gitdone-agent 0.7.6 → 0.7.7

package/index.js

@@ -13,6 +13,7 @@ import { execSync, execFileSync, spawn } from 'node:child_process'
 import {
   existsSync, writeFileSync, readFileSync, unlinkSync, renameSync,
   mkdirSync, copyFileSync, appendFileSync, readdirSync, rmSync, statSync,
+  openSync, writeSync, fsyncSync, closeSync,
 } from 'node:fs'
 import { resolve, join } from 'node:path'
 import { homedir, hostname, tmpdir } from 'node:os'
@@ -27,10 +28,12 @@ import { randomUUID, createHash } from 'node:crypto'
 // Reported to the server on every sync so the web UI can flag outdated agents.
 // Keep in lockstep with packages/agent/package.json "version" AND
 // src/lib/agentVersion.ts LATEST_AGENT_VERSION.
-const AGENT_VERSION = '0.7.6'
+const AGENT_VERSION = '0.7.7'
 
 const AGENT_DIR = join(homedir(), '.gitdone-agent')
 const CONFIG_PATH = join(AGENT_DIR, 'config.json')
+// Last-known-good copy of config.json, refreshed once per successful start.
+const CONFIG_BAK_PATH = CONFIG_PATH + '.bak'
 const STABLE_AGENT = join(AGENT_DIR, 'agent.mjs')
 const LOG_PATH = join(AGENT_DIR, 'agent.log')
 
@@ -80,20 +83,98 @@ function survive(kind, err) {
 process.on('uncaughtException', (err) => survive('uncaught exception', err))
 process.on('unhandledRejection', (err) => survive('unhandled rejection', err))
 
-function readConfig() {
-  try { return JSON.parse(readFileSync(CONFIG_PATH, 'utf8')) } catch { return null }
+function parseConfigFile(path) {
+  try {
+    // Strip a UTF-8 BOM: we never write one, but a config repaired by hand in an
+    // editor that adds one would otherwise be unparsable — and "I fixed the file
+    // and it still says no config" is the worst possible dead end (gd-478).
+    const cfg = JSON.parse(readFileSync(path, 'utf8').replace(/^/, ''))
+    return cfg && typeof cfg === 'object' && cfg.key ? cfg : null
+  } catch { return null }
+}
+
+// Rebuild the bare minimum from ai-mcp-config.json — last resort when both
+// config.json and its backup are gone. It is written from cfg.key/cfg.machineId
+// on every AI session, so it carries the two values that cannot be regenerated
+// locally (a new machineId would show up as a SECOND machine on the server, and
+// there is no way to invent the API key). Roots are lost, but an agent that is
+// online with no roots can be fixed from the web UI; an offline one cannot.
+function recoverConfigFromAiMcp() {
+  try {
+    const mcp = JSON.parse(readFileSync(join(AGENT_DIR, 'ai-mcp-config.json'), 'utf8'))
+    const server = mcp?.mcpServers?.gitdone
+    const key = server?.headers?.Authorization?.replace(/^Bearer\s+/, '')
+    const machineId = server?.headers?.['X-Gitdone-Machine-Id']
+    if (!key || !machineId || !server.url) return null
+    return {
+      key,
+      url: server.url.replace(/\/api\/mcp\/?$/, ''),
+      interval: 30,
+      machineId,
+      hostname: hostname(),
+      roots: [],
+    }
+  } catch { return null }
 }
 
+// True when the running config had to be rebuilt — surfaced by --doctor.
+let configWasRecovered = null
+
+// An unclean shutdown (power loss, BSOD) can leave config.json committed by the
+// filesystem as a NUL-filled file of the right length: intact on disk, garbage
+// to JSON.parse. Before gd-478 that bricked the agent for good — every autostart
+// exited with "no config found" and the supervisor just respawned it every 10s,
+// so the machine stayed offline until somebody hand-edited the file. A user
+// without filesystem access had no way out at all. So never trust the primary
+// copy blindly: fall back to the last-known-good backup, then to the AI MCP
+// config, and put whichever survived back in place.
+function readConfig() {
+  const primary = parseConfigFile(CONFIG_PATH)
+  if (primary) return primary
+  // Nothing to recover from on a fresh machine (install path) — stay quiet.
+  if (!existsSync(CONFIG_PATH) && !existsSync(CONFIG_BAK_PATH)) return null
+
+  for (const [source, cfg] of [
+    ['config.json.bak', parseConfigFile(CONFIG_BAK_PATH)],
+    ['ai-mcp-config.json', recoverConfigFromAiMcp()],
+  ]) {
+    if (!cfg) continue
+    configWasRecovered = source
+    log(`✗ config.json е повреден (най-вероятно от неочаквано изключване) — възстановен от ${source}`)
+    try { writeConfig(cfg) } catch (err) { log(`✗ записът на възстановения config не успя: ${err.message}`) }
+    return cfg
+  }
+  log('✗ config.json е повреден и няма от какво да се възстанови — пусни gitdone-agent --key=... --root=... --install')
+  return null
+}
+
+// Atomic AND durable: write to a temp file, force it to the platter, and only
+// then rename over the real one. The fsync is the part that matters — without
+// it the rename can be committed while the data is still in the page cache, and
+// a power cut in that window is exactly what produced the NUL-filled config in
+// gd-478. Losing the rename is harmless (the old config survives); losing the
+// data is not.
 function writeConfig(cfg) {
   ensureAgentDir()
-  // Write-then-rename so a crash / reboot mid-write can never leave a truncated
-  // config.json — a corrupt config makes every subsequent autostart exit
-  // immediately, which reads as "агентът умря и рестартът не помага" (gd-403).
   const tmp = CONFIG_PATH + '.tmp'
-  writeFileSync(tmp, JSON.stringify(cfg, null, 2), 'utf8')
+  const fd = openSync(tmp, 'w')
+  try {
+    writeSync(fd, JSON.stringify(cfg, null, 2), null, 'utf8')
+    fsyncSync(fd)
+  } finally {
+    closeSync(fd)
+  }
   renameSync(tmp, CONFIG_PATH)
 }
 
+// Refresh the last-known-good copy. Called once per successful start, so the
+// backup is always a config that actually booted the agent — never a half-baked
+// one. Best-effort: a failed backup must not stop the agent from running.
+function backupConfig(cfg) {
+  try { writeFileSync(CONFIG_BAK_PATH, JSON.stringify(cfg, null, 2), 'utf8') }
+  catch (err) { log(`✗ backup на config.json не успя: ${err.message}`) }
+}
+
 // ─── Arg parsing ─────────────────────────────────────────────────────────────
 
 function parseArgs() {
@@ -458,7 +539,12 @@ function runDoctor() {
   let hb = '(none yet)'
   try { hb = `(последен: преди ${Math.round((Date.now() - statSync(HEARTBEAT_PATH).mtimeMs) / 1000)}s)` } catch { /* no beat yet */ }
   console.log(`  heartbeat     : ${HEARTBEAT_PATH} ${hb}`)
-  console.log(`  config        : ${CONFIG_PATH} ${existsSync(CONFIG_PATH) ? '(ok)' : '(MISSING)'}`)
+  // cfg comes from readConfig() above, so a corrupt config.json has already been
+  // repaired by the time we print this — say so rather than a bare "(ok)".
+  const cfgState = configWasRecovered ? `(ВЪЗСТАНОВЕН от ${configWasRecovered} — беше повреден)`
+    : cfg ? '(ok)' : existsSync(CONFIG_PATH) ? '(ПОВРЕДЕН)' : '(MISSING)'
+  console.log(`  config        : ${CONFIG_PATH} ${cfgState}`)
+  console.log(`  config backup : ${CONFIG_BAK_PATH} ${parseConfigFile(CONFIG_BAK_PATH) ? '(ok)' : '(няма — прави се при първия успешен старт)'}`)
   console.log(`  log file      : ${LOG_PATH} ${existsSync(LOG_PATH) ? '(ok)' : '(none yet)'}`)
   console.log(`  crash log     : ${join(AGENT_DIR, 'agent-crash.log')} ${existsSync(join(AGENT_DIR, 'agent-crash.log')) ? '(има записи — виж го при проблеми)' : '(празен — няма крашове)'}`)
   const claude = findClaude()
@@ -2094,6 +2180,9 @@ async function runLoop(cfg) {
   // start so in-place-updated agents get the watchdog without a re-install.
   startHeartbeat()
   ensureWatchdog()
+  // This config just booted an agent, so it is known-good — snapshot it for
+  // readConfig() to fall back on (gd-478).
+  backupConfig(cfg)
   log(`gitdone-agent started — machine: ${cfg.hostname}, server: ${cfg.url}, interval: ${cfg.interval}s`)
   log(`  roots: ${cfg.roots.join(', ') || '(none — add one with --root)'}`)
 
@@ -2169,7 +2258,10 @@ async function main() {
   // No args → running mode (this is how autostart launches us): read config.
   const cfg = readConfig()
   if (!cfg || !cfg.key) {
-    console.error(`Error: no config found at ${CONFIG_PATH}. Run with --key=... --root=... --install first.`)
+    // Through agent.log, not just stderr — the autostart runs hidden, so the
+    // crash log is the only other place this would land and nobody reads it
+    // until someone already suspects the agent (gd-478).
+    log(`✗ няма използваем config в ${CONFIG_PATH} — пусни gitdone-agent --key=... --root=... --install`)
     process.exit(1)
   }
   await runLoop(cfg)

package/package.json

@@ -1,6 +1,6 @@
 {
     "name":  "gitdone-agent",
-    "version":  "0.7.6",
+    "version":  "0.7.7",
     "description":  "Local git agent for gitdone — watches a local repo and sends snapshots to gitdone.eu",
     "type":  "module",
     "bin":  {