@yeaft/webchat-agent 1.0.445 → 1.0.446

package/Dockerfile

@@ -4,7 +4,8 @@ ARG BUILD_VERSION=dev
 ENV NODE_ENV=production \
     HOME=/home/yeaft \
     YEAFT_DIR=/home/yeaft/.yeaft \
-    WORK_DIR=/workspace
+    WORK_DIR=/workspace \
+    YEAFT_AGENT_RUNTIME=container_agent
 
 RUN apt-get update \
   && apt-get install -y --no-install-recommends ca-certificates git openssh-client tini \
@@ -16,7 +17,9 @@ RUN apt-get update \
 WORKDIR /app
 COPY package.json package-lock.json ./
 COPY agent/package.json ./agent/
-RUN npm ci --workspace=agent --omit=dev
+RUN npm_config_cache=/tmp/yeaft-npm-cache npm ci --workspace=agent --omit=dev \
+  && rm -rf /tmp/yeaft-npm-cache \
+  && install -d -m 0700 -o yeaft -g yeaft /home/yeaft/.npm
 COPY --chown=yeaft:yeaft agent ./agent
 RUN node -e "const fs=require('fs'); const p='agent/package.json'; const j=JSON.parse(fs.readFileSync(p)); j.version=process.argv[1].replace(/^v/, ''); fs.writeFileSync(p, JSON.stringify(j, null, 2) + '\\n')" "$BUILD_VERSION" \
   && chmod 0755 agent/container-entrypoint.sh

package/cli.js

@@ -38,9 +38,12 @@ import {
   warnDeprecatedInstanceArg,
 } from './service/config.js';
 import {
+  buildContainerImageUpgradeMessage,
   buildUpgradeInstallCommand,
   buildUpgradeMetadataUrl,
   buildUpgradeVersionCommand,
+  CONTAINER_IMAGE_UPGRADE_REASON,
+  isContainerAgentRuntime,
   createWindowsUpgradeRun,
   launchWindowsUpgradeScript,
   prepareWindowsUpgradeRunner,
@@ -545,6 +548,7 @@ function parseAndStart(args) {
 }
 
 async function checkForUpdates() {
+  if (isContainerAgentRuntime()) return;
   try {
     const res = await fetch(buildUpgradeMetadataUrl(pkg.name));
     if (!res.ok) return;
@@ -562,6 +566,11 @@ async function checkForUpdates() {
 async function upgrade(args = []) {
   warnDeprecatedInstanceArg(args);
   const instanceId = resolveServiceInstanceId(args, process.env, { management: true });
+  if (isContainerAgentRuntime()) {
+    console.error(`${CONTAINER_IMAGE_UPGRADE_REASON}: ${buildContainerImageUpgradeMessage(pkg.version)}`);
+    process.exitCode = 1;
+    return;
+  }
   console.log(`Current version: ${pkg.version}`);
   console.log('Checking for updates...');
 

package/connection/upgrade.js

@@ -8,6 +8,10 @@ import { getConfigDir, getServiceName, getPm2AppName, getLaunchdPlistPath, DEFAU
 import {
   buildUpgradeInstallCommand,
   buildUpgradeMetadataArgs,
+  buildContainerImageUpgradeMessage,
+  CONTAINER_AGENT_CAPABILITY,
+  CONTAINER_IMAGE_UPGRADE_REASON,
+  isContainerAgentRuntime,
   createWindowsUpgradeRun,
   launchWindowsUpgradeScript,
   prepareWindowsUpgradeRunner,
@@ -175,6 +179,20 @@ function compareCmp(cur, cmp) {
 }
 
 export async function handleUpgradeAgent() {
+  if (isContainerAgentRuntime() || ctx.agentCapabilities?.includes(CONTAINER_AGENT_CAPABILITY)) {
+    const version = ctx.agentVersion || null;
+    const error = buildContainerImageUpgradeMessage(version);
+    console.warn(`[Agent] Upgrade rejected (${CONTAINER_IMAGE_UPGRADE_REASON}): ${error}`);
+    await sendToServer({
+      type: 'upgrade_agent_ack',
+      success: false,
+      reason: CONTAINER_IMAGE_UPGRADE_REASON,
+      error,
+      version,
+    });
+    return;
+  }
+
   console.log('[Agent] Upgrade requested, checking for updates...');
   try {
     const pkgName = ctx.pkgName || '@yeaft/webchat-agent';

package/container-manager.js

@@ -122,6 +122,7 @@ export function buildCreateArgs({
     '--mount', `type=bind,src=${resolve(secretFile)},dst=/run/yeaft-host-secret,readonly`,
     '--env', `SERVER_URL=${serverUrl}`,
     '--env', `AGENT_NAME=${agentName}`,
+    '--env', 'YEAFT_AGENT_RUNTIME=container_agent',
     '--env', 'AGENT_SECRET_FILE=/run/yeaft-host-secret',
     '--env', 'YEAFT_DIR=/home/yeaft/.yeaft',
     '--env', 'WORK_DIR=/workspace',

package/index.js

@@ -20,7 +20,9 @@ import {
 import { loadNodePty } from './terminal.js';
 import { connect } from './connection.js';
 import { loadMcpServers } from './mcp.js';
-import { SAFE_REMOTE_UPGRADE_CAPABILITY } from './upgrade-command.js';
+import {
+  getAgentUpgradeCapability,
+} from './upgrade-command.js';
 import { loadConfig as loadYeaftConfig } from './yeaft/config.js';
 import { initYeaftDir } from './yeaft/init.js';
 import { updateBrowserRuntimeSettings } from './yeaft/config-api.js';
@@ -173,7 +175,8 @@ async function detectCapabilities() {
   // agent build can speak plaintext WS frames. New servers see this and
   // flip `agent.encryptOutbound = false`, stopping outbound encryption
   // to this peer. Old servers ignore the unknown capability token.
-  const capabilities = ['background_tasks', 'file_editor', 'ping_session', 'plaintext-ok', 'workbench_session_routes', SAFE_REMOTE_UPGRADE_CAPABILITY, 'work_center', 'work_center_message_v2', 'session_history_search', 'session_history_outline', 'session_history_window_prefetch', 'file_reference_resolution', 'yeaft_plugins', 'yeaft_managed_skills'];
+  const capabilities = ['background_tasks', 'file_editor', 'ping_session', 'plaintext-ok', 'workbench_session_routes', 'work_center', 'work_center_message_v2', 'session_history_search', 'session_history_outline', 'session_history_window_prefetch', 'file_reference_resolution', 'yeaft_plugins', 'yeaft_managed_skills'];
+  capabilities.push(getAgentUpgradeCapability());
   if (process.platform === 'linux') capabilities.push('work_item_attachments');
   const pty = await loadNodePty();
   if (pty) capabilities.push('terminal');

package/local-runtime/agent/container-manager.js

@@ -122,6 +122,7 @@ export function buildCreateArgs({
     '--mount', `type=bind,src=${resolve(secretFile)},dst=/run/yeaft-host-secret,readonly`,
     '--env', `SERVER_URL=${serverUrl}`,
     '--env', `AGENT_NAME=${agentName}`,
+    '--env', 'YEAFT_AGENT_RUNTIME=container_agent',
     '--env', 'AGENT_SECRET_FILE=/run/yeaft-host-secret',
     '--env', 'YEAFT_DIR=/home/yeaft/.yeaft',
     '--env', 'WORK_DIR=/workspace',

package/local-runtime/server/handlers/client-misc.js

@@ -13,6 +13,8 @@ import {
 // may receive remote upgrade commands. Version thresholds are insufficient:
 // builds without this capability may still inherit the installed package cwd.
 export const SAFE_REMOTE_UPGRADE_CAPABILITY = 'remote_upgrade_safe';
+export const CONTAINER_AGENT_CAPABILITY = 'container_agent';
+export const CONTAINER_IMAGE_UPGRADE_REASON = 'container_image_upgrade_required';
 export { YEAFT_PLUGINS_CAPABILITY, YEAFT_PLUGINS_UNSUPPORTED_ERROR };
 
 async function rejectUnsupportedYeaftPlugins(client, msg, agentId) {
@@ -59,6 +61,19 @@ export async function handleClientMisc(clientId, client, msg, checkAgentAccess)
       if (!upgradeAgentId) break;
       if (!await checkAgentAccess(upgradeAgentId)) break;
       const upgradeAgent = agents.get(upgradeAgentId);
+      if (Array.isArray(upgradeAgent?.capabilities)
+          && upgradeAgent.capabilities.includes(CONTAINER_AGENT_CAPABILITY)) {
+        await sendToWebClient(client, {
+          type: 'upgrade_agent_ack',
+          agentId: upgradeAgentId,
+          success: false,
+          reason: CONTAINER_IMAGE_UPGRADE_REASON,
+          version: upgradeAgent?.version || null,
+          requiredCapability: CONTAINER_AGENT_CAPABILITY,
+          error: 'Container Agent is managed as a Docker image. Pull the configured image and recreate the same container through the Server/Sandbox lifecycle while keeping its persistent volumes and host-side agent-secret file.',
+        });
+        break;
+      }
       if (requiresManualUpgradeBridge(upgradeAgent?.capabilities, upgradeAgent?.platform)) {
         await sendToWebClient(client, {
           type: 'upgrade_agent_ack',

package/local-runtime/version.json

@@ -1 +1 @@
-{"version":"1.0.445"}
+{"version":"1.0.446"}