alexandr 0.3.3 → 0.3.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alexandr",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "Run the alexandr workspace runtime locally (npx alexandr up), and develop alexandr apps against a workspace (alexandr app link | dev | build | deploy).",
   "type": "module",
   "bin": {

package/src/docker.js

@@ -2,6 +2,7 @@
 // `docker compose` against the published kernel image. Pure Node child_process.
 
 import { spawnSync } from "node:child_process";
+import fs from "node:fs";
 import path from "node:path";
 
 import { EXIT } from "./exit.js";
@@ -38,12 +39,44 @@ function baseArgs(dir, projectName) {
   ];
 }
 
+/**
+ * ⚠⚠ THE INSTANCE'S `.env` IS THE ONLY SOURCE COMPOSE INTERPOLATES FROM. Compose gives the
+ * PROCESS environment precedence over the project's `.env`, and the updater sidecar's own
+ * environment is that very `.env`, frozen at the container's start (`env_file` on the service).
+ * So the recipe run from inside pinned `ALEXANDR_IMAGE=v0.0.13` in the file, then compose pulled
+ * and recreated v0.0.12 from the sidecar's stale variable — "Updated: 0.0.12 → 0.0.12", every
+ * press, including the one the 2026-09-08 E2E called a success (found on the first human press,
+ * aos, 2026-09-09). The same shadowing bites a host shell that exported `ALEXANDR_IMAGE` once.
+ * Every key the file defines is dropped from the child's environment; explicit `overrides`
+ * (a caller's deliberate one-off) still win.
+ */
+export function composeEnv(dir, base = process.env, overrides = {}) {
+  const env = { ...base };
+  for (const key of envFileKeys(dir)) delete env[key];
+  return { ...env, ...overrides };
+}
+
+// The KEYS the instance's `.env` defines (uncommented lines only) — a hand copy of the
+// instance module's parser, kept here because that module imports this one.
+function envFileKeys(dir) {
+  try {
+    return fs
+      .readFileSync(path.join(dir, ".env"), "utf8")
+      .split("\n")
+      .map((line) => line.match(/^\s*([A-Z0-9_]+)\s*=/))
+      .filter(Boolean)
+      .map((m) => m[1]);
+  } catch {
+    return [];
+  }
+}
+
 // Run a compose subcommand, inheriting stdio by default (streams to the user).
 export function compose(dir, projectName, args, opts = {}) {
   const r = spawnSync("docker", [...baseArgs(dir, projectName), ...args], {
     stdio: opts.stdio ?? "inherit",
     encoding: "utf8",
-    env: { ...process.env, ...(opts.env || {}) },
+    env: composeEnv(dir, process.env, opts.env || {}),
   });
   return { status: r.error ? 127 : r.status ?? 1 };
 }
@@ -52,7 +85,7 @@ export function compose(dir, projectName, args, opts = {}) {
 export function composeCapture(dir, projectName, args, env = {}) {
   const r = spawnSync("docker", [...baseArgs(dir, projectName), ...args], {
     encoding: "utf8",
-    env: { ...process.env, ...env },
+    env: composeEnv(dir, process.env, env),
   });
   return {
     status: r.error ? 127 : r.status ?? 1,

package/src/updater.js

@@ -124,6 +124,17 @@ export function createUpdaterHandler(deps) {
       } catch (e) {
         result = { ok: false, error: e?.message || String(e) };
       }
+      // ⚠ THE RECEIPT IS THE VERDICT, NOT THE EXIT CODE. `alexandr update` exits 0 after
+      // recreating whatever image compose resolved; when that is not the target, the box is
+      // "updated" onto the version it already ran (the 2026-09-09 press: `Updated: 0.0.12 →
+      // 0.0.12` with 0.0.13 asked for — the sidecar's own environment shadowed the pin). A done
+      // that names the wrong version is a failure with words, and the sheet offers the way back.
+      if (result.ok && !rollback && to && result.to && result.to !== to) {
+        result = {
+          ok: false,
+          error: `the box came back on ${result.to}, not ${to} — the recipe recreated the image it already ran`,
+        };
+      }
       if (result.ok) {
         write({ state: "done", phase: "done", to: result.to ?? to, from: result.from ?? null, rollback, startedAt, finishedAt: now() });
       } else {