@or3/cloud 0.1.54 → 0.1.56

package/assets/dashboard-operator.mjs

@@ -28,6 +28,7 @@ const maxRegistryBytes = 256 * 1024;
 const maxAttestationBytes = 1024 * 1024;
 const maxProcessOutputBytes = 64 * 1024;
 const maxUpdateDurationMs = 15 * 60 * 1000;
+const operatorHandoffTimeoutMs = 2 * 60 * 1000;
 let updateClaimed = false;
 const checkAttempts = [];
 const startAttempts = [];
@@ -607,35 +608,86 @@ function closeAfter(server, code) {
   setTimeout(() => server.close(() => process.exit(code)), 250).unref();
 }
 
-/**
- * A dashboard-origin update cannot recreate its own container before the CLI
- * has committed terminal state. Once the job is durable, ask Docker to replace
- * only this sidecar from the newly written digest-qualified overlay. The
- * detached Docker client survives the current container's termination.
- */
-function recreateOperatorAfterCommit(environment) {
-  const project = envValue(environment, 'OR3_COMPOSE_PROJECT');
-  if (!project) return;
-  try {
-    const child = spawn('docker', [
-      'compose',
-      '--project-name', project,
-      '--project-directory', deploymentDirectory,
-      '--env-file', join(deploymentDirectory, '.env'),
-      '-f', join(deploymentDirectory, 'compose.yaml'),
-      '-f', join(deploymentDirectory, 'compose.operator.yaml'),
-      'up', '-d', '--no-deps', '--force-recreate', 'or3-operator',
-    ], {
-      cwd: deploymentDirectory,
-      env: process.env,
-      detached: process.platform !== 'win32',
-      stdio: 'ignore',
-    });
-    child.unref();
-  } catch {
-    // The durable terminal job and restart policy still leave a host-CLI
-    // recovery path if Docker cannot schedule the sidecar replacement.
+async function completeOperatorHandoff(jobId, project) {
+  if (!requestIdPattern.test(jobId || '') || !/^[a-z0-9][a-z0-9_-]*$/i.test(project || '')) {
+    throw new Error('The dashboard operator handoff arguments are invalid.');
+  }
+  const deadline = Date.now() + operatorHandoffTimeoutMs;
+  while (Date.now() < deadline) {
+    const job = await readJob();
+    let state;
+    try {
+      state = JSON.parse(await readFile(statePath, 'utf8'));
+    } catch {
+      state = undefined;
+    }
+    if (
+      job?.id === jobId
+      && ['succeeded', 'failed', 'needs_attention'].includes(job.phase)
+      && state
+      && !state.incompleteOperation
+    ) {
+      const environment = await deploymentEnv();
+      if (envValue(environment, 'OR3_DASHBOARD_UPDATES_ENABLED') !== 'true') return;
+      const serviceFilters = [
+        '--filter', `label=com.docker.compose.project=${project}`,
+        '--filter', 'label=com.docker.compose.service=or3-operator',
+      ];
+      let lastOutput = '';
+      for (let attempt = 0; attempt < 6; attempt += 1) {
+        // Old protocol-v1 operators may start their own Compose replacement
+        // after writing the terminal job. Removing every container for this
+        // one stateless service also kills that in-container Compose child and
+        // clears any half-created successor without touching the application.
+        for (let sweep = 0; sweep < 2; sweep += 1) {
+          const listed = await runProcess('docker', ['ps', '-aq', ...serviceFilters], {
+            cwd: deploymentDirectory,
+            env: process.env,
+            timeoutMs: 30_000,
+          });
+          lastOutput = listed.output;
+          const containerIds = listed.code === 0
+            ? listed.output.split(/\s+/).filter((value) => /^[0-9a-f]{12,64}$/i.test(value))
+            : [];
+          if (containerIds.length > 0) {
+            const removed = await runProcess('docker', ['rm', '--force', ...containerIds], {
+              cwd: deploymentDirectory,
+              env: process.env,
+              timeoutMs: 30_000,
+            });
+            lastOutput = `${lastOutput}\n${removed.output}`.trim();
+          }
+          await delay(750);
+        }
+        const compose = [
+          'compose',
+          '--project-name', project,
+          '--project-directory', deploymentDirectory,
+          '--env-file', join(deploymentDirectory, '.env'),
+          '-f', join(deploymentDirectory, 'compose.yaml'),
+          '-f', join(deploymentDirectory, 'compose.operator.yaml'),
+        ];
+        const restarted = await runProcess('docker', [...compose, 'up', '-d', '--no-deps', 'or3-operator'], {
+          cwd: deploymentDirectory,
+          env: process.env,
+          timeoutMs: 60_000,
+        });
+        const running = restarted.code === 0
+          ? await runProcess('docker', [...compose, 'ps', '--status', 'running', '-q', 'or3-operator'], {
+              cwd: deploymentDirectory,
+              env: process.env,
+              timeoutMs: 30_000,
+            })
+          : { code: restarted.code, output: '' };
+        lastOutput = `${lastOutput}\n${restarted.output}\n${running.output}`.trim();
+        if (restarted.code === 0 && running.code === 0 && /^[0-9a-f]{12,64}$/i.test(running.output.trim())) return;
+        await delay(2_000);
+      }
+      throw new Error(`The dashboard operator handoff could not start its successor: ${lastOutput}`);
+    }
+    await delay(250);
   }
+  throw new Error('The dashboard operator handoff did not observe a durable terminal job.');
 }
 
 async function finish(server, job, error) {
@@ -644,21 +696,17 @@ async function finish(server, job, error) {
   if (error) job.error = error instanceof Error ? error.message : 'The update did not complete. OR3 restored the previous verified deployment when possible.';
   await writeJob(job);
   await audit(error ? 'update_failed' : 'update_succeeded', { jobId: job.id, targetVersion: job.targetVersion });
-  // A successful run restarts this narrowly scoped service so it reloads the
-  // just-installed operator program. Failed first-time enablement exits cleanly
-  // because the restored .env no longer declares the profile.
+  // The target CLI schedules a separate helper container before returning.
+  // That helper can survive replacing this container after the terminal job
+  // and lifecycle journal are durable. A process inside this container cannot.
   let enabled = true;
   try {
     const environment = await deploymentEnv();
     enabled = envValue(environment, 'OR3_DASHBOARD_UPDATES_ENABLED') === 'true';
-    if (enabled) recreateOperatorAfterCommit(environment);
   } catch {
-    // Keep the service restart-on-failure behavior when state cannot be read.
+    // Keep serving the durable job when state cannot be read.
   }
-  // A disabled bridge must stay down after a host update/restore. When it is
-  // still enabled, restart the sidecar so Docker recreates it from the just
-  // committed digest-qualified overlay and reloads the operator asset.
-  closeAfter(server, enabled ? 75 : 0);
+  if (!enabled) closeAfter(server, 0);
 }
 
 async function reconcileInterruptedJob() {
@@ -870,5 +918,9 @@ async function main() {
 }
 
 if (process.argv[1] && resolve(process.argv[1]) === resolve(fileURLToPath(import.meta.url))) {
-  await main();
+  if (process.argv[2] === '--complete-handoff') {
+    await completeOperatorHandoff(process.argv[3], process.argv[4]);
+  } else {
+    await main();
+  }
 }

package/dist/cli.mjs

@@ -30,7 +30,7 @@ import { fileURLToPath } from "node:url";
 import { createGunzip } from "node:zlib";
 var execFile = promisify(execFileCallback);
 var PACKAGE_ROOT = resolve(fileURLToPath(new URL("../", import.meta.url)));
-var PACKAGE_VERSION = "0.1.54";
+var PACKAGE_VERSION = "0.1.56";
 var IMAGE_REPOSITORY = "ghcr.io/saluana/or3-chat";
 var ASSET_ROOT = resolve(fileURLToPath(new URL("../assets/", import.meta.url)));
 var STATE_SCHEMA_VERSION = 1;
@@ -42,6 +42,8 @@ var BACKUP_RETENTION_KEEP = 5;
 var PURGE_REQUIRES_BACKUP_WITHIN_MS = 24 * 60 * 60 * 1000;
 var FREE_SPACE_HEADROOM_BYTES = 64 * 1024 * 1024;
 var BACKUP_ID_PATTERN = /^backup-[0-9A-Za-z-]+$/;
+var DASHBOARD_JOB_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var COMPOSE_PROJECT_PATTERN = /^[a-z0-9][a-z0-9_-]*$/i;
 var MANAGED_ASSET_INVENTORY_VERSION = 3;
 var DASHBOARD_LEASE_STALE_MS = 30000;
 var PROVISIONING_CREDENTIAL_KEYS = [
@@ -1398,6 +1400,54 @@ async function prepareVerifiedDashboardOperator(directory, version) {
   console.warn("Dashboard updates are unavailable on this Docker setup; the deployment will remain host-CLI managed.");
   return;
 }
+function dashboardOperatorHandoffArgs(directory, env, jobId) {
+  const project = env.OR3_COMPOSE_PROJECT;
+  if (!isAbsolute(directory) || !DASHBOARD_JOB_ID_PATTERN.test(jobId) || !COMPOSE_PROJECT_PATTERN.test(project ?? "") || !/^\d+$/.test(env.OR3_OPERATOR_UID ?? "") || !/^\d+$/.test(env.OR3_OPERATOR_GID ?? "") || !/^\d+$/.test(env.OR3_DOCKER_GID ?? "") || !isAbsolute(env.OR3_DOCKER_SOCKET ?? "") || !/@sha256:[0-9a-f]{64}$/i.test(env.OR3_OPERATOR_IMAGE ?? "")) {
+    throw new Error("Refusing to schedule an invalid dashboard operator handoff.");
+  }
+  return [
+    "run",
+    "--detach",
+    "--rm",
+    "--network",
+    "none",
+    "--read-only",
+    "--name",
+    `${project}-operator-handoff-${jobId}`,
+    "--user",
+    `${env.OR3_OPERATOR_UID}:${env.OR3_OPERATOR_GID}`,
+    "--group-add",
+    env.OR3_DOCKER_GID,
+    "--security-opt",
+    "no-new-privileges:true",
+    "--cap-drop",
+    "ALL",
+    "--mount",
+    `type=bind,src=${env.OR3_DOCKER_SOCKET},dst=/var/run/docker.sock`,
+    "--mount",
+    `type=bind,src=${directory},dst=${directory},readonly`,
+    "--workdir",
+    directory,
+    "--tmpfs",
+    "/tmp:rw,noexec,nosuid,size=16m",
+    "--entrypoint",
+    "/usr/local/bin/node",
+    env.OR3_OPERATOR_IMAGE,
+    join(directory, "dashboard-operator.mjs"),
+    "--complete-handoff",
+    jobId,
+    project
+  ];
+}
+async function scheduleDashboardOperatorHandoff(directory, env) {
+  const jobId = process.env.OR3_DASHBOARD_UPDATE_JOB_ID?.trim();
+  if (!jobId || env.OR3_DASHBOARD_UPDATES_ENABLED !== "true")
+    return;
+  const scheduled = await run("docker", dashboardOperatorHandoffArgs(directory, env, jobId), directory);
+  if (!scheduled.ok || !/^[0-9a-f]{12,64}$/i.test(scheduled.stdout.trim())) {
+    throw new Error(`Could not schedule the dashboard operator handoff. ${scheduled.stderr.trim()}`);
+  }
+}
 var DASHBOARD_OPERATOR_ENV_KEYS = [
   "OR3_DASHBOARD_UPDATES_ENABLED",
   "OR3_OPERATOR_IMAGE",
@@ -2926,8 +2976,9 @@ async function updateCommand(directory, flags) {
     state.deploymentRoot = resolve(loaded.directory);
     state.lastSuccessfulOperation = "update";
     state.lastError = undefined;
-    await clearPending(loaded.directory, state);
     await pruneBackups(loaded.directory, state, BACKUP_RETENTION_KEEP, false);
+    await scheduleDashboardOperatorHandoff(loaded.directory, nextEnv);
+    await clearPending(loaded.directory, state);
     console.log(`OR3 updated to ${targetVersion}. Image digest: ${digest}`);
     console.log(`Rollback point: ${backup.backupId}. Keep it until login, chat, and file checks pass.`);
   } catch (error) {
@@ -4590,6 +4641,7 @@ export {
   parseEnv,
   managedAssetNames,
   isVersion,
+  dashboardOperatorHandoffArgs,
   copyAssets,
   checkResolvedLoopbackBinding,
   buildEnv,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@or3/cloud",
-  "version": "0.1.54",
+  "version": "0.1.56",
   "description": "Install and operate the OR3 Cloud container distribution",
   "type": "module",
   "license": "GPL-3.0",
@@ -18,9 +18,9 @@
   "or3Cloud": {
     "dashboardUpdateProtocol": 1,
     "dashboardUpdateMinimumSourceVersion": "0.1.40",
-    "imageDigest": "sha256:1879df6bcd518473bc4bed7374ac7a94bce802118a113945249b3e4b5437d103",
-    "operatorImageDigest": "sha256:6426859d57ad2d13c1be6ec7c37211b738298a6944e9e6e55e972696ecf2bb9a",
-    "sourceRevision": "ed4fe2466010032aeace7de75a5a447be6bac0c1"
+    "imageDigest": "sha256:9d594d40e303149f52afca1b9a1df361a427b3ab347fcf794ea30f2e1f0ac9fc",
+    "operatorImageDigest": "sha256:4aa56bef475b2c1fd5f79f72e5c93433f9a3f0aaf0432cc7b823f6537407a125",
+    "sourceRevision": "7a6749f0f6d33390098ab030d38bafefb841d8c7"
   },
   "files": [
     "dist",