@yeaft/webchat-agent 1.0.674 → 1.0.675

package/connection/buffer.js

@@ -104,14 +104,14 @@ async function sendNow(msg, queuedSocket) {
   const socket = ctx.ws;
   if (!socket || socket.readyState !== WebSocket.OPEN) return bufferMessage(msg, 'Disconnected');
   // File transfers are request/connection scoped, unlike replayable chat output.
-  if (['file_content_chunk', 'video_chunk'].includes(msg.type) && queuedSocket !== socket) return 'dropped';
+  if (['file_content_chunk', 'video_chunk', 'upgrade_agent_ack'].includes(msg.type) && queuedSocket !== socket) return 'dropped';
   const payload = ctx.serverEncryptionRequired && ctx.sessionKey
     ? await encrypt(msg, ctx.sessionKey) : msg;
   if (socket !== ctx.ws || socket.readyState !== WebSocket.OPEN) {
     return bufferMessage(msg, 'Connection changed');
   }
   const data = JSON.stringify(payload);
-  if (['file_content_chunk', 'video_chunk'].includes(msg.type)) return sendTransferChunk(socket, data);
+  if (['file_content_chunk', 'video_chunk', 'upgrade_agent_ack'].includes(msg.type)) return sendTransferChunk(socket, data);
   socket.send(data);
   return 'sent';
 }
@@ -161,7 +161,7 @@ export async function sendToServer(msg) {
     return 'dropped';
   }
   const promise = new Promise((resolve, reject) => {
-    const connectionScoped = ['file_content_chunk', 'video_chunk'].includes(msg.type);
+    const connectionScoped = ['file_content_chunk', 'video_chunk', 'upgrade_agent_ack'].includes(msg.type);
     ctx.outboundSendQueue.push({ msg, bytes, resolve, reject, socket: connectionScoped ? ctx.ws : null });
     ctx.outboundSendQueueBytes = Number(ctx.outboundSendQueueBytes || 0) + bytes;
   });

package/connection/upgrade.js

@@ -21,6 +21,7 @@ import {
 } from '../upgrade-command.js';
 import { sendToServer } from './buffer.js';
 import { stopAgentHeartbeat } from './heartbeat.js';
+import { createUnixUpgradeRun, getUnixUpgradeLockPath, launchUnixUpgrade, shellQuote } from '../unix-upgrade.js';
 
 /**
  * Resolve the local service instance id for this running agent. Each agent
@@ -63,8 +64,11 @@ export function isUpgradeAvailable(currentVersion, latestVersion) {
 }
 
 // Shared cleanup logic for restart/upgrade
-function cleanupAndExit(exitCode) {
+function cleanupAndExit(exitCode, { maxCleanupMs = null } = {}) {
   setTimeout(async () => {
+    // The updater waits for this process. Do not let an unbounded async cleanup
+    // outlive the handoff and strand an on-failure service after exit(0).
+    if (maxCleanupMs) setTimeout(() => process.exit(exitCode), maxCleanupMs).unref();
     for (const [, term] of ctx.terminals) {
       if (term.pty) { try { term.pty.kill(); } catch {} }
       if (term.timer) clearTimeout(term.timer);
@@ -282,7 +286,7 @@ export async function handleUpgradeAgent(correlation = {}) {
     }
 
     // 清理并退出，让升级脚本接管
-    cleanupAndExit(0);
+    cleanupAndExit(0, { maxCleanupMs: 20_000 });
   } catch (e) {
     console.error('[Agent] Upgrade failed:', e.message);
     await sendUpgradeAck({ success: false, error: e.message });
@@ -416,11 +420,12 @@ export function buildUnixUpgradeScript({
   safePath,
   instanceId = DEFAULT_INSTANCE_ID,
   isDarwin = platform() === 'darwin',
+  run,
+  lockPath,
+  nodePath = process.execPath,
+  isSystemd = existsSync(join(homedir(), '.config', 'systemd', 'user', `${getServiceName(instanceId)}.service`)),
 }) {
-  const shPath = join(configDir, 'upgrade.sh');
   const serviceName = getServiceName(instanceId);
-  const systemdUnitPath = join(homedir(), '.config', 'systemd', 'user', `${serviceName}.service`);
-  const isSystemd = existsSync(systemdUnitPath);
   const plistPath = getLaunchdPlistPath(instanceId);
   const isLaunchd = isDarwin && existsSync(plistPath);
   const cwd = isGlobalInstall ? undefined : installDir;
@@ -428,16 +433,47 @@ export function buildUnixUpgradeScript({
   const shLines = [
     '#!/bin/bash',
     `PID=${pid}`,
-    `PKG="${pkgName}@${targetVersion}"`,
-    `NPM="${npmPath}"`,
-    `LOGFILE="${join(configDir, 'logs', 'upgrade.log')}"`,
-    `export PATH="${safePath}"`,
+    `PKG=${shellQuote(`${pkgName}@${targetVersion}`)}`,
+    `NPM=${shellQuote(npmPath)}`,
+    `LOGFILE=${shellQuote(join(configDir, 'logs', 'upgrade.log'))}`,
+    `export PATH=${shellQuote(safePath)}`,
     '',
     '# Redirect all output to log file',
-    'exec > "$LOGFILE" 2>&1',
+    'exec >> "$LOGFILE" 2>&1 || exit 1',
     'echo "[Upgrade] Started at $(date)"',
     '',
-    ...(cwd ? [`INSTALL_DIR="${cwd}"`] : []),
+    ...(cwd ? [`INSTALL_DIR=${shellQuote(cwd)}`] : []),
+    ...(run ? [
+      `RUN_DIR=${shellQuote(run.dir)}`,
+      `READY=${shellQuote(run.readyPath)}`,
+      `AUTHORIZED=${shellQuote(run.authorizePath)}`,
+      `ACCEPTED=${shellQuote(run.acceptedPath)}`,
+      `CANCELLED=${shellQuote(run.cancelPath)}`,
+      `ERROR_FILE=${shellQuote(run.errorPath)}`,
+      ...(lockPath ? [
+        `LOCK=${shellQuote(lockPath)}`,
+        'if ! command -v flock >/dev/null || ! exec 9>"$LOCK"; then',
+        '  echo "Cannot acquire installation upgrade lock; Agent remains online" > "$ERROR_FILE"',
+        '  exit 1',
+        'fi',
+        'if ! flock -n 9; then',
+        '  echo "Another Agent is upgrading this shared installation; retry after it finishes" > "$ERROR_FILE"',
+        '  exit 1',
+        'fi',
+      ] : []),
+      'echo "$$" > "$READY" || exit 1',
+      'COUNT=0',
+      'while [ ! -f "$AUTHORIZED" ]; do',
+      '  if [ -f "$CANCELLED" ] || ! kill -0 "$PID" 2>/dev/null || [ "$COUNT" -ge 60 ]; then',
+      '    echo "[Upgrade] Handoff cancelled; installation unchanged"',
+      '    exit 1',
+      '  fi',
+      '  COUNT=$((COUNT+1))',
+      '  sleep 1',
+      'done',
+      '[ ! -f "$CANCELLED" ] || exit 1',
+      'touch "$ACCEPTED" || exit 1',
+    ] : []),
     '',
     '# Wait for current process to exit',
     'COUNT=0',
@@ -445,10 +481,11 @@ export function buildUnixUpgradeScript({
     '  COUNT=$((COUNT+1))',
     '  if [ $COUNT -ge 30 ]; then',
     '    echo "[Upgrade] Timeout waiting for PID $PID to exit"',
-    '    break',
+    '    exit 1',
     '  fi',
     '  sleep 2',
     'done',
+    ...(run ? ['[ ! -f "$CANCELLED" ] || exit 1'] : []),
     '',
   ];
 
@@ -468,7 +505,10 @@ export function buildUnixUpgradeScript({
       'export DBUS_SESSION_BUS_ADDRESS="${DBUS_SESSION_BUS_ADDRESS:-unix:path=/run/user/$YEAFT_UID/bus}"',
       '',
       '# Stop systemd service to prevent restart loop',
-      `systemctl --user stop "${serviceName}" 2>/dev/null`,
+      `if ! systemctl --user stop "${serviceName}"; then`,
+      '  echo "[Upgrade] Could not stop selected service; refusing to modify installation"',
+      '  exit 1',
+      'fi',
       'sleep 1',
       '',
     );
@@ -487,10 +527,19 @@ export function buildUnixUpgradeScript({
     ? npmArgs.replace(/^npm /, '"$NPM" ')
     : `cd "$INSTALL_DIR" && ${npmArgs.replace(/^npm /, '"$NPM" ')}`;
 
+  // Recheck after acquiring the shared lock. An older queued process must not
+  // replace a package that another instance has already upgraded.
+  const installedManifest = join(installDir, 'node_modules', pkgName, 'package.json');
+  const versionCheck = `try { const fs = require('node:fs'); const v = JSON.parse(fs.readFileSync(process.argv[1])).version; const a = v.split('.').map(Number); const b = process.argv[2].split('.').map(Number); let d = 0; for (let i = 0; i < 3 && !d; i++) d = a[i] - b[i]; process.exit(d >= 0 ? 0 : 1); } catch { process.exit(1); }`;
   shLines.push(
+    `if ${shellQuote(nodePath)} -e ${shellQuote(versionCheck)} ${shellQuote(installedManifest)} ${shellQuote(targetVersion)}; then`,
+    '  echo "[Upgrade] Shared installation already has this version or newer; restarting selected instance only"',
+    '  EXIT_CODE=0',
+    'else',
     'echo "[Upgrade] Installing $PKG..."',
     npmCmd,
     'EXIT_CODE=$?',
+    'fi',
     'if [ $EXIT_CODE -ne 0 ]; then',
     '  echo "[Upgrade] npm install failed with exit code $EXIT_CODE"',
     'else',
@@ -527,8 +576,8 @@ export function buildUnixUpgradeScript({
     );
   }
 
-  // 清理脚本自身
-  shLines.push('', `rm -f "${shPath}"`);
+  // Keep failed handoffs for diagnosis; successful runs remove only their own files.
+  shLines.push('', run ? 'rm -rf -- "$RUN_DIR"' : `rm -f ${shellQuote(join(configDir, 'upgrade.sh'))}`);
 
   return shLines.join('\n');
 }
@@ -538,7 +587,16 @@ async function spawnUnixUpgradeScript(pkgName, installDir, isGlobalInstall, late
   // Create logs/ too: the generated script's `exec > "$LOGFILE" 2>&1` aborts
   // the whole upgrade silently if that directory is missing.
   mkdirSync(join(configDir, 'logs'), { recursive: true });
-  const shPath = join(configDir, 'upgrade.sh');
+  const run = createUnixUpgradeRun(configDir);
+  const isSystemd = platform() === 'linux' && (
+    !!process.env.INVOCATION_ID
+    || existsSync(join(homedir(), '.config', 'systemd', 'user', `${getServiceName(instanceId)}.service`))
+  );
+  // Linux flock is kernel-owned: it releases automatically even when an updater
+  // crashes. Never unlink the shared lock inode while another runner may use it.
+  const lockPath = platform() === 'linux'
+    ? getUnixUpgradeLockPath(installDir, join(getConfigDir(DEFAULT_INSTANCE_ID), 'upgrade-locks'))
+    : null;
 
   const script = buildUnixUpgradeScript({
     pkgName,
@@ -550,14 +608,20 @@ async function spawnUnixUpgradeScript(pkgName, installDir, isGlobalInstall, late
     npmPath,
     safePath,
     instanceId,
+    run,
+    lockPath,
+    isSystemd,
   });
 
-  writeFileSync(shPath, script, { mode: 0o755 });
-  const child = spawn('bash', [shPath], {
-    detached: true,
-    stdio: 'ignore',
+  writeFileSync(run.scriptPath, script, { mode: 0o700 });
+  await launchUnixUpgrade({
+    run,
+    instanceId,
+    isSystemd,
+    env: safeEnv,
+    serviceRunnerPath: fileURLToPath(new URL('../yeaft/systemd-service-runner.js', import.meta.url)),
+    sendUpgradeAck,
+    version: latestVersion,
   });
-  child.unref();
-  console.log(`[Agent] Spawned upgrade script: ${shPath}`);
-  await sendUpgradeAck({ success: true, version: latestVersion, pendingRestart: true });
+  console.log(`[Agent] Upgrade runner ready outside service cgroup: ${run.scriptPath}`);
 }

package/local-runtime/version.json

@@ -1 +1 @@
-{"version":"1.0.674"}
+{"version":"1.0.675"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yeaft/webchat-agent",
-  "version": "1.0.674",
+  "version": "1.0.675",
   "description": "Remote worker agent for Yeaft Web Code Agent — connects the native Yeaft engine, CLI providers, and workbench tools",
   "main": "index.js",
   "type": "module",

package/unix-upgrade.js

@@ -0,0 +1,135 @@
+import { createHash } from 'node:crypto';
+import { execFile, spawn } from 'node:child_process';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+
+export function shellQuote(value) {
+  return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+
+/** A shared install has one kernel lock, independent of the requesting instance. */
+export function getUnixUpgradeLockPath(installDir, lockRoot) {
+  const key = createHash('sha256').update(realpathSync(installDir)).digest('hex');
+  mkdirSync(lockRoot, { recursive: true, mode: 0o700 });
+  return join(lockRoot, `${key}.lock`);
+}
+
+/** Runtime files live outside the npm package and never contain public credentials. */
+export function createUnixUpgradeRun(configDir) {
+  const root = join(configDir, 'upgrade-runtime');
+  mkdirSync(root, { recursive: true, mode: 0o700 });
+  const dir = mkdtempSync(join(root, 'unix-'));
+  return {
+    dir,
+    scriptPath: join(dir, 'upgrade.sh'),
+    readyPath: join(dir, 'ready'),
+    authorizePath: join(dir, 'authorized'),
+    acceptedPath: join(dir, 'accepted'),
+    cancelPath: join(dir, 'cancelled'),
+    errorPath: join(dir, 'error'),
+  };
+}
+
+function processRunning(pid) {
+  try { process.kill(pid, 0); return true; } catch (error) { return error.code === 'EPERM'; }
+}
+
+/**
+ * Start an updater in a separate systemd service (never a detached child in the
+ * Agent cgroup). The shell must acquire its install lock and signal readiness
+ * before the caller acknowledges or exits. Failure leaves the Agent online.
+ */
+export async function launchUnixUpgrade({
+  run,
+  instanceId,
+  isSystemd,
+  env = process.env,
+  nodePath = process.execPath,
+  serviceRunnerPath,
+  sendUpgradeAck,
+  version,
+  timeoutMs = 10_000,
+}, dependencies = {}) {
+  const exec = dependencies.execFileAsync || execFileAsync;
+  const spawnProcess = dependencies.spawn || spawn;
+  const running = dependencies.processRunning || processRunning;
+  const unit = `yeaft-upgrade-${instanceId.slice(0, 60)}-${process.pid}-${run.dir.split('unix-').at(-1)}.service`;
+  const uid = process.getuid?.();
+  const managerEnv = {
+    ...env,
+    XDG_RUNTIME_DIR: env.XDG_RUNTIME_DIR || `/run/user/${uid}`,
+    DBUS_SESSION_BUS_ADDRESS: env.DBUS_SESSION_BUS_ADDRESS || `unix:path=/run/user/${uid}/bus`,
+  };
+  let child;
+  try {
+    if (isSystemd) {
+      // Pass the inherited environment privately, not as --setenv command-line
+      // arguments. The runner consumes/removes this payload before npm runs.
+      const payloadDir = join(run.dir, 'invocation');
+      mkdirSync(payloadDir, { mode: 0o700 });
+      const payloadPath = join(payloadDir, 'invocation.json');
+      writeFileSync(payloadPath, JSON.stringify({
+        command: '/bin/bash', args: [run.scriptPath], cwd: run.dir, env: managerEnv,
+      }), { mode: 0o600 });
+      await exec('systemd-run', [
+        '--user', '--quiet', '--collect', '--service-type=exec',
+        `--unit=${unit}`, '--', nodePath, serviceRunnerPath, payloadPath,
+      ], { env: managerEnv, timeout: timeoutMs });
+    } else {
+      child = spawnProcess('bash', [run.scriptPath], {
+        cwd: run.dir, env, detached: true, stdio: 'ignore',
+      });
+      await new Promise((resolve, reject) => {
+        child.once('spawn', resolve);
+        child.once('error', reject);
+      });
+      child.unref();
+    }
+
+    const deadline = Date.now() + timeoutMs;
+    let ownerPid;
+    while (Date.now() < deadline) {
+      if (existsSync(run.errorPath)) throw new Error(readFileSync(run.errorPath, 'utf8').trim());
+      try {
+        const pid = Number(readFileSync(run.readyPath, 'utf8'));
+        if (Number.isInteger(pid) && pid > 0 && running(pid)) { ownerPid = pid; break; }
+      } catch {}
+      if (child && child.exitCode != null) throw new Error(`Unix upgrade runner exited with code ${child.exitCode}`);
+      await delay(50);
+    }
+    if (!ownerPid) throw new Error('Unix upgrade runner did not become ready; Agent remains online');
+    let ackTimer;
+    try {
+      const outcome = await Promise.race([
+        sendUpgradeAck({ success: true, version, pendingRestart: true }),
+        new Promise((_, reject) => {
+          ackTimer = setTimeout(() => reject(new Error('Upgrade acknowledgement timed out; Agent remains online')), timeoutMs);
+        }),
+      ]);
+      if (outcome !== 'sent') throw new Error('Upgrade acknowledgement was not sent; Agent remains online');
+    } finally { clearTimeout(ackTimer); }
+    if (!running(ownerPid)) throw new Error('Unix upgrade runner exited during acknowledgement; Agent remains online');
+    writeFileSync(run.authorizePath, 'authorized');
+    const acceptDeadline = Date.now() + timeoutMs;
+    while (Date.now() < acceptDeadline) {
+      if (!running(ownerPid)) throw new Error('Unix upgrade runner exited before accepting handoff; Agent remains online');
+      if (existsSync(run.acceptedPath)) return { unit: isSystemd ? unit : null };
+      await delay(50);
+    }
+    throw new Error('Unix upgrade runner did not accept handoff; Agent remains online');
+  } catch (error) {
+    // Revoke authorization even if the manager is slow or start timed out.
+    writeFileSync(run.cancelPath, 'cancelled');
+    if (isSystemd) {
+      try { await exec('systemctl', ['--user', 'stop', unit], { env: managerEnv, timeout: 5000 }); } catch {}
+    } else if (child?.pid) {
+      try { process.kill(-child.pid, 'SIGTERM'); } catch {}
+    }
+    // Keep cancellation files: an ambiguously started runner must see them.
+    throw error;
+  }
+}