gitdone-agent 0.7.0 → 0.7.3

package/index.js

@@ -27,7 +27,7 @@ import { randomUUID } from 'node:crypto'
 // Reported to the server on every sync so the web UI can flag outdated agents.
 // Keep in lockstep with packages/agent/package.json "version" AND
 // src/lib/agentVersion.ts LATEST_AGENT_VERSION.
-const AGENT_VERSION = '0.7.0'
+const AGENT_VERSION = '0.7.1'
 
 const AGENT_DIR = join(homedir(), '.gitdone-agent')
 const CONFIG_PATH = join(AGENT_DIR, 'config.json')
@@ -253,6 +253,99 @@ function stopRunningAgents() {
   } catch { /* best-effort — at worst the old agent lingers until next login */ }
 }
 
+// ─── Watchdog (gd-431) ────────────────────────────────────────────────────────
+// Third, OUTER layer of crash safety. Layers 1-2 (survive() in-process, the
+// run-agent.cmd supervisor loop) still leave two ways for a machine to stay
+// offline: the supervisor cmd.exe itself dying (nothing restarts IT), and the
+// agent HANGING without exiting (process alive → supervisor waits forever).
+// So: the agent touches a heartbeat file every 30s, and a Windows scheduled
+// task runs watchdog.ps1 every 5 minutes (hidden via watchdog.vbs). A stale
+// heartbeat (>10 min) means dead OR hung → the watchdog kills any leftover
+// agent/supervisor processes and relaunches run-agent.cmd. The relaunch goes
+// through WMI Win32_Process.Create so the agent does NOT live inside the task's
+// job object — otherwise Task Scheduler would consider the task "still running"
+// forever and never fire it again (and stopping the task would kill the agent).
+//
+// Broken-session guard (gd-405): if a restart attempt does NOT revive the
+// heartbeat (0xc0000142 storms after a hardware crash — every start pops a
+// blocking error dialog), the watchdog backs off to one attempt per 30 min via
+// a stamp file instead of retrying every 5 — and a fresh heartbeat clears it.
+const WATCHDOG_TASK = 'GitdoneAgentWatchdog'
+const WATCHDOG_PS1 = join(AGENT_DIR, 'watchdog.ps1')
+const WATCHDOG_VBS = join(AGENT_DIR, 'watchdog.vbs')
+const HEARTBEAT_PATH = join(AGENT_DIR, 'heartbeat.txt')
+
+function startHeartbeat() {
+  const beat = () => {
+    try { ensureAgentDir(); writeFileSync(HEARTBEAT_PATH, new Date().toISOString()) } catch { /* best-effort */ }
+  }
+  beat()
+  setInterval(beat, 30_000)
+}
+
+// Idempotent: (re)writes the watchdog scripts and (re)creates the scheduled
+// task. Called on EVERY agent start — not just --install — so an in-place
+// update (gd-420) gains the watchdog too, and a deleted task self-heals.
+// The ps1 stays ASCII-only: PowerShell 5.1 misreads UTF-8-without-BOM files.
+function ensureWatchdog() {
+  if (process.platform !== 'win32') return
+  try {
+    ensureAgentDir()
+    const runCmd = join(AGENT_DIR, 'run-agent.cmd')
+    const ps1 = [
+      "$ErrorActionPreference = 'SilentlyContinue'",
+      `$dir = '${AGENT_DIR.replace(/'/g, "''")}'`,
+      "$hb = Join-Path $dir 'heartbeat.txt'",
+      "$stamp = Join-Path $dir 'watchdog-restart.stamp'",
+      "$wlog = Join-Path $dir 'watchdog.log'",
+      "$runCmd = Join-Path $dir 'run-agent.cmd'",
+      'function WLog([string]$m) { Add-Content -Path $wlog -Value ("[{0}] {1}" -f (Get-Date -Format \'yyyy-MM-dd HH:mm:ss\'), $m) }',
+      'if ((Test-Path $wlog) -and ((Get-Item $wlog).Length -gt 1048576)) { Move-Item -Path $wlog -Destination ($wlog + \'.old\') -Force }',
+      '# Fresh heartbeat (<10 min) = agent alive and ticking - nothing to do.',
+      'if ((Test-Path $hb) -and (((Get-Date) - (Get-Item $hb).LastWriteTime).TotalSeconds -lt 600)) {',
+      '  if (Test-Path $stamp) { Remove-Item -Path $stamp -Force }',
+      '  exit 0',
+      '}',
+      '# Last restart attempt did not revive the heartbeat - broken login session',
+      '# (e.g. 0xc0000142 after a hardware crash). Back off to one try per 30 min',
+      '# so retries cannot turn into a blocking-dialog storm (gd-405).',
+      'if ((Test-Path $stamp) -and (((Get-Date) - (Get-Item $stamp).LastWriteTime).TotalMinutes -lt 30)) { exit 0 }',
+      'New-Item -ItemType File -Path $stamp -Force | Out-Null',
+      "if (-not (Test-Path $runCmd)) { WLog 'run-agent.cmd missing - cannot restart; run gitdone-agent --install'; exit 0 }",
+      "WLog 'heartbeat stale - killing leftover agent processes and restarting'",
+      '# Same sweep as stopRunningAgents(): supervisors first, then agents, so a',
+      '# surviving supervisor cannot respawn a second agent mid-cleanup.',
+      'Get-CimInstance Win32_Process -Filter "Name=\'cmd.exe\'" | Where-Object { $_.CommandLine -like \'*run-agent.cmd*\' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }',
+      'Get-CimInstance Win32_Process -Filter "Name=\'node.exe\'" | Where-Object { $_.CommandLine -like \'*gitdone-agent*\' -or $_.CommandLine -like \'*agent.mjs*\' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }',
+      'Start-Sleep -Seconds 2',
+      '# WMI Create = the new process tree lives OUTSIDE the scheduled task job.',
+      '# (wmiclass accelerator, not Invoke-CimMethod - CIM cannot marshal the',
+      '# embedded Win32_ProcessStartup instance and dies with "Type mismatch".)',
+      "$sup = ([wmiclass]'Win32_ProcessStartup').CreateInstance()",
+      '$sup.ShowWindow = 0',
+      "$r = ([wmiclass]'Win32_Process').Create(('\"' + $env:ComSpec + '\" /c \"\"' + $runCmd + '\"\"'), $null, $sup)",
+      'WLog ("restart issued (ReturnValue={0}, Pid={1})" -f $r.ReturnValue, $r.ProcessId)',
+    ].join('\r\n')
+    writeFileSync(WATCHDOG_PS1, ps1, 'utf8')
+
+    // VBS wrapper so the 5-minute task never flashes a window.
+    const vbs = [
+      'Set WshShell = CreateObject("WScript.Shell")',
+      `WshShell.Run "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File ""${WATCHDOG_PS1}""", 0, True`,
+    ].join('\r\n')
+    writeFileSync(WATCHDOG_VBS, vbs, 'utf8')
+
+    execFileSync('schtasks', [
+      '/Create', '/F', '/SC', 'MINUTE', '/MO', '5',
+      '/TN', WATCHDOG_TASK,
+      '/TR', `wscript.exe "${WATCHDOG_VBS}"`,
+    ], { stdio: 'ignore', timeout: 30_000 })
+    log(`✓ watchdog: планирана задача „${WATCHDOG_TASK}" проверява агента на всеки 5 мин`)
+  } catch (err) {
+    log(`✗ watchdog setup failed: ${err?.message || err}`)
+  }
+}
+
 function installStartup() {
   ensureAgentDir()
   const nodePath = getNodePath()
@@ -317,6 +410,9 @@ function installStartup() {
   ].join('\r\n')
 
   writeFileSync(getVbsPath(), vbs, 'utf8')
+
+  // Outer safety layer: the 5-minute watchdog task (gd-431).
+  ensureWatchdog()
 }
 
 function uninstallStartup() {
@@ -329,6 +425,16 @@ function uninstallStartup() {
   }
   const cmdPath = join(AGENT_DIR, 'run-agent.cmd')
   if (existsSync(cmdPath)) unlinkSync(cmdPath)
+  // Drop the watchdog task too — otherwise it resurrects the agent in ≤5 min.
+  if (process.platform === 'win32') {
+    try {
+      execFileSync('schtasks', ['/Delete', '/F', '/TN', WATCHDOG_TASK], { stdio: 'ignore', timeout: 30_000 })
+      console.log('✓ Премахнат watchdog (планирана задача)')
+    } catch { /* not installed */ }
+  }
+  for (const f of [WATCHDOG_PS1, WATCHDOG_VBS, HEARTBEAT_PATH]) {
+    if (existsSync(f)) unlinkSync(f)
+  }
   // Also stop the live supervisor + agent — otherwise they keep running (and
   // the supervisor keeps resurrecting the agent) until the next reboot.
   stopRunningAgents()
@@ -344,6 +450,14 @@ function runDoctor() {
   console.log(`  stable agent  : ${STABLE_AGENT} ${existsSync(STABLE_AGENT) ? '(ok)' : '(not installed)'}`)
   console.log(`  autostart vbs : ${getVbsPath()} ${existsSync(getVbsPath()) ? '(ok)' : '(not installed)'}`)
   console.log(`  supervisor    : ${join(AGENT_DIR, 'run-agent.cmd')} ${existsSync(join(AGENT_DIR, 'run-agent.cmd')) ? '(ok)' : '(not installed — пусни --install за авторестарт при crash)'}`)
+  if (process.platform === 'win32') {
+    let wd = '(not installed — пусни --install или рестартирай агента)'
+    try { execFileSync('schtasks', ['/Query', '/TN', WATCHDOG_TASK], { stdio: 'ignore', timeout: 30_000 }); wd = '(ok — на всеки 5 мин)' } catch { /* missing */ }
+    console.log(`  watchdog      : ${WATCHDOG_TASK} ${wd}`)
+  }
+  let hb = '(none yet)'
+  try { hb = `(последен: преди ${Math.round((Date.now() - statSync(HEARTBEAT_PATH).mtimeMs) / 1000)}s)` } catch { /* no beat yet */ }
+  console.log(`  heartbeat     : ${HEARTBEAT_PATH} ${hb}`)
   console.log(`  config        : ${CONFIG_PATH} ${existsSync(CONFIG_PATH) ? '(ok)' : '(MISSING)'}`)
   console.log(`  log file      : ${LOG_PATH} ${existsSync(LOG_PATH) ? '(ok)' : '(none yet)'}`)
   console.log(`  crash log     : ${join(AGENT_DIR, 'agent-crash.log')} ${existsSync(join(AGENT_DIR, 'agent-crash.log')) ? '(има записи — виж го при проблеми)' : '(празен — няма крашове)'}`)
@@ -447,6 +561,28 @@ function gitTry(cmd, cwd) {
   }
 }
 
+// Like gitTry(), but hands git an ARGV array instead of a shell command string,
+// so git.exe runs directly with no shell in between. A shell string goes through
+// cmd.exe on Windows, which (a) mangles Cyrillic and (b) treats &, |, %, ^, <, >
+// as operators — so a Bulgarian commit message, or a path containing such a
+// character, silently corrupted the command and the commit failed. The old
+// commit path swallowed that via git() + `|| 'committed'` and reported a fake
+// success while nothing was committed (gd-445). gitDiffUntracked() already uses
+// execFileSync for the same reason. Local calls get 2 min; pass net for 5.
+function gitArgs(args, cwd, { net = false } = {}) {
+  try {
+    const out = execFileSync('git', args, {
+      cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'],
+      maxBuffer: GIT_MAX_BUFFER, timeout: net ? GIT_NET_TIMEOUT_MS : GIT_TIMEOUT_MS, env: GIT_ENV,
+    }).trim()
+    return { ok: true, out }
+  } catch (err) {
+    const timedOut = err.signal === 'SIGTERM' && err.code == null
+    const out = (err.stderr || err.stdout || (timedOut ? `git не отговори и беше прекратен` : err.message) || '').toString().trim()
+    return { ok: false, out }
+  }
+}
+
 // Never let a token reach the log file or the server's command-result.
 function redact(text, token) {
   if (!text || !token) return text
@@ -648,7 +784,18 @@ function getSnapshot(repoPath) {
   // -uall lists every untracked file individually instead of collapsing a new
   // directory into a single `dir/` entry — so the change list matches what
   // GitHub Desktop shows, file-for-file (gd-369).
-  const statusLines = git('git status --porcelain -uall', repoPath).split('\n').filter(Boolean)
+  // Read the status RAW (not via git(), which .trim()s the whole output). The
+  // porcelain format is fixed-width — 2 status columns, a space, then the path —
+  // and the first line of a worktree-only change starts with a space (e.g.
+  // " M .env.example"). git().trim() ate that leading space on the FIRST line
+  // only, shifting its columns so the path lost its first character (".env.example"
+  // → "env.example"); the mangled path then failed `git add` (or, before gd-445,
+  // failed silently). Strip only a trailing \r per line, never leading spaces (gd-446).
+  const statusLines = gitRaw('git status --porcelain -uall', repoPath)
+    .toString('utf8')
+    .split('\n')
+    .map((l) => l.replace(/\r$/, ''))
+    .filter(Boolean)
   const modified = []
   const staged = []
   const statuses = {}
@@ -1586,20 +1733,32 @@ async function executeCommand(cfg, cmd, repoPath) {
   const auth = cfg.auth?.[repoPath] ?? null
   try {
     if (cmd.type === 'commit') {
-      const msg = (cmd.payload?.message ?? 'commit').replace(/"/g, '\\"')
+      // Everything here goes through gitArgs (argv, no shell): the message and the
+      // paths are user/Cyrillic data that cmd.exe would corrupt, which used to make
+      // the commit fail silently while the console showed a fake ✓ (gd-445).
+      const msg = (cmd.payload?.message ?? '').trim() || 'commit'
       // When the UI sends a list of selected files, stage ONLY those so the
       // resulting commit (and the push that follows) contains just the checked
       // files. No list → stage everything (old behaviour / older UIs).
       const files = Array.isArray(cmd.payload?.files)
         ? cmd.payload.files.filter((f) => typeof f === 'string' && f.trim())
         : []
-      if (files.length) {
-        const quoted = files.map((f) => `"${f.replace(/"/g, '\\"')}"`).join(' ')
-        git(`git add -- ${quoted}`, repoPath)
+      const add = files.length
+        ? gitArgs(['add', '--', ...files], repoPath)
+        : gitArgs(['add', '-A'], repoPath)
+      if (!add.ok) throw new Error(`git add се провали: ${add.out}`)
+      const commit = gitArgs(['commit', '-m', msg], repoPath)
+      if (commit.ok) {
+        result = commit.out || 'committed'
+      } else if (/nothing to commit|no changes added|working tree clean/i.test(commit.out)) {
+        // Benign: the checked files carried no staged change (already committed or
+        // whitespace-only). Say so plainly instead of faking success.
+        result = 'няма промени за commit'
       } else {
-        git('git add -A', repoPath)
+        // Real failure (hook, identity, lock, corrupt path…) — surface it so the
+        // console shows the reason instead of the old silent fake ✓.
+        throw new Error(commit.out || 'git commit се провали')
       }
-      result = git(`git commit -m "${msg}"`, repoPath) || 'committed'
     } else if (cmd.type === 'push' || cmd.type === 'pull') {
       result = pushOrPull(cmd.type, repoPath, auth)
     } else if (cmd.type === 'discard') {
@@ -1809,6 +1968,11 @@ async function streamCommands(cfg) {
 
 async function runLoop(cfg) {
   ensureSingleInstance()
+  // Watchdog food: a heartbeat file every 30s. Stale >10 min (dead OR hung
+  // event loop) → the scheduled task restarts us (gd-431). Registered on every
+  // start so in-place-updated agents get the watchdog without a re-install.
+  startHeartbeat()
+  ensureWatchdog()
   log(`gitdone-agent started — machine: ${cfg.hostname}, server: ${cfg.url}, interval: ${cfg.interval}s`)
   log(`  roots: ${cfg.roots.join(', ') || '(none — add one with --root)'}`)
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name":  "gitdone-agent",
-    "version":  "0.7.0",
+    "version":  "0.7.3",
     "description":  "Local git agent for gitdone — watches a local repo and sends snapshots to gitdone.eu",
     "type":  "module",
     "bin":  {