@maudecode/talaria-web 1.15.0 → 1.17.2

package/dist/tools/updates.js

@@ -14,6 +14,7 @@ import { readCapped } from '../http/capped.js';
 import { execFile } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { delimiter, dirname, isAbsolute, join, resolve } from 'node:path';
 import { dict } from '../config/agent-config.js';
 import { validateReleaseInfo } from '../release.js';
@@ -178,8 +179,12 @@ export function githubJson(fetchImpl, env) {
         return JSON.parse(body.toString('utf8'));
     };
 }
-/** Python `published_web_release`: the newest completed `release-set-<sha>` whose Web component matches the channel's tag family. */
-export async function publishedWebRelease(channel, getJson, now = () => performance.now()) {
+const completeManifest = (m, tag) => m?.schemaVersion === 1 && m.status === 'complete' && m.releaseSet === tag.slice('release-set-'.length);
+/**
+ * Python `published_web_release`: the newest completed `release-set-<sha>` whose Web component matches the channel's tag family.
+ * `installed` (a bare `X.Y.Z`) also counts the completed releases an update skips, one manifest per older release set (TAL-624).
+ */
+export async function publishedWebRelease(channel, getJson, now = () => performance.now(), installed) {
     const tagPattern = new RegExp(`^${channel === 'experimental' ? 'web-exp-v' : 'web-v'}${VERSION}$`);
     const deadline = now() + 15_000;
     const fetchJson = (path, asset = false) => {
@@ -204,10 +209,11 @@ export async function publishedWebRelease(channel, getJson, now = () => performa
     if (exhausted)
         throw new ReleaseUnavailable('Release history exceeds automatic lookup; update manually');
     published.sort((a, b) => (str(a.published_at) < str(b.published_at) ? 1 : str(a.published_at) > str(b.published_at) ? -1 : 0));
-    for (const release of published) {
+    /** A release set's tag and manifest; null for other releases. */
+    const manifestOf = async (release) => {
         const tag = release.tag_name;
         if (typeof tag !== 'string' || !/^release-set-[a-f0-9]{40}$/.test(tag))
-            continue;
+            return null;
         if (!Array.isArray(release.assets))
             throw new ReleaseUnavailable('Published release set has invalid assets');
         const assets = release.assets.filter((a) => Boolean(a) && typeof a === 'object' && a.name === 'release-set.json');
@@ -215,8 +221,36 @@ export async function publishedWebRelease(channel, getJson, now = () => performa
         if (assets.length !== 1 || typeof id !== 'number' || !Number.isInteger(id) || id < 1)
             throw new ReleaseUnavailable('Published release set lacks its immutable manifest');
         const manifest = await fetchJson(`/releases/assets/${String(id)}`, true);
-        const m = manifest && typeof manifest === 'object' && !Array.isArray(manifest) ? manifest : null;
-        if (m?.schemaVersion !== 1 || m.status !== 'complete' || m.releaseSet !== tag.slice('release-set-'.length))
+        return { tag, m: manifest && typeof manifest === 'object' && !Array.isArray(manifest) ? manifest : null };
+    };
+    /** Distinct completed channel versions above `installed` in the older release sets, plus `latest`. A Web tag without a completed set never counts; an unreadable set ends the count. */
+    const releasesSince = async (older, latest) => {
+        if (installed === undefined || compareVersions(latest, installed) <= 0)
+            return 1;
+        const versions = new Set([latest]);
+        try {
+            for (const release of older) {
+                const set = await manifestOf(release);
+                if (!set || !completeManifest(set.m, set.tag))
+                    continue;
+                const webTag = dict(dict(set.m.components).web).tag;
+                if (typeof webTag !== 'string' || !tagPattern.test(webTag))
+                    continue;
+                const version = webTag.split('-v').pop() ?? '';
+                if (compareVersions(version, installed) <= 0)
+                    break;
+                versions.add(version);
+            }
+        }
+        catch { /* the newest release still counts */ }
+        return versions.size;
+    };
+    for (const [index, release] of published.entries()) {
+        const set = await manifestOf(release);
+        if (!set)
+            continue;
+        const { tag, m } = set;
+        if (!completeManifest(m, tag))
             throw new ReleaseUnavailable('Release set is incomplete or has inconsistent provenance');
         if (!m.components || typeof m.components !== 'object' || Array.isArray(m.components))
             throw new ReleaseUnavailable('Release set lacks component metadata');
@@ -256,6 +290,7 @@ export async function publishedWebRelease(channel, getJson, now = () => performa
             manifestReleaseSet: str(m.releaseSet),
             runtime: { tag: componentTag, version: component.version, sourceRevision: source, releaseSet: source, contracts: supported, compatibleAgent: agent },
             release_url: `${REPOSITORY_URL}/releases/tag/${tag}`,
+            releasesBehind: await releasesSince(published.slice(index + 1), str(component.version)),
         };
     }
     throw new ReleaseUnavailable('No completed Talaria Web release is available on this channel');
@@ -319,6 +354,11 @@ export function ghcrExperimental(fetchImpl) {
             }
             return { tag: `web-exp-v${version}`, version, sourceRevision, digest: layer.digest, size };
         },
+        builds: async () => {
+            const body = await json(await send(`${GHCR}/v2/${EXPERIMENTAL_REPOSITORY}/tags/list?n=1000`, { headers: { Authorization: `Bearer ${await token()}` }, signal: AbortSignal.timeout(5000) }), 'tag list');
+            const tags = Array.isArray(body.tags) ? body.tags : [];
+            return new Set(tags.flatMap((tag) => (typeof tag === 'string' && /^sha-[a-f0-9]{40}$/.test(tag) ? [tag.slice(4)] : [])));
+        },
         download: async (release) => {
             let res = await send(`${GHCR}/v2/${EXPERIMENTAL_REPOSITORY}/blobs/${release.digest}`, { headers: { Authorization: `Bearer ${await token()}` }, signal: AbortSignal.timeout(120_000) });
             if (res.status >= 300 && res.status < 400) {
@@ -412,8 +452,37 @@ function diskRelease(webRoot) {
 function npmInstallChannel(installed, id) {
     return str(diskRelease(installed.packageRoot)?.tag ?? id.release().tag).startsWith('web-exp-v') ? 'experimental' : 'stable';
 }
-/** An npm install on Experimental: behind when its source differs from the `experimental` tag, or when switching channels. */
-async function checkNpmExperimental(result, installed, id, registry) {
+/**
+ * Published Experimental builds after `installed` up to `latest` (TAL-626): commits on `latest`'s history back to `installed`
+ * that carry a `sha-` build tag. Never below 1; 1 when the history or tag list cannot be read.
+ */
+async function experimentalBuildsBehind(installed, latest, registry, getJson) {
+    if (!installed)
+        return 1;
+    let count = 0;
+    try {
+        const builds = await registry.builds();
+        for (let page = 1; page <= 5; page += 1) {
+            const commits = await getJson(`/commits?sha=${latest}&per_page=100&page=${String(page)}`, { asset: false });
+            if (!Array.isArray(commits))
+                break;
+            for (const commit of commits) {
+                const sha = dict(commit).sha;
+                if (sha === installed)
+                    return Math.max(1, count);
+                if (typeof sha === 'string' && builds.has(sha))
+                    count += 1;
+            }
+            if (commits.length < 100)
+                break;
+        }
+    }
+    catch { /* count what was read */ }
+    // ponytail: 500 commits back; an older install reports the builds within that window.
+    return Math.max(1, count);
+}
+/** An npm install on Experimental: behind by its missed builds when its source differs from the `experimental` tag, or when switching channels. */
+async function checkNpmExperimental(result, installed, id, registry, getJson) {
     let release;
     try {
         release = await registry.release();
@@ -426,9 +495,9 @@ async function checkNpmExperimental(result, installed, id, registry) {
     const disk = diskRelease(installed.packageRoot);
     const current = str(disk?.sourceRevision ?? id.release().sourceRevision) || null;
     if (npmInstallChannel(installed, id) !== 'experimental')
-        return { ...result, current_sha: current, behind: 1, channel_switch: true, message: `Switching to Experimental installs ${release.version}.` };
+        return { ...result, current_sha: current, behind: await experimentalBuildsBehind(current, release.sourceRevision, registry, getJson), channel_switch: true, message: `Switching to Experimental installs ${release.version}.` };
     if (disk?.sourceRevision !== release.sourceRevision)
-        return { ...result, current_sha: current, behind: 1, message: `Experimental update ${release.version} is available.` };
+        return { ...result, current_sha: current, behind: await experimentalBuildsBehind(current, release.sourceRevision, registry, getJson), message: `Experimental update ${release.version} is available.` };
     const metadataRepair = !same(id.release(), disk);
     return { ...result, current_sha: release.sourceRevision, behind: 0, metadata_repair: metadataRepair, ...(metadataRepair ? { message: 'The npm package is current; finish the update to restart with that version.' } : {}) };
 }
@@ -440,10 +509,12 @@ export async function checkWebUpdate(webRoot, currentVersion, channel, git, getJ
     if (root !== null)
         return { ...result, manual_update: true, message: CONTRIBUTOR_CHECKOUT_MESSAGE };
     if (channel === 'experimental' && npmInstall && registry)
-        return checkNpmExperimental(result, npmInstall, id, registry);
+        return checkNpmExperimental(result, npmInstall, id, registry, getJson);
+    const packaged = new RegExp(`^${channel === 'experimental' ? 'web-exp-v' : 'web-v'}${VERSION}$`).exec(currentVersion)?.slice(1, 4).join('.');
+    const installed = npmInstall?.version ?? packaged;
     let release;
     try {
-        release = await publishedWebRelease(channel, getJson);
+        release = await publishedWebRelease(channel, getJson, undefined, installed && new RegExp(`^${VERSION}$`).test(installed) ? installed : undefined);
     }
     catch (error) {
         if (error instanceof ReleaseUnavailable)
@@ -461,7 +532,7 @@ export async function checkWebUpdate(webRoot, currentVersion, channel, git, getJ
             if (comparison > 0)
                 return { ...result, current_sha: id.release().sourceRevision ?? null, behind: 0, no_git: true, install_kind: 'npm', manual_update: true, message: 'This npm installation is ahead of the selected Stable release.' };
             if (comparison < 0)
-                return { ...result, current_sha: id.release().sourceRevision ?? null, behind: 1, no_git: true, install_kind: 'npm', npm: release.npm, manual_update: false, message: `Stable npm update ${release.version} is available.` };
+                return { ...result, current_sha: id.release().sourceRevision ?? null, behind: release.releasesBehind, no_git: true, install_kind: 'npm', npm: release.npm, manual_update: false, message: `Stable npm update ${release.version} is available.` };
             const installed = diskRelease(npmInstall.packageRoot);
             if (!same(installed, release.runtime))
                 return { ...result, current_sha: id.release().sourceRevision ?? null, behind: null, no_git: true, install_kind: 'npm', manual_update: true, error: 'Installed npm release metadata does not match the completed release.' };
@@ -476,7 +547,7 @@ export async function checkWebUpdate(webRoot, currentVersion, channel, git, getJ
             const latest = release.version.split('.').map(Number);
             const cmp = installed.map((v, i) => Math.sign(v - (latest[i] ?? 0))).find((s) => s !== 0) ?? 0;
             if (cmp !== 0)
-                behind = cmp < 0 ? 1 : 0;
+                behind = cmp < 0 ? release.releasesBehind : 0;
         }
         return { ...result, current_sha: current, behind, no_git: true, manual_update: true, message: 'Use the published Talaria Web image or authenticated monorepo installation; legacy checkouts require migration.' };
     }
@@ -709,6 +780,7 @@ export async function checkAgentUpdate(path, git, channel = DEFAULT_CHANNEL) {
         const message = fetched.out ? `fetch failed: ${sanitizeGitDiagnostic(fetched.out)}` : 'fetch failed';
         return { name: 'agent', channel, behind: null, error: message, stale_check: true, dirty: await isDirty(path, git) };
     }
+    await recoverInterruptedAutostash(path, git);
     try {
         return { ...await agentTarget(path, git, channel), dirty: await isDirty(path, git) };
     }
@@ -716,7 +788,7 @@ export async function checkAgentUpdate(path, git, channel = DEFAULT_CHANNEL) {
         return { name: 'agent', channel, behind: null, error: error.message };
     }
 }
-/** Fetch, confirm the immutable Agent target, stash, fast-forward, and pop. */
+/** Fetch, confirm the immutable Agent target, stash, fast-forward, and restore the stash. */
 export async function applyAgentUpdate(path, git, channel = DEFAULT_CHANNEL, policy) {
     if (!path || !existsSync(join(path, '.git')))
         return { ok: false, message: 'Not a git repository' };
@@ -746,6 +818,7 @@ export async function applyAgentUpdate(path, git, channel = DEFAULT_CHANNEL, pol
         return warning;
     const ref = str(info.branch);
     const revision = str(info.latest_sha);
+    await recoverInterruptedAutostash(path, git);
     const status = await git(['status', '--porcelain', '--untracked-files=no'], path);
     if (!status.ok) {
         if (isGitLockError(status.out))
@@ -755,41 +828,101 @@ export async function applyAgentUpdate(path, git, channel = DEFAULT_CHANNEL, pol
     if (status.out.split('\n').some((line) => ['DD', 'AU', 'UD', 'UA', 'DU', 'AA', 'UU'].includes(line.slice(0, 2)))) {
         return { ok: false, message: `The local agent repo has unresolved merge conflicts. To reset to the latest remote version run: git -C ${path} checkout . && git -C ${path} pull --ff-only`, conflict: true };
     }
-    let stashed = false;
+    let saved = null;
     if (status.out) {
-        if (!(await git(['stash', 'push', '-m', 'hermes-update-autostash'], path)).ok)
-            return { ok: false, message: 'Failed to stash local changes' };
-        stashed = true;
+        const result = await saveLocalChanges(path, git);
+        if (typeof result === 'string')
+            return { ok: false, message: result };
+        saved = result;
     }
     // Merge the immutable commit that was checked/acknowledged, never re-fetch a moving ref here.
     const pulled = await git(['merge', '--ff-only', revision], path, 30_000);
     if (!pulled.ok) {
-        let note = '';
-        if (stashed)
-            note = ` ${await restoreStash(path, git, pulled.out)}`;
+        const restored = saved ? await restoreLocalChanges(path, git, saved) : null;
+        const note = restored ? ` ${restored.note}` : '';
+        const conflict = restored && !restored.applied ? { stash_conflict: true } : {};
         if (isGitLockError(pulled.out))
-            return { ok: false, message: `Pull failed due to a repository lock: ${pulled.out.trim()}.${note}`, lock_conflict: true };
-        return { ok: false, message: `Pull failed: ${sanitizeGitDiagnostic(pulled.out)}.${note}` };
-    }
-    let message = `agent updated to ${ref}`;
-    if (stashed) {
-        const popped = await git(['stash', 'pop'], path);
-        if (!popped.ok)
-            message += '. Local changes remain in `git stash list`; resolve them manually.';
+            return { ok: false, message: `Pull failed due to a repository lock: ${pulled.out.trim()}.${note}`, lock_conflict: true, ...conflict };
+        return { ok: false, message: `Pull failed: ${sanitizeGitDiagnostic(pulled.out)}.${note}`, ...conflict };
     }
+    const restored = saved ? await restoreLocalChanges(path, git, saved) : null;
     const verified = await verifiedAgentIdentity(path, revision, git);
     if (!verified)
         return { ok: false, message: 'The Agent update completed, but the installed revision could not be verified.', target: 'agent' };
-    return { ok: true, message, target: 'agent', ref, ...verified };
+    return { ok: true, message: `agent updated to ${ref}.${restored ? ` ${restored.note}` : ''}`, target: 'agent', ref, ...verified, ...(restored && !restored.applied ? { stash_conflict: true } : {}) };
 }
-async function restoreStash(path, git, pullOut) {
-    if ((await git(['stash', 'pop'], path)).ok)
-        return 'Local modifications were restored from the temporary stash.';
-    if ((await git(['stash', 'apply'], path)).ok) {
-        await git(['stash', 'drop'], path);
-        return 'Local modifications were restored from the temporary stash.';
-    }
-    return `Your local modifications could not be restored automatically (stash pop failed after pull error: ${pullOut.trim().slice(0, 200) || 'no detail'}). They remain safely in \`git stash list\`; run \`git -C ${path} stash pop\` once the lock is cleared.`;
+const AUTOSTASH_REFS = 'refs/talaria/autostash/';
+/** An update holds its saved changes here only while it runs; one left behind marks an interrupted update. */
+const PENDING_AUTOSTASH_REFS = `${AUTOSTASH_REFS}pending/`;
+async function autostashPatch(path, git, sha) {
+    const dir = mkdtempSync(join(tmpdir(), 'talaria-autostash-'));
+    const saved = { sha, ref: `${PENDING_AUTOSTASH_REFS}${sha}`, dir, patch: join(dir, 'autostash.patch') };
+    if ((await git(['diff', '--binary', `--output=${saved.patch}`, `${sha}^1`, sha], path)).ok)
+        return saved;
+    rmSync(dir, { recursive: true, force: true });
+    return null;
+}
+/**
+ * Save tracked local changes as a stash commit under a private per-commit ref, never the shared stash reflog
+ * whose entries other processes can shift, then revert exactly those changes. `git apply` writes the whole patch
+ * or nothing, so an edit made meanwhile aborts the update instead of being lost. Returns an error message on failure.
+ */
+async function saveLocalChanges(path, git) {
+    const created = await git(['stash', 'create', 'hermes-update-autostash'], path);
+    if (!created.ok || !SHA.test(created.out))
+        return 'Failed to stash local changes';
+    const sha = created.out;
+    if (!(await git(['update-ref', `${PENDING_AUTOSTASH_REFS}${sha}`, sha], path)).ok)
+        return 'Failed to stash local changes';
+    const saved = await autostashPatch(path, git, sha);
+    if (!saved || (lstatSync(saved.patch).size > 0 && !(await git(['apply', '-R', '--whitespace=nowarn', saved.patch], path)).ok)) {
+        if (saved)
+            rmSync(saved.dir, { recursive: true, force: true });
+        await git(['update-ref', '-d', `${PENDING_AUTOSTASH_REFS}${sha}`, sha], path);
+        return 'Local changes in the Agent checkout changed while the update was saving them, so nothing was modified. Try the update again.';
+    }
+    // Only the index returns to HEAD; the working tree is untouched and staged content stays in the saved commit.
+    await git(['reset', '-q'], path);
+    return saved;
+}
+/** Re-apply the saved changes atomically; on a conflict keep the commit under its own ref and leave the files as the update wrote them. */
+async function restoreLocalChanges(path, git, saved) {
+    try {
+        if (lstatSync(saved.patch).size === 0 || (await git(['apply', '--whitespace=nowarn', saved.patch], path)).ok) {
+            await git(['update-ref', '-d', saved.ref, saved.sha], path);
+            return { applied: true, note: 'Local modifications were restored.' };
+        }
+    }
+    finally {
+        rmSync(saved.dir, { recursive: true, force: true });
+    }
+    const short = saved.sha.slice(0, 12);
+    // The kept ref owns the commit; the stash list entry is only a convenience others may drop.
+    const keptRef = `${AUTOSTASH_REFS}${saved.sha}`;
+    const kept = (await git(['update-ref', keptRef, saved.sha], path)).ok;
+    if (kept)
+        await git(['update-ref', '-d', saved.ref, saved.sha], path);
+    const ref = kept ? keptRef : saved.ref;
+    const listed = kept && (await git(['stash', 'store', '-m', 'hermes-update-autostash', saved.sha], path)).ok;
+    return { applied: false, note: `Your local modifications could not be re-applied cleanly and were saved as ${short} under ${ref}${listed ? ' and in the git stash' : ''}; Agent files were left as the update wrote them. To inspect: git -C ${path} stash show -p ${short}. To re-apply: git -C ${path} stash apply ${short}, then resolve conflicts. Once you are satisfied, run git -C ${path} update-ref -d ${ref}${listed ? ' and drop that stash entry' : ''}.` };
+}
+/** Finish an update the server stopped mid-way: its saved changes return to the tree, or are kept and listed in the git stash if they no longer apply. */
+async function recoverInterruptedAutostash(path, git) {
+    const refs = await git(['for-each-ref', '--format=%(objectname)', PENDING_AUTOSTASH_REFS], path);
+    if (!refs.ok)
+        return;
+    for (const sha of refs.out.split('\n').filter((line) => SHA.test(line))) {
+        const saved = await autostashPatch(path, git, sha);
+        if (!saved)
+            continue;
+        // Stopped before the revert or after the restore: the changes are already in the tree.
+        if (lstatSync(saved.patch).size === 0 || (await git(['apply', '-R', '--check', saved.patch], path)).ok) {
+            rmSync(saved.dir, { recursive: true, force: true });
+            await git(['update-ref', '-d', saved.ref, sha], path);
+        }
+        else
+            await restoreLocalChanges(path, git, saved);
+    }
 }
 /** Python `apply_force_update` (agent branch): fetch, refuse a pure-ancestor rewind, `checkout . && clean -fd && reset --hard`. */
 export async function forceAgentUpdate(path, git, log, channel = DEFAULT_CHANNEL, policy) {
@@ -1014,8 +1147,8 @@ export class UpdateService {
         }
         if (cached.include_agent !== includeAgent) {
             cached.include_agent = includeAgent;
-            if (!includeAgent)
-                cached.agent = ignoredAgent();
+            // A cached result from the other mode never answers this one: re-enabled Agent checks wait for the next check.
+            cached.agent = includeAgent ? null : ignoredAgent();
         }
         cached.cached = true;
         return cached;
@@ -1343,6 +1476,39 @@ export class UpdateService {
     }
 }
 const ignoredAgent = () => ({ name: 'agent', behind: 0, ignored: true });
+/** TAL-559: one target's status and apply availability, decided here so clients only word them. */
+export function updateTargetView(name, info, off) {
+    const behind = typeof info.behind === 'number' ? info.behind : null;
+    // Web refuses dirty checkouts; Agent updates stash local changes and restore them, so only Web dirt blocks.
+    const state = off || info.ignored === true ? 'off'
+        : info.error ? 'check_failed'
+            : info.dirty === true && name === 'webui' ? 'local_changes'
+                : info.metadata_repair === true ? 'finish'
+                    : info.manual_update === true ? 'manual'
+                        : behind !== null && behind > 0 ? (info.release_based === true ? 'release_ready' : 'commits_behind')
+                            : behind === 0 ? 'up_to_date'
+                                : info.no_git === true && info.install_kind !== 'npm' ? 'manual'
+                                    : 'unknown';
+    const latest = typeof info.latest_version === 'string' ? info.latest_version : null;
+    const current = typeof info.current_version === 'string' ? info.current_version : '';
+    return {
+        ...info, state,
+        can_apply: ['release_ready', 'commits_behind', 'finish'].includes(state) && info.manual_update !== true && (info.no_git !== true || info.install_kind === 'npm'),
+        // Stable Agent reports a bare 12-hex revision when its checkout sits on no release tag.
+        installed_unverified: state === 'release_ready' && (!current || /^[0-9a-f]{12}$/.test(current)),
+        manual_link: name === 'webui' && state !== 'off' && info.manual_update === true && Boolean(info.error || info.dirty || info.behind !== 0),
+        target_version: state === 'finish' || state === 'release_ready' || (state === 'manual' && info.release_based === true && (behind ?? 0) > 0) ? latest : null,
+    };
+}
+/** `/api/updates/check`: every present target carries its view; disabled checks report both targets off. */
+export function updatesCheckView(status) {
+    const off = status.disabled === true;
+    const view = (name) => {
+        const info = status[name];
+        return info && typeof info === 'object' ? updateTargetView(name, info, off) : off ? updateTargetView(name, {}, true) : null;
+    };
+    return { ...status, webui: view('webui'), agent: view('agent') };
+}
 /** Python `_wait_until_restart_safe`: poll until no chat work is active, bounded so a stuck run cannot jam the update forever. */
 export async function waitUntilRestartSafe(blockers, opts = {}) {
     const now = opts.now ?? (() => Date.now());