gitdone-agent 0.2.1 → 0.3.1

package/index.js

@@ -24,6 +24,11 @@ import { randomUUID } from 'node:crypto'
 // truth for the running agent), and a log file (so failures are visible even
 // when the agent runs in a hidden window).
 
+// Reported to the server on every sync so the web UI can flag outdated agents.
+// Keep in lockstep with packages/agent/package.json "version" AND
+// src/lib/agentVersion.ts LATEST_AGENT_VERSION.
+const AGENT_VERSION = '0.3.1'
+
 const AGENT_DIR = join(homedir(), '.gitdone-agent')
 const CONFIG_PATH = join(AGENT_DIR, 'config.json')
 const STABLE_AGENT = join(AGENT_DIR, 'agent.mjs')
@@ -102,10 +107,33 @@ function getNodePath() {
   return process.execPath
 }
 
+// Kill any previously-running agent processes so an update applies WITHOUT a
+// Windows re-login. Targets node processes launched from the agent dir
+// (~/.gitdone-agent), excluding ourselves — the npx installer runs from the
+// npx cache, so it won't match. Best-effort; failures are non-fatal.
+function stopRunningAgents() {
+  const ps = [
+    "$ErrorActionPreference='SilentlyContinue'",
+    "Get-CimInstance Win32_Process -Filter \"Name='node.exe'\" |",
+    `  Where-Object { $_.CommandLine -like '*.gitdone-agent*' -and $_.ProcessId -ne ${process.pid} } |`,
+    '  ForEach-Object { Stop-Process -Id $_.ProcessId -Force }',
+  ].join('\n')
+  try {
+    ensureAgentDir()
+    const scriptPath = join(AGENT_DIR, 'stop-agents.ps1')
+    writeFileSync(scriptPath, ps, 'utf8')
+    execSync(`powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "${scriptPath}"`, { stdio: 'ignore' })
+  } catch { /* best-effort — at worst the old agent lingers until next login */ }
+}
+
 function installStartup() {
   ensureAgentDir()
   const nodePath = getNodePath()
 
+  // Stop the previously-running agent(s) first so we don't end up with the old
+  // build still reporting alongside the new one until the next Windows login.
+  stopRunningAgents()
+
   // Copy this script to a stable location. process.argv[1] may point inside an
   // npx cache dir that gets purged later — referencing it from autostart would
   // silently break on the next login. A stable copy survives.
@@ -171,6 +199,49 @@ function git(cmd, cwd) {
   }
 }
 
+// Like git(), but surfaces failures (with stderr) instead of swallowing them —
+// used for push/pull where we need to detect auth rejection.
+function gitTry(cmd, cwd) {
+  try {
+    const out = execSync(cmd, { cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }).trim()
+    return { ok: true, out }
+  } catch (err) {
+    const out = (err.stderr || err.stdout || err.message || '').toString().trim()
+    return { ok: false, out }
+  }
+}
+
+// Never let a token reach the log file or the server's command-result.
+function redact(text, token) {
+  if (!text || !token) return text
+  return text.split(token).join('***')
+}
+
+// https://x-access-token:<token>@github.com/<owner>/<repo>.git — an ad-hoc URL
+// passed straight to push/pull, so it never gets written into .git/config.
+function authUrl(auth) {
+  const repo = auth.repo.replace(/\.git$/i, '')
+  return `https://x-access-token:${auth.token}@github.com/${repo}.git`
+}
+
+// Push/pull using the server-issued token when we have one; otherwise fall back
+// to the machine's own git credentials (old behaviour). Throws on failure.
+function pushOrPull(type, repoPath, auth) {
+  const branch = git('git branch --show-current', repoPath) || 'HEAD'
+  let cmd
+  if (auth) {
+    const url = authUrl(auth)
+    cmd = type === 'push' ? `git push "${url}" HEAD:${branch}` : `git pull "${url}" ${branch}`
+  } else {
+    cmd = type === 'push' ? 'git push' : 'git pull'
+  }
+  const r = gitTry(cmd, repoPath)
+  if (!r.ok) throw new Error(r.out || `${type} failed`)
+  return r.out || (type === 'push' ? 'pushed' : 'pulled')
+}
+
+const AUTH_FAIL = /authentication|authorization|403|401|denied|could not read Username|invalid username or password|terminal prompts disabled/i
+
 function parseDiffByFile(diffOutput) {
   const files = {}
   if (!diffOutput) return files
@@ -274,20 +345,26 @@ async function reportCommandResult(cfg, id, status, result) {
 async function executeCommand(cfg, cmd, repoPath) {
   let result = 'ok'
   let status = 'done'
+  const auth = cfg.auth?.[repoPath] ?? null
   try {
     if (cmd.type === 'commit') {
       const msg = (cmd.payload?.message ?? 'commit').replace(/"/g, '\\"')
       git('git add -A', repoPath)
       result = git(`git commit -m "${msg}"`, repoPath) || 'committed'
-    } else if (cmd.type === 'push') {
-      result = git('git push', repoPath) || 'pushed'
-    } else if (cmd.type === 'pull') {
-      result = git('git pull', repoPath) || 'pulled'
+    } else if (cmd.type === 'push' || cmd.type === 'pull') {
+      result = pushOrPull(cmd.type, repoPath, auth)
     }
-    log(`✓ ${cmd.type} @ ${repoPath}: ${result}`)
+    log(`✓ ${cmd.type} @ ${repoPath}: ${redact(result, auth?.token)}`)
   } catch (err) {
     status = 'error'
-    result = err.message
+    result = redact(err.message, auth?.token)
+    // Cached token rejected (e.g. rotated/expired on the server) → drop it so
+    // the next snapshot reports hasGithubAuth:false and the server reissues one.
+    if (auth && AUTH_FAIL.test(err.message)) {
+      delete cfg.auth[repoPath]
+      writeConfig(cfg)
+      result += ' — токенът е изчистен, пробвай командата пак'
+    }
     log(`✗ ${cmd.type} failed @ ${repoPath}: ${result}`)
   }
   await reportCommandResult(cfg, cmd.id, status, result)
@@ -298,6 +375,7 @@ async function sync(cfg, discovered) {
   const data = await api(cfg, '/api/v1/agent/sync', {
     machineId: cfg.machineId,
     hostname: cfg.hostname,
+    agentVersion: AGENT_VERSION,
     roots: cfg.roots,
     repos: discovered,
   })
@@ -311,8 +389,17 @@ async function pushSnapshot(cfg, repo) {
     machineId: cfg.machineId,
     path: repo.path,
     repoName: repo.name,
+    // Tells the server whether we already hold a push token for this repo.
+    // Always a boolean → marks us as a token-capable agent.
+    hasGithubAuth: !!cfg.auth?.[repo.path],
     ...snapshot,
   })
+  // Server issued a (fresh) push token — cache it on disk so we ask only once.
+  if (data.githubAuth?.token && data.githubAuth?.repo) {
+    cfg.auth = cfg.auth ?? {}
+    cfg.auth[repo.path] = { token: data.githubAuth.token, repo: data.githubAuth.repo }
+    writeConfig(cfg)
+  }
   for (const cmd of data.commands ?? []) {
     await executeCommand(cfg, cmd, repo.path)
   }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name":  "gitdone-agent",
-    "version":  "0.2.1",
+    "version":  "0.3.1",
     "description":  "Local git agent for gitdone — watches a local repo and sends snapshots to gitdone.eu",
     "type":  "module",
     "bin":  {