@yeaft/webchat-agent 1.0.250 → 1.0.252

package/cli.js

@@ -32,7 +32,9 @@ import {
 import { applyAgentIdentityToEnv, warnDeprecatedInstanceArg } from './service/config.js';
 import {
   buildUpgradeInstallCommand,
+  buildUpgradeMetadataUrl,
   buildUpgradeVersionCommand,
+  launchWindowsUpgradeScript,
 } from './upgrade-command.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -58,7 +60,7 @@ if (command === 'doctor') {
     process.exit(1);
   }
 } else if (command === 'upgrade') {
-  upgrade();
+  await upgrade();
 } else if (command === '--version' || command === '-v') {
   console.log(pkg.version);
 } else if (command === '--help' || command === '-h') {
@@ -464,7 +466,7 @@ function parseAndStart(args) {
 
 async function checkForUpdates() {
   try {
-    const res = await fetch(`https://registry.npmjs.org/${pkg.name}/latest`);
+    const res = await fetch(buildUpgradeMetadataUrl(pkg.name));
     if (!res.ok) return;
     const data = await res.json();
     const latest = data.version;
@@ -477,12 +479,12 @@ async function checkForUpdates() {
   }
 }
 
-function upgrade() {
+async function upgrade() {
   console.log(`Current version: ${pkg.version}`);
   console.log('Checking for updates...');
 
   try {
-    const latest = execSync(buildUpgradeVersionCommand(pkg.name), { encoding: 'utf-8' }).trim();
+    const latest = execSync(buildUpgradeVersionCommand(`${pkg.name}@latest`), { encoding: 'utf-8' }).trim();
     if (latest === pkg.version) {
       console.log('Already up to date.');
       return;
@@ -493,9 +495,9 @@ function upgrade() {
       // On Windows, the current process locks its own files. npm cannot overwrite
       // them while this process is running. Spawn a detached bat script that waits
       // for us to exit, then runs npm install, then optionally restarts the service.
-      upgradeWindows(latest);
+      await upgradeWindows(latest);
     } else {
-      execSync(buildUpgradeInstallCommand(`${pkg.name}@latest`), { stdio: 'inherit' });
+      execSync(buildUpgradeInstallCommand(`${pkg.name}@${latest}`), { stdio: 'inherit' });
       console.log(`Successfully upgraded to ${latest}`);
 
       // If PM2 is managing yeaft-agent, restart it so the new version takes effect
@@ -517,28 +519,24 @@ function upgrade() {
   }
 }
 
-function upgradeWindows(latestVersion) {
+async function upgradeWindows(latestVersion) {
   const configDir = join(process.env.APPDATA || join(homedir(), 'AppData', 'Roaming'), 'yeaft-agent');
   mkdirSync(configDir, { recursive: true });
   const logDir = join(configDir, 'logs');
   mkdirSync(logDir, { recursive: true });
   const batPath = join(configDir, 'upgrade-cli.bat');
-  const vbsPath = join(configDir, 'upgrade-cli.vbs');
+  const handoffPath = join(configDir, 'upgrade-cli.started');
   const logPath = join(logDir, 'upgrade.log');
   const pid = process.pid;
   const pkgSpec = `${pkg.name}@${latestVersion}`;
 
-  // --- PM2 handling: delete app before exit to prevent auto-restart ---
+  // Detect PM2 now, but do not delete it until the updater confirms handoff.
   let isPm2 = false;
   const ecoPath = join(configDir, 'ecosystem.config.cjs');
   try {
     const pm2List = execSync('pm2 jlist', { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
     const apps = JSON.parse(pm2List);
     isPm2 = Array.isArray(apps) && apps.some(app => app.name === 'yeaft-agent');
-    if (isPm2) {
-      execSync('pm2 delete yeaft-agent', { stdio: 'pipe' });
-      console.log('PM2 app deleted to prevent auto-restart during upgrade.');
-    }
   } catch {
     // PM2 not installed or not managing yeaft-agent — continue
   }
@@ -549,12 +547,14 @@ function upgradeWindows(latestVersion) {
     `set PID=${pid}`,
     `set PKG=${pkgSpec}`,
     `set LOGFILE=${logPath}`,
+    `set HANDOFF=${handoffPath}`,
     `set MAX_WAIT=30`,
     `set COUNT=0`,
     '',
     ':: Change to temp dir to avoid EBUSY on cwd',
     'cd /d "%TEMP%"',
     '',
+    'echo started>"%HANDOFF%"',
     'echo [Upgrade] Started at %date% %time% > "%LOGFILE%"',
     `echo [Upgrade] Version: ${pkg.version} -> ${latestVersion} >> "%LOGFILE%"`,
     `echo [Upgrade] PM2 managed: ${isPm2 ? 'yes (deleted pre-exit)' : 'no'} >> "%LOGFILE%"`,
@@ -607,28 +607,25 @@ function upgradeWindows(latestVersion) {
     '',
     'echo [Upgrade] Finished at %time% >> "%LOGFILE%"',
     ':CLEANUP',
-    `del /F /Q "${vbsPath}" 2>NUL`,
+    'del /F /Q "%HANDOFF%" 2>NUL',
     `del /F /Q "${batPath}" 2>NUL`,
   );
 
   writeFileSync(batPath, batLines.join('\r\n'));
 
-  // Use VBScript wrapper to fully detach the bat process from the parent.
-  // WshShell.Run with 0 (hidden window) and False (don't wait) ensures the bat
-  // runs completely independently — survives parent exit, no console window flash.
-  const vbsLines = [
-    'Set WshShell = CreateObject("WScript.Shell")',
-    `WshShell.Run """${batPath}""", 0, False`,
-  ];
-  writeFileSync(vbsPath, vbsLines.join('\r\n'));
-
-  spawn('wscript.exe', [vbsPath], {
-    detached: true,
-    stdio: 'ignore',
-    windowsHide: true,
-  }).unref();
+  const launcher = await launchWindowsUpgradeScript({
+    batPath,
+    handoffPath,
+    spawnProcess: spawn,
+    onHandoff: isPm2
+      ? () => {
+          execSync('pm2 delete yeaft-agent', { stdio: 'pipe' });
+          console.log('PM2 app deleted after upgrade handoff.');
+        }
+      : undefined,
+  });
 
-  console.log(`Upgrade script spawned via VBScript wrapper.`);
+  console.log(`Upgrade script spawned via ${launcher}.`);
   console.log(`This process will exit now. The upgrade will proceed after exit.`);
   console.log(`Check upgrade log: ${logPath}`);
   process.exit(0);

package/connection/upgrade.js

@@ -1,10 +1,15 @@
 import { execFile, execFileSync, spawn } from 'child_process';
-import { writeFileSync, mkdirSync, existsSync, cpSync } from 'fs';
+import { writeFileSync, mkdirSync, existsSync } from 'fs';
 import { join, dirname } from 'path';
-import { fileURLToPath } from 'url';
 import { platform, homedir } from 'os';
 import ctx from '../context.js';
 import { getConfigDir, getServiceName, getPm2AppName, getLaunchdPlistPath, DEFAULT_INSTANCE_ID } from '../service.js';
+import {
+  buildUpgradeInstallCommand,
+  buildUpgradeMetadataArgs,
+  buildUpgradeUpdateCommand,
+  launchWindowsUpgradeScript,
+} from '../upgrade-command.js';
 import { sendToServer } from './buffer.js';
 import { stopAgentHeartbeat } from './heartbeat.js';
 
@@ -39,24 +44,6 @@ const shellOpt = isWin ? { shell: true, windowsHide: true } : {};
 const currentPath = process.env.PATH || '/usr/bin:/bin:/usr/sbin:/sbin';
 const safePath = currentPath.includes(nodeBinDir) ? currentPath : `${nodeBinDir}:${currentPath}`;
 const safeEnv = { ...process.env, PATH: safePath };
-export const PUBLIC_NPM_REGISTRY = 'https://registry.npmjs.org/';
-
-/**
- * Build an npm metadata query that bypasses stale local metadata and registry
- * mirrors. Upgrade decisions must use the package actually published to the
- * public registry, not a cached `latest` value from a previous release.
- */
-export function buildNpmMetadataArgs(packageSpec, field) {
-  return [
-    'view',
-    packageSpec,
-    field,
-    `--registry=${PUBLIC_NPM_REGISTRY}`,
-    '--prefer-online',
-    '--prefer-offline=false',
-    '--offline=false',
-  ];
-}
 
 /** Return true only when `latestVersion` is semantically newer. */
 export function isUpgradeAvailable(currentVersion, latestVersion) {
@@ -66,9 +53,9 @@ export function isUpgradeAvailable(currentVersion, latestVersion) {
   return cmpTuple(latest, current) > 0;
 }
 
-/** Build the Windows worker invocation with the same registry used for metadata. */
-export function buildWindowsWorkerCommand(nodePath) {
-  return `"${nodePath.replace(/\//g, '\\')}" "%WORKER%" "%PKG%" "%PKG_DIR%" "%LOGFILE%" "${PUBLIC_NPM_REGISTRY}"`;
+/** Build the detached Windows npm invocation used after the Agent exits. */
+export function buildWindowsUpgradeCommand() {
+  return `call ${buildUpgradeUpdateCommand('%PKG%')}`;
 }
 
 // Shared cleanup logic for restart/upgrade
@@ -119,7 +106,7 @@ async function fetchRequiredNodeRange(pkgName, version) {
     const stdout = await new Promise((resolve, reject) => {
       execFile(
         npmPath,
-        buildNpmMetadataArgs(`${pkgName}@${version}`, 'engines.node'),
+        buildUpgradeMetadataArgs(`${pkgName}@${version}`, 'engines.node'),
         { stdio: 'pipe', env: safeEnv, ...shellOpt },
         (err, out) => { if (err) reject(err); else resolve(out.toString().trim()); },
       );
@@ -191,10 +178,10 @@ export async function handleUpgradeAgent() {
   console.log('[Agent] Upgrade requested, checking for updates...');
   try {
     const pkgName = ctx.pkgName || '@yeaft/webchat-agent';
-    // Force a public-registry refresh so stale Windows npm metadata or a lagging
-    // registry mirror cannot report the installed version as the latest one.
+    // Force an online refresh from the company-approved Yeaft registry instead
+    // of inheriting a blocked or stale registry from the user's npm config.
     const latestVersion = await new Promise((resolve, reject) => {
-      execFile(npmPath, buildNpmMetadataArgs(`${pkgName}@latest`, 'version'), { stdio: 'pipe', env: safeEnv, ...shellOpt }, (err, stdout) => {
+      execFile(npmPath, buildUpgradeMetadataArgs(`${pkgName}@latest`, 'version'), { stdio: 'pipe', env: safeEnv, ...shellOpt }, (err, stdout) => {
         if (err) reject(err); else resolve(stdout.toString().trim());
       });
     });
@@ -260,15 +247,15 @@ export async function handleUpgradeAgent() {
       await spawnUnixUpgradeScript(pkgName, installDir, isGlobalInstall, latestVersion, instanceId);
     }
 
-    // On PM2: delete the app BEFORE exiting so PM2 won't auto-restart the old version.
-    // The upgrade script will re-register it with `pm2 start <ecosystem>` after replacing files.
+    // Windows deletes PM2 inside the verified handoff callback. Unix keeps the
+    // existing pre-exit behavior because its detached launcher has no marker.
     const isPm2 = !!process.env.pm_id;
-    if (isPm2) {
+    if (!isWindows && isPm2) {
       try {
         execFileSync(pm2Path, ['delete', getPm2AppName(instanceId)], { stdio: 'pipe', env: safeEnv, ...shellOpt });
-        console.log(`[Agent] PM2 app deleted to prevent auto-restart during upgrade`);
+        console.log('[Agent] PM2 app deleted to prevent auto-restart during upgrade');
       } catch {
-        console.log(`[Agent] PM2 delete skipped (app may not be registered)`);
+        console.log('[Agent] PM2 delete skipped (app may not be registered)');
       }
     }
 
@@ -287,38 +274,29 @@ async function spawnWindowsUpgradeScript(pkgName, installDir, isGlobalInstall, l
   const logDir = join(configDir, 'logs');
   mkdirSync(logDir, { recursive: true });
   const batPath = join(configDir, 'upgrade.bat');
-  const vbsPath = join(configDir, 'upgrade.vbs');
+  const handoffPath = join(configDir, 'upgrade.started');
   const logPath = join(logDir, 'upgrade.log');
   const isPm2 = !!process.env.pm_id;
   const installDirWin = installDir.replace(/\//g, '\\');
   const ecoPath = join(configDir, 'ecosystem.config.cjs').replace(/\//g, '\\');
 
-  // Copy upgrade-worker-template.js to config dir (runs as CJS there, away from ESM context)
-  const thisDir = dirname(fileURLToPath(import.meta.url));
-  const workerSrc = join(thisDir, 'upgrade-worker-template.js');
-  const workerDst = join(configDir, 'upgrade-worker.js');
-  cpSync(workerSrc, workerDst);
-
-  // Determine the target package directory inside node_modules
-  const pkgDir = join(installDir, 'node_modules', ...pkgName.split('/')).replace(/\//g, '\\');
-
   const pm2Win = pm2Path.replace(/\//g, '\\');
 
   const batLines = [
     '@echo off',
     'setlocal',
     `set PID=${pid}`,
-    `set PKG=${pkgName}@${latestVersion}`,
+    `set PKG=${pkgName}`,
     `set INSTALL_DIR=${installDirWin}`,
-    `set PKG_DIR=${pkgDir}`,
     `set LOGFILE=${logPath}`,
-    `set WORKER=${workerDst}`,
+    `set HANDOFF=${handoffPath}`,
     `set MAX_WAIT=30`,
     `set COUNT=0`,
     '',
     ':: Change to temp dir to avoid EBUSY on cwd',
     'cd /d "%TEMP%"',
     '',
+    'echo started>"%HANDOFF%"',
     'echo [Upgrade] Started at %date% %time% > "%LOGFILE%"',
     `echo [Upgrade] Version: ${ctx.agentVersion} -> ${latestVersion} >> "%LOGFILE%"`,
     `echo [Upgrade] PM2 managed: ${isPm2 ? 'yes (deleted pre-exit)' : 'no'} >> "%LOGFILE%"`,
@@ -348,18 +326,20 @@ async function spawnWindowsUpgradeScript(pkgName, installDir, isGlobalInstall, l
     'ping -n 5 127.0.0.1 >NUL',
   );
 
-  // Use Node.js worker for file-level upgrade (avoids EBUSY on directory rename)
+  // Run npm only after the Agent has released its package files. The old
+  // package-copy worker performed a second dependency install, hid failures,
+  // and bypassed npm's supported global-update transaction.
   batLines.push(
-    'echo [Upgrade] Running upgrade worker at %time%... >> "%LOGFILE%"',
-    buildWindowsWorkerCommand(process.execPath),
+    'echo [Upgrade] Running npm update at %time%... >> "%LOGFILE%"',
+    `${buildWindowsUpgradeCommand()} >> "%LOGFILE%" 2>&1`,
     'if not "%errorlevel%"=="0" (',
-    '  echo [Upgrade] Worker failed with exit code %errorlevel% at %time% >> "%LOGFILE%"',
-    '  goto CLEANUP',
+    '  echo [Upgrade] npm update failed with exit code %errorlevel% at %time% >> "%LOGFILE%"',
+    '  goto RESTART_SERVICE',
     ')',
-    'echo [Upgrade] Worker completed successfully at %time% >> "%LOGFILE%"',
+    'echo [Upgrade] npm update succeeded at %time% >> "%LOGFILE%"',
   );
 
-  batLines.push(':CLEANUP');
+  batLines.push(':RESTART_SERVICE');
 
   if (isPm2) {
     // Re-register and start via ecosystem config (PM2 app was deleted pre-exit)
@@ -375,33 +355,28 @@ async function spawnWindowsUpgradeScript(pkgName, installDir, isGlobalInstall, l
     );
   }
 
-  // Clean up worker, vbs launcher, and bat script
   batLines.push(
     '',
     'echo [Upgrade] Finished at %time% >> "%LOGFILE%"',
-    `del /F /Q "${workerDst}" 2>NUL`,
-    `del /F /Q "${vbsPath}" 2>NUL`,
+    'del /F /Q "%HANDOFF%" 2>NUL',
     `del /F /Q "${batPath}"`,
   );
 
   writeFileSync(batPath, batLines.join('\r\n'));
 
-  // Use VBScript wrapper to fully detach the bat process from the parent.
-  // WshShell.Run with 0 (hidden window) and False (don't wait) ensures the bat
-  // runs completely independently — survives parent exit, no console window flash.
-  const vbsLines = [
-    'Set WshShell = CreateObject("WScript.Shell")',
-    `WshShell.Run """${batPath}""", 0, False`,
-  ];
-  writeFileSync(vbsPath, vbsLines.join('\r\n'));
-
-  spawn('wscript.exe', [vbsPath], {
-    detached: true,
-    stdio: 'ignore',
-    windowsHide: true,
-  }).unref();
+  const launcher = await launchWindowsUpgradeScript({
+    batPath,
+    handoffPath,
+    spawnProcess: spawn,
+    onHandoff: isPm2
+      ? () => {
+          execFileSync(pm2Path, ['delete', getPm2AppName(instanceId)], { stdio: 'pipe', env: safeEnv, ...shellOpt });
+          console.log('[Agent] PM2 app deleted after upgrade handoff');
+        }
+      : undefined,
+  });
 
-  console.log(`[Agent] Spawned upgrade via VBScript (PID wait for ${pid}, pm2=${isPm2}, dir=${installDir}): ${batPath}`);
+  console.log(`[Agent] Spawned upgrade via ${launcher} (PID wait for ${pid}, pm2=${isPm2}, dir=${installDir}): ${batPath}`);
   await sendToServer({ type: 'upgrade_agent_ack', success: true, version: latestVersion, pendingRestart: true });
 }
 
@@ -463,7 +438,6 @@ export function buildUnixUpgradeScript({
     '#!/bin/bash',
     `PID=${pid}`,
     `PKG="${pkgName}@${targetVersion}"`,
-    `REGISTRY="${PUBLIC_NPM_REGISTRY}"`,
     `NPM="${npmPath}"`,
     `LOGFILE="${join(configDir, 'logs', 'upgrade.log')}"`,
     `export PATH="${safePath}"`,
@@ -517,9 +491,10 @@ export function buildUnixUpgradeScript({
   }
 
   // npm install (use absolute path via $NPM variable)
+  const npmArgs = buildUpgradeInstallCommand('"$PKG"', { global: isGlobalInstall });
   const npmCmd = isGlobalInstall
-    ? `"$NPM" install -g "$PKG" --registry="$REGISTRY"`
-    : `cd "$INSTALL_DIR" && "$NPM" install "$PKG" --registry="$REGISTRY"`;
+    ? npmArgs.replace(/^npm /, '"$NPM" ')
+    : `cd "$INSTALL_DIR" && ${npmArgs.replace(/^npm /, '"$NPM" ')}`;
 
   shLines.push(
     'echo "[Upgrade] Installing $PKG..."',

package/local-runtime/server/handlers/client-work-center.js

@@ -12,6 +12,11 @@ import {
 
 const REQUEST_TIMEOUT_MS = 60_000;
 const pendingRequests = new Map();
+const WORK_ITEM_ATTACHMENT_OPS = new Set(['create', 'work_item_message', 'action_input', 'guide']);
+
+export function workCenterOpAcceptsAttachments(op) {
+  return WORK_ITEM_ATTACHMENT_OPS.has(op);
+}
 
 function decodePreviewBase64(value) {
   const data = typeof value === 'string' ? value : '';
@@ -140,7 +145,7 @@ export async function handleClientWorkCenter(client, msg, checkAgentAccess) {
 
   const op = typeof msg.op === 'string' ? msg.op : '';
   const sourcePayload = msg.payload && typeof msg.payload === 'object' ? msg.payload : {};
-  if (['create', 'action_input', 'guide'].includes(op) && Object.hasOwn(sourcePayload, 'files')) {
+  if (workCenterOpAcceptsAttachments(op) && Object.hasOwn(sourcePayload, 'files')) {
     await sendToWebClient(client, {
       type: 'work_center_response',
       requestId: typeof msg.requestId === 'string' ? msg.requestId : null,
@@ -170,13 +175,15 @@ export async function handleClientWorkCenter(client, msg, checkAgentAccess) {
   let resolved = { payload: sourcePayload, consumedIds: [] };
   try {
     const attachments = Array.isArray(sourcePayload.attachments) ? sourcePayload.attachments : [];
-    if (['create', 'action_input', 'guide'].includes(op) && attachments.length > 0) {
+    if (workCenterOpAcceptsAttachments(op) && attachments.length > 0) {
       const capabilities = agents.get(agentId)?.capabilities;
       if (!Array.isArray(capabilities) || !capabilities.includes('work_item_attachments')) {
         throw new Error('The selected Agent does not support WorkItem attachments');
       }
     }
-    if (['create', 'action_input', 'guide'].includes(op)) resolved = resolveWorkItemAttachments(client, sourcePayload);
+    if (workCenterOpAcceptsAttachments(op)) {
+      resolved = resolveWorkItemAttachments(client, sourcePayload);
+    }
   } catch (error) {
     await sendToWebClient(client, {
       type: 'work_center_response',

package/local-runtime/version.json

@@ -1 +1 @@
-{"version":"1.0.250"}
+{"version":"1.0.252"}