@inetafrica/open-claudia 2.2.8 → 2.2.9

package/CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## v2.2.9
+- Startup self-heal for grandfathered AgentSpace pods: if `.password-changed` exists on the PVC but AgentSpace was never notified (because the pod changed its password before `AGENTSPACE_API_URL` was injected, or before the `/pods/self/password-changed` callback shipped), the web server fires the callback once on startup and writes a `.password-changed-notified` sentinel so subsequent restarts don't retry. `notifyAgentSpacePasswordChanged` now returns a status so `setPassword` can also drop the sentinel after a successful live notification. Pre-v2.2.x grandfathered pods that never wrote the marker file still need manual `webPasswordUserSet=true` in Mongo.
+
 ## v2.2.8
 - `/upgrade` now works on docker containers that run our baked-in `/app` source (the common self-host layout). Previously the handler fell through to `npm install -g`, which hit `EACCES` because the runtime user is uid 1001 and couldn't write the global node_modules — and even when it could, the bot reads from `/app`, not the global root, so the new version was never picked up. The new branch detects the `/app` layout, `npm pack`s the latest tarball, overlays it onto `/app`, runs `npm install --omit=dev`, and exits so the orchestrator restarts the container on the new source. AgentSpace pods (which have `AGENTSPACE_POD_TOKEN` + `AGENTSPACE_API_URL`) still go through the control plane; nothing else changes for them or for npm-global installs.
 - Dockerfile: `chown -R claudia:claudia /app` after the build steps so the runtime user can overlay new source during the in-place `/upgrade` above. Previously `/app` and its `node_modules` were root-owned because the COPY and `npm ci` ran as root before `USER 1001`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "2.2.8",
+  "version": "2.2.9",
   "description": "Your always-on AI coding assistant — Claude Code, Cursor Agent, and OpenAI Codex via Telegram or Kazee Chat",
   "main": "bot.js",
   "bin": {

package/web.js

@@ -31,6 +31,10 @@ function getPassword() {
 }
 
 const PASSWORD_CHANGED_FILE = path.join(CONFIG_DIR, ".password-changed");
+// Sentinel: written once AgentSpace has been notified about the user-set
+// password. Used to keep the startup self-heal idempotent for grandfathered
+// pods that changed their password before AGENTSPACE_API_URL was injected.
+const PASSWORD_CHANGED_NOTIFIED_FILE = path.join(CONFIG_DIR, ".password-changed-notified");
 
 function isPasswordChanged() {
   return fs.existsSync(PASSWORD_CHANGED_FILE);
@@ -48,30 +52,56 @@ function validatePasswordComplexity(pw) {
 function setPassword(newPassword) {
   fs.writeFileSync(WEB_PASSWORD_FILE, newPassword);
   fs.writeFileSync(PASSWORD_CHANGED_FILE, new Date().toISOString());
-  notifyAgentSpacePasswordChanged();
+  notifyAgentSpacePasswordChanged().then((r) => {
+    if (r && r.ok) {
+      try { fs.writeFileSync(PASSWORD_CHANGED_NOTIFIED_FILE, new Date().toISOString()); } catch (e) {}
+    }
+  }).catch(() => {});
 }
 
 function notifyAgentSpacePasswordChanged() {
-  const apiUrl = process.env.AGENTSPACE_API_URL;
-  const token = process.env.AGENTSPACE_POD_TOKEN;
-  if (!apiUrl || !token) return;
-  let u;
-  try { u = new URL("/pods/self/password-changed", apiUrl); } catch (e) { return; }
-  const lib = u.protocol === "https:" ? require("https") : require("http");
-  const req = lib.request({
-    method: "POST",
-    hostname: u.hostname,
-    port: u.port || (u.protocol === "https:" ? 443 : 80),
-    path: u.pathname + u.search,
-    headers: {
-      "Authorization": `Bearer ${token}`,
-      "Content-Type": "application/json",
-      "Content-Length": "0",
-    },
+  return new Promise((resolve) => {
+    const apiUrl = process.env.AGENTSPACE_API_URL;
+    const token = process.env.AGENTSPACE_POD_TOKEN;
+    if (!apiUrl || !token) return resolve({ ok: false, reason: "missing-env" });
+    let u;
+    try { u = new URL("/pods/self/password-changed", apiUrl); } catch (e) { return resolve({ ok: false, reason: "bad-url" }); }
+    const lib = u.protocol === "https:" ? require("https") : require("http");
+    const req = lib.request({
+      method: "POST",
+      hostname: u.hostname,
+      port: u.port || (u.protocol === "https:" ? 443 : 80),
+      path: u.pathname + u.search,
+      headers: {
+        "Authorization": `Bearer ${token}`,
+        "Content-Type": "application/json",
+        "Content-Length": "0",
+      },
+    }, (res) => {
+      res.on("data", () => {});
+      res.on("end", () => resolve({ ok: res.statusCode >= 200 && res.statusCode < 300, status: res.statusCode }));
+    });
+    req.on("error", (e) => resolve({ ok: false, reason: String(e.message || e) }));
+    req.setTimeout(5000, () => { try { req.destroy(); } catch (e) {} resolve({ ok: false, reason: "timeout" }); });
+    req.end();
   });
-  req.on("error", () => {});
-  req.setTimeout(5000, () => { try { req.destroy(); } catch (e) {} });
-  req.end();
+}
+
+// Startup self-heal for grandfathered pods. If the pod changed its web
+// password before AGENTSPACE_API_URL was injected (or before the callback
+// existed), the marker file is on disk but AgentSpace still thinks the
+// initial password is valid. Fire the callback once on startup; on success
+// write a sentinel so we don't repeat it on every restart.
+function reconcileGrandfatheredPasswordChange() {
+  if (!isPasswordChanged()) return;
+  if (fs.existsSync(PASSWORD_CHANGED_NOTIFIED_FILE)) return;
+  if (!process.env.AGENTSPACE_API_URL || !process.env.AGENTSPACE_POD_TOKEN) return;
+  notifyAgentSpacePasswordChanged().then((r) => {
+    if (r && r.ok) {
+      try { fs.writeFileSync(PASSWORD_CHANGED_NOTIFIED_FILE, new Date().toISOString()); } catch (e) {}
+      console.log("[web] Notified AgentSpace of pre-existing user-set password.");
+    }
+  }).catch(() => {});
 }
 
 function checkBearerAuth(req) {
@@ -741,6 +771,7 @@ function startWebServer() {
   server.listen(PORT, () => {
     console.log(`Web UI running on http://localhost:${PORT}`);
     console.log("Admin password configured.");
+    reconcileGrandfatheredPasswordChange();
   });
 
   return server;