gitdone-agent 0.7.5 → 0.7.7

package/index.js

@@ -13,6 +13,7 @@ import { execSync, execFileSync, spawn } from 'node:child_process'
 import {
   existsSync, writeFileSync, readFileSync, unlinkSync, renameSync,
   mkdirSync, copyFileSync, appendFileSync, readdirSync, rmSync, statSync,
+  openSync, writeSync, fsyncSync, closeSync,
 } from 'node:fs'
 import { resolve, join } from 'node:path'
 import { homedir, hostname, tmpdir } from 'node:os'
@@ -27,10 +28,12 @@ import { randomUUID, createHash } from 'node:crypto'
 // Reported to the server on every sync so the web UI can flag outdated agents.
 // Keep in lockstep with packages/agent/package.json "version" AND
 // src/lib/agentVersion.ts LATEST_AGENT_VERSION.
-const AGENT_VERSION = '0.7.5'
+const AGENT_VERSION = '0.7.7'
 
 const AGENT_DIR = join(homedir(), '.gitdone-agent')
 const CONFIG_PATH = join(AGENT_DIR, 'config.json')
+// Last-known-good copy of config.json, refreshed once per successful start.
+const CONFIG_BAK_PATH = CONFIG_PATH + '.bak'
 const STABLE_AGENT = join(AGENT_DIR, 'agent.mjs')
 const LOG_PATH = join(AGENT_DIR, 'agent.log')
 
@@ -80,20 +83,98 @@ function survive(kind, err) {
 process.on('uncaughtException', (err) => survive('uncaught exception', err))
 process.on('unhandledRejection', (err) => survive('unhandled rejection', err))
 
-function readConfig() {
-  try { return JSON.parse(readFileSync(CONFIG_PATH, 'utf8')) } catch { return null }
+function parseConfigFile(path) {
+  try {
+    // Strip a UTF-8 BOM: we never write one, but a config repaired by hand in an
+    // editor that adds one would otherwise be unparsable — and "I fixed the file
+    // and it still says no config" is the worst possible dead end (gd-478).
+    const cfg = JSON.parse(readFileSync(path, 'utf8').replace(/^/, ''))
+    return cfg && typeof cfg === 'object' && cfg.key ? cfg : null
+  } catch { return null }
+}
+
+// Rebuild the bare minimum from ai-mcp-config.json — last resort when both
+// config.json and its backup are gone. It is written from cfg.key/cfg.machineId
+// on every AI session, so it carries the two values that cannot be regenerated
+// locally (a new machineId would show up as a SECOND machine on the server, and
+// there is no way to invent the API key). Roots are lost, but an agent that is
+// online with no roots can be fixed from the web UI; an offline one cannot.
+function recoverConfigFromAiMcp() {
+  try {
+    const mcp = JSON.parse(readFileSync(join(AGENT_DIR, 'ai-mcp-config.json'), 'utf8'))
+    const server = mcp?.mcpServers?.gitdone
+    const key = server?.headers?.Authorization?.replace(/^Bearer\s+/, '')
+    const machineId = server?.headers?.['X-Gitdone-Machine-Id']
+    if (!key || !machineId || !server.url) return null
+    return {
+      key,
+      url: server.url.replace(/\/api\/mcp\/?$/, ''),
+      interval: 30,
+      machineId,
+      hostname: hostname(),
+      roots: [],
+    }
+  } catch { return null }
 }
 
+// True when the running config had to be rebuilt — surfaced by --doctor.
+let configWasRecovered = null
+
+// An unclean shutdown (power loss, BSOD) can leave config.json committed by the
+// filesystem as a NUL-filled file of the right length: intact on disk, garbage
+// to JSON.parse. Before gd-478 that bricked the agent for good — every autostart
+// exited with "no config found" and the supervisor just respawned it every 10s,
+// so the machine stayed offline until somebody hand-edited the file. A user
+// without filesystem access had no way out at all. So never trust the primary
+// copy blindly: fall back to the last-known-good backup, then to the AI MCP
+// config, and put whichever survived back in place.
+function readConfig() {
+  const primary = parseConfigFile(CONFIG_PATH)
+  if (primary) return primary
+  // Nothing to recover from on a fresh machine (install path) — stay quiet.
+  if (!existsSync(CONFIG_PATH) && !existsSync(CONFIG_BAK_PATH)) return null
+
+  for (const [source, cfg] of [
+    ['config.json.bak', parseConfigFile(CONFIG_BAK_PATH)],
+    ['ai-mcp-config.json', recoverConfigFromAiMcp()],
+  ]) {
+    if (!cfg) continue
+    configWasRecovered = source
+    log(`✗ config.json е повреден (най-вероятно от неочаквано изключване) — възстановен от ${source}`)
+    try { writeConfig(cfg) } catch (err) { log(`✗ записът на възстановения config не успя: ${err.message}`) }
+    return cfg
+  }
+  log('✗ config.json е повреден и няма от какво да се възстанови — пусни gitdone-agent --key=... --root=... --install')
+  return null
+}
+
+// Atomic AND durable: write to a temp file, force it to the platter, and only
+// then rename over the real one. The fsync is the part that matters — without
+// it the rename can be committed while the data is still in the page cache, and
+// a power cut in that window is exactly what produced the NUL-filled config in
+// gd-478. Losing the rename is harmless (the old config survives); losing the
+// data is not.
 function writeConfig(cfg) {
   ensureAgentDir()
-  // Write-then-rename so a crash / reboot mid-write can never leave a truncated
-  // config.json — a corrupt config makes every subsequent autostart exit
-  // immediately, which reads as "агентът умря и рестартът не помага" (gd-403).
   const tmp = CONFIG_PATH + '.tmp'
-  writeFileSync(tmp, JSON.stringify(cfg, null, 2), 'utf8')
+  const fd = openSync(tmp, 'w')
+  try {
+    writeSync(fd, JSON.stringify(cfg, null, 2), null, 'utf8')
+    fsyncSync(fd)
+  } finally {
+    closeSync(fd)
+  }
   renameSync(tmp, CONFIG_PATH)
 }
 
+// Refresh the last-known-good copy. Called once per successful start, so the
+// backup is always a config that actually booted the agent — never a half-baked
+// one. Best-effort: a failed backup must not stop the agent from running.
+function backupConfig(cfg) {
+  try { writeFileSync(CONFIG_BAK_PATH, JSON.stringify(cfg, null, 2), 'utf8') }
+  catch (err) { log(`✗ backup на config.json не успя: ${err.message}`) }
+}
+
 // ─── Arg parsing ─────────────────────────────────────────────────────────────
 
 function parseArgs() {
@@ -458,7 +539,12 @@ function runDoctor() {
   let hb = '(none yet)'
   try { hb = `(последен: преди ${Math.round((Date.now() - statSync(HEARTBEAT_PATH).mtimeMs) / 1000)}s)` } catch { /* no beat yet */ }
   console.log(`  heartbeat     : ${HEARTBEAT_PATH} ${hb}`)
-  console.log(`  config        : ${CONFIG_PATH} ${existsSync(CONFIG_PATH) ? '(ok)' : '(MISSING)'}`)
+  // cfg comes from readConfig() above, so a corrupt config.json has already been
+  // repaired by the time we print this — say so rather than a bare "(ok)".
+  const cfgState = configWasRecovered ? `(ВЪЗСТАНОВЕН от ${configWasRecovered} — беше повреден)`
+    : cfg ? '(ok)' : existsSync(CONFIG_PATH) ? '(ПОВРЕДЕН)' : '(MISSING)'
+  console.log(`  config        : ${CONFIG_PATH} ${cfgState}`)
+  console.log(`  config backup : ${CONFIG_BAK_PATH} ${parseConfigFile(CONFIG_BAK_PATH) ? '(ok)' : '(няма — прави се при първия успешен старт)'}`)
   console.log(`  log file      : ${LOG_PATH} ${existsSync(LOG_PATH) ? '(ok)' : '(none yet)'}`)
   console.log(`  crash log     : ${join(AGENT_DIR, 'agent-crash.log')} ${existsSync(join(AGENT_DIR, 'agent-crash.log')) ? '(има записи — виж го при проблеми)' : '(празен — няма крашове)'}`)
   const claude = findClaude()
@@ -909,7 +995,7 @@ async function reportCommandResult(cfg, id, status, result) {
 // how many tokens the run cost. `streamingText` / `activityText` (gd-419) carry
 // the live "being typed" preview and the latest thinking snippet — explicit ''
 // clears them; `undefined` leaves them untouched.
-async function postRunEvents(cfg, runId, events, status, result, usage, streamingText, activityText) {
+async function postRunEvents(cfg, runId, events, status, result, usage, streamingText, activityText, extra) {
   await api(cfg, '/api/v1/agent/ai-run/events', {
     runId,
     events,
@@ -918,9 +1004,32 @@ async function postRunEvents(cfg, runId, events, status, result, usage, streamin
     ...(usage ? { usage } : {}),
     ...(streamingText !== undefined ? { streamingText } : {}),
     ...(activityText !== undefined ? { activityText } : {}),
+    // gd-466: claude's own session id (for --resume) + precise stop cause.
+    ...(extra?.claudeSessionId ? { claudeSessionId: extra.claudeSessionId } : {}),
+    ...(extra?.stopReason ? { stopReason: extra.stopReason } : {}),
+    ...(typeof extra?.resetAt === 'number' ? { resetAt: extra.resetAt } : {}),
   }).catch((e) => log(`✗ ai-run events post failed: ${e.message}`))
 }
 
+// gd-466: parse a hard usage-limit stop out of claude's headless output. On the
+// limit, the CLI surfaces "Claude AI usage limit reached|<epoch_seconds>" (in
+// the result text and/or stderr); the epoch is the window reset. Returns the
+// reset in ms when found, else { limited } with a null resetAt (telemetry is
+// then the backstop), else not limited.
+function detectUsageLimit(text) {
+  const hay = String(text || '')
+  const withEpoch = hay.match(/usage limit reached\s*\|\s*(\d{9,13})/i)
+  if (withEpoch) {
+    let n = Number(withEpoch[1])
+    if (n < 1e12) n *= 1000 // seconds → ms
+    return { limited: true, resetAt: n }
+  }
+  if (/usage limit reached|reached your usage limit|rate limit(?:ed)?|exceeded your.*\blimit\b/i.test(hay)) {
+    return { limited: true, resetAt: null }
+  }
+  return { limited: false, resetAt: null }
+}
+
 // Post transcript lines (and optional turn status / Claude session id) for an
 // interactive AiSession chat turn.
 async function postSessionEvents(cfg, sessionId, events, status, claudeSessionId, streamingText, activityText) {
@@ -991,6 +1100,11 @@ function parseStreamLine(line, push, onInit, onDelta, onMeta, onTurnEnd) {
   }
   if (ev.type === 'result') {
     if (ev.subtype && ev.subtype !== 'success') push('SYSTEM', `Резултат: ${ev.subtype}`)
+    // gd-466: surface the final result text + subtype so the caller can detect a
+    // hard usage-limit stop (the "usage limit reached|<epoch>" lands here).
+    if (typeof onMeta === 'function' && (ev.subtype || typeof ev.result === 'string')) {
+      onMeta({ subtype: ev.subtype, resultText: typeof ev.result === 'string' ? ev.result : undefined })
+    }
     // claude's final result carries cumulative token usage + its own cost.
     // Prefer `modelUsage` (summed over every model/subagent turn) which is the
     // true cumulative; top-level `usage` is often just the last turn. Fall back
@@ -1176,6 +1290,8 @@ function runAiCommand(cfg, cmd, repoPath) {
   const prompt = cmd.payload?.prompt ?? ''
   const allowCommit = cmd.payload?.allowCommit === true
   const model = aiModelArg(cmd.payload?.model)
+  // gd-466: a token-reset resume asks us to continue claude's own conversation.
+  const resumeId = cmd.payload?.resume || null
   if (!runId || !prompt) {
     reportCommandResult(cfg, cmd.id, 'error', 'invalid ai_run payload')
     return
@@ -1208,6 +1324,10 @@ function runAiCommand(cfg, cmd, repoPath) {
     // Stream text token-by-token + thinking deltas so the terminal shows the
     // reply being written live, ред по ред, not in whole-block batches (gd-419).
     '--include-partial-messages',
+    // gd-466: resume claude's own prior conversation for this task when we're
+    // continuing after a token reset — it keeps its context/todo. A stale/missing
+    // session errors out fast; the watchdog then re-dispatches fresh (no resume).
+    ...(resumeId ? ['--resume', resumeId] : []),
     // Model chosen in gitDone (project default / task); omitted → machine default (gd-354).
     ...(model ? ['--model', model] : []),
     '--permission-mode', 'acceptEdits',
@@ -1240,7 +1360,11 @@ function runAiCommand(cfg, cmd, repoPath) {
     const activityText = activityChanged ? liveActivity : undefined
     sentLive = liveText
     sentActivity = liveActivity
-    await postRunEvents(cfg, runId, batch, undefined, undefined, undefined, streamingText, activityText)
+    // gd-466: persist claude's session id as soon as we have it (once), so a
+    // resume survives even if the agent dies before the clean close handler.
+    const extra = (!sentSession && capturedSession) ? { claudeSessionId: capturedSession } : undefined
+    if (extra) sentSession = true
+    await postRunEvents(cfg, runId, batch, undefined, undefined, undefined, streamingText, activityText, extra)
     flushing = false
   }
   const push = (kind, text) => {
@@ -1260,14 +1384,25 @@ function runAiCommand(cfg, cmd, repoPath) {
   const timer = setInterval(flush, 500)
 
   // Accumulate model + token usage across the stream (model from init, usage
-  // from the final result event) to report once on exit (gd-334).
-  const meta = { model: undefined, usage: undefined, costUsd: undefined }
+  // from the final result event) to report once on exit (gd-334). gd-466 also
+  // captures the final result text/subtype (for usage-limit detection).
+  const meta = { model: undefined, usage: undefined, costUsd: undefined, resultText: undefined, subtype: undefined }
   const onMeta = (m) => {
     if (m.model) meta.model = m.model
     if (m.usage) meta.usage = m.usage
     if (typeof m.costUsd === 'number') meta.costUsd = m.costUsd
+    if (m.resultText) meta.resultText = m.resultText
+    if (m.subtype) meta.subtype = m.subtype
   }
 
+  // gd-466: claude's own session id (from its init event) + any stderr — both
+  // feed a token-reset resume: the id lets us --resume, the stderr helps detect
+  // a usage-limit stop.
+  let capturedSession = null
+  let sentSession = false
+  const onInit = (sid) => { if (sid) capturedSession = sid }
+  let stderrBuf = ''
+
   log(`▶ ai_run ${runId} @ ${repoPath} via ${claudePath}`)
   postRunEvents(cfg, runId, [{ kind: 'SYSTEM', text: `Стартиране на Claude Code в ${repoPath}…` }], 'running')
 
@@ -1296,14 +1431,14 @@ function runAiCommand(cfg, cmd, repoPath) {
     while ((nl = buf.indexOf('\n')) >= 0) {
       const line = buf.slice(0, nl).trim()
       buf = buf.slice(nl + 1)
-      if (line) parseStreamLine(line, push, undefined, onDelta, onMeta)
+      if (line) parseStreamLine(line, push, onInit, onDelta, onMeta)
     }
   })
-  child.stderr.on('data', (d) => { const s = d.toString().trim(); if (s) push('SYSTEM', s) })
+  child.stderr.on('data', (d) => { const s = d.toString().trim(); if (s) { stderrBuf = (stderrBuf + '\n' + s).slice(-8000); push('SYSTEM', s) } })
   child.on('error', (err) => push('SYSTEM', `Процесна грешка: ${err.message}`))
   child.on('close', async (code) => {
     clearInterval(timer)
-    if (buf.trim()) parseStreamLine(buf.trim(), push, undefined, onDelta, onMeta)
+    if (buf.trim()) parseStreamLine(buf.trim(), push, onInit, onDelta, onMeta)
     liveText = '' // run is over — drop any lingering live preview / thought
     liveActivity = ''
     await flush()
@@ -1312,17 +1447,38 @@ function runAiCommand(cfg, cmd, repoPath) {
     const usage = meta.usage
       ? { model: meta.model, ...meta.usage, ...(typeof meta.costUsd === 'number' ? { costUsd: meta.costUsd } : {}) }
       : undefined
-    const events = [{ kind: 'SYSTEM', text: ok ? '✓ Готово.' : `✗ Процесът приключи с код ${code}.` }]
+
+    // gd-466: did we stop on the token limit? Check the final result text, its
+    // subtype, and stderr. A hard hit gives us the precise reset epoch; report
+    // it so the server parks the task for an exact auto-resume.
+    const limit = detectUsageLimit(`${meta.resultText || ''}\n${meta.subtype || ''}\n${stderrBuf}`)
+    const extra = {
+      ...(capturedSession ? { claudeSessionId: capturedSession } : {}),
+      ...(limit.limited ? { stopReason: 'usage_limit' } : {}),
+      ...(limit.limited && typeof limit.resetAt === 'number' ? { resetAt: limit.resetAt } : {}),
+    }
+
+    const events = [{
+      kind: 'SYSTEM',
+      text: limit.limited
+        ? '⏳ Достигнат лимит на токени — спирам. gitDone ще ме продължи автоматично след ресета.'
+        : (ok ? '✓ Готово.' : `✗ Процесът приключи с код ${code}.`),
+    }]
     if (usage) events.push({ kind: 'SYSTEM', text: `📊 Токени: ${fmtTokens(usage.inputTokens)} вход · ${fmtTokens(usage.outputTokens)} изход${usage.cacheReadTokens ? ` · ${fmtTokens(usage.cacheReadTokens)} кеш` : ''}${typeof usage.costUsd === 'number' ? ` · $${usage.costUsd.toFixed(4)}` : ''}` })
     await postRunEvents(
       cfg, runId,
       events,
-      ok ? 'done' : 'error',
-      ok ? 'ok' : `exit ${code}`,
+      // A limit stop is not a clean finish — report it as 'error' so the run
+      // ends and the server's park/resume path (not the DONE path) takes over.
+      ok && !limit.limited ? 'done' : 'error',
+      limit.limited ? 'usage_limit' : (ok ? 'ok' : `exit ${code}`),
       usage,
+      undefined,
+      undefined,
+      extra,
     )
-    reportCommandResult(cfg, cmd.id, ok ? 'done' : 'error', `exit ${code}`)
-    log(`■ ai_run ${runId} приключи (code ${code})`)
+    reportCommandResult(cfg, cmd.id, ok && !limit.limited ? 'done' : 'error', limit.limited ? 'usage_limit' : `exit ${code}`)
+    log(`■ ai_run ${runId} приключи (code ${code}${limit.limited ? ', usage_limit' : ''})`)
   })
 }
 
@@ -2024,6 +2180,9 @@ async function runLoop(cfg) {
   // start so in-place-updated agents get the watchdog without a re-install.
   startHeartbeat()
   ensureWatchdog()
+  // This config just booted an agent, so it is known-good — snapshot it for
+  // readConfig() to fall back on (gd-478).
+  backupConfig(cfg)
   log(`gitdone-agent started — machine: ${cfg.hostname}, server: ${cfg.url}, interval: ${cfg.interval}s`)
   log(`  roots: ${cfg.roots.join(', ') || '(none — add one with --root)'}`)
 
@@ -2099,7 +2258,10 @@ async function main() {
   // No args → running mode (this is how autostart launches us): read config.
   const cfg = readConfig()
   if (!cfg || !cfg.key) {
-    console.error(`Error: no config found at ${CONFIG_PATH}. Run with --key=... --root=... --install first.`)
+    // Through agent.log, not just stderr — the autostart runs hidden, so the
+    // crash log is the only other place this would land and nobody reads it
+    // until someone already suspects the agent (gd-478).
+    log(`✗ няма използваем config в ${CONFIG_PATH} — пусни gitdone-agent --key=... --root=... --install`)
     process.exit(1)
   }
   await runLoop(cfg)

package/package.json

@@ -1,6 +1,6 @@
 {
     "name":  "gitdone-agent",
-    "version":  "0.7.5",
+    "version":  "0.7.7",
     "description":  "Local git agent for gitdone — watches a local repo and sends snapshots to gitdone.eu",
     "type":  "module",
     "bin":  {