deltara 0.30.54 → 0.31.0

package/bin/integrity.json

@@ -1,5 +1,5 @@
 {
-  "deltara": "sha256:9517a21c066e5bd376d0f970e0bfc0412da298d4520421b93950d7eb3576289a",
-  "generated_at": "2026-05-05T18:37:53Z",
-  "version": "0.30.54"
+  "deltara": "sha256:b6abe5779edcfdc9dfea0d27eb4cb3250d7b21a2929e17d4f1d6e3af7f4bbb8c",
+  "generated_at": "2026-05-05T19:23:55Z",
+  "version": "0.31.0"
 }

package/bin/postinstall.js

@@ -1,18 +1,27 @@
 #!/usr/bin/env node
-// postinstall.js — runs `deltara setup --auto` with output wired directly to
-// the controlling terminal, bypassing npm's stdout pipe.
+// postinstall.js — npm lifecycle hook (runs after `npm install -g deltara`).
 //
-// npm (v7+) runs lifecycle scripts with stdout piped — not connected to the
-// terminal. Even `stdio: "inherit"` inherits npm's pipe, not /dev/tty.
-// Opening /dev/tty directly gives us the actual terminal fd, so all setup
-// output (header, steps, privacy lines) is visible to the user.
+// Three phases:
+//   1. Stop any running deltara server (old binary in memory).
+//   2. Run `deltara setup --auto` for auth/MCP config (idempotent).
+//   3. Start a fresh deltara server detached (new binary in memory).
+//
+// Why all three matter:
+//   The deltara server is a long-running standalone daemon — NO MCP host
+//   respawns it on demand. After `npm install -g deltara@<new>`, the new
+//   binary is on disk but the old server keeps running with the old binary
+//   loaded in memory. The release also rotates _CLI_SECRET, so the old
+//   server hits 403 forever and pipelines silently fail. Killing without
+//   restart just leaves the user with a dead system. Both halves required.
+//
+// All steps are best-effort — never fail npm install over upgrade hygiene.
 
-const { spawnSync } = require("child_process");
+const { spawnSync, spawn } = require("child_process");
 const path = require("path");
 const fs = require("fs");
 const os = require("os");
 
-// Skip in CI or non-interactive environments where /dev/tty won't exist.
+// Skip in CI or non-interactive environments.
 if (process.env.CI || process.env.DELTARA_NO_SETUP) {
   process.exit(0);
 }
@@ -22,32 +31,97 @@ const arch = os.arch();
 const platformKey = `${platform}-${arch}`;
 const binName = platform === "win32" ? "deltara.exe" : "deltara";
 const binPath = path.join(__dirname, "..", "vendor", platformKey, binName);
+const homeDir = os.homedir();
+const deltaraDir = path.join(homeDir, ".deltara");
+const pidFile = path.join(deltaraDir, "server.pid");
+const upgradePendingFile = path.join(deltaraDir, "mcp_upgrade_pending");
 
 if (!fs.existsSync(binPath)) {
-  // Unsupported platform — not an error, setup just won't run.
+  // Unsupported platform — not an error.
   process.exit(0);
 }
 
 // Ensure executable bit (may be missing on some npm extract paths).
 try { fs.chmodSync(binPath, 0o755); } catch (_) {}
 
-// Open /dev/tty as the output fd — this is the controlling terminal regardless
-// of how npm has wired our stdout/stderr.
+// ─────────────────────────────────────────────────────────────────────
+// Phase 1: Stop any running deltara server.
+// ─────────────────────────────────────────────────────────────────────
+function killOldServer() {
+  let killed = false;
+
+  // 1a. Read PID file and try graceful then forceful kill.
+  if (fs.existsSync(pidFile)) {
+    try {
+      const pidStr = fs.readFileSync(pidFile, "utf8").trim();
+      const pid = parseInt(pidStr, 10);
+      if (pid > 0) {
+        try {
+          process.kill(pid, "SIGTERM");
+          // Give the server up to ~2.5s to exit gracefully.
+          const start = Date.now();
+          while (Date.now() - start < 2500) {
+            try {
+              process.kill(pid, 0); // signal 0 = check existence
+              // Still alive — sleep a beat
+              const wait = spawnSync(process.execPath, ["-e", "setTimeout(()=>{},250)"], { stdio: "ignore" });
+              if (wait.status === null) break;
+            } catch (_) {
+              // ESRCH — process is gone
+              killed = true;
+              break;
+            }
+          }
+          // Forceful if still alive.
+          if (!killed) {
+            try { process.kill(pid, "SIGKILL"); killed = true; } catch (_) {}
+          }
+        } catch (e) {
+          // EPERM (different user) or ESRCH (already gone) — both OK.
+        }
+      }
+    } catch (_) {}
+  }
+
+  // 1b. Belt-and-suspenders: pkill by command-line match (Unix only).
+  // Catches PIDs from stale lock files where pidFile is missing.
+  if (platform !== "win32") {
+    try {
+      spawnSync("pkill", ["-9", "-f", "deltara server"], { stdio: "ignore" });
+    } catch (_) {}
+  }
+
+  // 1c. Clean lock files.
+  for (const f of [pidFile, upgradePendingFile]) {
+    try { if (fs.existsSync(f)) fs.unlinkSync(f); } catch (_) {}
+  }
+
+  return killed;
+}
+
+const wasRunning = killOldServer();
+if (wasRunning) {
+  // Print to stdout (postinstall) so user sees the action.
+  console.log("  Deltara: stopped previous server (upgrade).");
+}
+
+// ─────────────────────────────────────────────────────────────────────
+// Phase 2: Run `deltara setup --auto` with TTY wired up.
+// ─────────────────────────────────────────────────────────────────────
 let ttyFd;
 if (platform !== "win32") {
   try {
     ttyFd = fs.openSync("/dev/tty", "w");
   } catch (_) {
-    // No controlling terminal (e.g. SSH without TTY allocation, Docker).
-    // Run silently rather than crashing the install.
+    // No controlling terminal (SSH no-TTY, Docker, etc.).
+    // Skip both setup and server start — user can run `deltara setup` manually.
     process.exit(0);
   }
 } else {
-  // Windows: stdout is already fine (npm behaviour differs).
   ttyFd = process.stdout.fd;
 }
 
-const result = spawnSync(binPath, ["setup", "--auto"], {
+const setupResult = spawnSync(binPath, ["setup", "--auto"], {
   stdio: ["inherit", ttyFd, ttyFd],
   env: process.env,
 });
@@ -56,5 +130,62 @@ if (ttyFd !== process.stdout.fd) {
   try { fs.closeSync(ttyFd); } catch (_) {}
 }
 
-// Non-zero exits are non-fatal — a failed setup shouldn't block npm install.
+// Setup non-zero exit is non-fatal — but don't try to start the server
+// if setup failed; auth config may be incomplete.
+if (setupResult.status !== 0) {
+  process.exit(0);
+}
+
+// ─────────────────────────────────────────────────────────────────────
+// Phase 3: Start fresh deltara server detached.
+// ─────────────────────────────────────────────────────────────────────
+function startNewServer() {
+  try {
+    const child = spawn(binPath, ["server", "start"], {
+      detached: true,
+      stdio: "ignore",
+      env: process.env,
+    });
+    child.unref();
+    // Brief poll for confirmation: server.pid should be rewritten with the
+    // new process's PID within a couple of seconds.
+    const start = Date.now();
+    let confirmed = false;
+    while (Date.now() - start < 4000) {
+      if (fs.existsSync(pidFile)) {
+        try {
+          const newPid = parseInt(fs.readFileSync(pidFile, "utf8").trim(), 10);
+          if (newPid > 0) {
+            try {
+              process.kill(newPid, 0); // alive check
+              confirmed = true;
+              break;
+            } catch (_) {}
+          }
+        } catch (_) {}
+      }
+      // Short busy-wait — child_process.spawnSync(setTimeout) trick avoids
+      // requiring async/await in this script.
+      const _w = spawnSync(process.execPath, ["-e", "setTimeout(()=>{},250)"], { stdio: "ignore" });
+      if (_w.status === null) break;
+    }
+    if (confirmed) {
+      console.log("  Deltara: new server started.");
+    } else {
+      console.log(
+        "  Deltara: server did not confirm within 4s. " +
+        "Run 'deltara server start' to see the error live."
+      );
+    }
+  } catch (e) {
+    console.log(
+      "  Deltara: failed to spawn new server: " + e.message + "\n" +
+      "  Run 'deltara server start' to start it manually."
+    );
+  }
+}
+
+startNewServer();
+
+// Always exit 0 — npm install must never fail because of upgrade-restart.
 process.exit(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deltara",
-  "version": "0.30.54",
+  "version": "0.31.0",
   "description": "Multi-agent research pipelines \u2014 run deep research from your terminal",
   "bin": {
     "deltara": "bin/deltara.js"