@maudecode/talaria-web 1.14.0 → 1.16.1

package/dist/tools/updates.js

@@ -14,6 +14,7 @@ import { readCapped } from '../http/capped.js';
 import { execFile } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { delimiter, dirname, isAbsolute, join, resolve } from 'node:path';
 import { dict } from '../config/agent-config.js';
 import { validateReleaseInfo } from '../release.js';
@@ -178,8 +179,12 @@ export function githubJson(fetchImpl, env) {
         return JSON.parse(body.toString('utf8'));
     };
 }
-/** Python `published_web_release`: the newest completed `release-set-<sha>` whose Web component matches the channel's tag family. */
-export async function publishedWebRelease(channel, getJson, now = () => performance.now()) {
+const completeManifest = (m, tag) => m?.schemaVersion === 1 && m.status === 'complete' && m.releaseSet === tag.slice('release-set-'.length);
+/**
+ * Python `published_web_release`: the newest completed `release-set-<sha>` whose Web component matches the channel's tag family.
+ * `installed` (a bare `X.Y.Z`) also counts the completed releases an update skips, one manifest per older release set (TAL-624).
+ */
+export async function publishedWebRelease(channel, getJson, now = () => performance.now(), installed) {
     const tagPattern = new RegExp(`^${channel === 'experimental' ? 'web-exp-v' : 'web-v'}${VERSION}$`);
     const deadline = now() + 15_000;
     const fetchJson = (path, asset = false) => {
@@ -204,10 +209,11 @@ export async function publishedWebRelease(channel, getJson, now = () => performa
     if (exhausted)
         throw new ReleaseUnavailable('Release history exceeds automatic lookup; update manually');
     published.sort((a, b) => (str(a.published_at) < str(b.published_at) ? 1 : str(a.published_at) > str(b.published_at) ? -1 : 0));
-    for (const release of published) {
+    /** A release set's tag and manifest; null for other releases. */
+    const manifestOf = async (release) => {
         const tag = release.tag_name;
         if (typeof tag !== 'string' || !/^release-set-[a-f0-9]{40}$/.test(tag))
-            continue;
+            return null;
         if (!Array.isArray(release.assets))
             throw new ReleaseUnavailable('Published release set has invalid assets');
         const assets = release.assets.filter((a) => Boolean(a) && typeof a === 'object' && a.name === 'release-set.json');
@@ -215,8 +221,36 @@ export async function publishedWebRelease(channel, getJson, now = () => performa
         if (assets.length !== 1 || typeof id !== 'number' || !Number.isInteger(id) || id < 1)
             throw new ReleaseUnavailable('Published release set lacks its immutable manifest');
         const manifest = await fetchJson(`/releases/assets/${String(id)}`, true);
-        const m = manifest && typeof manifest === 'object' && !Array.isArray(manifest) ? manifest : null;
-        if (m?.schemaVersion !== 1 || m.status !== 'complete' || m.releaseSet !== tag.slice('release-set-'.length))
+        return { tag, m: manifest && typeof manifest === 'object' && !Array.isArray(manifest) ? manifest : null };
+    };
+    /** Distinct completed channel versions above `installed` in the older release sets, plus `latest`. A Web tag without a completed set never counts; an unreadable set ends the count. */
+    const releasesSince = async (older, latest) => {
+        if (installed === undefined || compareVersions(latest, installed) <= 0)
+            return 1;
+        const versions = new Set([latest]);
+        try {
+            for (const release of older) {
+                const set = await manifestOf(release);
+                if (!set || !completeManifest(set.m, set.tag))
+                    continue;
+                const webTag = dict(dict(set.m.components).web).tag;
+                if (typeof webTag !== 'string' || !tagPattern.test(webTag))
+                    continue;
+                const version = webTag.split('-v').pop() ?? '';
+                if (compareVersions(version, installed) <= 0)
+                    break;
+                versions.add(version);
+            }
+        }
+        catch { /* the newest release still counts */ }
+        return versions.size;
+    };
+    for (const [index, release] of published.entries()) {
+        const set = await manifestOf(release);
+        if (!set)
+            continue;
+        const { tag, m } = set;
+        if (!completeManifest(m, tag))
             throw new ReleaseUnavailable('Release set is incomplete or has inconsistent provenance');
         if (!m.components || typeof m.components !== 'object' || Array.isArray(m.components))
             throw new ReleaseUnavailable('Release set lacks component metadata');
@@ -256,6 +290,7 @@ export async function publishedWebRelease(channel, getJson, now = () => performa
             manifestReleaseSet: str(m.releaseSet),
             runtime: { tag: componentTag, version: component.version, sourceRevision: source, releaseSet: source, contracts: supported, compatibleAgent: agent },
             release_url: `${REPOSITORY_URL}/releases/tag/${tag}`,
+            releasesBehind: await releasesSince(published.slice(index + 1), str(component.version)),
         };
     }
     throw new ReleaseUnavailable('No completed Talaria Web release is available on this channel');
@@ -441,9 +476,11 @@ export async function checkWebUpdate(webRoot, currentVersion, channel, git, getJ
         return { ...result, manual_update: true, message: CONTRIBUTOR_CHECKOUT_MESSAGE };
     if (channel === 'experimental' && npmInstall && registry)
         return checkNpmExperimental(result, npmInstall, id, registry);
+    const packaged = new RegExp(`^${channel === 'experimental' ? 'web-exp-v' : 'web-v'}${VERSION}$`).exec(currentVersion)?.slice(1, 4).join('.');
+    const installed = npmInstall?.version ?? packaged;
     let release;
     try {
-        release = await publishedWebRelease(channel, getJson);
+        release = await publishedWebRelease(channel, getJson, undefined, installed && new RegExp(`^${VERSION}$`).test(installed) ? installed : undefined);
     }
     catch (error) {
         if (error instanceof ReleaseUnavailable)
@@ -461,7 +498,7 @@ export async function checkWebUpdate(webRoot, currentVersion, channel, git, getJ
             if (comparison > 0)
                 return { ...result, current_sha: id.release().sourceRevision ?? null, behind: 0, no_git: true, install_kind: 'npm', manual_update: true, message: 'This npm installation is ahead of the selected Stable release.' };
             if (comparison < 0)
-                return { ...result, current_sha: id.release().sourceRevision ?? null, behind: 1, no_git: true, install_kind: 'npm', npm: release.npm, manual_update: false, message: `Stable npm update ${release.version} is available.` };
+                return { ...result, current_sha: id.release().sourceRevision ?? null, behind: release.releasesBehind, no_git: true, install_kind: 'npm', npm: release.npm, manual_update: false, message: `Stable npm update ${release.version} is available.` };
             const installed = diskRelease(npmInstall.packageRoot);
             if (!same(installed, release.runtime))
                 return { ...result, current_sha: id.release().sourceRevision ?? null, behind: null, no_git: true, install_kind: 'npm', manual_update: true, error: 'Installed npm release metadata does not match the completed release.' };
@@ -476,7 +513,7 @@ export async function checkWebUpdate(webRoot, currentVersion, channel, git, getJ
             const latest = release.version.split('.').map(Number);
             const cmp = installed.map((v, i) => Math.sign(v - (latest[i] ?? 0))).find((s) => s !== 0) ?? 0;
             if (cmp !== 0)
-                behind = cmp < 0 ? 1 : 0;
+                behind = cmp < 0 ? release.releasesBehind : 0;
         }
         return { ...result, current_sha: current, behind, no_git: true, manual_update: true, message: 'Use the published Talaria Web image or authenticated monorepo installation; legacy checkouts require migration.' };
     }
@@ -709,6 +746,7 @@ export async function checkAgentUpdate(path, git, channel = DEFAULT_CHANNEL) {
         const message = fetched.out ? `fetch failed: ${sanitizeGitDiagnostic(fetched.out)}` : 'fetch failed';
         return { name: 'agent', channel, behind: null, error: message, stale_check: true, dirty: await isDirty(path, git) };
     }
+    await recoverInterruptedAutostash(path, git);
     try {
         return { ...await agentTarget(path, git, channel), dirty: await isDirty(path, git) };
     }
@@ -716,7 +754,7 @@ export async function checkAgentUpdate(path, git, channel = DEFAULT_CHANNEL) {
         return { name: 'agent', channel, behind: null, error: error.message };
     }
 }
-/** Fetch, confirm the immutable Agent target, stash, fast-forward, and pop. */
+/** Fetch, confirm the immutable Agent target, stash, fast-forward, and restore the stash. */
 export async function applyAgentUpdate(path, git, channel = DEFAULT_CHANNEL, policy) {
     if (!path || !existsSync(join(path, '.git')))
         return { ok: false, message: 'Not a git repository' };
@@ -746,6 +784,7 @@ export async function applyAgentUpdate(path, git, channel = DEFAULT_CHANNEL, pol
         return warning;
     const ref = str(info.branch);
     const revision = str(info.latest_sha);
+    await recoverInterruptedAutostash(path, git);
     const status = await git(['status', '--porcelain', '--untracked-files=no'], path);
     if (!status.ok) {
         if (isGitLockError(status.out))
@@ -755,41 +794,101 @@ export async function applyAgentUpdate(path, git, channel = DEFAULT_CHANNEL, pol
     if (status.out.split('\n').some((line) => ['DD', 'AU', 'UD', 'UA', 'DU', 'AA', 'UU'].includes(line.slice(0, 2)))) {
         return { ok: false, message: `The local agent repo has unresolved merge conflicts. To reset to the latest remote version run: git -C ${path} checkout . && git -C ${path} pull --ff-only`, conflict: true };
     }
-    let stashed = false;
+    let saved = null;
     if (status.out) {
-        if (!(await git(['stash', 'push', '-m', 'hermes-update-autostash'], path)).ok)
-            return { ok: false, message: 'Failed to stash local changes' };
-        stashed = true;
+        const result = await saveLocalChanges(path, git);
+        if (typeof result === 'string')
+            return { ok: false, message: result };
+        saved = result;
     }
     // Merge the immutable commit that was checked/acknowledged, never re-fetch a moving ref here.
     const pulled = await git(['merge', '--ff-only', revision], path, 30_000);
     if (!pulled.ok) {
-        let note = '';
-        if (stashed)
-            note = ` ${await restoreStash(path, git, pulled.out)}`;
+        const restored = saved ? await restoreLocalChanges(path, git, saved) : null;
+        const note = restored ? ` ${restored.note}` : '';
+        const conflict = restored && !restored.applied ? { stash_conflict: true } : {};
         if (isGitLockError(pulled.out))
-            return { ok: false, message: `Pull failed due to a repository lock: ${pulled.out.trim()}.${note}`, lock_conflict: true };
-        return { ok: false, message: `Pull failed: ${sanitizeGitDiagnostic(pulled.out)}.${note}` };
-    }
-    let message = `agent updated to ${ref}`;
-    if (stashed) {
-        const popped = await git(['stash', 'pop'], path);
-        if (!popped.ok)
-            message += '. Local changes remain in `git stash list`; resolve them manually.';
+            return { ok: false, message: `Pull failed due to a repository lock: ${pulled.out.trim()}.${note}`, lock_conflict: true, ...conflict };
+        return { ok: false, message: `Pull failed: ${sanitizeGitDiagnostic(pulled.out)}.${note}`, ...conflict };
     }
+    const restored = saved ? await restoreLocalChanges(path, git, saved) : null;
     const verified = await verifiedAgentIdentity(path, revision, git);
     if (!verified)
         return { ok: false, message: 'The Agent update completed, but the installed revision could not be verified.', target: 'agent' };
-    return { ok: true, message, target: 'agent', ref, ...verified };
+    return { ok: true, message: `agent updated to ${ref}.${restored ? ` ${restored.note}` : ''}`, target: 'agent', ref, ...verified, ...(restored && !restored.applied ? { stash_conflict: true } : {}) };
+}
+const AUTOSTASH_REFS = 'refs/talaria/autostash/';
+/** An update holds its saved changes here only while it runs; one left behind marks an interrupted update. */
+const PENDING_AUTOSTASH_REFS = `${AUTOSTASH_REFS}pending/`;
+async function autostashPatch(path, git, sha) {
+    const dir = mkdtempSync(join(tmpdir(), 'talaria-autostash-'));
+    const saved = { sha, ref: `${PENDING_AUTOSTASH_REFS}${sha}`, dir, patch: join(dir, 'autostash.patch') };
+    if ((await git(['diff', '--binary', `--output=${saved.patch}`, `${sha}^1`, sha], path)).ok)
+        return saved;
+    rmSync(dir, { recursive: true, force: true });
+    return null;
 }
-async function restoreStash(path, git, pullOut) {
-    if ((await git(['stash', 'pop'], path)).ok)
-        return 'Local modifications were restored from the temporary stash.';
-    if ((await git(['stash', 'apply'], path)).ok) {
-        await git(['stash', 'drop'], path);
-        return 'Local modifications were restored from the temporary stash.';
-    }
-    return `Your local modifications could not be restored automatically (stash pop failed after pull error: ${pullOut.trim().slice(0, 200) || 'no detail'}). They remain safely in \`git stash list\`; run \`git -C ${path} stash pop\` once the lock is cleared.`;
+/**
+ * Save tracked local changes as a stash commit under a private per-commit ref, never the shared stash reflog
+ * whose entries other processes can shift, then revert exactly those changes. `git apply` writes the whole patch
+ * or nothing, so an edit made meanwhile aborts the update instead of being lost. Returns an error message on failure.
+ */
+async function saveLocalChanges(path, git) {
+    const created = await git(['stash', 'create', 'hermes-update-autostash'], path);
+    if (!created.ok || !SHA.test(created.out))
+        return 'Failed to stash local changes';
+    const sha = created.out;
+    if (!(await git(['update-ref', `${PENDING_AUTOSTASH_REFS}${sha}`, sha], path)).ok)
+        return 'Failed to stash local changes';
+    const saved = await autostashPatch(path, git, sha);
+    if (!saved || (lstatSync(saved.patch).size > 0 && !(await git(['apply', '-R', '--whitespace=nowarn', saved.patch], path)).ok)) {
+        if (saved)
+            rmSync(saved.dir, { recursive: true, force: true });
+        await git(['update-ref', '-d', `${PENDING_AUTOSTASH_REFS}${sha}`, sha], path);
+        return 'Local changes in the Agent checkout changed while the update was saving them, so nothing was modified. Try the update again.';
+    }
+    // Only the index returns to HEAD; the working tree is untouched and staged content stays in the saved commit.
+    await git(['reset', '-q'], path);
+    return saved;
+}
+/** Re-apply the saved changes atomically; on a conflict keep the commit under its own ref and leave the files as the update wrote them. */
+async function restoreLocalChanges(path, git, saved) {
+    try {
+        if (lstatSync(saved.patch).size === 0 || (await git(['apply', '--whitespace=nowarn', saved.patch], path)).ok) {
+            await git(['update-ref', '-d', saved.ref, saved.sha], path);
+            return { applied: true, note: 'Local modifications were restored.' };
+        }
+    }
+    finally {
+        rmSync(saved.dir, { recursive: true, force: true });
+    }
+    const short = saved.sha.slice(0, 12);
+    // The kept ref owns the commit; the stash list entry is only a convenience others may drop.
+    const keptRef = `${AUTOSTASH_REFS}${saved.sha}`;
+    const kept = (await git(['update-ref', keptRef, saved.sha], path)).ok;
+    if (kept)
+        await git(['update-ref', '-d', saved.ref, saved.sha], path);
+    const ref = kept ? keptRef : saved.ref;
+    const listed = kept && (await git(['stash', 'store', '-m', 'hermes-update-autostash', saved.sha], path)).ok;
+    return { applied: false, note: `Your local modifications could not be re-applied cleanly and were saved as ${short} under ${ref}${listed ? ' and in the git stash' : ''}; Agent files were left as the update wrote them. To inspect: git -C ${path} stash show -p ${short}. To re-apply: git -C ${path} stash apply ${short}, then resolve conflicts. Once you are satisfied, run git -C ${path} update-ref -d ${ref}${listed ? ' and drop that stash entry' : ''}.` };
+}
+/** Finish an update the server stopped mid-way: its saved changes return to the tree, or are kept and listed in the git stash if they no longer apply. */
+async function recoverInterruptedAutostash(path, git) {
+    const refs = await git(['for-each-ref', '--format=%(objectname)', PENDING_AUTOSTASH_REFS], path);
+    if (!refs.ok)
+        return;
+    for (const sha of refs.out.split('\n').filter((line) => SHA.test(line))) {
+        const saved = await autostashPatch(path, git, sha);
+        if (!saved)
+            continue;
+        // Stopped before the revert or after the restore: the changes are already in the tree.
+        if (lstatSync(saved.patch).size === 0 || (await git(['apply', '-R', '--check', saved.patch], path)).ok) {
+            rmSync(saved.dir, { recursive: true, force: true });
+            await git(['update-ref', '-d', saved.ref, sha], path);
+        }
+        else
+            await restoreLocalChanges(path, git, saved);
+    }
 }
 /** Python `apply_force_update` (agent branch): fetch, refuse a pure-ancestor rewind, `checkout . && clean -fd && reset --hard`. */
 export async function forceAgentUpdate(path, git, log, channel = DEFAULT_CHANNEL, policy) {