amicus 1.7.2 → 1.7.3

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "1.7.2",
+  "version": "1.7.3",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "author": { "name": "Christian Wagner" },
   "homepage": "https://bourbondog.github.io/amicus/",

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to Amicus are documented here. Format follows
 
 ## [Unreleased]
 
+## [1.7.3] - 2026-06-30
+
+### Fixed
+- **The Electron self-heal no longer wedges itself.** A repair that was killed or hung mid-run (or a
+  pre-1.7.3 build) could leave an orphaned single-flight lockfile, after which *every* subsequent repair
+  — including `amicus doctor --fix` and the GUI launch — reported "another electron repair is already in
+  progress" and did nothing. The lock now records the holder's PID + timestamp and reclaims an orphaned
+  lock (dead holder, older than a 15-minute TTL, or the old empty format), so the GUI can self-heal
+  again; a live, recent holder still yields honest contention (no double-extract). The controlled
+  download is time-boxed (and the last-resort installer bounded) so a stalled fetch can't recreate the
+  stuck lock. **After upgrading, an already-stuck lock clears itself on the next repair.**
+
 ## [1.7.2] - 2026-06-30
 
 The Electron self-heal now tells the truth, heals the cases it can, and clearly explains the ones it can't.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "1.7.2",
+  "version": "1.7.3",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "keywords": [
     "claude",

package/src/sidecar/electron-install.js

@@ -22,11 +22,11 @@
 
 const fsDefault = require('fs');
 const path = require('path');
-const os = require('os');
 const { spawnSync } = require('child_process');
 
 const { resolveCacheRoots } = require('./electron-cache');
 const { avHint, verifyExtractOutcome: verifyQuarantine } = require('./electron-quarantine');
+const { acquireRepairLock } = require('./electron-lock');
 
 /** Default on-disk location of the installed electron package. */
 function defaultElectronDir() {
@@ -115,22 +115,6 @@ function cachedZip({ version, platform = process.platform, arch = process.arch,
   return null;
 }
 
-/**
- * Single-flight lockfile: only one caller may extract/install at a time, so
- * concurrent callers don't double-extract (Windows EBUSY). Throws an
- * EEXIST-coded error when another holder is active.
- */
-function defaultAcquireLock({ electronDir, fs = fsDefault }) {
-  const lockPath = path.join(os.tmpdir(), `amicus-electron-repair-${Buffer.from(electronDir).toString('hex').slice(0, 16)}.lock`);
-  const fd = fs.openSync(lockPath, 'wx'); // EEXIST if held
-  return {
-    release() {
-      try { fs.closeSync(fd); } catch { /* ignore */ }
-      try { fs.rmSync(lockPath, { force: true }); } catch { /* ignore */ }
-    },
-  };
-}
-
 /** Restore path.txt so electron/index.js resolves the freshly-extracted exe. */
 function writePathTxt({ electronDir, platform, fs }) {
   fs.writeFileSync(path.join(electronDir, 'path.txt'), platformExe(platform));
@@ -166,6 +150,10 @@ async function controlledProvision({
     platform,
     arch,
     checksums: undefined,
+    // Bound the fetch so a stalled/blocked network aborts (got v11 timeouts:
+    // socket = inactivity, request = total) instead of hanging the repair —
+    // a hung-then-killed download is what orphaned the single-flight lock.
+    downloadOptions: { timeout: { socket: 60000, request: 480000 } },
   });
   await extractFromCache({ zip, electronDir, platform, extract, fs });
 }
@@ -212,9 +200,12 @@ async function repairElectron({
 } = {}) {
   const fs = deps.fs || fsDefault;
   const extract = deps.extract || require('extract-zip');
-  const spawn = deps.spawn || ((cmd, args, o) => spawnSync(cmd, args, { ...o, timeout: timeoutMs }));
+  // Default-bound the last-resort installer spawn (8 min) so a first-GUI-use
+  // provision that reaches runInstaller without an explicit timeoutMs can't hang
+  // the holder — the caller's timeoutMs still wins when provided.
+  const spawn = deps.spawn || ((cmd, args, o) => spawnSync(cmd, args, { ...o, timeout: timeoutMs || 480000 }));
   const findZip = deps.cachedZip || ((o) => cachedZip(o));
-  const acquireLock = deps.acquireLock || ((o) => defaultAcquireLock({ ...o, fs }));
+  const acquireLock = deps.acquireLock || ((o) => acquireRepairLock({ ...o, fs }));
   const downloadArtifact = deps.downloadArtifact || require('@electron/get').downloadArtifact;
 
   if (!version) {

package/src/sidecar/electron-lock.js

@@ -0,0 +1,95 @@
+/**
+ * Stale-aware single-flight lock for the electron self-heal (#53).
+ *
+ * Only one process may extract/install electron at a time (concurrent extracts
+ * trip Windows EBUSY). The lock is a file in the OS temp dir keyed by the
+ * electron dir. It records the holder PID + a timestamp so a LATER caller can
+ * detect — and STEAL — a lock orphaned by a killed/crashed/rebooted repair (or
+ * left by a pre-v1.7.3 build, which wrote an empty lockfile). A bare wx lock
+ * with no staleness recovery wedges EVERY future repair forever with "another
+ * electron repair is already in progress" once the holder dies without
+ * releasing — which is exactly what it did in the field.
+ */
+
+'use strict';
+
+const fsDefault = require('fs');
+const path = require('path');
+const os = require('os');
+
+/** A real repair (even a ~170MB download) finishes well within this. */
+const STALE_MS = 15 * 60 * 1000;
+
+/** Temp-dir lockfile path, keyed by the electron install dir. */
+function lockPathFor(electronDir) {
+  const key = Buffer.from(electronDir).toString('hex').slice(0, 16);
+  return path.join(os.tmpdir(), `amicus-electron-repair-${key}.lock`);
+}
+
+/**
+ * Is an existing lockfile orphaned? Stale when it predates STALE_MS, its holder
+ * process is gone (ESRCH), or it is empty / corrupt / pre-v1.7.3 format. A lock
+ * held by a LIVE, recent process is NOT stale (real contention).
+ * @returns {boolean}
+ */
+function isStaleLock(lockPath, fs = fsDefault, now = Date.now()) {
+  let raw;
+  try {
+    raw = fs.readFileSync(lockPath, 'utf-8');
+  } catch {
+    return false; // already gone — absent, not stale
+  }
+  let meta;
+  try {
+    meta = JSON.parse(raw);
+  } catch {
+    return true; // empty / corrupt / pre-v1.7.3 empty lockfile -> orphaned
+  }
+  if (typeof meta.at === 'number' && now - meta.at > STALE_MS) {
+    return true; // older than any real repair
+  }
+  if (typeof meta.pid === 'number') {
+    try {
+      process.kill(meta.pid, 0); // throws if the process is gone
+      return false; // holder alive
+    } catch (err) {
+      return !!(err && err.code === 'ESRCH'); // ESRCH => dead/stale; EPERM => alive (not ours)
+    }
+  }
+  return true; // no usable pid/timestamp -> treat as orphaned
+}
+
+/**
+ * Acquire the single-flight repair lock. Throws an EEXIST-coded error ONLY when
+ * a live, recent process genuinely holds it; otherwise steals an orphaned lock.
+ * @returns {{ release: () => void }}
+ */
+function acquireRepairLock({ electronDir, fs = fsDefault }) {
+  const lockPath = lockPathFor(electronDir);
+
+  function create() {
+    // Atomic exclusive create WITH content in a single call: the file is never
+    // observable empty (no open-then-write gap a concurrent reader could
+    // misjudge as a corrupt orphan and steal). 'wx' throws EEXIST if held.
+    fs.writeFileSync(lockPath, JSON.stringify({ pid: process.pid, at: Date.now() }), { flag: 'wx' });
+  }
+
+  try {
+    create();
+  } catch (e) {
+    if (!e || e.code !== 'EEXIST') { throw e; }
+    if (!isStaleLock(lockPath, fs)) { throw e; } // genuinely held by a live process
+    // Steal the orphan, then re-create. If a real process races us into the
+    // gap, the second create() throws EEXIST and we surface honest contention.
+    try { fs.rmSync(lockPath, { force: true }); } catch { /* ignore */ }
+    create();
+  }
+
+  return {
+    release() {
+      try { fs.rmSync(lockPath, { force: true }); } catch { /* ignore */ }
+    },
+  };
+}
+
+module.exports = { acquireRepairLock, isStaleLock, lockPathFor, STALE_MS };