
+import { copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, symlinkSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { AGENT_PACKAGE, pointCurrentAt } from './self-upgrade.js';
@@ -188,6 +188,10 @@ export async function installService(argv) {
         }
         act(`point ${current} at versions/${version}`, () => pointCurrentAt(dir, version));
     }
+    // Paths written before the versioned layout (cron lines, other units) keep working.
+    if (!existsSync(join(dir, 'node_modules')) && !isSymlink(join(dir, 'node_modules'))) {
+        act(`link ${join(dir, 'node_modules')} to current/node_modules`, () => symlinkSync(join('current', 'node_modules'), join(dir, 'node_modules'), 'dir'));
+    }
     // The launcher is copied from the release that runs install-service, not linked:
     // self-upgrades never replace it.
     act(`install ${join(dir, 'launcher', 'launcher.mjs')}`, () => {
@@ -205,6 +209,8 @@ export async function installService(argv) {
             execFileSync('chown', [`${user}:${user}`, dir]);
             execFileSync('chown', ['-R', `${user}:${user}`, join(dir, 'versions'), join(dir, '.npm')]);
             execFileSync('chown', ['-h', `${user}:${user}`, current]);
+            if (isSymlink(join(dir, 'node_modules')))
+                execFileSync('chown', ['-h', `${user}:${user}`, join(dir, 'node_modules')]);
         });
     }
     act(`write ${options.unitPath}${existsSync(options.unitPath) ? ` (previous unit kept as ${options.unitPath}.pre-launcher)` : ''}`, () => {

package/dist/upgrade/self-upgrade.d.ts

@@ -14,6 +14,12 @@ export interface UpgradeState {
 }
 export declare function installDir(env?: NodeJS.ProcessEnv): string;
 export declare function readUpgradeState(dir: string): UpgradeState | null;
+/**
+ * An agent running as root inside a directory another account owns (a deploy
+ * user that installs releases there) gives what it writes to that owner, so
+ * the owner can still replace or remove it. Otherwise this does nothing.
+ */
+export declare function adoptInstallOwner(dir: string, path: string, uid?: number | undefined): void;
 export declare function writeUpgradeState(dir: string, state: UpgradeState): void;
 export declare function pointCurrentAt(dir: string, version: string): void;
 export type Layout = AgentSelfUpgradeStatus['layout'];

package/dist/upgrade/self-upgrade.js

@@ -9,7 +9,7 @@
  */
 import { createHash } from 'node:crypto';
 import { spawn } from 'node:child_process';
-import { accessSync, constants, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { accessSync, constants, existsSync, lchownSync, lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { AGENT_SELF_UPGRADE_PROTOCOL, checkUpgradeAllowed, compareVersions, } from '@hivemagnus/magnus-contracts';
 export const STATE_FILE = 'upgrade-state.json';
@@ -25,16 +25,39 @@ export function readUpgradeState(dir) {
         return null;
     }
 }
+/**
+ * An agent running as root inside a directory another account owns (a deploy
+ * user that installs releases there) gives what it writes to that owner, so
+ * the owner can still replace or remove it. Otherwise this does nothing.
+ */
+export function adoptInstallOwner(dir, path, uid = process.getuid?.()) {
+    if (uid !== 0)
+        return;
+    const owner = statSync(dir);
+    if (owner.uid === 0)
+        return;
+    const walk = (entry) => {
+        const info = lstatSync(entry);
+        lchownSync(entry, owner.uid, owner.gid);
+        if (info.isDirectory())
+            for (const child of readdirSync(entry))
+                walk(join(entry, child));
+    };
+    if (lstatSync(path, { throwIfNoEntry: false }))
+        walk(path);
+}
 export function writeUpgradeState(dir, state) {
     const path = join(dir, STATE_FILE);
     const temporary = `${path}.${process.pid}.tmp`;
     writeFileSync(temporary, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 });
+    adoptInstallOwner(dir, temporary);
     renameSync(temporary, path);
 }
 export function pointCurrentAt(dir, version) {
     const temporary = join(dir, `current.${process.pid}.tmp`);
     rmSync(temporary, { force: true });
     symlinkSync(join('versions', version), temporary, 'dir');
+    adoptInstallOwner(dir, temporary);
     renameSync(temporary, join(dir, 'current'));
 }
 export function detectLayout(dir, env = process.env) {
@@ -228,6 +251,8 @@ export async function stageUpgrade(options) {
         }
         rmSync(target, { recursive: true, force: true });
         mkdirSync(join(dir, 'versions'), { recursive: true });
+        adoptInstallOwner(dir, join(dir, 'versions'));
+        adoptInstallOwner(dir, install);
         renameSync(install, target);
         const now = (options.now ?? new Date()).toISOString();
         writeUpgradeState(dir, { state: 'staged', from, to: request.version, requestId: request.requestId, attempt: 0, maxAttempts: 2, reason: null, updatedAt: now });
@@ -236,6 +261,8 @@ export async function stageUpgrade(options) {
     }
     finally {
         rmSync(work, { recursive: true, force: true });
+        adoptInstallOwner(dir, join(dir, 'staging'));
+        adoptInstallOwner(dir, join(dir, '.npm'));
         staging = false;
     }
 }

package/dist/upgrade/stable-path.d.ts

@@ -0,0 +1,2 @@
+export declare function stableCodePath(path: string, env?: NodeJS.ProcessEnv): string;
+//# sourceMappingURL=stable-path.d.ts.map

package/dist/upgrade/stable-path.js

@@ -0,0 +1,33 @@
+/**
+ * Paths to this agent's own code that outlive the process (cron lines, for
+ * example) must not name versions/<X>: a self-upgrade moves ./current and later
+ * prunes old versions. Under the launcher, such a path is rewritten through the
+ * install directory: `<dir>/node_modules/…` when that is the compatibility link
+ * to current/node_modules (so lines written before the versioned layout keep
+ * their exact text), otherwise `<dir>/current/…`.
+ */
+import { lstatSync, realpathSync } from 'node:fs';
+import { join, relative, resolve, sep } from 'node:path';
+export function stableCodePath(path, env = process.env) {
+    if (env['MAGNUS_AGENT_LAUNCHER'] !== '1' || !env['AGENT_INSTALL_DIR'])
+        return path;
+    const dir = resolve(env['AGENT_INSTALL_DIR']);
+    const inside = relative(join(dir, 'versions'), path);
+    if (inside.startsWith('..') || inside === '' || inside.startsWith(sep))
+        return path;
+    const [, ...rest] = inside.split(sep);
+    if (rest.length === 0)
+        return path;
+    try {
+        const link = join(dir, 'node_modules');
+        if (rest[0] === 'node_modules' && lstatSync(link).isSymbolicLink()
+            && realpathSync(link) === realpathSync(join(dir, 'current', 'node_modules'))) {
+            return join(dir, ...rest);
+        }
+    }
+    catch {
+        // no compatibility link
+    }
+    return join(dir, 'current', ...rest);
+}
+//# sourceMappingURL=stable-path.js.map

package/launcher/launcher.mjs

@@ -14,7 +14,7 @@
  * `magnus-agent install-service` replaces it. It never escalates privileges.
  */
 import { spawn } from 'node:child_process';
-import { existsSync, readFileSync, renameSync, rmSync, symlinkSync, writeFileSync, openSync, fsyncSync, closeSync } from 'node:fs';
+import { closeSync, existsSync, fsyncSync, lchownSync, openSync, readFileSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
@@ -61,12 +61,20 @@ export function readState(dir) {
   }
 }
 
+/** Running as root in a directory another account owns: hand what we write to that owner. */
+function adoptOwner(dir, path) {
+  if (process.getuid?.() !== 0) return;
+  const owner = statSync(dir);
+  if (owner.uid !== 0) lchownSync(path, owner.uid, owner.gid);
+}
+
 export function writeState(dir, state) {
   const path = join(dir, STATE_FILE);
   const temporary = `${path}.${process.pid}.tmp`;
   writeFileSync(temporary, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 });
   const fd = openSync(temporary, 'r');
   try { fsyncSync(fd); } finally { closeSync(fd); }
+  adoptOwner(dir, temporary);
   renameSync(temporary, path);
 }
 
@@ -74,6 +82,7 @@ export function pointCurrentAt(dir, version) {
   const temporary = join(dir, `current.${process.pid}.tmp`);
   rmSync(temporary, { force: true });
   symlinkSync(join('versions', version), temporary, 'dir');
+  adoptOwner(dir, temporary);
   renameSync(temporary, join(dir, 'current'));
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hivemagnus/magnus-agent",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "Magnus node agent: a small daemon that enrolls a Linux host with a magnus-server and runs authenticated health, command, cron, file and skill management, with optional Hermes Agent, Codex and Ardent management.",
   "keywords": [
     "magnus",
@@ -55,22 +55,22 @@
     "clean": "node -e \"const fs=require('node:fs');fs.rmSync('dist',{recursive:true,force:true});fs.rmSync('tsconfig.tsbuildinfo',{force:true})\""
   },
   "dependencies": {
-    "@hivemagnus/magnus-contracts": "1.1.0",
+    "@hivemagnus/magnus-contracts": "1.1.2",
     "@hono/node-server": "^2.1.5",
     "dotenv": "^18.0.9",
-    "hono": "^4.13.14",
+    "hono": "^4.13.16",
     "ky": "^2.2.0",
-    "nanoid": "^5.1.16",
+    "nanoid": "^6.0.2",
     "tar-stream": "3.2.2",
-    "undici": "^7.30.1",
+    "undici": "^8.12.3",
     "yaml": "^2.9.1",
     "zod": "^4.6.7"
   },
   "devDependencies": {
-    "@types/node": "^22.20.5",
+    "@types/node": "^24.19.2",
     "@types/tar-stream": "^3.1.5",
     "tsx": "^4.23.15",
-    "typescript": "^5.8.3",
-    "vitest": "^4.1.12"
+    "typescript": "^6.0.3",
+    "vitest": "^5.0.5"
   }
 }