auxilo-mcp 0.9.14 → 0.9.16

package/bin/auxilo-cli.js

@@ -22,6 +22,7 @@ const readline = require('readline');
 const { exec } = require('child_process');
 const installer = require('../lib/installer.js');
 const review = require('../lib/review.js');
+const runnerAutoupdate = require('../lib/runner-autoupdate.js');
 const providers = require('../scripts/providers/index.js');
 const byoKeyProvider = require('../scripts/providers/byo-key.js');
 
@@ -186,6 +187,10 @@ const CONSENT_TEXT = `
       other agents unlock your learnings and are not guaranteed. Earnings
       accrue now. Withdrawals open soon, and auxilo.io/status shows where
       things stand.
+    • UPDATES itself once a day from npm. A newer version installs only after
+      its signature and checksum both pass, and if either fails you keep the
+      copy you have. Run auxilo setup --no-autoupdate to decline. auxilo
+      status shows the setting and the last check.
   You can stop any time with \`auxilo disable\` (local kill-switch) and review
   every run in ~/.auxilo/extract.log. Saying No installs the MCP server only.
   No session-end capture hook is written into any client config unless you say
@@ -291,6 +296,15 @@ async function cmdSetup(flags) {
     process.exit(1);
   }
 
+  // RUNNER-AUTO-UPDATE (0.9.16): `--no-autoupdate` persists the opt-out so
+  // every future hook-fired run skips the self-update network check, not
+  // just this invocation of `setup` (env AUXILO_RUNNER_AUTOUPDATE=0 is the
+  // other, per-run-only opt-out — see lib/runner-autoupdate.js).
+  if (flags['no-autoupdate']) {
+    installer.writeRunnerConfig(HOME, { autoupdate: false });
+    console.log('  ✓ Runner auto-update disabled (persisted to ~/.auxilo/runner-config.json)');
+  }
+
   const claudeCode = chosen.find((c) => c.id === 'claude-code');
   if (claudeCode) {
     // LW-18: SessionStart held-count notice ("N learnings held for your
@@ -551,6 +565,13 @@ async function cmdStatus() {
   if (s.runnerInstalled) {
     const line = runnerSkewLine(installer.runnerVersionSkew(HOME));
     if (line) console.log(line);
+    // RUNNER-AUTO-UPDATE (0.9.16): one more line in the same section, no new
+    // heading — auto-update on/off/paused-by-env, last check time, and the
+    // last verification result (if any check has ever run).
+    const autoupdateLine = runnerAutoupdate.runnerAutoupdateStatusLine(
+      runnerAutoupdate.getRunnerAutoupdateStatus(HOME)
+    );
+    if (autoupdateLine) console.log(autoupdateLine);
   }
   console.log(extractionProviderLine(await providers.resolveProvider({})));
   // Lazy require: scripts/runner.js is a heavier module (sources, sensitivity
@@ -1435,10 +1456,12 @@ async function cmdProvider(flags) {
 
 function usage(command) {
   const blocks = {
-    setup: `Usage: auxilo setup [--re-auth] [--base-url <url>]
+    setup: `Usage: auxilo setup [--re-auth] [--base-url <url>] [--no-autoupdate]
 
 Interactively detect clients, register Auxilo, sign in, install the optional
-extraction runner and SessionEnd hook, and record the extraction choice.`,
+extraction runner and SessionEnd hook, and record the extraction choice.
+--no-autoupdate persists opt-out of the runner's self-update check (default:
+on — see AUXILO_RUNNER_AUTOUPDATE=0 for a per-run-only opt-out instead).`,
     init: `Usage: auxilo init [--scope <read|earnings-read|contribute>] [--label <name>]
                    [--env-file <path>] [--save] [--json] [--no-browser]
                    [--base-url <url>]

package/lib/extraction-index.js

@@ -14,7 +14,16 @@ const os = require('node:os');
 const path = require('node:path');
 const { findNearDuplicate, scoreChannels } = require('./similarity.js');
 
-const DEFAULT_INDEX_PATH = path.join(os.homedir(), '.auxilo', 'extracted-index.jsonl');
+// TEST-HOME-ISOLATION incident 2: same AUXILO_HOME-over-os.homedir() fallback
+// as scripts/providers/index.js's PROVIDERS_STATE_PATH and
+// scripts/providers/byo-key.js's DEFAULT_PROVIDERS_STATE_PATH (duplicated,
+// not imported — see those files' docblocks). This makes the default resolve
+// through the same seam isolation already uses elsewhere, so a caller that
+// forgets an explicit indexPath is still isolated by construction whenever
+// AUXILO_HOME is set (scripts/test/run-isolated.js sets both AUXILO_HOME and
+// HOME, so this is defense-in-depth, not the primary guard — every call site
+// should still pass an explicit indexPath; see test/no-real-home-writes.test.js).
+const DEFAULT_INDEX_PATH = path.join(process.env.AUXILO_HOME || os.homedir(), '.auxilo', 'extracted-index.jsonl');
 const HYDRATION_PAGE_SIZE = 500;
 const PROMPT_MEMORY_MAX_TOKENS = 1200;
 const PROMPT_MEMORY_MAX_ROWS = 40;

package/lib/installer.js

@@ -24,6 +24,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 const { hasAuxiloSessionEndHook } = require('./hook-status.js');
 
 // ─── Constants ──────────────────────────────────────────────────────────────
@@ -118,6 +119,16 @@ const RUNNER_STACK = Object.freeze([
   ['lib/similarity.js', 'lib/similarity.js', 0o644],
   ['lib/hook-status.js', 'lib/hook-status.js', 0o644],
   ['lib/ops-alert.js', 'lib/ops-alert.js', 0o644],
+  // RUNNER-AUTO-UPDATE (0.9.16): runner.js requires lib/runner-autoupdate.js,
+  // which in turn requires lib/installer.js (installRunner/binRootFor/
+  // readRunnerConfig/writeRunnerConfig — the atomic-swap seam) plus its own
+  // two small helpers. All four must ship or the installed runner's first
+  // auto-update check is a MODULE_NOT_FOUND (test/runner-packaging-closure.test.js
+  // guards this closure automatically).
+  ['lib/runner-autoupdate.js', 'lib/runner-autoupdate.js', 0o644],
+  ['lib/tar-extract.js', 'lib/tar-extract.js', 0o644],
+  ['lib/semver-min.js', 'lib/semver-min.js', 0o644],
+  ['lib/installer.js', 'lib/installer.js', 0o644],
   ['config/near-duplicate.json', 'config/near-duplicate.json', 0o644],
 ]);
 
@@ -629,6 +640,56 @@ function writeCredentials(homeDir, creds) {
   return credPath;
 }
 
+// ─── Runner config (RUNNER-AUTO-UPDATE, 0.9.16 §6) ──────────────────────────
+//
+// Lightweight, NON-secret sibling to credentials.json: holds the persisted
+// `auxilo setup --no-autoupdate` opt-out plus the auto-update check/
+// verification state `auxilo status` reports (lib/runner-autoupdate.js is
+// the only other reader/writer). Deliberately a separate file rather than
+// folded into credentials.json — credentials.json is chmod 0600 and its
+// shape is the auth contract (api_key/base_url/email/account_id); this file
+// holds neither secrets nor auth state, so it stays plain (no forced chmod)
+// and its shape can grow without touching the auth surface.
+
+function runnerConfigPath(homeDir) {
+  return path.join(homeDir, '.auxilo', 'runner-config.json');
+}
+
+/** Malformed/absent → {} (same tolerance as readCredentials). */
+function readRunnerConfig(homeDir) {
+  try {
+    const cfg = JSON.parse(fs.readFileSync(runnerConfigPath(homeDir), 'utf-8'));
+    return cfg && typeof cfg === 'object' && !Array.isArray(cfg) ? cfg : {};
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Merge `patch` into the existing config and write it back (read-modify-
+ * write, tmp + rename — same discipline as writeCredentials/saveLedger).
+ * Never throws — a failed write must not break the caller (setup, or the
+ * best-effort auto-update state persistence).
+ *
+ * @param {string} homeDir
+ * @param {object} patch  Shallow-merged into the existing config.
+ * @returns {object} the config as written (best-effort — may be stale if
+ *   the write itself failed).
+ */
+function writeRunnerConfig(homeDir, patch) {
+  const merged = { ...readRunnerConfig(homeDir), ...(patch || {}) };
+  try {
+    const cfgPath = runnerConfigPath(homeDir);
+    fs.mkdirSync(path.dirname(cfgPath), { recursive: true });
+    const tmp = `${cfgPath}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(merged, null, 2) + '\n');
+    fs.renameSync(tmp, cfgPath);
+  } catch {
+    /* best-effort — see doc comment above */
+  }
+  return merged;
+}
+
 // ─── Device-code auth (spec §LW-12 step 2; server.js /auth/device) ──────────
 
 /**
@@ -843,12 +904,18 @@ exit 0
  * @param {string} homeDir
  * @param {object} [opts]
  * @param {string} [opts.packageRoot=PACKAGE_ROOT]
+ * @param {string} [opts.binRootOverride]  RUNNER-AUTO-UPDATE (0.9.16): build
+ *   the stack somewhere OTHER than <home>/.auxilo/bin — e.g. `<bin>.new` —
+ *   so the auto-updater can build+verify a full new stack in a scratch dir
+ *   and only `fs.renameSync` it into place as the single atomic swap step.
+ *   Defaults to `binRootFor(homeDir)`, so ordinary `setup` behavior (writes
+ *   straight into <home>/.auxilo/bin) is completely unchanged.
  * @returns {{ binRoot: string, hookPath: string, versionPath: string, version: string, installed: string[] }}
  */
 function installRunner(homeDir, opts = {}) {
   if (!homeDir) throw new Error('installRunner: homeDir is required');
   const packageRoot = opts.packageRoot || PACKAGE_ROOT;
-  const binRoot = binRootFor(homeDir);
+  const binRoot = opts.binRootOverride || binRootFor(homeDir);
   const installed = [];
 
   for (const [src, dest, mode] of RUNNER_STACK) {
@@ -863,13 +930,20 @@ function installRunner(homeDir, opts = {}) {
     installed.push(destPath);
   }
 
-  const hookPath = hookScriptPathFor(homeDir);
+  // NOTE: the hook script's own CONTENT always names the real final
+  // <home>/.auxilo/bin location (renderHookScript is homeDir-based, not
+  // binRoot-based) — correct even while staging into a binRootOverride
+  // scratch dir, since that is where this tree lands after the swap. Only
+  // the WRITE TARGET (hookPath/versionPath below) follows binRoot, so a
+  // staged build never touches the real bin root until the caller renames
+  // the whole staged directory into place.
+  const hookPath = path.join(binRoot, path.basename(hookScriptPathFor(homeDir)));
   fs.writeFileSync(hookPath, renderHookScript(homeDir));
   fs.chmodSync(hookPath, 0o755);
   installed.push(hookPath);
 
   const version = packageVersion(packageRoot);
-  const versionPath = runnerVersionPath(homeDir);
+  const versionPath = path.join(binRoot, path.basename(runnerVersionPath(homeDir)));
   fs.writeFileSync(versionPath, `${version}\n`);
   fs.chmodSync(versionPath, 0o644);
   installed.push(versionPath);
@@ -877,6 +951,151 @@ function installRunner(homeDir, opts = {}) {
   return { binRoot, hookPath, versionPath, version, installed };
 }
 
+/**
+ * RUNNER-AUTO-UPDATE B1 fix: install the runner stack into the REAL
+ * `<home>/.auxilo/bin` (never a scratch `binRootOverride`) with every write
+ * ATOMIC PER FILE — a `<dest>.tmp-<pid>-<rand>` write followed by
+ * `fs.renameSync` onto the final path — instead of staging a whole tree
+ * elsewhere and `fs.renameSync`-ing the ENTIRE directory into place.
+ *
+ * Why this exists: the old auto-update swap renamed the whole `<bin>`
+ * directory. `installRunner` only ever writes the files listed in
+ * RUNNER_STACK plus the hook script and VERSION stamp — but `<bin>` also
+ * holds files installRunner never touches: the per-client capture shims
+ * (captureShimPath), the review-notice shim (noticeShimPath), the
+ * sweeper/backup wrappers, and jobs/ — all referenced by ABSOLUTE PATH from
+ * client settings files and launchd plists. A whole-directory rename
+ * silently deletes every one of those on the very first auto-update. Per-
+ * file atomic writes touch only the files this function actually knows
+ * about and leave every sibling entry in `<bin>` completely untouched.
+ *
+ * Each individual file lands atomically (a reader never observes a
+ * partially-written file), but there is no cross-file transaction — if this
+ * throws partway through, some stack files may already be updated and
+ * others not. That is an intentional trade for correctness over the old
+ * design's false all-or-nothing guarantee, which in practice deleted
+ * everything BUT the stack on every run. A crash mid-loop still leaves a
+ * fully-functional `<bin>` (old files for whatever wasn't reached yet, new
+ * files for what was) — never a missing directory.
+ *
+ * @param {string} homeDir
+ * @param {object} [opts]
+ * @param {string} [opts.packageRoot=PACKAGE_ROOT]  Root to copy FROM — the
+ *   caller passes the already-SRI+signature-verified extracted tarball dir.
+ * @returns {{ binRoot: string, hookPath: string, versionPath: string, version: string, installed: string[] }}
+ */
+/**
+ * MEDIUM-2 fix (0.9.16 fix pass 2). RUNNER_STACK's sources/providers/schemas
+ * rows are DERIVED by enumerating the package's own directories at require
+ * time (sourceAdapterRows/providerAdapterRows/providerSchemaRows above) — a
+ * file REMOVED from a newer release's package is simply absent from the
+ * NEW RUNNER_STACK, but installRunnerAtomic only ever WRITES what's in the
+ * stack; it never deleted what a PRIOR install left behind. A stale adapter
+ * (or provider/schema/lib module) from an old version therefore survived
+ * every auto-update indefinitely, still sitting in `<bin>` and still
+ * require()-able by anything that enumerates its directory the way
+ * scripts/runner.js's own loadSources() does.
+ *
+ * Scoped tightly on purpose: only the directories RUNNER_STACK actually
+ * populates by enumeration are pruned — never the bin ROOT itself, and
+ * never any other subdirectory. `<bin>` also holds files/dirs
+ * installRunnerAtomic has never managed (capture shims, the review-notice
+ * shim, sweeper/backup wrappers, jobs/ — see installRunnerAtomic's own doc
+ * comment on why a whole-directory approach is unsafe here) — pruning must
+ * leave every one of those completely untouched, exactly like the atomic
+ * writes above already do.
+ *
+ * Also sweeps orphaned `<file>.tmp-<pid>-<hex>` scratch files left in a
+ * pruned directory by a process that crashed between atomicWrite's write
+ * and its rename (so a leftover partial write from a prior crashed install
+ * doesn't accumulate forever either).
+ *
+ * @param {string} binRoot
+ * @param {string[]} keepDestPaths  Absolute dest paths this install just
+ *   wrote (the `installed` accumulator, stack rows only — hook/VERSION
+ *   live outside every prunable dir so including them would be harmless
+ *   but is unnecessary).
+ */
+const PRUNABLE_STACK_DIRS = Object.freeze([
+  'scripts/sources',
+  'scripts/providers',
+  'scripts/providers/schemas',
+  'lib',
+]);
+
+const ORPHANED_TMP_RE = /\.tmp-\d+-[0-9a-f]+$/;
+
+function pruneStaleStackFiles(binRoot, keepDestPaths) {
+  const keep = new Set(keepDestPaths.map((p) => path.resolve(p)));
+  for (const rel of PRUNABLE_STACK_DIRS) {
+    const dir = path.join(binRoot, rel);
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue; // directory doesn't exist (nothing shipped there) — nothing to prune
+    }
+    for (const entry of entries) {
+      // Never descend into or remove subdirectories here — each prunable
+      // subdirectory (e.g. scripts/providers/schemas) is enumerated in its
+      // own PRUNABLE_STACK_DIRS row; a bare directory entry (like
+      // scripts/providers/schemas itself, seen while walking
+      // scripts/providers) is left alone.
+      if (!entry.isFile()) continue;
+      const full = path.join(dir, entry.name);
+      if (ORPHANED_TMP_RE.test(entry.name)) {
+        try { fs.rmSync(full, { force: true }); } catch { /* best-effort */ }
+        continue;
+      }
+      if (!keep.has(path.resolve(full))) {
+        try { fs.rmSync(full, { force: true }); } catch { /* best-effort */ }
+      }
+    }
+  }
+}
+
+function installRunnerAtomic(homeDir, opts = {}) {
+  if (!homeDir) throw new Error('installRunnerAtomic: homeDir is required');
+  const packageRoot = opts.packageRoot || PACKAGE_ROOT;
+  const binRoot = binRootFor(homeDir);
+  const installed = [];
+
+  function atomicWrite(destPath, writeTmp, mode) {
+    fs.mkdirSync(path.dirname(destPath), { recursive: true });
+    const tmp = `${destPath}.tmp-${process.pid}-${crypto.randomBytes(6).toString('hex')}`;
+    writeTmp(tmp);
+    fs.chmodSync(tmp, mode);
+    fs.renameSync(tmp, destPath); // atomic on the same filesystem (same dir)
+  }
+
+  for (const [src, dest, mode] of RUNNER_STACK) {
+    const srcPath = path.join(packageRoot, src);
+    const destPath = path.join(binRoot, dest);
+    if (!fs.existsSync(srcPath)) {
+      throw new Error(`installRunnerAtomic: missing package file ${srcPath} — reinstall auxilo-mcp`);
+    }
+    atomicWrite(destPath, (tmp) => fs.copyFileSync(srcPath, tmp), mode);
+    installed.push(destPath);
+  }
+
+  // MEDIUM-2: prune stale stack files (removed adapters/providers/schemas/
+  // lib modules from a prior version) now that every file the NEW stack
+  // wants is safely on disk. Scoped to the enumerated dirs only — see
+  // pruneStaleStackFiles's doc comment.
+  pruneStaleStackFiles(binRoot, installed);
+
+  const hookPath = path.join(binRoot, path.basename(hookScriptPathFor(homeDir)));
+  atomicWrite(hookPath, (tmp) => fs.writeFileSync(tmp, renderHookScript(homeDir)), 0o755);
+  installed.push(hookPath);
+
+  const version = packageVersion(packageRoot);
+  const versionPath = path.join(binRoot, path.basename(runnerVersionPath(homeDir)));
+  atomicWrite(versionPath, (tmp) => fs.writeFileSync(tmp, `${version}\n`), 0o644);
+  installed.push(versionPath);
+
+  return { binRoot, hookPath, versionPath, version, installed };
+}
+
 // ─── Runner-stack freshness (CLEAN-LANE-FLIP Phase B) ───────────────────────
 
 /** <home>/.auxilo/bin/VERSION — the package version installRunner last copied. */
@@ -1794,12 +2013,17 @@ module.exports = {
   credentialsPath,
   readCredentials,
   writeCredentials,
+  runnerConfigPath,
+  readRunnerConfig,
+  writeRunnerConfig,
   writeEnvFile,
   deviceLogin,
   binRootFor,
   hookScriptPathFor,
   renderHookScript,
   installRunner,
+  installRunnerAtomic,
+  pruneStaleStackFiles,
   runnerVersionPath,
   packageVersion,
   installedRunnerVersion,