fullcourtdefense-cli 1.18.7 → 1.18.9

package/dist/commands/daemon.js

@@ -465,6 +465,67 @@ async function runDaemon(args, config) {
             log(`Could not report remote action ${actionId} status ${status}; the server will expire it safely.`);
         }
     };
+    // ── Honest upgrade_cli completion ─────────────────────────────────────────
+    // An MSI/npm upgrade replaces THIS process: the daemon that triggered the
+    // update cannot observe the outcome. Persist the action id, let the freshly
+    // upgraded daemon (or a stale-marker check) report the REAL result — the
+    // dashboard should never show "succeeded" for a version that never arrived.
+    const pendingUpgradeFile = () => path.join(daemonDir(), 'pending-upgrade.json');
+    const PENDING_UPGRADE_STALE_MS = 15 * 60_000;
+    const writePendingUpgradeMarker = (actionId, target) => {
+        try {
+            fs.writeFileSync(pendingUpgradeFile(), JSON.stringify({
+                actionId,
+                target,
+                fromVersion: cliVersion(),
+                startedAt: new Date().toISOString(),
+            }), 'utf8');
+        }
+        catch { /* marker is best-effort; the server TTL expires the action safely */ }
+    };
+    const verifyPendingUpgrade = async () => {
+        let marker;
+        try {
+            marker = JSON.parse(fs.readFileSync(pendingUpgradeFile(), 'utf8'));
+        }
+        catch {
+            return; // no pending upgrade
+        }
+        if (!marker?.actionId || !marker.target) {
+            try {
+                fs.unlinkSync(pendingUpgradeFile());
+            }
+            catch { /* ignore */ }
+            return;
+        }
+        const current = cliVersion();
+        if (compareVersions(current, marker.target) >= 0) {
+            try {
+                fs.unlinkSync(pendingUpgradeFile());
+            }
+            catch { /* ignore */ }
+            await reportMachineAction(marker.actionId, 'succeeded', {
+                resultSummary: `CLI updated to ${current} and the daemon restarted on the new build.`,
+            });
+            log(`Upgrade verified: CLI ${marker.fromVersion || 'unknown'} -> ${current} is live (action ${marker.actionId}).`);
+            await uploadLogTail();
+            return;
+        }
+        const startedAt = marker.startedAt ? Date.parse(marker.startedAt) : NaN;
+        if (!Number.isFinite(startedAt) || Date.now() - startedAt > PENDING_UPGRADE_STALE_MS) {
+            try {
+                fs.unlinkSync(pendingUpgradeFile());
+            }
+            catch { /* ignore */ }
+            await reportMachineAction(marker.actionId, 'failed', {
+                error: `The updater was triggered but the CLI still reports ${current || 'unknown'} after ${Math.round(PENDING_UPGRADE_STALE_MS / 60_000)} minutes (target ${marker.target}). Check %ProgramData%\\FullCourtDefense\\updater.log on the machine.`,
+            });
+            log(`Upgrade verification failed: still on ${current || 'unknown'}, target was ${marker.target} (action ${marker.actionId}).`);
+            await uploadLogTail();
+        }
+        // Otherwise the install is still in flight — keep the marker and re-check
+        // on the next heartbeat; the post-install daemon relaunch settles it.
+    };
     const executeMachineAction = async (action) => {
         if (executingActionIds.has(action.id))
             return;
@@ -547,7 +608,14 @@ async function runDaemon(args, config) {
                     resultSummary = `CLI ${cliVersion() || 'unknown'} is already at ${target}.`;
                 }
                 else if (outcome.started) {
-                    resultSummary = outcome.detail;
+                    // The install replaces this process — DON'T report success yet.
+                    // Leave the action "running" with a marker; the freshly upgraded
+                    // daemon confirms the new version (or the check reports failure).
+                    writePendingUpgradeMarker(action.id, target);
+                    log(`Upgrade CLI: installer started — success will be confirmed once the new daemon is on ${target}.`);
+                    executingActionIds.delete(action.id);
+                    await uploadLogTail();
+                    return;
                 }
                 else {
                     throw new Error(outcome.detail);
@@ -660,10 +728,16 @@ async function runDaemon(args, config) {
             await uploadLogTail();
         }
         catch { /* spool stays on disk for the next tick */ }
+        // Settle any in-flight upgrade_cli action (success once the new build is
+        // live, failure when the target never arrived).
+        await verifyPendingUpgrade();
     };
     // --- boot ---------------------------------------------------------------
     const watched = refreshWatchTargets();
     log(`Watching ${watched} config file(s) across ${watchers.size} director${watchers.size === 1 ? 'y' : 'ies'}.`);
+    // First: if this boot IS the post-upgrade relaunch, confirm the pending
+    // upgrade_cli action before anything else touches the control plane.
+    await verifyPendingUpgrade();
     await pollBundle();
     // One protective pass at startup so a machine that drifted while the daemon
     // was down converges immediately. Runs BEFORE the first heartbeat: upgrades

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.18.7"
+  "version": "1.18.9"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.18.7",
+  "version": "1.18.9",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {