@oar-sh/oar 0.9.1 → 0.9.3

package/server/services/update-check-service.mjs

@@ -0,0 +1,220 @@
+'use strict';
+
+import { channelForVersion, compareSemverIsh, parseSemverIsh } from '../../shared/update-semver.mjs';
+
+// Polls oar.sh/latest.json for new OAR releases. Zero-telemetry promise:
+// automatic checking is OPT-IN (off unless the stored setting says '1'), so a
+// default install never contacts oar.sh — only the settings toggle or an
+// explicit "check now" triggers a request. OAR_NO_UPDATE_CHECK=1 is the hard
+// kill switch (tests, air-gapped hosts): the runtime then never constructs
+// this service, so not even manual checks can reach out.
+
+export const UPDATE_MANIFEST_URL_DEFAULT = 'https://oar.sh/latest.json';
+export const UPDATE_CHECK_INTERVAL_MS = 12 * 3_600_000;
+export const UPDATE_CHECK_JITTER_MS = 3_600_000;
+export const UPDATE_FETCH_TIMEOUT_MS = 5_000;
+
+export const UPDATE_AUTO_CHECK_SETTING_KEY = 'update_auto_check_enabled';
+const ETAG_SETTING_KEY = 'update_check_etag';
+const RESULT_SETTING_KEY = 'update_check_result';
+const DISMISSED_SETTING_KEY = 'update_dismissed_version';
+
+export function isUpdateCheckKilled(env = process.env) {
+  return String(env?.OAR_NO_UPDATE_CHECK || '').trim() === '1';
+}
+
+export function resolveUpdateManifestUrl(env = process.env) {
+  return String(env?.OAR_UPDATE_MANIFEST_URL || '').trim() || UPDATE_MANIFEST_URL_DEFAULT;
+}
+
+export function createUpdateCheckService({
+  runningVersion,
+  installMethod = 'npm-global',
+  manifestUrl = UPDATE_MANIFEST_URL_DEFAULT,
+  fetchImpl = globalThis.fetch,
+  readSetting,
+  writeSetting,
+  setTimeoutImpl = setTimeout,
+  clearTimeoutImpl = clearTimeout,
+  randomImpl = Math.random,
+  nowImpl = Date.now,
+  logger = console,
+  onStateChange = null,
+} = {}) {
+  let timer = null;
+  let checkInFlight = null;
+  let schemaUnsupported = false;
+  let schemaWarned = false;
+
+  const channel = channelForVersion(runningVersion);
+
+  const emit = () => {
+    try {
+      onStateChange?.(getSnapshot());
+    } catch {}
+  };
+
+  const readResult = () => {
+    try {
+      const parsed = JSON.parse(String(readSetting(RESULT_SETTING_KEY) || ''));
+      return parsed && typeof parsed === 'object' ? parsed : null;
+    } catch {
+      return null;
+    }
+  };
+
+  function isAutoCheckEnabled() {
+    return String(readSetting(UPDATE_AUTO_CHECK_SETTING_KEY) || '').trim() === '1';
+  }
+
+  function getSnapshot() {
+    const result = readResult();
+    const latest = String(result?.version || '');
+    const available = !!latest && compareSemverIsh(latest, runningVersion) > 0;
+    const critical = result?.critical === true;
+    const dismissedVersion = String(readSetting(DISMISSED_SETTING_KEY) || '').trim();
+    return {
+      autoCheckEnabled: isAutoCheckEnabled(),
+      runningVersion,
+      installMethod,
+      channel,
+      available,
+      version: available ? latest : null,
+      notesUrl: available ? String(result?.notesUrl || '') || null : null,
+      publishedAt: available ? String(result?.publishedAt || '') || null : null,
+      critical: available ? critical : false,
+      dismissed: available && !critical && dismissedVersion === latest,
+      lastCheckedAt: result?.checkedAt || null,
+      schemaUnsupported,
+    };
+  }
+
+  function disarm() {
+    if (timer) {
+      clearTimeoutImpl(timer);
+      timer = null;
+    }
+  }
+
+  function arm(delayMs) {
+    disarm();
+    if (schemaUnsupported) return;
+    timer = setTimeoutImpl(() => {
+      timer = null;
+      if (!isAutoCheckEnabled()) return; // opted out since arming; stay quiet
+      void checkNow().finally(() => {
+        if (isAutoCheckEnabled()) arm(nextDelayMs());
+      });
+    }, delayMs);
+    timer?.unref?.();
+  }
+
+  function nextDelayMs() {
+    // ±1h of jitter so a fleet of relays doesn't hit oar.sh in sync.
+    return UPDATE_CHECK_INTERVAL_MS + Math.floor((randomImpl() * 2 - 1) * UPDATE_CHECK_JITTER_MS);
+  }
+
+  /** A failed check must never affect anything: all failures resolve silently. */
+  async function checkNow() {
+    if (schemaUnsupported) return getSnapshot();
+    if (checkInFlight) return checkInFlight;
+    checkInFlight = (async () => {
+      try {
+        const headers = { Accept: 'application/json' };
+        const etag = String(readSetting(ETAG_SETTING_KEY) || '').trim();
+        // Only revalidate when the cached result actually exists — an orphaned
+        // ETag row would otherwise 304 forever and report nothing.
+        if (etag && readResult()) headers['If-None-Match'] = etag;
+        const response = await fetchImpl(manifestUrl, {
+          headers,
+          redirect: 'follow',
+          signal: AbortSignal.timeout?.(UPDATE_FETCH_TIMEOUT_MS),
+        });
+        if (response.status === 304) {
+          const cached = readResult();
+          if (cached) {
+            writeSetting(RESULT_SETTING_KEY, JSON.stringify({ ...cached, checkedAt: new Date(nowImpl()).toISOString() }));
+          }
+          return getSnapshot();
+        }
+        if (!response.ok) return getSnapshot();
+        const manifest = await response.json();
+        if (!manifest || typeof manifest !== 'object') return getSnapshot();
+        if (manifest.schemaVersion !== 1) {
+          schemaUnsupported = true;
+          disarm();
+          if (!schemaWarned) {
+            schemaWarned = true;
+            logger.warn?.(`update check: latest.json schemaVersion ${manifest.schemaVersion} is unknown to this relay; update checking stopped (update OAR manually)`);
+          }
+          return getSnapshot();
+        }
+        const entry = manifest.channels?.[channel] || manifest.channels?.stable;
+        if (!entry || !parseSemverIsh(entry.version)) return getSnapshot();
+        const responseEtag = String(response.headers?.get?.('etag') || '').trim();
+        if (responseEtag) writeSetting(ETAG_SETTING_KEY, responseEtag);
+        writeSetting(RESULT_SETTING_KEY, JSON.stringify({
+          version: String(entry.version),
+          notesUrl: String(entry.notesUrl || ''),
+          publishedAt: String(entry.publishedAt || ''),
+          critical: entry.critical === true,
+          channel,
+          checkedAt: new Date(nowImpl()).toISOString(),
+        }));
+        return getSnapshot();
+      } catch {
+        return getSnapshot(); // timeout, DNS, JSON garbage — all silent
+      } finally {
+        checkInFlight = null;
+        emit();
+      }
+    })();
+    return checkInFlight;
+  }
+
+  function setAutoCheck(enabled) {
+    writeSetting(UPDATE_AUTO_CHECK_SETTING_KEY, enabled ? '1' : '0');
+    if (enabled) {
+      void checkNow();
+      arm(nextDelayMs());
+    } else {
+      disarm();
+    }
+    emit();
+    return { ok: true, autoCheckEnabled: !!enabled };
+  }
+
+  /** Boot hook: arms the poller only when the user already opted in. */
+  function startIfEnabled() {
+    if (!isAutoCheckEnabled()) return false;
+    void checkNow();
+    arm(nextDelayMs());
+    return true;
+  }
+
+  function dismissVersion(version) {
+    const snapshot = getSnapshot();
+    if (!snapshot.available) return { ok: false, error: 'No update to dismiss' };
+    if (snapshot.critical) return { ok: false, error: 'This update is marked critical and cannot be dismissed' };
+    if (String(version || '').trim() !== snapshot.version) {
+      return { ok: false, error: 'Version mismatch' };
+    }
+    writeSetting(DISMISSED_SETTING_KEY, snapshot.version);
+    emit();
+    return { ok: true };
+  }
+
+  function stop() {
+    disarm();
+  }
+
+  return {
+    startIfEnabled,
+    setAutoCheck,
+    isAutoCheckEnabled,
+    checkNow,
+    getSnapshot,
+    dismissVersion,
+    stop,
+  };
+}

package/server/services/update-install-service.mjs

@@ -0,0 +1,279 @@
+'use strict';
+
+import { spawn as defaultSpawn } from 'child_process';
+
+import {
+  CLI_SPAWN_DISABLED_ERROR,
+  MAX_CAPTURED_OUTPUT_CHARS,
+  killTree,
+  runToCompletion,
+  stripTerminalEscapes,
+  tailOf,
+} from './cli-process-runner.mjs';
+import { compareSemverIsh, parseSemverIsh } from '../../shared/update-semver.mjs';
+
+// Applies an OAR self-update: `npm i -g @oar-sh/oar@<version>` with the log
+// streamed to the UI (same snapshot/logSeq idiom as cli-install-service, which
+// stays untouched — its descriptor table is provider CLIs only), then the
+// existing queue-idle relay restart. The attempt is persisted BEFORE the
+// restart so the next boot can prove the version actually changed; an
+// unchanged version surfaces the npm log as a failure instead of false
+// success.
+
+export const UPDATE_PACKAGE_NAME = '@oar-sh/oar';
+export const UPDATE_ATTEMPT_SETTING_KEY = 'update_attempt';
+export const UPDATE_OUTCOME_SETTING_KEY = 'update_last_outcome';
+export const UPDATE_INSTALL_TIMEOUT_MS = 10 * 60_000;
+const LOG_FLUSH_MS = 250;
+const ATTEMPT_LOG_TAIL_CHARS = 4_000;
+
+export const UPDATE_INSTALL_STATES = Object.freeze({
+  IDLE: 'idle',
+  RUNNING: 'running',
+  SUCCESS: 'success',
+  ERROR: 'error',
+});
+
+/**
+ * Boot-time reconciliation of a persisted update attempt. Pure; called before
+ * any service exists so even a crash loop settles the outcome exactly once.
+ */
+/**
+ * Version equality on parsed triples so a `v`-prefixed manifest version still
+ * matches the package.json it installed; raw equality only when parsing fails
+ * (compareSemverIsh treats unparseable input as equal, which must not read as
+ * a successful update).
+ */
+function sameVersion(a, b) {
+  if (parseSemverIsh(a) && parseSemverIsh(b)) return compareSemverIsh(a, b) === 0;
+  return String(a) === String(b);
+}
+
+export function reconcileUpdateAttempt({
+  readSetting,
+  writeSetting,
+  deleteSetting,
+  runningVersion,
+  nowMs = Date.now(),
+  // Generous on purpose: the restart is queue-idle-deferred and can sit for
+  // hours, and a swallowed failure outcome is worse than a late one.
+  maxAgeMs = 7 * 24 * 3_600_000,
+} = {}) {
+  let attempt = null;
+  try {
+    attempt = JSON.parse(String(readSetting(UPDATE_ATTEMPT_SETTING_KEY) || ''));
+  } catch {
+    attempt = null;
+  }
+  if (!attempt || typeof attempt !== 'object') return null;
+  deleteSetting(UPDATE_ATTEMPT_SETTING_KEY);
+
+  const attempted = String(attempt.attemptedVersion || '');
+  const startedAtMs = Date.parse(String(attempt.startedAt || '')) || 0;
+  if (attempted && sameVersion(attempted, runningVersion)) {
+    const outcome = { status: 'success', version: attempted, at: new Date(nowMs).toISOString() };
+    writeSetting(UPDATE_OUTCOME_SETTING_KEY, JSON.stringify(outcome));
+    return outcome;
+  }
+  if (!startedAtMs || nowMs - startedAtMs > maxAgeMs) return null; // stale leftovers: drop quietly
+  const outcome = {
+    status: 'failure',
+    attemptedVersion: attempted,
+    fromVersion: String(attempt.fromVersion || ''),
+    logTail: String(attempt.logTail || ''),
+    at: new Date(nowMs).toISOString(),
+  };
+  writeSetting(UPDATE_OUTCOME_SETTING_KEY, JSON.stringify(outcome));
+  return outcome;
+}
+
+export function readUpdateOutcome(readSetting) {
+  try {
+    const parsed = JSON.parse(String(readSetting(UPDATE_OUTCOME_SETTING_KEY) || ''));
+    return parsed && typeof parsed === 'object' ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+export function createUpdateInstallService({
+  runningVersion,
+  installMethod = 'npm-global',
+  spawnImpl = defaultSpawn,
+  env = process.env,
+  platform = process.platform,
+  setTimeoutImpl = setTimeout,
+  clearTimeoutImpl = clearTimeout,
+  nowImpl = Date.now,
+  readSetting,
+  writeSetting,
+  deleteSetting,
+  requestRelayShutdown,
+  logger = console,
+} = {}) {
+  const listeners = new Set();
+  let state = UPDATE_INSTALL_STATES.IDLE;
+  let targetVersion = null;
+  let log = '';
+  let logSeq = 0;
+  let startedAt = null;
+  let finishedAt = null;
+  let lastError = null;
+  let flushTimer = null;
+  let pendingLog = '';
+  let activeChild = null;
+
+  function getSnapshot() {
+    return {
+      state,
+      targetVersion,
+      log,
+      logSeq,
+      startedAt,
+      finishedAt,
+      error: lastError,
+      active: state === UPDATE_INSTALL_STATES.RUNNING,
+      lastOutcome: readUpdateOutcome(readSetting),
+    };
+  }
+
+  function broadcast() {
+    const snapshot = getSnapshot();
+    for (const listener of listeners) {
+      try { listener(snapshot); } catch {}
+    }
+  }
+
+  function appendLog(chunk) {
+    pendingLog += chunk;
+    if (flushTimer) return;
+    flushTimer = setTimeoutImpl(() => {
+      flushTimer = null;
+      if (!pendingLog) return;
+      log = stripTerminalEscapes(`${log}${pendingLog}`).slice(-MAX_CAPTURED_OUTPUT_CHARS);
+      pendingLog = '';
+      logSeq += 1;
+      broadcast();
+    }, LOG_FLUSH_MS);
+    flushTimer?.unref?.();
+  }
+
+  function flushLogNow() {
+    if (flushTimer) {
+      clearTimeoutImpl(flushTimer);
+      flushTimer = null;
+    }
+    if (pendingLog) {
+      log = stripTerminalEscapes(`${log}${pendingLog}`).slice(-MAX_CAPTURED_OUTPUT_CHARS);
+      pendingLog = '';
+      logSeq += 1;
+    }
+  }
+
+  async function startUpdate({ version } = {}) {
+    if (state === UPDATE_INSTALL_STATES.RUNNING) {
+      return { ok: false, statusCode: 409, error: 'An update is already running' };
+    }
+    const target = String(version || '').trim();
+    if (!parseSemverIsh(target)) {
+      return { ok: false, statusCode: 400, error: 'version must be a release version like 0.9.2' };
+    }
+    if (installMethod !== 'npm-global') {
+      return { ok: false, statusCode: 400, error: 'This relay runs from a git checkout — pull to update' };
+    }
+    if (String(env?.COPILOT_WEB_RELAY_DISABLE_CLI_SPAWN || '') === '1') {
+      return { ok: false, statusCode: 503, error: CLI_SPAWN_DISABLED_ERROR };
+    }
+
+    state = UPDATE_INSTALL_STATES.RUNNING;
+    targetVersion = target;
+    log = '';
+    // A timed-out child from a previous run can still be emitting: drop any
+    // buffered chunks and the armed flush so they can't bleed into this log.
+    pendingLog = '';
+    if (flushTimer) {
+      clearTimeoutImpl(flushTimer);
+      flushTimer = null;
+    }
+    logSeq += 1;
+    startedAt = new Date(nowImpl()).toISOString();
+    finishedAt = null;
+    lastError = null;
+    deleteSetting(UPDATE_OUTCOME_SETTING_KEY);
+    broadcast();
+
+    // npm itself is a shim on Windows; spawn npm.cmd through a shell there
+    // (args are fixed strings + a validated semver, so no injection surface).
+    const command = platform === 'win32' ? 'npm.cmd' : 'npm';
+    const args = ['install', '-g', `${UPDATE_PACKAGE_NAME}@${target}`];
+    const result = await runToCompletion(
+      () => spawnImpl(command, args, {
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: { ...env },
+        ...(platform === 'win32' ? { windowsHide: true, shell: true } : { detached: true }),
+      }),
+      {
+        timeoutMs: UPDATE_INSTALL_TIMEOUT_MS,
+        setTimeoutImpl,
+        clearTimeoutImpl,
+        killChild: (child, signal) => killTree(child, signal, { platform }),
+        onChild: (child) => { activeChild = child; },
+        onOutput: (text) => appendLog(text),
+      },
+    );
+    activeChild = null;
+    flushLogNow();
+    finishedAt = new Date(nowImpl()).toISOString();
+
+    if (!result.ok) {
+      state = UPDATE_INSTALL_STATES.ERROR;
+      lastError = result.error || `npm exited with code ${result.code}`;
+      broadcast();
+      return { ok: false, statusCode: 500, error: lastError };
+    }
+
+    // Persist the attempt BEFORE the restart request: the next boot compares
+    // the running version against it and turns "nothing changed" into a
+    // visible failure carrying this log tail.
+    writeSetting(UPDATE_ATTEMPT_SETTING_KEY, JSON.stringify({
+      attemptedVersion: target,
+      fromVersion: String(runningVersion),
+      startedAt,
+      logTail: tailOf(log, ATTEMPT_LOG_TAIL_CHARS),
+    }));
+    state = UPDATE_INSTALL_STATES.SUCCESS;
+    broadcast();
+    try {
+      requestRelayShutdown({ reason: 'self-update', requestedBy: 'update-install-service', restart: true });
+    } catch (error) {
+      logger.warn?.(`update install: restart request failed: ${error?.message || error}`);
+    }
+    return { ok: true, targetVersion: target };
+  }
+
+  function cancel() {
+    if (state === UPDATE_INSTALL_STATES.RUNNING && activeChild) {
+      try { killTree(activeChild, 'SIGTERM', { platform }); } catch {}
+      return { ok: true, cancelling: true };
+    }
+    // Terminal states reset to idle, mirroring cli-install-service's cancel.
+    state = UPDATE_INSTALL_STATES.IDLE;
+    targetVersion = null;
+    lastError = null;
+    broadcast();
+    return { ok: true };
+  }
+
+  function clearOutcome() {
+    deleteSetting(UPDATE_OUTCOME_SETTING_KEY);
+    broadcast();
+    return { ok: true };
+  }
+
+  function subscribe(listener) {
+    listeners.add(listener);
+    return () => listeners.delete(listener);
+  }
+
+  return { startUpdate, cancel, clearOutcome, getSnapshot, subscribe };
+}

package/server/services/windows-autostart-service.mjs

@@ -1,10 +1,15 @@
 import fs from 'fs';
 import path from 'path';
 import { randomUUID } from 'crypto';
+import { resolveOarRoot } from './oar-state-migration-service.mjs';
 
-export const WINDOWS_AUTOSTART_FILENAME = 'copilot-remote-web-relay.cmd';
+export const WINDOWS_AUTOSTART_FILENAME = 'oar-web-relay.cmd';
+// The pre-rebrand name. Never written anymore, but still recognized (an install
+// that enabled autostart before the OAR rename has this file) and cleaned up on
+// every state change so the two names can never both launch a relay.
+export const LEGACY_WINDOWS_AUTOSTART_FILENAME = 'copilot-remote-web-relay.cmd';
 
-function escapeBatchValue(value) {
+export function escapeBatchValue(value) {
   return String(value || '').replaceAll('%', '%%');
 }
 
@@ -20,6 +25,10 @@ export function buildWindowsAutostartScript({
   packageRoot,
   nodePath = process.execPath,
   configPath = '',
+  // On Windows a process pins its cwd, and self-update must be able to
+  // replace the package directory — so the relay runs from the OAR state
+  // root, not from the code it executes.
+  workingDirectory = '',
   pathImpl = path,
 } = {}) {
   const resolvedPackageRoot = pathImpl.resolve(String(packageRoot || ''));
@@ -33,13 +42,16 @@ export function buildWindowsAutostartScript({
   const serverPath = pathImpl.join(resolvedPackageRoot, 'server', 'server.js');
   const lines = [
     '@echo off',
-    'title Copilot Remote Web Relay',
+    'title OAR Web Relay',
   ];
   if (String(configPath || '').trim()) {
     lines.push(`set "COPILOT_WEB_RELAY_CONFIG=${escapeBatchValue(pathImpl.resolve(configPath))}"`);
   }
+  const cwdTarget = String(workingDirectory || '').trim()
+    ? pathImpl.resolve(String(workingDirectory))
+    : resolvedPackageRoot;
   lines.push(
-    `cd /d "${escapeBatchValue(resolvedPackageRoot)}"`,
+    `cd /d "${escapeBatchValue(cwdTarget)}"`,
     `"${escapeBatchValue(resolvedNodePath)}" "${escapeBatchValue(serverPath)}"`,
     '',
   );
@@ -64,14 +76,33 @@ export function createWindowsAutostartService({
     );
   }
 
+  function legacyEntryPath() {
+    return pathImpl.join(
+      resolveWindowsStartupDirectory(env, pathImpl),
+      LEGACY_WINDOWS_AUTOSTART_FILENAME,
+    );
+  }
+
   function getState() {
+    // The legacy-named entry still counts as "enabled": it starts the relay at
+    // sign-in exactly like the current name does, and reporting it as off
+    // would invite enabling a second copy next to it.
+    const enabled = supported
+      && (fsImpl.existsSync(entryPath()) || fsImpl.existsSync(legacyEntryPath()));
     return {
       supported,
-      enabled: supported ? fsImpl.existsSync(entryPath()) : false,
+      enabled: supported ? enabled : false,
       platform,
     };
   }
 
+  function removeLegacyEntry() {
+    const target = legacyEntryPath();
+    if (!fsImpl.existsSync(target)) return false;
+    fsImpl.unlinkSync(target);
+    return true;
+  }
+
   function setEnabled(enabled) {
     if (!supported) {
       throw new Error('Windows autostart is only available on Windows.');
@@ -83,14 +114,19 @@ export function createWindowsAutostartService({
     const targetPath = entryPath();
     const existed = fsImpl.existsSync(targetPath);
     if (!enabled) {
+      const removedLegacy = removeLegacyEntry();
       if (existed) fsImpl.unlinkSync(targetPath);
-      return { ...getState(), changed: existed };
+      return { ...getState(), changed: existed || removedLegacy };
     }
+    // Enabling always converges on the one current filename; if only the
+    // legacy entry existed, the current-name write below reports the change.
+    removeLegacyEntry();
 
     const script = buildWindowsAutostartScript({
       packageRoot,
       nodePath,
       configPath,
+      workingDirectory: resolveOarRoot(env, platform),
       pathImpl,
     });
     if (existed && fsImpl.readFileSync(targetPath, 'utf8') === script) {