@saadnvd1/agent-os 0.3.680 → 0.3.691

package/scripts/install-deps

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# Install this checkout's dependencies the one way AgentOS does: pnpm, frozen
+# to pnpm-lock.yaml, only the build scripts pnpm-workspace.yaml allows, then a
+# check that the native modules work and the PDF browser. For first installs
+# (setup, `agent-os install`); a running server's updates go through
+# scripts/redeploy, which installs beside the live tree.
+#   scripts/install-deps [--no-browser]
+set -euo pipefail
+cd "$(dirname "$0")/.."
+# shellcheck source=lib/pnpm.sh
+source scripts/lib/pnpm.sh
+
+if [ -s "$HOME/.nvm/nvm.sh" ]; then
+  # shellcheck disable=SC1091
+  source "$HOME/.nvm/nvm.sh" >/dev/null
+  nvm use >/dev/null
+fi
+use_pnpm
+
+# devDependencies are needed to build, even when the shell has NODE_ENV=production.
+unset NODE_ENV npm_config_production npm_config_omit
+pnpm install --frozen-lockfile
+node scripts/check-native.mjs
+[ "${1:-}" = "--no-browser" ] || install_pdf_browser

package/scripts/lib/commands.sh

@@ -43,7 +43,7 @@ cmd_install() {
 
     # Install dependencies
     log_info "Installing dependencies..."
-    npm install --include=dev --legacy-peer-deps
+    scripts/install-deps
 
     # Build for production
     log_info "Building for production..."
@@ -296,7 +296,7 @@ cmd_update() {
         git pull --ff-only
 
         log_info "Installing dependencies..."
-        npm install --include=dev --legacy-peer-deps
+        scripts/install-deps
 
         log_info "Rebuilding..."
         npm run build

package/scripts/lib/deps-swap.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# Install dependencies beside the live ones, prove the native modules work in
+# them, and only then swap them in. A deploy that brings a broken install
+# fails here, and the node_modules the running server reads is never touched.
+# The tree being replaced stays in .deps/prev for one rollback.
+# Sourced by scripts/redeploy; run from the repository root, after use_pnpm.
+# Test hooks: AGENTOS_INSTALL_CMD (default `pnpm install --frozen-lockfile`),
+# AGENTOS_NATIVE_CHECK (default `node scripts/check-native.mjs <dir>`).
+
+DEPS=.deps
+STAGE=$DEPS/stage
+PREV=$DEPS/prev
+STAMP=.agentos-deps
+
+# What an install depends on. A new Node or CPU rebuilds the native modules.
+deps_stamp() {
+  {
+    cat package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc 2>/dev/null
+    node -p 'process.version + process.platform + process.arch'
+  } | shasum -a 256 | cut -d' ' -f1
+}
+
+# 0 and a staged tree to swap in, or 10 when the live install is already
+# right, or 1 with the live tree untouched.
+install_beside() {
+  local stamp
+  stamp=$(deps_stamp)
+  if [ -d node_modules ] && [ "$(cat "node_modules/$STAMP" 2>/dev/null)" = "$stamp" ]; then
+    echo "Dependencies unchanged."
+    # The last build ran on these same dependencies, so a rollback has
+    # nothing to put back.
+    rm -rf "$PREV"
+    return 10
+  fi
+  rm -rf "$STAGE"
+  mkdir -p "$STAGE"
+  cp package.json pnpm-lock.yaml pnpm-workspace.yaml "$STAGE/"
+  [ -f .npmrc ] && cp .npmrc "$STAGE/"
+  # HUSKY=0: the staged copy is not a git checkout.
+  if ! (cd "$STAGE" && HUSKY=0 bash -c "${AGENTOS_INSTALL_CMD:-pnpm install --frozen-lockfile}"); then
+    rm -rf "$STAGE"
+    echo "Install failed; the live node_modules is untouched." >&2
+    return 1
+  fi
+  if ! bash -c "${AGENTOS_NATIVE_CHECK:-node scripts/check-native.mjs \"\$1\"}" _ "$STAGE/node_modules"; then
+    rm -rf "$STAGE"
+    echo "Native modules do not load in the new install; the live node_modules is untouched." >&2
+    return 1
+  fi
+  echo "$stamp" > "$STAGE/node_modules/$STAMP"
+}
+
+swap_deps() {
+  [ -d "$STAGE/node_modules" ] || { echo "no checked install to swap in" >&2; return 1; }
+  rm -rf "$PREV"
+  mkdir -p "$DEPS"
+  [ -d node_modules ] && mv node_modules "$PREV"
+  mv "$STAGE/node_modules" node_modules
+  rm -rf "$STAGE"
+}
+
+# Put the node_modules from before the last swap back (a failed build, or
+# `redeploy --rollback`); the current one is dropped.
+restore_deps() {
+  [ -d "$PREV" ] || return 0
+  rm -rf node_modules
+  mv "$PREV" node_modules
+}

package/scripts/lib/deps-swap.test.ts

@@ -0,0 +1,115 @@
+import { spawnSync } from "node:child_process";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { tempDir } from "@/lib/test-temp";
+
+const LIB = join(import.meta.dirname, "deps-swap.sh");
+
+let dir: string;
+const read = (p: string) => readFileSync(join(dir, p), "utf8");
+
+// Runs the library's functions in `dir` with a fake install and native check.
+function run(script: string, env: Record<string, string> = {}) {
+  return spawnSync("bash", ["-c", `source "${LIB}"; ${script}`], {
+    cwd: dir,
+    encoding: "utf8",
+    env: { ...process.env, ...env },
+  });
+}
+
+const INSTALL = "mkdir -p node_modules && echo new > node_modules/marker";
+
+beforeEach(() => {
+  dir = tempDir("deps-swap-");
+  for (const f of ["package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml"])
+    writeFileSync(join(dir, f), `{}\n`);
+  mkdirSync(join(dir, "node_modules"));
+  writeFileSync(join(dir, "node_modules/marker"), "old\n");
+});
+afterEach(() => rmSync(dir, { recursive: true, force: true }));
+
+describe("install_beside", () => {
+  it("installs beside, checks, and swaps in; the old tree is kept for a rollback", () => {
+    const r = run("install_beside && swap_deps", {
+      AGENTOS_INSTALL_CMD: INSTALL,
+      AGENTOS_NATIVE_CHECK: "true",
+    });
+    expect(r.status).toBe(0);
+    expect(read("node_modules/marker")).toBe("new\n");
+    expect(read(".deps/prev/marker")).toBe("old\n");
+    expect(existsSync(join(dir, ".deps/stage"))).toBe(false);
+  });
+
+  it("leaves the live node_modules alone when the native check fails", () => {
+    const r = run("install_beside", {
+      AGENTOS_INSTALL_CMD: INSTALL,
+      AGENTOS_NATIVE_CHECK: "exit 1",
+    });
+    expect(r.status).toBe(1);
+    expect(r.stderr).toContain("Native modules do not load");
+    expect(read("node_modules/marker")).toBe("old\n");
+    expect(existsSync(join(dir, ".deps/stage"))).toBe(false);
+  });
+
+  it("leaves the live node_modules alone when the install fails", () => {
+    const r = run("install_beside", {
+      AGENTOS_INSTALL_CMD: "exit 3",
+      AGENTOS_NATIVE_CHECK: "true",
+    });
+    expect(r.status).toBe(1);
+    expect(read("node_modules/marker")).toBe("old\n");
+  });
+
+  it("skips the install when nothing it depends on changed", () => {
+    const first = run("install_beside && swap_deps", {
+      AGENTOS_INSTALL_CMD: INSTALL,
+      AGENTOS_NATIVE_CHECK: "true",
+    });
+    expect(first.status).toBe(0);
+    const again = run("install_beside", {
+      AGENTOS_INSTALL_CMD: "exit 9",
+      AGENTOS_NATIVE_CHECK: "exit 9",
+    });
+    expect(again.status).toBe(10);
+    // A rollback has nothing to restore: the last build used these same deps.
+    expect(existsSync(join(dir, ".deps/prev"))).toBe(false);
+  });
+
+  it("installs again when the lockfile changes", () => {
+    run("install_beside && swap_deps", {
+      AGENTOS_INSTALL_CMD: INSTALL,
+      AGENTOS_NATIVE_CHECK: "true",
+    });
+    writeFileSync(join(dir, "pnpm-lock.yaml"), "changed\n");
+    const r = run("install_beside", {
+      AGENTOS_INSTALL_CMD: INSTALL,
+      AGENTOS_NATIVE_CHECK: "true",
+    });
+    expect(r.status).toBe(0);
+  });
+});
+
+describe("restore_deps", () => {
+  it("puts the previous node_modules back after a swap", () => {
+    run("install_beside && swap_deps && restore_deps", {
+      AGENTOS_INSTALL_CMD: INSTALL,
+      AGENTOS_NATIVE_CHECK: "true",
+    });
+    expect(read("node_modules/marker")).toBe("old\n");
+    expect(existsSync(join(dir, ".deps/prev"))).toBe(false);
+  });
+
+  it("does nothing without a previous tree", () => {
+    rmSync(join(dir, ".deps"), { recursive: true, force: true });
+    const r = run("restore_deps");
+    expect(r.status).toBe(0);
+    expect(read("node_modules/marker")).toBe("old\n");
+  });
+});

package/scripts/lib/pnpm.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Make `pnpm` runnable: the pinned version comes from package.json's
+# packageManager field through corepack (bundled with Node 22; Node 25+ needs
+# `npm i -g corepack`). Sourced by scripts/install-deps and scripts/redeploy.
+
+use_pnpm() {
+  export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+  if ! command -v pnpm >/dev/null 2>&1 && command -v corepack >/dev/null 2>&1; then
+    corepack enable pnpm >/dev/null 2>&1 || true
+  fi
+  if ! command -v pnpm >/dev/null 2>&1; then
+    echo "pnpm is not available. Use Node 22 (it bundles corepack: corepack enable pnpm) or npm i -g corepack." >&2
+    return 1
+  fi
+}
+
+# Share -> Download -> PDF prints with Playwright's headless shell, at the
+# revision the locked playwright package names. A failed download only warns:
+# a deploy must not hang on a CDN, and the PDF option hides itself without a
+# browser. Run after the install, from the repository root.
+install_pdf_browser() {
+  if ! pnpm exec playwright install chromium-headless-shell; then
+    echo "Warning: could not download the PDF browser; share PDF is unavailable until 'pnpm exec playwright install chromium-headless-shell' succeeds." >&2
+    return 0
+  fi
+  if [ "$(uname -s)" = Linux ]; then
+    local bin missing
+    bin=$(node -e 'const p=require("playwright").chromium.executablePath();const fs=require("fs"),path=require("path");const root=path.dirname(path.dirname(path.dirname(p)));const d=fs.readdirSync(root).filter(x=>x.startsWith("chromium_headless_shell-")).sort().pop();if(d){const b=fs.readdirSync(path.join(root,d)).find(x=>x.startsWith("chrome-headless-shell-"));if(b)console.log(path.join(root,d,b,"chrome-headless-shell"))}' 2>/dev/null || true)
+    if [ -n "$bin" ] && command -v ldd >/dev/null 2>&1; then
+      missing=$(ldd "$bin" 2>/dev/null | grep -c 'not found' || true)
+      if [ "${missing:-0}" -gt 0 ]; then
+        echo "Warning: the PDF browser is missing $missing system libraries; run: sudo pnpm exec playwright install-deps chromium-headless-shell" >&2
+      fi
+    fi
+  fi
+}

package/scripts/lib/prerequisites.sh

@@ -47,7 +47,7 @@ check_node() {
     if command -v node &> /dev/null; then
         local version
         version=$(node -v | sed 's/v//' | cut -d. -f1)
-        if [[ "$version" -ge 20 ]]; then
+        if [[ "$version" -ge 22 ]]; then
             local node_path=$(command -v node)
             log_success "Found Node.js v$(node -v | sed 's/v//') at $node_path"
             return 0
@@ -60,7 +60,7 @@ check_node() {
     if command -v node &> /dev/null; then
         local version
         version=$(node -v | sed 's/v//' | cut -d. -f1)
-        if [[ "$version" -ge 20 ]]; then
+        if [[ "$version" -ge 22 ]]; then
             local node_path=$(command -v node)
             local manager=""
 
@@ -202,10 +202,10 @@ install_node() {
     if command -v node &> /dev/null; then
         local version
         version=$(node -v | sed 's/v//' | cut -d. -f1)
-        if [[ "$version" -ge 20 ]]; then
+        if [[ "$version" -ge 22 ]]; then
             return 0
         fi
-        log_warn "Node.js $version found, but 20+ required"
+        log_warn "Node.js $version found, but 22+ required"
     fi
 
     log_info "Installing Node.js..."
@@ -224,9 +224,9 @@ install_node() {
                 export PATH="$HOME/.local/share/fnm:$PATH"
                 eval "$(fnm env --use-on-cd)"
 
-                # Install and use Node.js 20
-                fnm install 20
-                fnm use 20
+                # Install and use Node.js 22
+                fnm install 22
+                fnm use 22
 
                 # Add fnm to shell profile
                 local shell_profile=""
@@ -261,7 +261,7 @@ install_node() {
             sudo yum install -y nodejs
             ;;
         *)
-            log_error "Please install Node.js 20+ manually: https://nodejs.org"
+            log_error "Please install Node.js 22+ manually: https://nodejs.org"
             exit 1
             ;;
     esac
@@ -499,7 +499,7 @@ check_and_install_prerequisites() {
 
     # What this distro has no installer for here is still missing.
     local still=()
-    check_node > /dev/null || still+=("node 20+")
+    check_node > /dev/null || still+=("node 22+")
     check_git > /dev/null || still+=("git")
     check_tmux > /dev/null || still+=("tmux")
     if [[ ${#still[@]} -gt 0 ]]; then

package/scripts/publish

@@ -14,10 +14,11 @@ trap 'rm -f "$npmrc"' EXIT
 chmod 600 "$npmrc"
 printf '//registry.npmjs.org/:_authToken=%s\n' "$token" > "$npmrc"
 
-echo "Publishing $name@$version as $(npx -y npm@latest whoami --userconfig "$npmrc")"
+# npm is pinned (at least a week old), not @latest: this runs with the publish token.
+echo "Publishing $name@$version as $(npx -y npm@11.21.0 whoami --userconfig "$npmrc")"
 # A 409 "previously staged" means npm already took this version (an earlier
 # run gave up waiting): that's not a failure, just keep waiting for it.
-if ! out=$(NODE_ENV=development npx -y npm@latest publish --access public \
+if ! out=$(NODE_ENV=development npx -y npm@11.21.0 publish --access public \
   --userconfig "$npmrc" --ignore-scripts --loglevel warn 2>&1); then
   echo "$out"
   echo "$out" | grep -qiE "previously staged|cannot publish over" || exit 1

package/scripts/redeploy

@@ -8,6 +8,10 @@ set -euo pipefail
 cd "$(dirname "$0")/.."
 # shellcheck source=lib/build-swap.sh
 source scripts/lib/build-swap.sh
+# shellcheck source=lib/pnpm.sh
+source scripts/lib/pnpm.sh
+# shellcheck source=lib/deps-swap.sh
+source scripts/lib/deps-swap.sh
 
 if [ -s "$HOME/.nvm/nvm.sh" ]; then
   # shellcheck disable=SC1091
@@ -15,23 +19,36 @@ if [ -s "$HOME/.nvm/nvm.sh" ]; then
   nvm use >/dev/null
 fi
 
+# The pull can replace this script, so what follows runs from a fresh start.
+if [ "${1:-}" != "--rollback" ] && [ "${1:-}" != "--pulled" ]; then
+  echo "::phase pulling"
+  git pull --ff-only
+  exec bash "$0" --pulled
+fi
+
 acquire_build_lock
 
 if [ "${1:-}" = "--rollback" ]; then
   rollback_build
+  # The build and the dependencies it ran on go back together.
+  restore_deps
 else
-  echo "::phase pulling"
-  git pull --ff-only
   echo "::phase installing"
+  use_pnpm
   # The build needs dev dependencies even when the shell runs with
   # NODE_ENV=production (as sessions started by AgentOS do).
-  npm install --include=dev --no-audit --no-fund
-  # Another npm version (on another machine) rewrites the lockfile's flags; a
-  # deploy never changes it, and a dirty lockfile would block the next pull.
-  git checkout -- package-lock.json 2>/dev/null || true
-  node scripts/ensure-native.mjs
+  unset NODE_ENV npm_config_production npm_config_omit
+  # Installed beside the live node_modules and checked (SQLite opens, a pty
+  # spawns) before they replace it: a broken install fails the deploy here,
+  # and the running server keeps the build and dependencies it has.
+  swapped=0
+  install_beside && rc=0 || rc=$?
+  [ "$rc" = 0 ] && { swap_deps; swapped=1; }
+  [ "$rc" = 0 ] || [ "$rc" = 10 ] || exit 1
+  install_pdf_browser
   echo "::phase building"
-  build_beside
+  # A build that fails on the new dependencies puts the old ones back.
+  build_beside || { [ "$swapped" = 1 ] && restore_deps; exit 1; }
   swap_build
 fi
 

package/scripts/setup.sh

@@ -8,13 +8,13 @@ echo ""
 # Check Node.js
 if ! command -v node &> /dev/null; then
     echo "Error: Node.js is not installed"
-    echo "Install Node.js 20+ from https://nodejs.org"
+    echo "Install Node.js 22+ from https://nodejs.org"
     exit 1
 fi
 
 NODE_VERSION=$(node -v | cut -d'v' -f2 | cut -d'.' -f1)
-if [ "$NODE_VERSION" -lt 20 ]; then
-    echo "Error: Node.js 20+ required (found v$NODE_VERSION)"
+if [ "$NODE_VERSION" -lt 22 ]; then
+    echo "Error: Node.js 22+ required (found v$NODE_VERSION)"
     exit 1
 fi
 echo "Node.js: $(node -v)"
@@ -60,7 +60,7 @@ fi
 # Install dependencies
 echo ""
 echo "Installing dependencies..."
-npm install
+scripts/install-deps
 
 echo ""
 echo "Setup complete!"

package/tsconfig.json

@@ -33,6 +33,7 @@
     "node_modules",
     ".next-build",
     ".next-prev",
+    ".deps",
     "public/sw.js",
     "app/sw.ts"
   ]

package/scripts/ensure-native.mjs

@@ -1,23 +0,0 @@
-// Native modules are compiled for one Node ABI. After a Node upgrade they fail
-// at the first database call, so check before starting and rebuild if needed.
-import { createRequire } from "module";
-import { execSync } from "child_process";
-
-const require = createRequire(import.meta.url);
-const modules = ["better-sqlite3", "node-pty"];
-
-function loads(name) {
-  try {
-    if (name === "better-sqlite3") require(name)(":memory:").close();
-    else require(name);
-    return true;
-  } catch (err) {
-    return !String(err?.message).includes("NODE_MODULE_VERSION");
-  }
-}
-
-const stale = modules.filter((m) => !loads(m));
-if (stale.length) {
-  console.log(`Rebuilding ${stale.join(", ")} for Node ${process.version}...`);
-  execSync(`npm rebuild ${stale.join(" ")}`, { stdio: "inherit" });
-}