@staix/agent-hub 0.30.0 → 0.31.0

package/src/cli/runtime-version-warning.ts

@@ -1,4 +1,5 @@
 import type { DoctorCheck } from "./output.ts";
+import { parseList, pluginState, type InstalledPlugin } from "./setup.ts";
 
 const VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z]+(?:[.-][0-9A-Za-z]+)*)?(?:\+[0-9A-Za-z]+(?:[.-][0-9A-Za-z]+)*)?$/;
 const version = (value: unknown): string | undefined => typeof value === "string" && value.length <= 64 && VERSION.exec(value)?.[0] === value ? value : undefined;
@@ -26,3 +27,52 @@ export function runtimeVersionWarnings(daemonVersion: unknown, cliVersion: unkno
   } catch { unknown("plugin versus daemon", "plugin and daemon versions could not be compared"); }
   return rows;
 }
+
+/**
+ * #718 (#1179): the lines `ahub upgrade` ends with when the global CLI or the shared Claude plugin is older than the daemon it upgraded, or none. `ahub upgrade` upgrades one project's daemon
+ * only, so the person must update the CLI and the plugin themselves; without these lines a stale CLI later fails with a message that does not say why.
+ *
+ * It reuses `runtimeVersionWarnings`, the comparison `ahub doctor` prints, so the two never disagree about what is older. The one difference is a handover: when an older CLI hands the upgrade to the
+ * target release's own coordinator (`AGENTHUB_UPGRADE_HANDOVER=1`, set by every release since #272), the process that prints is the target itself and cannot see the CLI that started it, but that
+ * CLI is older by construction (it handed over because the target was newer), so `handedOver` stands for it. An unknown plugin (no `claude`, unreadable inventory) is never a claim.
+ */
+export function globalUpdateAfterUpgrade(target: unknown, cli: unknown, plugin: unknown, handedOver = false): string[] {
+  const running = version(target);
+  if (!running) return [];
+  const warned = new Set(runtimeVersionWarnings(running, handedOver ? undefined : cli, plugin).filter(row => row.level === "warn").map(row => row.name));
+  const cliOlder = handedOver || warned.has("CLI versus daemon"), pluginOlder = warned.has("plugin versus daemon");
+  if (!cliOlder && !pluginOlder) return [];
+  return [
+    "ahub upgrade does not update the global CLI or the shared Claude plugin.",
+    cliOlder
+      ? `${handedOver ? "The CLI that started this upgrade is older than the daemon this upgrade installs" : "The global CLI is older than the daemon this upgrade installs"} (${running}): run \`bun add -g @staix/agent-hub@${running}\` and then \`ahub setup\` yourself.`
+      : `The installed plugin is older than the daemon this upgrade installs (${running}): run \`ahub setup\` yourself.`,
+  ];
+}
+
+export interface GlobalUpdateInputs {
+  /** The daemon this upgrade installs. */
+  target: string;
+  /** This process's own version. */
+  cli: string;
+  /** True when an older CLI handed the upgrade to this release's coordinator (`AGENTHUB_UPGRADE_HANDOVER=1`). */
+  handedOver: boolean;
+  /** Where this release's shipped plugin bundle lives, for `pluginState`. */
+  packageRoot: string;
+  /** The same `claude plugin list --json` probe `ahub doctor` runs. */
+  probe: () => { status: number | null; stdout?: string | null };
+}
+
+/**
+ * #718: `globalUpdateAfterUpgrade` with the plugin version read from the probe. Advice only: a missing `claude`, a probe that throws or times out, a non-zero exit or an unparsable list reads as an
+ * unknown plugin, which is never a claim, and nothing here can fail an upgrade.
+ */
+export function globalUpdateAdvice(input: GlobalUpdateInputs): string[] {
+  let plugin: string | undefined;
+  try {
+    const probed = input.probe();
+    const state = pluginState(parseList<InstalledPlugin>(probed.status === 0 ? probed.stdout ?? "" : ""), input.packageRoot);
+    plugin = state.state === "missing" ? undefined : state.version;
+  } catch { /* an unknown plugin: the CLI half below does not depend on it */ }
+  try { return globalUpdateAfterUpgrade(input.target, input.cli, plugin, input.handedOver); } catch { return []; }
+}

package/src/cli/status-lines.ts

@@ -1,8 +1,11 @@
 import type { ContextView } from "../hub/context-window.ts";
+import { memorySyncNextStep, type MemorySyncCause } from "../hub/memory-sync-state.ts";
 // What `ahub status` prints for a peer and for a model backend, kept pure so it can be checked.
 
-export interface PeerRow { permissionMode?: string; context?: ContextView; state?: string; queued?: number; queuedImportant?: number; needsReview?: number; heldBy?: string; holdNote?: string; liveAccepted?: string[]; oldestQueuedAt?: number; importantWaitingSince?: number; importantWaitingNote?: string; attached?: boolean; toolsOnly?: string; pullOnly?: boolean; lastInboxAt?: number | null; permissionNote?: string; reviewerUnavailable?: string; paused?: string; servedBy?: string; requestedModel?: string }
+export interface PeerRow { permissionMode?: string; context?: ContextView; state?: string; queued?: number; queuedImportant?: number; needsReview?: number; heldBy?: string; holdNote?: string; reviewObserverHoldNote?: string; liveAccepted?: string[]; oldestQueuedAt?: number; importantWaitingSince?: number; importantWaitingNote?: string; attached?: boolean; attachMode?: "channel" | "tools-only"; attachEvidence?: string; toolsOnly?: string; pullOnly?: boolean; lastInboxAt?: number | null; permissionNote?: string; reviewerUnavailable?: string; paused?: string; servedBy?: string; requestedModel?: string }
 export interface BackendRow { kind?: string; alias?: string; state?: string; active?: number; requestedModel?: string; actualModel?: string; provider?: string; coolingUntil?: string; failures?: number; failingUntil?: string }
+export interface MemorySyncRow { state?: string; at?: number; cause?: string; declinedCount?: number; declinedIdsKnown?: false; withheldCount?: number; exportedCount?: number; placementActive?: false; nextStep?: string }
+export interface ReviewInputHealthRow { state?: string; cause?: string | null }
 
 /** Aliases are already namespaced ("dgx/coding"); only an alias that is not gets its kind in front of it. */
 export function backendLabel(backend: BackendRow): string {
@@ -15,3 +18,40 @@ export function backendLabel(backend: BackendRow): string {
 export function contextLine(reading: ContextView, time = (at: number) => new Date(at).toISOString()): string {
   return `context ${reading.used === null ? "unknown" : `${Math.round(reading.used * 100)}%`} (${reading.freshness}${reading.source ? `, ${reading.source}` : ""}${reading.measuredAt !== null ? `, measured ${time(reading.measuredAt)}` : ""})`;
 }
+
+/** Human status copy for machine-local sync; upstream error text never enters this projection. */
+export function memorySyncLine(sync: MemorySyncRow, time = (at: number) => new Date(at).toISOString()): string {
+  const allowedStates = ["disabled", "unavailable", "notrun", "not-configured", "stopped", "ok", "failed", "unknown"];
+  const state = allowedStates.includes(sync.state ?? "") ? sync.state! : "unknown";
+  const hasTimestamp = sync.at !== undefined;
+  const validTimestamp = Number.isSafeInteger(sync.at) && Math.abs(sync.at!) <= 8_640_000_000_000_000;
+  const stamp = hasTimestamp ? `; automatic, last ${validTimestamp ? time(sync.at!) : "unknown"}` : "";
+  if (state === "not-configured" || state === "stopped") return `${state}${stamp}; next: ${memorySyncNextStep(state === "stopped" ? "stopped" : "remote")}`;
+  if (state === "ok" && Number.isSafeInteger(sync.withheldCount) && sync.withheldCount! >= 0
+    && Number.isSafeInteger(sync.exportedCount) && sync.exportedCount! >= 0)
+    return `ok${stamp}; ${sync.withheldCount} row${sync.withheldCount === 1 ? "" : "s"} withheld locally; ${sync.exportedCount} exported`;
+  if (state !== "failed") return `${state}${stamp}`;
+  const causes = ["declined", "remote", "binding", "stopped", "transport", "unknown"];
+  const cause = (causes.includes(sync.cause ?? "") ? sync.cause : "unknown") as MemorySyncCause;
+  if (cause === "declined" && sync.placementActive === false) {
+    const declined = Number.isSafeInteger(sync.declinedCount) && sync.declinedCount! >= 0 ? String(sync.declinedCount) : "unknown";
+    return "machine sync blocked: " + declined + " declined rows; per-row placement is not active on this store (agent-mem has no activation command yet, agent-mem#281). Inspect with `ahub memory declined`.";
+  }
+  const count = Number.isSafeInteger(sync.declinedCount) && sync.declinedCount! >= 0 ? `, ${sync.declinedCount} declined` : "";
+  const ids = cause === "declined" && sync.declinedIdsKnown === false ? "; declined ID set unknown" : "";
+  return `failed (${cause}${count})${stamp}${ids}; next: ${memorySyncNextStep(cause)}`;
+}
+
+/** Public-safe status guidance; never print journal exception text or provenance contents. */
+export function reviewInputHealthLine(health: ReviewInputHealthRow): string | undefined {
+  if (health.state === "healthy") return undefined;
+  const cause = health.state === "corrupt" && ["provenance_corrupt", "provenance_incomplete"].includes(health.cause ?? "") ? health.cause!
+    : health.state === "corrupt" ? "provenance_corrupt"
+    : health.state === "incomplete" && ["provenance_incomplete", "incomplete_markers", "legacy_coverage"].includes(health.cause ?? "") ? health.cause!
+    : "unknown";
+  const next = cause === "incomplete_markers" ? "verify the peer's next ordinary input or confirmed session change"
+    : cause === "legacy_coverage" ? "keep affected work held until review-input coverage is confirmed"
+    : "keep affected work held; inspect or repair only review-input provenance, preserving delivery and task state";
+  const state = health.state === "incomplete" || health.state === "corrupt" ? health.state : "unknown";
+  return `${state} (${cause}); next: ${next}`;
+}

package/src/cli/tail-render.ts

@@ -2,6 +2,7 @@ import type { BusEvent } from "../hub/bus.ts";
 
 export function renderTailEvent(e: BusEvent): string {
   if (e.t === "state") return `  . ${e.peer} is ${e.state}`;
+  if (e.t === "remote_delivery_settled") return `  . remote delivery ${e.deliveryId} settled for ${e.peer} (${e.outcome})`;
   if (e.t === "undeliverable") return `  ! gave up delivering ${e.env.id} (from ${e.env.from}) to ${e.peer}`;
   if (e.t === "envelope" && e.env.from === "hub" && e.env.kind !== "chat") {
     return `${new Date(e.env.ts).toLocaleTimeString()} hub -> ${e.env.to?.join(",")} [${e.env.kind}${e.env.refs?.task ? ` #${e.env.refs.task}` : ""}]\n${e.env.body.split("\n")[0]!.replace(/^/, "    ")}`;

package/src/cli/upgrade-interactive.ts

@@ -51,6 +51,11 @@ export interface UpgradeHost {
   entry: string;
   /** This CLI's version. */
   version: string;
+  /**
+   * #718 (#1179): lines to print after the upgrade completed, under the summary: the global CLI or the shared Claude plugin is older than the upgraded daemon and `ahub upgrade` does not update either.
+   * Never part of a blocked, cancelled or abandoned operation, and empty when nothing is older or the versions are unknown.
+   */
+  afterCompleted?(op: RecoveryOperation): Promise<string[]> | string[];
 }
 
 function emit(io: ScreenIO, lines: readonly string[]): void { for (const line of lines) io.out(line); }
@@ -69,6 +74,13 @@ async function summary(host: UpgradeHost, io: ScreenIO, op: RecoveryOperation):
   const live = await host.endInspection?.(op).catch(() => ({} as Record<string, Inspection | undefined>));
   emit(io, renderSummary(op, live ?? {}, io.presentation));
 }
+/** #718: the update step for the global CLI and plugin, once, after a completed upgrade (both callers have just seen `completed`). A host that cannot read the versions, or a failure reading them, prints nothing: it is advice, never a failure. */
+async function globalUpdate(host: UpgradeHost, io: ScreenIO, op: RecoveryOperation): Promise<void> {
+  if (op.plan.kind !== "upgrade") return;
+  let lines: string[] = [];
+  try { lines = await host.afterCompleted?.(op) ?? []; } catch { /* advice only */ }
+  for (const line of lines) human(io, line);
+}
 const clock = (io: ScreenIO) => io.presentation?.now() ?? Date.now();
 
 const yes = async (io: ScreenIO, question: string): Promise<boolean> => /^y(es)?$/i.test((await ask(io, question)) ?? "");
@@ -236,7 +248,7 @@ export async function operationScreen(host: UpgradeHost, io: ScreenIO, id: strin
   for (let acted = false, reset = false; ;) {
     if (io.interrupted()) return "quit";
     const op = host.read(id), runner = host.runner(id);
-    if (op.phase === "completed") { if (io.presentation) await summary(host, io, op); else human(io, `${op.plan.kind} to ${op.plan.version} completed`); return "completed"; }
+    if (op.phase === "completed") { if (io.presentation) await summary(host, io, op); else human(io, `${op.plan.kind} to ${op.plan.version} completed`); await globalUpdate(host, io, op); return "completed"; }
     if (op.phase === "cancelled") {
       if (io.presentation) await summary(host, io, op);
       else human(io, `operation ${id} is ${op.disposition ? "ended (abandoned, not completed)" : "cancelled"}; the recovery lock is free`);
@@ -351,7 +363,7 @@ export async function planScreen(host: UpgradeHost, io: ScreenIO): Promise<void>
       try { op = await host.apply(plan, () => io.interrupted()); } catch (error) { human(io, `ahub: ${(error as Error).message}`); continue; }
       human(io, `operation ${op.id} started; Enter opens its menu, Ctrl+C leaves, and neither stops the ${plan.kind}`);
       const end = await follow(host, io, op.id);
-      if (end === "completed") { if (io.presentation) await summary(host, io, host.read(op.id)); else human(io, `${plan.kind} to ${plan.version} completed`); return; }
+      if (end === "completed") { if (io.presentation) await summary(host, io, host.read(op.id)); else human(io, `${plan.kind} to ${plan.version} completed`); await globalUpdate(host, io, host.read(op.id)); return; }
       if (end === "left") return;
       // Blocked, cancelled or left to its runner: the lock check above opens its screen, or plans again once it is free.
     }

package/src/hub/action-class.ts

@@ -171,6 +171,14 @@ function commands(text: string, nest = 0): Command[] | undefined {
 function object(value: unknown): Record<string, unknown> | undefined {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : undefined;
 }
+/**
+ * #725 (#1193): the device files a redirect can name without writing any file: `2>/dev/null` is the common case. Matched as the exact literal the command wrote, never as a resolved path, so
+ * `/dev/../tmp/x`, `/dev//null`, `/dev/null/x` and `/dev/sda` stay outputs outside the root. Only `/dev/null` and `/dev/tty` are listed (the person's ruling): no descriptor stands behind either. `/dev/stdout`,
+ * `/dev/stderr`, `/dev/fd/1` and `/dev/fd/2` reopen whatever file fd 1 or 2 already points at, and a `>` truncates it (`sh -c 'echo x >/dev/stdout' >>/tmp/log` truncates /tmp/log on Linux), so they stay
+ * outputs, as does every `/dev/fd/<n>`. The redirect itself is still recorded (`redirected`), so the read-only git fast path stays closed.
+ */
+const DEVICE_OUTPUTS: ReadonlySet<string> = new Set(["/dev/null", "/dev/tty"]);
+const isDeviceOutput = (target: string): boolean => DEVICE_OUTPUTS.has(target);
 function outside(target: string, root: string, cwd: string): boolean {
   if (!isAbsolute(root) || !target || /[$`]/.test(target)) return false;
   if (target.startsWith("~") || !cwd && !isAbsolute(target)) return true;
@@ -646,7 +654,7 @@ function classify(command: Command, root: string, cwd: string[], found: Set<Acti
       if (nested) sequence(nested, root, cwd, found, depth + 1, bare ? floor : undefined);
     }
   }
-  if (command.outputs.some(p => cwd.some(at => outside(p, root, at)))) found.add("destroy");
+  if (command.outputs.some(p => !isDeviceOutput(p) && cwd.some(at => outside(p, root, at)))) found.add("destroy");
   if (program === "git") {
     const heads = commandHeads(words, ["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--config-env"],
       ["-P", "-p", "--no-pager", "--paginate", "--literal-pathspecs", "--bare", "--no-optional-locks", "--no-replace-objects"], ["push", "reset", "clean", "branch"]);