@songsid/agend 2.2.0-beta.1 → 2.2.0-beta.11

package/dist/cli.js

@@ -20,10 +20,10 @@ import { existsSync, readFileSync, writeFileSync, appendFileSync, unlinkSync, mk
 import { homedir, totalmem, freemem, userInfo } from "node:os";
 import { fileURLToPath } from "node:url";
 import { spawn, spawnSync, execSync, execFileSync } from "node:child_process";
-import { getAgendHome, getTmuxSocketName } from "./paths.js";
+import { getAgendHome, getTmuxSocketName, isDefaultAgendHome } from "./paths.js";
 import { hasPausedMarker } from "./pause-marker.js";
 import { COMPLETION_SHELLS, completionScript } from "./completion.js";
-import { getUpdateSelector, isExactVersion, isUnrequestedDowngrade, lookupTargetVersion, reportUpdateRestart, shouldSkipUpdate, runningFleetPredatesInstall, processStartMs, } from "./update-check.js";
+import { getUpdateSelector, isExactVersion, isUnrequestedDowngrade, lookupTargetVersion, reportUpdateRestart, shouldSkipUpdate, runningFleetPredatesInstall, fleetProvenStopped, readFleetPidEvidence, pidAlive, processStartMs, } from "./update-check.js";
 import { clearUpdateMarker, markUpdateInProgress, setUpdateProgressStage } from "./update-marker.js";
 import { describeSignalSource, forceAllowed, gateFleetControl, recordInstanceControl, withOrigin } from "./fleet-control-audit.js";
 import { FLEET_STOP_TIMEOUT_MS, stopDetachedOwner, systemdStopTimeoutMs, detachedProcessStart, detachedProcessExited } from "./fleet-stop-budget.js";
@@ -1495,7 +1495,7 @@ program
         const { newAgendInvocation, retireSystemCopy, activationSettled } = await import("./update-install.js");
         // What the restart came to — carried, never inferred from the exit code (pending ≠ restarted).
         let restartResult = null;
-        const { activateService } = await import("./service-activation.js");
+        const { activateService, systemdPeerBus } = await import("./service-activation.js");
         const { getServicePath, getSystemServicePath, detectPlatform } = await import("./service-installer.js");
         const { accessSync, constants } = await import("node:fs");
         const newAgend = newAgendInvocation({ viaNvm, nvmSh }, verified.agendPath);
@@ -1518,6 +1518,18 @@ program
             const result = spawnSync(command, args, { encoding: "utf-8", timeout: 15_000, stdio: ["ignore", "pipe", "pipe"] });
             return { status: result.status, signal: result.signal, stdout: result.stdout ?? "", stderr: result.stderr ?? "" };
         };
+        // #1660: the retire outcome lands after this process's restart returns —
+        // after the new fleet may have consumed this receipt. Capture it now so
+        // the cleanup write later can prove it still owns the marker (checklist
+        // 3/5). A missed capture only skips the marker write; retire still runs.
+        let cleanupReceipt = null;
+        if (verified.retireSystemCopy) {
+            try {
+                const { markCleanupPending } = await import("./update-marker.js");
+                cleanupReceipt = markCleanupPending(DATA_DIR);
+            }
+            catch { /* no receipt: retire still runs, the marker write is skipped */ }
+        }
         const outcome = activateService(manager, verified, {
             run: capture,
             readFile: path => { try {
@@ -1546,7 +1558,8 @@ program
             catch {
                 return false;
             } },
-            // `agend install` activates by default; the update owns stop/start, so only the file is refreshed here.
+            // `agend install` activates by default; the update owns stop/start, so only the file is refreshed here. Only
+            // an existing service is refreshed: a detached fleet's update never calls this (#1631).
             refresh: () => {
                 const result = capture(newAgend.command, [...newAgend.args, "install", "--no-activate"]);
                 if (result.status === 0)
@@ -1566,6 +1579,7 @@ program
             log: message => console.log(message),
             restorePackage,
             systemdRecovery: restoreChecked ? { restorePackage: restoreChecked } : undefined,
+            peerBus: systemdPeerBus,
         });
         // Settled: after a success only this transition's preimage is kept (for a repair); a failure consumed it.
         if (activationSettled(outcome, restartResult) && rollback)
@@ -1574,10 +1588,41 @@ program
         // new install (activationSettled) is it removed; pending, failed or refused, it stays, so the old unit still starts.
         if (verified.retireSystemCopy) {
             if (activationSettled(outcome, restartResult)) {
-                const retireResult = retireSystemCopy({ run: (command, args) => capture(command, args), log: message => console.log(message) }, verified.npmPath);
+                // #1735: the old copy is the package this updater runs from (the nvm route is taken because its prefix is not
+                // writable); the warning names it.
+                const oldCopyDir = (() => { try {
+                    return realpathSync(dirname(__dirname));
+                }
+                catch {
+                    return undefined;
+                } })();
+                const retireResult = retireSystemCopy({ run: (command, args) => capture(command, args), log: message => console.log(message) }, verified.npmPath, oldCopyDir);
+                // The marker write proves the pre-restart receipt still owns the
+                // marker: refused when it is gone or belongs to another operation.
+                const recordCleanup = async (result) => {
+                    if (!cleanupReceipt)
+                        return;
+                    try {
+                        const { writeCleanupOutcome } = await import("./update-marker.js");
+                        writeCleanupOutcome(DATA_DIR, cleanupReceipt, result);
+                    }
+                    catch { /* receipt unverifiable: retire already ran; stdout stands */ }
+                };
                 if (!retireResult.ok) {
                     console.error(`  ✗ Old system install was not removed: ${retireResult.reason}`);
                     process.exitCode = 1;
+                    // Resolve the pending flag so no watch waits out the max age.
+                    await recordCleanup(null);
+                }
+                else if (retireResult.warning) {
+                    // #1660: cleanup only — the new version runs. Exit 0; the single
+                    // print lives here (retireSystemCopy stays silent, P3-1).
+                    console.log(`  ⚠️  ${retireResult.warning}`
+                        + (retireResult.cleanupCommand ? `\n  $ ${retireResult.cleanupCommand}` : ""));
+                    await recordCleanup({ warning: retireResult.warning, cleanupCommand: retireResult.cleanupCommand });
+                }
+                else {
+                    await recordCleanup(null);
                 }
             }
             else {
@@ -1622,15 +1667,9 @@ program
             installedAtMs = statSync(fileURLToPath(import.meta.url)).mtimeMs;
         }
         catch { /* unknown */ }
-        if (runningFleetPredatesInstall({
-            pid: fleetPid,
-            installedAtMs,
-            processStartMs: pid => processStartMs(pid),
-            isFleetProcess: pid => isFleetStartCommandLine(readProcessCommandLine(pid)),
-        })) {
-            console.log(`\n  v${pkgVersion} is installed, but the running fleet started before it was — verifying it before restarting onto it.`);
-            // The earlier update may have stopped exactly because this install failed verification (#1449 review): a
-            // second `agend update` must not restart onto it unchecked.
+        // The earlier update may have stopped exactly because this install failed verification (#1449 review): a
+        // second `agend update` must not restart onto it — nor call it up to date — unchecked.
+        const verifyInstalled = async () => {
             const { verifyInstalledPackage } = await import("./update-install.js");
             const verified = verifyInstalledPackage({ pkg: `@songsid/agend@${pkgVersion}`, targetVersion: pkgVersion, viaNvm: false, nvmSh }, {
                 run: (command, args, options = {}) => {
@@ -1644,13 +1683,42 @@ program
                 console.error(message);
                 setUpdateProgressStage(DATA_DIR, "failed", { error: message.trim() });
                 process.exitCode = 1;
-                return;
             }
+            return verified;
+        };
+        if (runningFleetPredatesInstall({
+            pid: fleetPid,
+            installedAtMs,
+            processStartMs: pid => processStartMs(pid),
+            isFleetProcess: pid => isFleetStartCommandLine(readProcessCommandLine(pid)),
+        })) {
+            console.log(`\n  v${pkgVersion} is installed, but the running fleet started before it was — verifying it before restarting onto it.`);
+            const verified = await verifyInstalled();
+            if (!verified.ok)
+                return;
             console.log(`  ✓ v${pkgVersion} verified — restarting the fleet onto it.\n`);
             markUpdateInProgress(DATA_DIR);
             await activateVerified(verified, false);
             return;
         }
+        // #1829 ⑥: installed, but no fleet runs (a restart that never finished, a stopped service): not "up to date".
+        // Verified first, then the exact next step — never started from here, so nothing bypasses `agend start`'s checks.
+        // Only a fleet.pid that is missing, or names a pid proven gone / not a fleet, says so (review: unreadable,
+        // empty or malformed is unknown, and keeps the old answer).
+        const pidEvidence = readFleetPidEvidence(join(DATA_DIR, "fleet.pid"));
+        if (pidEvidence.kind !== "unknown" && fleetProvenStopped({
+            pid: pidEvidence.kind === "valid" ? pidEvidence.pid : null,
+            alive: pid => pidAlive(pid),
+            commandLine: pid => readProcessCommandLine(pid),
+            isFleetProcess: line => isFleetStartCommandLine(line),
+        })) {
+            const verified = await verifyInstalled();
+            if (!verified.ok)
+                return;
+            console.error(`\n  ✗ AgEnD v${pkgVersion} is installed but the fleet is not running — run: agend start\n`);
+            process.exitCode = 1;
+            return;
+        }
         console.log(`\n  ✓ Already up to date (v${pkgVersion})\n`);
         setUpdateProgressStage(DATA_DIR, "complete", { version: pkgVersion });
         return;
@@ -1663,6 +1731,42 @@ program
         process.exitCode = 1;
         return;
     }
+    // ── Check if npm global needs sudo (read-only; decides the nvm path the preflight judges) ──
+    let needsSudo = false;
+    try {
+        const prefix = execSync("npm config get prefix", { encoding: "utf-8" }).trim();
+        const { accessSync, constants } = await import("node:fs");
+        try {
+            accessSync(prefix, constants.W_OK);
+        }
+        catch {
+            needsSudo = true;
+        }
+    }
+    catch { /* assume no sudo needed */ }
+    // ── #1441 B: can the target run here, on the Node it will actually run on? ──
+    // Read where the install runs (#1623 review): a direct install runs `npm` and the release's `node` from this
+    // environment, so it is decided now, before anything is touched. An nvm install runs nvm's npm and Node 22, which
+    // exist only once nvm has selected them: runUpdateInstall decides it there, before the lock and npm.
+    const preflight = targetVersion ? await import("./update-preflight.js") : null;
+    if (preflight && targetVersion && !needsSudo) {
+        const verdict = preflight.preflightUpdate({
+            run: (argv, timeoutMs) => {
+                const r = spawnSync(argv[0], argv.slice(1), { encoding: "utf-8", timeout: timeoutMs, stdio: ["ignore", "pipe", "ignore"] });
+                return { status: r.status, stdout: r.stdout ?? "" };
+            },
+            npm: "npm",
+        }, pkg, targetVersion, "the `node` on PATH");
+        if (verdict.kind === "refuse") {
+            console.error(`\n${verdict.message}\n`);
+            // A chat-started /update (Discord, Telegram, an agent) is waiting on this: the reason is its outcome.
+            setUpdateProgressStage(DATA_DIR, "failed", { error: `Not updated: ${verdict.summary}. Nothing was changed.` });
+            process.exitCode = 1;
+            return;
+        }
+        if (verdict.kind === "unknown")
+            console.log(verdict.note);
+    }
     if (targetVersion) {
         console.log(`\n  Updating AgEnD v${pkgVersion} → v${targetVersion}...\n`);
     }
@@ -1684,19 +1788,6 @@ program
         process.exit(1);
     };
     setUpdateProgressStage(DATA_DIR, "downloading");
-    // ── Check if npm global needs sudo ──
-    let needsSudo = false;
-    try {
-        const prefix = execSync("npm config get prefix", { encoding: "utf-8" }).trim();
-        const { accessSync, constants } = await import("node:fs");
-        try {
-            accessSync(prefix, constants.W_OK);
-        }
-        catch {
-            needsSudo = true;
-        }
-    }
-    catch { /* assume no sudo needed */ }
     if (needsSudo) {
         // ── nvm path: install without sudo ──
         if (!existsSync(nvmSh)) {
@@ -1728,6 +1819,9 @@ program
     process.once("exit", () => releaseLock());
     const installed = runUpdateInstall({
         pkg, targetVersion, viaNvm: needsSudo, nvmSh, rollback: true,
+        ...(preflight && targetVersion && needsSudo
+            ? { preflight: preflight.installPreflight(pkg, targetVersion, "the Node 22 nvm selected", { log: m => console.log(m), error: m => console.error(m) }) }
+            : {}),
         lock: prefix => {
             const lock = acquireInstallLock(prefix, { spec: pkg, agendHome: DATA_DIR }, {
                 pid: process.pid, processStart: admission.processStart, newToken: () => randomBytes(16).toString("hex"),
@@ -1786,15 +1880,34 @@ program
     .option("--activate", "Deprecated; service activation is now the default")
     .option("--no-activate", "Write the service file without activating it")
     .action(async (opts) => {
-    const { installService, activateService, detectPlatform, renderLaunchdPlist, launchdPlistPath } = await import("./service-installer.js");
+    const { installService, activateService, detectPlatform, renderLaunchdPlist, launchdPlistPath, getServicePath, getSystemServicePath, serviceHomeFor } = await import("./service-installer.js");
+    // #1631 B: an older updater (2.2.0-beta.1 and before) refreshes a hand-started fleet's service too, through this
+    // command — which would CREATE a unit or plist, and every later update would then take a manager it may not reach
+    // as the authority. When no service exists and it is certain this is that updater's refresh, write nothing. A
+    // manual `agend install` (with or without --no-activate) creates the service as always.
+    if (opts.activate === false && getServicePath() === null && getSystemServicePath() === null) {
+        const { startedByUpdater, systemUpdaterCallerProbe } = await import("./updater-caller.js");
+        const caller = startedByUpdater(systemUpdaterCallerProbe(DATA_DIR, pkgVersion));
+        if (caller.updater) {
+            console.log("  No service to refresh: this update runs a hand-started fleet, so none was created (`agend install` creates one).");
+            return;
+        }
+    }
     const execPath = canonicalCliEntry();
-    const serviceVars = {
-        label: "com.agend.fleet",
-        execPath,
-        path: process.env.PATH,
-        workingDirectory: DATA_DIR,
-        logPath: join(DATA_DIR, "fleet.log"),
-    };
+    // A fleet on a custom AGEND_HOME must come back on it after a service restart or an update: the definition names
+    // it (the default home adds nothing). A refresh from the default home keeps an existing definition's home.
+    const existingPath = getServicePath();
+    const service = serviceHomeFor(DATA_DIR, {
+        refresh: opts.activate === false,
+        existingDefinition: existingPath ? (() => { try {
+            return readFileSync(existingPath, "utf-8");
+        }
+        catch {
+            return null;
+        } })() : null,
+        isDefault: isDefaultAgendHome,
+    });
+    const serviceVars = { label: "com.agend.fleet", execPath, path: process.env.PATH, ...service };
     // #1450 C6: on launchd, writing a new plist without activating is a PLANNED activation — proven, recorded, and
     // left for `agend restart` (a reload there would itself start the job). See service-plan.ts.
     if (opts.activate === false && detectPlatform() === "macos") {
@@ -2194,7 +2307,8 @@ program
         }
         if (filterCustom)
             console.log(`  ⚠ ${unitPath} sets its own CoredumpFilter; left as is. CoredumpFilter=0 keeps crash dumps to a few KB (#1113).`);
-        if (expectation.ok && refuses(guard.guardSystemd(captureRun, systemdTarget.user, systemdTarget.unit, expectation.expected, guardDeps)))
+        const { systemdPeerBus } = await import("./service-activation.js");
+        if (expectation.ok && refuses(guard.guardSystemd(captureRun, systemdTarget.user, systemdTarget.unit, expectation.expected, guardDeps, systemdPeerBus)))
             return;
         // Clears the failed state AND the start-limit counter (#1113:
         // StartLimitBurst=4 in 30min) for whichever unit this restart targets,
@@ -2578,7 +2692,7 @@ program
     console.log("Web token rotated.");
     console.log("Every previously issued dashboard link and browser session is now rejected.");
     console.log("A running fleet picks this up immediately — no restart needed.");
-    console.log("Sign in again with `agend web` (prints a one-time code), or /dashboard in your chat channel.");
+    console.log("Sign in again with `agend web` (prints a one-time code), or /web in your chat channel.");
 });
 program
     .command("view")
@@ -2901,7 +3015,21 @@ async function fuzzyMatch(query, names) {
     return null;
 }
 async function resolveInstance(query, config) {
-    const names = await listInstanceNames(config);
+    const namesRaw = await listInstanceNames(config);
+    const names = [...new Set(namesRaw)]; // P3-3: deduplicate (a classicBot instanceName can equal a fleet name)
+    const { resolveName } = await import("./topic-commands.js");
+    const entries = names.map((name) => ({
+        name,
+        displayName: config.instances[name]?.display_name,
+    }));
+    const result = resolveName(query, entries);
+    if (result.kind === "name")
+        return result.realName;
+    if (result.kind === "ambiguous") {
+        console.error(`"${query}" matches multiple instances: ${result.realNames.join(", ")}. Use the real name.`);
+        process.exit(1);
+    }
+    // Fall through to the original fuzzy match on real names.
     const match = await fuzzyMatch(query, names);
     if (!match) {
         console.error(`No instance matching "${query}". Available: ${names.join(", ")}`);