@songsid/agend 2.2.0-beta.2 → 2.2.0-beta.20

package/dist/cli.js

@@ -16,14 +16,14 @@ import { Command } from "commander";
 import { join, dirname } from "node:path";
 import { SchedulerDb } from "./scheduler/db.js";
 import { Cron } from "croner";
-import { existsSync, readFileSync, writeFileSync, appendFileSync, unlinkSync, mkdirSync, chmodSync, readdirSync, rmSync, statSync, realpathSync, } from "node:fs";
+import { existsSync, readFileSync, writeFileSync, appendFileSync, unlinkSync, mkdirSync, chmodSync, readdirSync, rmSync, statSync, realpathSync, openSync, writeSync, closeSync, } from "node:fs";
 import { homedir, totalmem, freemem, userInfo } from "node:os";
 import { fileURLToPath } from "node:url";
 import { spawn, spawnSync, execSync, execFileSync } from "node:child_process";
-import { getAgendHome, getTmuxSocketName } from "./paths.js";
+import { getAgendHome, getTmuxSocketName, isDefaultAgendHome } from "./paths.js";
 import { hasPausedMarker } from "./pause-marker.js";
 import { COMPLETION_SHELLS, completionScript } from "./completion.js";
-import { getUpdateSelector, isExactVersion, isUnrequestedDowngrade, lookupTargetVersion, reportUpdateRestart, shouldSkipUpdate, runningFleetPredatesInstall, processStartMs, } from "./update-check.js";
+import { getUpdateSelector, isExactVersion, isUnrequestedDowngrade, lookupTargetVersion, reportUpdateRestart, shouldSkipUpdate, runningFleetPredatesInstall, fleetProvenStopped, readFleetPidEvidence, pidAlive, processStartMs, } from "./update-check.js";
 import { clearUpdateMarker, markUpdateInProgress, setUpdateProgressStage } from "./update-marker.js";
 import { describeSignalSource, forceAllowed, gateFleetControl, recordInstanceControl, withOrigin } from "./fleet-control-audit.js";
 import { FLEET_STOP_TIMEOUT_MS, stopDetachedOwner, systemdStopTimeoutMs, detachedProcessStart, detachedProcessExited } from "./fleet-stop-budget.js";
@@ -38,6 +38,7 @@ import { DeliveryStatusArgs } from "./outbound-schemas.js";
 import { requestCpuProfile } from "./profile-control.js";
 import { requestSettingsConfirmation } from "./settings-control.js";
 import { canonicalCliEntry, selfCommand } from "./cli-entry.js";
+import { handOff, shouldHandOff } from "./launchd-handoff.js";
 /** Prefix tmux args with -L when socket isolation is active. */
 function tmuxArgs(args) {
     const socket = getTmuxSocketName();
@@ -79,6 +80,28 @@ function planDeps() {
         now: () => new Date(),
     };
 }
+/**
+ * #1871: hand this command to a detached copy that outlives the fleet's stop (see launchd-handoff.ts). True when it
+ * did; false to carry on here (not an agent session, or the copy could not be started — said so).
+ */
+async function handOffLaunchdActivation(action) {
+    if (!shouldHandOff(process.env))
+        return false;
+    const handed = await handOff({ agendHome: DATA_DIR, self: selfCommand(process.argv.slice(2)), env: process.env, action }, {
+        open: path => openSync(path, "a", 0o600),
+        write: (fd, text) => writeSync(fd, text),
+        close: fd => closeSync(fd),
+        spawn: (command, args, options) => spawn(command, args, options),
+        now: () => new Date(),
+    });
+    if (handed.ok) {
+        console.log(`  ↪ This session belongs to the fleet that launchd is about to stop, so \`agend ${action}\` goes on in the background.`);
+        console.log(`  Its output: ${handed.log}`);
+        return true;
+    }
+    console.log(`  ⚠ Could not continue in the background (${handed.reason}); going on in this session.`);
+    return false;
+}
 const FLEET_CONFIG_PATH = join(DATA_DIR, "fleet.yaml");
 // CLI commands run outside FleetManager. Honor an explicit fleet locale while
 // keeping the historical English CLI default when config is missing/unset.
@@ -1446,6 +1469,12 @@ program
     }
     if (!gateFleetControl(DATA_DIR, "update", { yes: opts.yes }))
         process.exit(1);
+    // #1871: on launchd the activation boots out the fleet this agent session runs in; the update must outlive that.
+    {
+        const { getServicePath, getSystemServicePath, detectPlatform } = await import("./service-installer.js");
+        if (detectPlatform() === "macos" && !getSystemServicePath() && getServicePath() && await handOffLaunchdActivation("update"))
+            return;
+    }
     const { spawnSync } = await import("node:child_process");
     // The channel follows the version being replaced — this CLI's own package — so an alpha or beta stays on its channel.
     const tag = getUpdateSelector(opts, pkgVersion);
@@ -1495,7 +1524,7 @@ program
         const { newAgendInvocation, retireSystemCopy, activationSettled } = await import("./update-install.js");
         // What the restart came to — carried, never inferred from the exit code (pending ≠ restarted).
         let restartResult = null;
-        const { activateService } = await import("./service-activation.js");
+        const { activateService, systemdPeerBus } = await import("./service-activation.js");
         const { getServicePath, getSystemServicePath, detectPlatform } = await import("./service-installer.js");
         const { accessSync, constants } = await import("node:fs");
         const newAgend = newAgendInvocation({ viaNvm, nvmSh }, verified.agendPath);
@@ -1518,6 +1547,18 @@ program
             const result = spawnSync(command, args, { encoding: "utf-8", timeout: 15_000, stdio: ["ignore", "pipe", "pipe"] });
             return { status: result.status, signal: result.signal, stdout: result.stdout ?? "", stderr: result.stderr ?? "" };
         };
+        // #1660: the retire outcome lands after this process's restart returns —
+        // after the new fleet may have consumed this receipt. Capture it now so
+        // the cleanup write later can prove it still owns the marker (checklist
+        // 3/5). A missed capture only skips the marker write; retire still runs.
+        let cleanupReceipt = null;
+        if (verified.retireSystemCopy) {
+            try {
+                const { markCleanupPending } = await import("./update-marker.js");
+                cleanupReceipt = markCleanupPending(DATA_DIR);
+            }
+            catch { /* no receipt: retire still runs, the marker write is skipped */ }
+        }
         const outcome = activateService(manager, verified, {
             run: capture,
             readFile: path => { try {
@@ -1567,6 +1608,7 @@ program
             log: message => console.log(message),
             restorePackage,
             systemdRecovery: restoreChecked ? { restorePackage: restoreChecked } : undefined,
+            peerBus: systemdPeerBus,
         });
         // Settled: after a success only this transition's preimage is kept (for a repair); a failure consumed it.
         if (activationSettled(outcome, restartResult) && rollback)
@@ -1575,10 +1617,41 @@ program
         // new install (activationSettled) is it removed; pending, failed or refused, it stays, so the old unit still starts.
         if (verified.retireSystemCopy) {
             if (activationSettled(outcome, restartResult)) {
-                const retireResult = retireSystemCopy({ run: (command, args) => capture(command, args), log: message => console.log(message) }, verified.npmPath);
+                // #1735: the old copy is the package this updater runs from (the nvm route is taken because its prefix is not
+                // writable); the warning names it.
+                const oldCopyDir = (() => { try {
+                    return realpathSync(dirname(__dirname));
+                }
+                catch {
+                    return undefined;
+                } })();
+                const retireResult = retireSystemCopy({ run: (command, args) => capture(command, args), log: message => console.log(message) }, verified.npmPath, oldCopyDir);
+                // The marker write proves the pre-restart receipt still owns the
+                // marker: refused when it is gone or belongs to another operation.
+                const recordCleanup = async (result) => {
+                    if (!cleanupReceipt)
+                        return;
+                    try {
+                        const { writeCleanupOutcome } = await import("./update-marker.js");
+                        writeCleanupOutcome(DATA_DIR, cleanupReceipt, result);
+                    }
+                    catch { /* receipt unverifiable: retire already ran; stdout stands */ }
+                };
                 if (!retireResult.ok) {
                     console.error(`  ✗ Old system install was not removed: ${retireResult.reason}`);
                     process.exitCode = 1;
+                    // Resolve the pending flag so no watch waits out the max age.
+                    await recordCleanup(null);
+                }
+                else if (retireResult.warning) {
+                    // #1660: cleanup only — the new version runs. Exit 0; the single
+                    // print lives here (retireSystemCopy stays silent, P3-1).
+                    console.log(`  ⚠️  ${retireResult.warning}`
+                        + (retireResult.cleanupCommand ? `\n  $ ${retireResult.cleanupCommand}` : ""));
+                    await recordCleanup({ warning: retireResult.warning, cleanupCommand: retireResult.cleanupCommand });
+                }
+                else {
+                    await recordCleanup(null);
                 }
             }
             else {
@@ -1623,15 +1696,9 @@ program
             installedAtMs = statSync(fileURLToPath(import.meta.url)).mtimeMs;
         }
         catch { /* unknown */ }
-        if (runningFleetPredatesInstall({
-            pid: fleetPid,
-            installedAtMs,
-            processStartMs: pid => processStartMs(pid),
-            isFleetProcess: pid => isFleetStartCommandLine(readProcessCommandLine(pid)),
-        })) {
-            console.log(`\n  v${pkgVersion} is installed, but the running fleet started before it was — verifying it before restarting onto it.`);
-            // The earlier update may have stopped exactly because this install failed verification (#1449 review): a
-            // second `agend update` must not restart onto it unchecked.
+        // The earlier update may have stopped exactly because this install failed verification (#1449 review): a
+        // second `agend update` must not restart onto it — nor call it up to date — unchecked.
+        const verifyInstalled = async () => {
             const { verifyInstalledPackage } = await import("./update-install.js");
             const verified = verifyInstalledPackage({ pkg: `@songsid/agend@${pkgVersion}`, targetVersion: pkgVersion, viaNvm: false, nvmSh }, {
                 run: (command, args, options = {}) => {
@@ -1645,13 +1712,42 @@ program
                 console.error(message);
                 setUpdateProgressStage(DATA_DIR, "failed", { error: message.trim() });
                 process.exitCode = 1;
-                return;
             }
+            return verified;
+        };
+        if (runningFleetPredatesInstall({
+            pid: fleetPid,
+            installedAtMs,
+            processStartMs: pid => processStartMs(pid),
+            isFleetProcess: pid => isFleetStartCommandLine(readProcessCommandLine(pid)),
+        })) {
+            console.log(`\n  v${pkgVersion} is installed, but the running fleet started before it was — verifying it before restarting onto it.`);
+            const verified = await verifyInstalled();
+            if (!verified.ok)
+                return;
             console.log(`  ✓ v${pkgVersion} verified — restarting the fleet onto it.\n`);
             markUpdateInProgress(DATA_DIR);
             await activateVerified(verified, false);
             return;
         }
+        // #1829 ⑥: installed, but no fleet runs (a restart that never finished, a stopped service): not "up to date".
+        // Verified first, then the exact next step — never started from here, so nothing bypasses `agend start`'s checks.
+        // Only a fleet.pid that is missing, or names a pid proven gone / not a fleet, says so (review: unreadable,
+        // empty or malformed is unknown, and keeps the old answer).
+        const pidEvidence = readFleetPidEvidence(join(DATA_DIR, "fleet.pid"));
+        if (pidEvidence.kind !== "unknown" && fleetProvenStopped({
+            pid: pidEvidence.kind === "valid" ? pidEvidence.pid : null,
+            alive: pid => pidAlive(pid),
+            commandLine: pid => readProcessCommandLine(pid),
+            isFleetProcess: line => isFleetStartCommandLine(line),
+        })) {
+            const verified = await verifyInstalled();
+            if (!verified.ok)
+                return;
+            console.error(`\n  ✗ AgEnD v${pkgVersion} is installed but the fleet is not running — run: agend start\n`);
+            process.exitCode = 1;
+            return;
+        }
         console.log(`\n  ✓ Already up to date (v${pkgVersion})\n`);
         setUpdateProgressStage(DATA_DIR, "complete", { version: pkgVersion });
         return;
@@ -1757,7 +1853,7 @@ program
             : {}),
         lock: prefix => {
             const lock = acquireInstallLock(prefix, { spec: pkg, agendHome: DATA_DIR }, {
-                pid: process.pid, processStart: admission.processStart, newToken: () => randomBytes(16).toString("hex"),
+                pid: process.pid, processStart: admission.processStart, startTicks: admission.startTicks, bootId: admission.bootId, newToken: () => randomBytes(16).toString("hex"),
                 now: () => new Date(), log: message => console.log(message),
             });
             if (!lock.ok)
@@ -1813,7 +1909,7 @@ program
     .option("--activate", "Deprecated; service activation is now the default")
     .option("--no-activate", "Write the service file without activating it")
     .action(async (opts) => {
-    const { installService, activateService, detectPlatform, renderLaunchdPlist, launchdPlistPath, getServicePath, getSystemServicePath } = await import("./service-installer.js");
+    const { installService, activateService, detectPlatform, renderLaunchdPlist, launchdPlistPath, getServicePath, getSystemServicePath, serviceHomeFor } = await import("./service-installer.js");
     // #1631 B: an older updater (2.2.0-beta.1 and before) refreshes a hand-started fleet's service too, through this
     // command — which would CREATE a unit or plist, and every later update would then take a manager it may not reach
     // as the authority. When no service exists and it is certain this is that updater's refresh, write nothing. A
@@ -1827,13 +1923,20 @@ program
         }
     }
     const execPath = canonicalCliEntry();
-    const serviceVars = {
-        label: "com.agend.fleet",
-        execPath,
-        path: process.env.PATH,
-        workingDirectory: DATA_DIR,
-        logPath: join(DATA_DIR, "fleet.log"),
-    };
+    // A fleet on a custom AGEND_HOME must come back on it after a service restart or an update: the definition names
+    // it (the default home adds nothing). A refresh from the default home keeps an existing definition's home.
+    const existingPath = getServicePath();
+    const service = serviceHomeFor(DATA_DIR, {
+        refresh: opts.activate === false,
+        existingDefinition: existingPath ? (() => { try {
+            return readFileSync(existingPath, "utf-8");
+        }
+        catch {
+            return null;
+        } })() : null,
+        isDefault: isDefaultAgendHome,
+    });
+    const serviceVars = { label: "com.agend.fleet", execPath, path: process.env.PATH, ...service };
     // #1450 C6: on launchd, writing a new plist without activating is a PLANNED activation — proven, recorded, and
     // left for `agend restart` (a reload there would itself start the job). See service-plan.ts.
     if (opts.activate === false && detectPlatform() === "macos") {
@@ -1863,6 +1966,25 @@ program
         console.log(`  ${outcome.message}`);
         return;
     }
+    // #1884: a legacy system unit is the service a root fleet runs under; the refresh brings its ExecStart to this
+    // install's selection too, or `agend restart` refuses it after an update (see refreshSystemUnitExecStart).
+    const systemUnit = opts.activate === false && detectPlatform() !== "macos" ? getSystemServicePath() : null;
+    if (systemUnit) {
+        const { refreshSystemUnitExecStart } = await import("./service-installer.js");
+        try {
+            const refreshed = refreshSystemUnitExecStart(systemUnit, serviceVars, dirname(dirname(execPath)));
+            if (refreshed.kind === "updated")
+                console.log(`  ✓ ${systemUnit}: ExecStart=${refreshed.execStart}`);
+            else if (refreshed.kind === "foreign")
+                console.log(`  ℹ ${systemUnit} left as it is: ${refreshed.reason}.`);
+            else if (refreshed.kind === "unreadable")
+                console.log(`  ⚠ ${systemUnit} could not be read; left as it is.`);
+        }
+        catch (err) {
+            console.error(`  ✗ ${systemUnit} could not be updated (${err.message}); \`agend restart\` will refuse until its ExecStart starts this install. Run the update as root, or: sudo agend install --no-activate`);
+            process.exitCode = 1;
+        }
+    }
     const svcPath = installService(serviceVars);
     console.log(t("install.path", svcPath));
     if (opts.activate !== false) {
@@ -2233,7 +2355,8 @@ program
         }
         if (filterCustom)
             console.log(`  ⚠ ${unitPath} sets its own CoredumpFilter; left as is. CoredumpFilter=0 keeps crash dumps to a few KB (#1113).`);
-        if (expectation.ok && refuses(guard.guardSystemd(captureRun, systemdTarget.user, systemdTarget.unit, expectation.expected, guardDeps)))
+        const { systemdPeerBus } = await import("./service-activation.js");
+        if (expectation.ok && refuses(guard.guardSystemd(captureRun, systemdTarget.user, systemdTarget.unit, expectation.expected, guardDeps, systemdPeerBus)))
             return;
         // Clears the failed state AND the start-limit counter (#1113:
         // StartLimitBurst=4 in 30min) for whichever unit this restart targets,
@@ -2272,8 +2395,13 @@ program
         if (printed.status === 0) {
             const plistPath = getServicePath() ?? join(homedir(), "Library", "LaunchAgents", `${label}.plist`);
             // Path 2 (#1450 C6): a proven new plist waits on disk with its plan — exactly one bootout + bootstrap.
-            const { readPlan, admitPlan, planPath } = await import("./service-plan.js");
-            const plan = opts.force ? null : readPlan(DATA_DIR, deps);
+            const { readPlan, admitPlan, planPath, planCarriedOut } = await import("./service-plan.js");
+            const recorded = opts.force ? null : readPlan(DATA_DIR, deps);
+            // #1871: an interrupted update's plan whose job launchd already runs (after `agend start`) is done: restart that
+            // job as an unchanged one (path 1) instead of refusing it for its new pid.
+            const plan = recorded && planCarriedOut(recorded, target, deps) ? null : recorded;
+            if (recorded && !plan)
+                console.log("  ℹ launchd already runs the job an interrupted update planned; restarting it as it is.");
             if (plan && expectation.ok) {
                 const pkgDir = dirname(dirname(expectation.expected.entry));
                 const admitted = admitPlan(plan, { target, expected: expectation.expected, pkgDir }, deps);
@@ -2282,6 +2410,8 @@ program
                     process.exitCode = 1;
                     return;
                 }
+                if (await handOffLaunchdActivation("restart"))
+                    return;
                 const { activateService } = await import("./service-activation.js");
                 const outcome = activateService({ kind: "launchd", label, plistPath: plan.plistPath, domain: `gui/${uid}` }, { bin: expectation.expected.entry, entry: expectation.expected.entry, node: expectation.expected.node, dir: pkgDir }, {
                     ...deps,
@@ -2555,6 +2685,16 @@ program
     const { runSetupWizard } = await import("./setup-wizard.js");
     await runSetupWizard();
 });
+// The opener is optional (a server or WSL without xdg-open): a spawn failure is an `error` event, and unhandled it
+// crashed the command after the link was already printed (#1854). The printed link still works, so say so instead.
+function openInBrowser(url) {
+    const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open";
+    const child = spawn(cmd, [url], { detached: true, stdio: "ignore" });
+    child.on("error", (err) => {
+        console.error(`Could not open a browser (${cmd}: ${err.code ?? err.message}). Open the link above yourself.`);
+    });
+    child.unref();
+}
 program
     .command("web")
     .description("Open the Web UI sign-in page in your browser and print a one-time sign-in code")
@@ -2597,9 +2737,7 @@ program
     console.log(`Code:         ${code}   (works once, valid ~${minutes} min)`);
     if (opts.code)
         return;
-    const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open";
-    const child = spawn(cmd, [signin], { detached: true, stdio: "ignore" });
-    child.unref();
+    openInBrowser(signin);
 });
 program
     .command("web-token")
@@ -2629,9 +2767,7 @@ program
     const port = fleet.health_port ?? 19280;
     const url = `http://localhost:${port}/view`;
     console.log(`Opening ${url}`);
-    const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open";
-    const child = spawn(cmd, [url], { detached: true, stdio: "ignore" });
-    child.unref();
+    openInBrowser(url);
 });
 program
     .command("validate")
@@ -2940,7 +3076,21 @@ async function fuzzyMatch(query, names) {
     return null;
 }
 async function resolveInstance(query, config) {
-    const names = await listInstanceNames(config);
+    const namesRaw = await listInstanceNames(config);
+    const names = [...new Set(namesRaw)]; // P3-3: deduplicate (a classicBot instanceName can equal a fleet name)
+    const { resolveName } = await import("./topic-commands.js");
+    const entries = names.map((name) => ({
+        name,
+        displayName: config.instances[name]?.display_name,
+    }));
+    const result = resolveName(query, entries);
+    if (result.kind === "name")
+        return result.realName;
+    if (result.kind === "ambiguous") {
+        console.error(`"${query}" matches multiple instances: ${result.realNames.join(", ")}. Use the real name.`);
+        process.exit(1);
+    }
+    // Fall through to the original fuzzy match on real names.
     const match = await fuzzyMatch(query, names);
     if (!match) {
         console.error(`No instance matching "${query}". Available: ${names.join(", ")}`);