@ramarivera/coding-buddy 0.9.4 → 0.9.5

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
     },
     "metadata": {
         "description": "Persistent coding companion for Claude Code, Pi, and Oh My Pi (requires bun: https://bun.sh/install)",
-        "version": "0.9.4"
+        "version": "0.9.5"
     },
     "plugins": [
         {
             "name": "coding-buddy",
             "source": "./",
             "description": "Persistent coding companion for Claude Code, Pi, and Oh My Pi. MCP-based terminal pet with ASCII art, stats, reactions, and personality. Requires bun runtime (https://bun.sh/install).",
-            "version": "0.9.4",
+            "version": "0.9.5",
             "author": {
                 "name": "ramarivera"
             },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "coding-buddy",
-    "version": "0.9.4",
+    "version": "0.9.5",
     "description": "Persistent coding companion for Claude Code, Pi, and Oh My Pi. MCP-based terminal pet with ASCII art, stats, reactions, and personality.",
     "author": {
         "name": "ramarivera"

package/cli/install.ts

@@ -7,7 +7,7 @@
  * ~/.claude/ layout when the env var is unset.
  */
 
-import { readFileSync, writeFileSync, mkdirSync, existsSync, cpSync } from "fs";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, cpSync, rmSync } from "fs";
 import { execFileSync, execSync } from "child_process";
 import { resolve, dirname, join } from "path";
 
@@ -22,7 +22,12 @@ import {
 } from "../server/path.ts";
 import { loadCompanion, saveCompanion, resolveUserId, writeStatusState } from "../server/state.ts";
 import { generateFallbackName } from "../core/reactions.ts"
-import { copyRuntimeApp, stableRuntimePaths } from "./runtime-app.ts";
+import {
+  installRuntimeAppAtomically,
+  redactSecrets,
+  stableRuntimePaths,
+  supportsTextLockfile,
+} from "./runtime-app.ts";
 
 /** Recognise any buddy-owned hook command, however it is pathed. */
 function isBuddyHookCommand(command: unknown): boolean {
@@ -261,10 +266,31 @@ function installHooks(settings: Record<string, any>, appDir: string) {
 }
 
 function installRuntimeApp(): string {
-  const appDir = copyRuntimeApp(PROJECT_ROOT, buddyStateDir());
-  const installArgs = ["install", "--production", "--ignore-scripts"];
-  if (existsSync(join(appDir, "bun.lock"))) installArgs.push("--frozen-lockfile");
-  execFileSync("bun", installArgs, { cwd: appDir, stdio: "ignore" });
+  const appDir = installRuntimeAppAtomically(PROJECT_ROOT, buddyStateDir(), (stagingDir) => {
+    const installArgs = ["install", "--production", "--ignore-scripts"];
+    const lockfile = join(stagingDir, "bun.lock");
+    if (existsSync(lockfile)) {
+      const bunVersion = execFileSync("bun", ["--version"], { encoding: "utf8" }).trim();
+      if (supportsTextLockfile(bunVersion)) {
+        installArgs.push("--frozen-lockfile");
+      } else {
+        rmSync(lockfile, { force: true });
+        warn(`Bun ${bunVersion} cannot read bun.lock (needs 1.2 or newer); installing dependencies unpinned. Upgrade Bun for a reproducible install.`);
+      }
+    }
+    try {
+      execFileSync("bun", installArgs, { cwd: stagingDir, stdio: ["ignore", "pipe", "pipe"], encoding: "utf8" });
+    } catch (error) {
+      // Show bun's own output: without it a dependency failure reads as a bare
+      // "Command failed" and the user cannot tell what broke. The original
+      // error is not attached as `cause` because it carries the raw output.
+      const failure = error as { stdout?: string; stderr?: string };
+      const output = redactSecrets([failure.stdout, failure.stderr].filter(Boolean).join("\n").trim());
+      throw new Error(
+        `bun ${installArgs.join(" ")} failed${output ? `:\n${output}` : ""}\nThe previous runtime app, if any, was left in place.`,
+      );
+    }
+  });
   ok(`Stable runtime installed: ${appDir}`);
   return appDir;
 }

package/cli/runtime-app.ts

@@ -1,5 +1,6 @@
-import { cpSync, existsSync, mkdirSync, rmSync } from "fs";
+import { cpSync, existsSync, mkdirSync, rmSync, renameSync } from "fs";
 import { join } from "path";
+import { randomUUID } from "crypto";
 
 export const RUNTIME_DIRECTORIES = [
   "core",
@@ -11,6 +12,13 @@ export const RUNTIME_DIRECTORIES = [
 
 export const RUNTIME_FILES = ["package.json", "bun.lock"] as const;
 
+/**
+ * npm never packs a file named bun.lock, so the published tarball carries the
+ * lockfile as runtime.bun.lock (written by the prepack script). A git checkout
+ * has the real bun.lock instead.
+ */
+export const PACKED_LOCKFILE = "runtime.bun.lock";
+
 export function stableRuntimeAppDir(stateDir: string): string {
   return join(stateDir, "app");
 }
@@ -25,12 +33,28 @@ export function stableRuntimePaths(appDir: string) {
   };
 }
 
+export const STAGING_PREFIX = "app.staging-";
+
 /**
- * Replace the stable runtime copy. The app directory is owned by the
- * installer, so removing it first also removes files deleted by an upgrade.
+ * A staging directory unique to this install, so two installers running at
+ * once (a manual run and a post-apply hook, say) never delete each other's
+ * in-progress dependency install.
  */
-export function copyRuntimeApp(sourceRoot: string, stateDir: string): string {
-  const appDir = stableRuntimeAppDir(stateDir);
+export function stagingRuntimeAppDir(stateDir: string): string {
+  return join(stateDir, `${STAGING_PREFIX}${process.pid}-${randomUUID().slice(0, 8)}`);
+}
+
+/**
+ * Write a fresh runtime copy into `targetDir`, the stable app directory by
+ * default. The directory is owned by the installer, so removing it first also
+ * removes files deleted by an upgrade.
+ */
+export function copyRuntimeApp(
+  sourceRoot: string,
+  stateDir: string,
+  targetDir: string = stableRuntimeAppDir(stateDir),
+): string {
+  const appDir = targetDir;
   rmSync(appDir, { recursive: true, force: true });
   mkdirSync(appDir, { recursive: true });
 
@@ -45,5 +69,133 @@ export function copyRuntimeApp(sourceRoot: string, stateDir: string): string {
     if (existsSync(source)) cpSync(source, join(appDir, file), { force: true });
   }
 
+  const packedLock = join(sourceRoot, PACKED_LOCKFILE);
+  const appLock = join(appDir, "bun.lock");
+  if (!existsSync(appLock) && existsSync(packedLock)) cpSync(packedLock, appLock);
+
   return appDir;
 }
+
+/**
+ * Build the runtime app next to the live one and swap it in only after
+ * `prepare` (the dependency install) succeeds. A failed install then leaves
+ * the previous working app, and the MCP registration that points at it,
+ * untouched.
+ */
+export function installRuntimeAppAtomically(
+  sourceRoot: string,
+  stateDir: string,
+  prepare: (stagingDir: string) => void,
+): string {
+  const appDir = stableRuntimeAppDir(stateDir);
+  const stagingDir = stagingRuntimeAppDir(stateDir);
+  try {
+    copyRuntimeApp(sourceRoot, stateDir, stagingDir);
+    prepare(stagingDir);
+  } catch (error) {
+    rmSync(stagingDir, { recursive: true, force: true });
+    throw error;
+  }
+  promoteStagedApp(stagingDir, appDir);
+  return appDir;
+}
+
+const PROMOTE_ATTEMPTS = 3;
+export const PREVIOUS_PREFIX = "app.previous-";
+
+/**
+ * Swap the staged app into place without ever leaving the user with no app.
+ *
+ * The live app is moved aside, not deleted, and is moved back if the staged
+ * app cannot take its place. Another installer can recreate `appDir` in the
+ * middle of the swap, so the swap retries; if it still cannot rename and a
+ * complete app from that other installer is in place, that app is kept.
+ * Staging and moved-aside copies are removed on every path.
+ */
+export function promoteStagedApp(
+  stagingDir: string,
+  appDir: string,
+  rename: (from: string, to: string) => void = renameSync,
+): void {
+  const backups: string[] = [];
+  let lastError: unknown;
+  // True only when our move-in failed because an app we did not put there was
+  // in the way: another installer finished between our two renames.
+  let displacedByOther = false;
+  // Where the previous app was left if it could be neither replaced nor put
+  // back. Kept across retries so the final error can always name it.
+  let stranded: string | undefined;
+
+  for (let attempt = 0; attempt < PROMOTE_ATTEMPTS; attempt++) {
+    const backup = `${appDir}.previous-${process.pid}-${randomUUID().slice(0, 8)}`;
+    let movedAside = false;
+    let promoting = false;
+    displacedByOther = false;
+    try {
+      if (existsSync(appDir)) {
+        backups.push(backup);
+        rename(appDir, backup);
+        movedAside = true;
+      }
+      promoting = true;
+      rename(stagingDir, appDir);
+      for (const dir of backups) rmSync(dir, { recursive: true, force: true });
+      if (stranded) rmSync(stranded, { recursive: true, force: true });
+      return;
+    } catch (error) {
+      lastError = error;
+      displacedByOther = promoting && existsSync(appDir);
+      if (movedAside && !existsSync(appDir)) {
+        try {
+          rename(backup, appDir);
+        } catch {
+          // Leave the moved-aside copy where it is; the final error names it.
+          backups.splice(backups.indexOf(backup), 1);
+          stranded = backup;
+        }
+      }
+    }
+  }
+
+  rmSync(stagingDir, { recursive: true, force: true });
+  for (const dir of backups) rmSync(dir, { recursive: true, force: true });
+  // Another installer's complete app is in place: keep it. Every other
+  // failure, including never getting the old app out of the way, is an error.
+  if (displacedByOther && existsSync(stableRuntimePaths(appDir).mcpServer)) {
+    if (stranded) rmSync(stranded, { recursive: true, force: true });
+    return;
+  }
+  if (stranded) {
+    throw new Error(
+      `Could not install the new runtime app or put the previous one back. The previous app is at ${stranded}; rename it to ${appDir} to recover.`,
+      { cause: lastError },
+    );
+  }
+  throw lastError;
+}
+
+/**
+ * bun.lock is Bun's text lockfile, which Bun reads from 1.2.0 on. Older Bun
+ * rejects it under --frozen-lockfile, so the installer drops the lockfile for
+ * those versions and installs unpinned, as it did before the lockfile shipped.
+ */
+export function supportsTextLockfile(bunVersion: string): boolean {
+  const match = /^(\d+)\.(\d+)\./.exec(bunVersion.trim());
+  if (!match) return false;
+  const major = Number(match[1]);
+  const minor = Number(match[2]);
+  return major > 1 || (major === 1 && minor >= 2);
+}
+
+/**
+ * Strip registry credentials from tool output before it is shown. Bun before
+ * 1.1.34 could echo an .npmrc token in a warning.
+ */
+export function redactSecrets(text: string): string {
+  return text
+    .replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/gi, "$1[redacted]@")
+    .replace(/(_authToken|_auth|_password)\s*=\s*\S+/gi, "$1=[redacted]")
+    .replace(/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/g, "$1 [redacted]")
+    .replace(/\bnpm_[A-Za-z0-9]{20,}\b/g, "[redacted]");
+}
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ramarivera/coding-buddy",
-  "version": "0.9.4",
+  "version": "0.9.5",
   "description": "Persistent coding companion for Claude Code, Pi, and Oh My Pi",
   "type": "module",
   "omp": {
@@ -38,6 +38,8 @@
     "gen:emoji-widths": "bun run scripts/gen-emoji-widths.ts",
     "sync-version": "bun run scripts/sync-version.ts",
     "version": "bun run sync-version && git add .claude-plugin",
+    "prepack": "node -e \"require('fs').copyFileSync('bun.lock','runtime.bun.lock')\"",
+    "postpack": "node -e \"require('fs').rmSync('runtime.bun.lock',{force:true})\"",
     "ci:statusline": "bash scripts/ci/check-statusline.sh",
     "ci:vhs:render": "bash scripts/ci/render-vhs-goldens.sh",
     "ci:vhs:update": "bash scripts/ci/render-vhs-goldens.sh --update",
@@ -53,6 +55,7 @@
     "statusline/",
     "scripts/",
     ".claude-plugin/",
+    "runtime.bun.lock",
     "!**/*.test.ts"
   ],
   "keywords": [