cartethyia 2.7.4 → 2.7.6

package/src/console/system-prompt/routes.ts

@@ -21,18 +21,25 @@ import {
 import {
   EMPTY_TENANT_SYSTEM_PROMPTS,
   PROMPT_MODES,
+  SYSTEM_PROMPT_ALIAS_LIMIT,
+  SYSTEM_PROMPT_COMBO_LIMIT,
   SYSTEM_PROMPT_MODEL_LIMIT,
+  SYSTEM_PROMPT_PRESET_LIMIT,
+  SYSTEM_PROMPT_PRESET_NAME_CAP,
   SYSTEM_PROMPT_PROVIDER_LIMIT,
   SYSTEM_PROMPT_TEXT_CAP_BYTES,
   isPromptSetting,
+  isScopePromptRef,
+  isSystemPromptPreset,
   parseSystemPromptModelKey,
   type PromptSetting,
-  type ProviderPromptEntry,
+  type ScopePromptRef,
+  type SystemPromptPreset,
   type TenantSystemPrompts,
 } from "./contracts";
 
 /** Route-group context injected by the composition root. */
-export interface SystemPromptRoutesConfig {
+interface SystemPromptRoutesConfig {
   readonly db: CartethyiaDatabase;
   readonly accessResolver: ConsoleAccessResolver;
   readonly auditSink?: AuditSink;
@@ -53,6 +60,46 @@ function validateSetting(value: unknown, scopeLabel: string): PromptSetting {
   return value;
 }
 
+/** Validates one preset. */
+function validatePreset(value: unknown, scopeLabel: string): SystemPromptPreset {
+  if (!isSystemPromptPreset(value)) {
+    throw new ConsoleDomainError("invalid_request", 400, `${scopeLabel} is not a valid preset`);
+  }
+  if (value.name.length > SYSTEM_PROMPT_PRESET_NAME_CAP) {
+    throw new ConsoleDomainError(
+      "invalid_request",
+      400,
+      `${scopeLabel} name exceeds the ${SYSTEM_PROMPT_PRESET_NAME_CAP} character limit`,
+    );
+  }
+  validateSetting(value, scopeLabel);
+  return value;
+}
+
+/** Validates one scope reference; a preset id that does not exist is
+ * neutralized to `off` rather than rejected, so deleting a preset does not
+ * block saving a configuration that still references it. */
+function validateScopeRef(
+  value: unknown,
+  scopeLabel: string,
+  presetIds: ReadonlySet<string>,
+): ScopePromptRef {
+  if (!isScopePromptRef(value)) {
+    throw new ConsoleDomainError("invalid_request", 400, `${scopeLabel} is not a valid scope reference`);
+  }
+  if (value.kind === "preset") {
+    if (!presetIds.has(value.presetId)) {
+      return { kind: "off" };
+    }
+    return value;
+  }
+  if (value.kind === "custom") {
+    validateSetting(value.setting, scopeLabel);
+    return value;
+  }
+  return value;
+}
+
 /** Validates the full PUT body into the stored shape. */
 function validateBody(value: unknown): TenantSystemPrompts {
   if (typeof value !== "object" || value === null) {
@@ -60,68 +107,71 @@ function validateBody(value: unknown): TenantSystemPrompts {
   }
   const body = value as {
     global?: unknown;
+    presets?: unknown;
     providers?: unknown;
     models?: unknown;
+    combos?: unknown;
+    aliases?: unknown;
   };
 
-  const global =
-    body.global === null || body.global === undefined
-      ? null
-      : validateSetting(body.global, "global");
-
-  if (body.providers !== undefined && typeof body.providers !== "object") {
-    throw new ConsoleDomainError("invalid_request", 400, "providers must be an object");
+  if (body.presets !== undefined && typeof body.presets !== "object") {
+    throw new ConsoleDomainError("invalid_request", 400, "presets must be an object");
   }
-  const rawProviders = (body.providers ?? {}) as Record<string, unknown>;
-  const providerIds = Object.keys(rawProviders);
-  if (providerIds.length > SYSTEM_PROMPT_PROVIDER_LIMIT) {
+  const rawPresets = (body.presets ?? {}) as Record<string, unknown>;
+  const presetIds = Object.keys(rawPresets);
+  if (presetIds.length > SYSTEM_PROMPT_PRESET_LIMIT) {
     throw new ConsoleDomainError(
       "invalid_request",
       400,
-      `providers exceeds the ${SYSTEM_PROMPT_PROVIDER_LIMIT} entry limit`,
+      `presets exceeds the ${SYSTEM_PROMPT_PRESET_LIMIT} entry limit`,
     );
   }
-  const providers: Record<string, ProviderPromptEntry> = {};
-  for (const providerId of providerIds) {
-    const entry = rawProviders[providerId];
-    if (typeof entry !== "object" || entry === null) {
-      throw new ConsoleDomainError("invalid_request", 400, `provider ${providerId} entry must be an object`);
+  const presets: Record<string, SystemPromptPreset> = {};
+  for (const id of presetIds) {
+    presets[id] = validatePreset(rawPresets[id], `preset ${id}`);
+  }
+  const presetIdSet = new Set(presetIds);
+
+  const global =
+    body.global === null || body.global === undefined
+      ? null
+      : validateScopeRef(body.global, "global", presetIdSet);
+
+  const readRefMap = (
+    raw: unknown,
+    label: string,
+    limit: number,
+  ): Record<string, ScopePromptRef> => {
+    if (raw !== undefined && typeof raw !== "object") {
+      throw new ConsoleDomainError("invalid_request", 400, `${label} must be an object`);
     }
-    const candidate = entry as Partial<ProviderPromptEntry>;
-    if (typeof candidate.followGlobal !== "boolean") {
-      throw new ConsoleDomainError("invalid_request", 400, `provider ${providerId} needs followGlobal`);
+    const entries = (raw ?? {}) as Record<string, unknown>;
+    const keys = Object.keys(entries);
+    if (keys.length > limit) {
+      throw new ConsoleDomainError(
+        "invalid_request",
+        400,
+        `${label} exceeds the ${limit} entry limit`,
+      );
     }
-    if (candidate.followGlobal) {
-      providers[providerId] = { followGlobal: true };
-    } else {
-      providers[providerId] = {
-        followGlobal: false,
-        setting: validateSetting(candidate.setting, `provider ${providerId}`),
-      };
+    const out: Record<string, ScopePromptRef> = {};
+    for (const key of keys) {
+      out[key] = validateScopeRef(entries[key], `${label} ${key}`, presetIdSet);
     }
-  }
+    return out;
+  };
 
-  if (body.models !== undefined && typeof body.models !== "object") {
-    throw new ConsoleDomainError("invalid_request", 400, "models must be an object");
-  }
-  const rawModels = (body.models ?? {}) as Record<string, unknown>;
-  const modelKeys = Object.keys(rawModels);
-  if (modelKeys.length > SYSTEM_PROMPT_MODEL_LIMIT) {
-    throw new ConsoleDomainError(
-      "invalid_request",
-      400,
-      `models exceeds the ${SYSTEM_PROMPT_MODEL_LIMIT} entry limit`,
-    );
-  }
-  const models: Record<string, PromptSetting> = {};
-  for (const key of modelKeys) {
+  const providers = readRefMap(body.providers, "providers", SYSTEM_PROMPT_PROVIDER_LIMIT);
+  const models = readRefMap(body.models, "models", SYSTEM_PROMPT_MODEL_LIMIT);
+  for (const key of Object.keys(models)) {
     if (parseSystemPromptModelKey(key) === null) {
       throw new ConsoleDomainError("invalid_request", 400, `model key ${key} is malformed`);
     }
-    models[key] = validateSetting(rawModels[key], `model ${key}`);
   }
+  const combos = readRefMap(body.combos, "combos", SYSTEM_PROMPT_COMBO_LIMIT);
+  const aliases = readRefMap(body.aliases, "aliases", SYSTEM_PROMPT_ALIAS_LIMIT);
 
-  return { global, providers, models };
+  return { global, presets, providers, models, combos, aliases };
 }
 
 /**
@@ -150,8 +200,11 @@ export function createSystemPromptRoutes(config: SystemPromptRoutesConfig) {
           target: "tenant_system_prompts",
           detail: {
             global: next.global !== null,
+            presets: Object.keys(next.presets).length,
             providers: Object.keys(next.providers).length,
             models: Object.keys(next.models).length,
+            combos: Object.keys(next.combos).length,
+            aliases: Object.keys(next.aliases).length,
           },
         });
         return next;

package/src/console/updates/apply-update.ts

@@ -0,0 +1,244 @@
+/**
+ * The detached update flow — the one implementation the console route and the
+ * CLI (`carte update`, console menu) share.
+ *
+ * npm cannot replace this package's directory while a process is executing out
+ * of it (EBUSY on Windows), and the deployment model has no process supervisor
+ * that could restart after an in-process install. So the installer MUST be a
+ * detached process that outlives the gateway that asked for it: the caller
+ * writes an intent file, spawns the installer, and then exits (gracefully, via
+ * the ShutdownCoordinator, on the console route).
+ *
+ * The status file is the contract between the two processes: the gateway writes
+ * `{status:"installing"}` before spawning, and the detached installer
+ * (spawnDetachedInstaller's wrapper) overwrites it with
+ * `{status:"success"|"failed", exitCode, stderrTail}` when npm finishes.
+ * `GET /updates/status` reads it back, so the dashboard knows whether the
+ * install landed or died — instead of polling a release tag forever with no
+ * answer when npm failed.
+ */
+import { spawn } from "node:child_process";
+import { closeSync, mkdirSync, openSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { resolveUserConfigDir } from "../../config/package-paths";
+
+/** Shape written before the installer spawns and overwritten by its wrapper. */
+export interface UpdateStatus {
+  readonly status: "installing" | "success" | "failed";
+  readonly targetTag?: string;
+  readonly startedAt: string;
+  readonly exitCode?: number;
+  /** Last bytes of the installer's stderr, so a failed install is diagnosable. */
+  readonly stderrTail?: string;
+}
+
+/** Age under which a fresh `installing` status means "already running". */
+export const INSTALLING_FRESH_MS = 10 * 60_000;
+
+const UPDATE_STATUS_FILE = "update-status.json";
+const UPDATE_LOG_FILE = "update.log";
+
+/** How much of the installer's stderr is preserved in a failed status. */
+const STDERR_TAIL_BYTES = 4_096;
+
+export function updateStatusPath(configDir: string = resolveUserConfigDir()): string {
+  return join(configDir, UPDATE_STATUS_FILE);
+}
+
+export function updateLogPath(configDir: string = resolveUserConfigDir()): string {
+  return join(configDir, UPDATE_LOG_FILE);
+}
+
+/** Reads and parses the status file; any absence or corruption answers null. */
+export function readUpdateStatus(configDir: string = resolveUserConfigDir()): UpdateStatus | null {
+  try {
+    const raw = readFileSync(updateStatusPath(configDir), "utf8");
+    const parsed = JSON.parse(raw) as Partial<UpdateStatus> | null;
+    if (
+      parsed === null ||
+      typeof parsed !== "object" ||
+      (parsed.status !== "installing" && parsed.status !== "success" && parsed.status !== "failed") ||
+      typeof parsed.startedAt !== "string"
+    ) {
+      return null;
+    }
+    return parsed as UpdateStatus;
+  } catch {
+    return null;
+  }
+}
+
+/** Writes a status atomically enough for this purpose: one rename via write. */
+export function writeUpdateStatus(status: UpdateStatus, configDir: string = resolveUserConfigDir()): void {
+  mkdirSync(configDir, { recursive: true });
+  writeFileSync(updateStatusPath(configDir), JSON.stringify(status));
+}
+
+/** True when a still-`installing` status was written recently enough to trust. */
+export function isFreshlyInstalling(status: UpdateStatus | null, now: number = Date.now()): boolean {
+  if (status === null || status.status !== "installing") return false;
+  const startedAt = Date.parse(status.startedAt);
+  if (!Number.isFinite(startedAt)) return false;
+  return now - startedAt < INSTALLING_FRESH_MS;
+}
+
+/**
+ * Processes still running out of the package directory, so npm can rename it.
+ *
+ * The rename is the whole install on Windows, and it fails with EBUSY while
+ * anything holds the directory — including a hold that outlives the process
+ * that took it. `carte` itself runs from that directory, so the install has to
+ * wait until this process is gone; these are the others.
+ */
+export function stopHoldingProcesses(): void {
+  if (process.platform !== "win32") return;
+  // `taskkill` filters on the window title and image name only, so it is asked
+  // for the two processes this CLI can leave behind. /T takes the tree, so a
+  // detached gateway started by a tray goes with it.
+  for (const image of ["cartethyia.exe", "carte.exe"]) {
+    try {
+      spawn("taskkill", ["/F", "/T", "/IM", image], { stdio: "ignore" }).unref();
+    } catch {
+      // A missing taskkill is not the install's problem; npm will report the
+      // hold if one is left.
+    }
+  }
+}
+
+export const UPDATE_INSTALL_COMMAND = "npm install -g cartethyia@latest --prefer-online";
+
+/**
+ * Spawns the detached installer and returns immediately.
+ *
+ * `stdio` is redirected to `update.log` (append) rather than ignored, so a
+ * failed npm run leaves its output behind for the operator. The spawned
+ * wrapper re-execs this module's finish step as a `bun -e` script that runs
+ * `npm` to completion and then overwrites the status file — see
+ * {@link finishDetachedUpdate}, the function the wrapper string mirrors. If the
+ * wrapper itself cannot be spawned, the status is flipped to `failed` here so
+ * the dashboard's poll loop is not left spinning on a silent `installing`.
+ */
+export function spawnDetachedUpdate(options: {
+  readonly targetTag?: string;
+  readonly configDir?: string;
+}): { started: boolean; error?: string } {
+  const configDir = options.configDir ?? resolveUserConfigDir();
+  const isWin = process.platform === "win32";
+  const restart = isWin
+    ? "cartethyia start"
+    : "systemctl restart cartethyia 2>/dev/null || cartethyia start";
+  const script = `${UPDATE_INSTALL_COMMAND} && ${restart}`;
+  const wrapper = buildInstallerWrapperScript(script);
+  try {
+    stopHoldingProcesses();
+    let logFd: number | undefined;
+    try {
+      mkdirSync(configDir, { recursive: true });
+      logFd = openSync(updateLogPath(configDir), "a");
+    } catch {
+      // A log file that cannot be opened must not block the install; the
+      // installer then runs with stdio ignored as before.
+    }
+    const child = spawn(
+      process.execPath,
+      ["-e", wrapper],
+      { detached: true, stdio: logFd === undefined ? "ignore" : ["ignore", logFd, logFd] },
+    );
+    child.unref();
+    if (logFd !== undefined) {
+      try {
+        // The parent's copy of the fd is not needed once the child inherits it.
+        closeSync(logFd);
+      } catch {
+        // An unclosed fd in a process that is about to drain and exit is
+        // harmless.
+      }
+    }
+    return { started: true };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    try {
+      writeUpdateStatus(
+        { status: "failed", ...(options.targetTag === undefined ? {} : { targetTag: options.targetTag }), startedAt: new Date().toISOString(), stderrTail: message },
+        configDir,
+      );
+    } catch {
+      // Nothing more can be reported if even the status write fails.
+    }
+    return { started: false, error: message };
+  }
+}
+
+/**
+ * The script string handed to `bun -e` (or `node -e`, whatever `process.execPath`
+ * is). It mirrors {@link finishDetachedUpdate} because a detached process cannot
+ * import this module: it must be one self-contained expression that survives the
+ * parent exiting. Kept in this file, next to the function, so the two are
+ * reviewed together.
+ */
+function buildInstallerWrapperScript(script: string): string {
+  const installer = JSON.stringify(script);
+  const shell = JSON.stringify(process.platform === "win32" ? "cmd.exe" : "/bin/sh");
+  const argsPrefix = process.platform === "win32" ? '"/c",' : '"-c",';
+  const statusPath = JSON.stringify(updateStatusPath());
+  return `
+const { spawn } = require("node:child_process");
+const { readFileSync, writeFileSync, openSync } = require("node:fs");
+const startedAt = new Date().toISOString();
+let logFd;
+try { logFd = openSync(${JSON.stringify(updateLogPath())}, "a"); } catch {}
+const child = spawn(${shell}, [${argsPrefix} ${installer}], { stdio: logFd === undefined ? "ignore" : ["ignore", logFd, logFd] });
+let stderrTail = "";
+child.on("exit", (exitCode) => {
+  writeFileSync(${statusPath}, JSON.stringify({
+    status: exitCode === 0 ? "success" : "failed",
+    startedAt,
+    exitCode: exitCode ?? -1,
+    ...(stderrTail ? { stderrTail } : {}),
+  }));
+  process.exit(exitCode ?? -1);
+});
+child.on("error", (error) => {
+  try {
+    writeFileSync(${statusPath}, JSON.stringify({ status: "failed", startedAt, exitCode: -1, stderrTail: String(error) }));
+  } catch {}
+  process.exit(-1);
+});
+`.trim();
+}
+
+/**
+ * Runs the install to completion and records the terminal status. Exported for
+ * the test suite, which exercises the same code shape the wrapper string
+ * executes; production reaches it only through the detached wrapper.
+ */
+export async function finishDetachedUpdate(
+  runInstall: (onStderr: (chunk: string) => void) => Promise<number>,
+  configDir: string = resolveUserConfigDir(),
+): Promise<UpdateStatus> {
+  const startedAt = new Date().toISOString();
+  let stderrTail = "";
+  let exitCode: number;
+  try {
+    exitCode = await runInstall((chunk) => {
+      stderrTail = (stderrTail + chunk).slice(-STDERR_TAIL_BYTES);
+    });
+  } catch (error) {
+    const status: UpdateStatus = {
+      status: "failed",
+      startedAt,
+      exitCode: -1,
+      stderrTail: (error instanceof Error ? error.message : String(error)).slice(-STDERR_TAIL_BYTES),
+    };
+    writeUpdateStatus(status, configDir);
+    return status;
+  }
+  const status: UpdateStatus = {
+    status: exitCode === 0 ? "success" : "failed",
+    startedAt,
+    exitCode,
+    ...(stderrTail ? { stderrTail } : {}),
+  };
+  writeUpdateStatus(status, configDir);
+  return status;
+}