goosetools-worker 0.2.6 → 0.2.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "goosetools-worker",
-  "version": "0.2.6",
+  "version": "0.2.7",
   "description": "The Goose Tools carousel worker — your computer drafts and renders carousel slides for goosetools.com using your own Claude account.",
   "repository": {
     "type": "git",

package/worker/agent-cli.js

@@ -146,7 +146,11 @@ export function detect(agent) {
 }
 
 // Tools Claude must NOT touch in oneshot mode — everything is inlined.
-const CLAUDE_TOOLS_OFF = "Read,Edit,Write,Bash,Glob,Grep,WebFetch,WebSearch";
+const CLAUDE_TOOLS_OFF = "Read,Edit,Write,Bash,Glob,Grep,WebFetch,WebSearch,NotebookEdit,Task";
+// "read" may open the files a prompt names (photos, references) and nothing
+// else: no writing, no shell, no web. Denied explicitly, because an allow-list
+// alone doesn't override a user whose own Claude settings pre-approve more.
+const CLAUDE_READ_ONLY_OFF = "Edit,Write,Bash,WebFetch,WebSearch,NotebookEdit,Task";
 
 /**
  * Run a prompt through the chosen agent CLI.
@@ -181,6 +185,9 @@ export async function runAgent({
         "acceptEdits",
         "--allowedTools",
         tools,
+        // The user's own MCP servers (a Gmail "send", say) must never be in
+        // reach of a prompt built from untrusted email.
+        "--strict-mcp-config",
       ];
       if (resume) args.push("--resume", resume);
       const raw = await run(normalized, args, { timeoutMs, cwd });
@@ -199,9 +206,9 @@ export async function runAgent({
         return { text: raw, sessionId: namespaced(normalized, resume) };
       }
     }
-    const args = ["-p", prompt, "--output-format", "text"];
-    if (mode === "oneshot") args.push("--disallowedTools", CLAUDE_TOOLS_OFF);
-    if (mode === "read") args.push("--allowedTools", "Read");
+    const args = ["-p", prompt, "--output-format", "text", "--strict-mcp-config"];
+    if (mode === "oneshot" || mode === "text") args.push("--disallowedTools", CLAUDE_TOOLS_OFF);
+    if (mode === "read") args.push("--allowedTools", "Read", "--disallowedTools", CLAUDE_READ_ONLY_OFF);
     const text = await run(normalized, args, { timeoutMs, cwd });
     return { text, sessionId: null };
   }

package/worker/index.js

@@ -566,6 +566,10 @@ async function runJob(job) {
 
   // Render.
   const outDir = join(dir, "output");
+  // A requeued job reuses this folder. Slides left from the earlier attempt
+  // (an 8-slide draft re-drafted as 6, or an old slide-03.mp4 that outranks the
+  // new slide-03.png) would be uploaded with the new deck.
+  rmSync(outDir, { recursive: true, force: true });
   await execFileAsync(
     "node",
     [join(ROOT, "src", "render.js"), dir, "--aspect", job.aspect, "--out", outDir],

package/worker/install-helpers.js

@@ -0,0 +1,113 @@
+// SHARED FILE: the source of truth is workers/shared/install-helpers.js in the
+// goosetools repo; copied into each worker (as install-helpers.mjs for the
+// overlay worker, a CommonJS package). Edit the shared one, then
+// `npm run workers:sync`.
+//
+// The parts of installing a background worker that every worker gets wrong in
+// the same way if each writes its own.
+
+import { execSync } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+
+const sleepSync = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+
+/**
+ * The node binary the background service should run.
+ *
+ * `process.execPath` under Homebrew is a versioned folder
+ * (/opt/homebrew/Cellar/node/25.8.2/bin/node) that `brew upgrade` + cleanup
+ * deletes, after which every worker fails to start, silently, forever. The
+ * stable link (/opt/homebrew/bin/node) follows upgrades, so prefer it whenever
+ * it points at the same install.
+ */
+export function stableNodePath(execPath = process.execPath) {
+  if (!/\/Cellar\/node(@\d+)?\//.test(execPath)) return execPath;
+  for (const candidate of ["/opt/homebrew/bin/node", "/usr/local/bin/node"]) {
+    try {
+      if (existsSync(candidate) && realpathSync(candidate).includes("/Cellar/node")) return candidate;
+    } catch {}
+  }
+  return execPath;
+}
+
+/** The newest published version, asked of the registry itself, not a cache. */
+export function latestPublished(pkg) {
+  try {
+    return execSync(`npm view ${pkg} version --prefer-online`, {
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 20000,
+      shell: true,
+    })
+      .toString()
+      .trim();
+  } catch {
+    return null; // offline, or npm unreachable
+  }
+}
+
+/**
+ * Install exactly the newest version of `pkg` into `prefix`, and prove it.
+ *
+ * `npm install pkg@latest` reads a cached, abbreviated copy of the package
+ * listing that can lag a publish by minutes, so right after a release it
+ * quietly reinstalled the previous version and reported success. This asks
+ * the registry for the version first, installs that exact version with
+ * --prefer-online, and retries (for a few minutes) until what's on disk is
+ * what was asked for.
+ */
+export function installExact({ pkg, prefix, installedVersion, log = console.log }) {
+  const target = latestPublished(pkg);
+  if (!target) {
+    // Can't reach the registry to ask; fall back to whatever it will give.
+    execSync(`npm install --no-fund --no-audit --loglevel=error --prefix "${prefix}" ${pkg}@latest`, {
+      stdio: ["ignore", "inherit", "inherit"],
+      shell: true,
+    });
+    return installedVersion();
+  }
+  const attempts = 8;
+  for (let i = 1; i <= attempts; i++) {
+    try {
+      execSync(
+        `npm install --no-fund --no-audit --loglevel=error --prefer-online --prefix "${prefix}" ${pkg}@${target}`,
+        { stdio: ["ignore", "inherit", "pipe"], shell: true },
+      );
+      if (installedVersion() === target) return target;
+    } catch (e) {
+      if (i === attempts) throw e;
+    }
+    if (i < attempts) {
+      log(`  npm hasn't caught up with ${pkg}@${target} yet — trying again in 20s (${i}/${attempts})`);
+      sleepSync(20000);
+    }
+  }
+  throw new Error(`installed ${installedVersion() ?? "nothing"} but ${target} is the latest — try again in a few minutes`);
+}
+
+/**
+ * Write the shared ~/.goosetools/env, keeping any keys this installer doesn't
+ * own (VOICE_DIR and friends) and never leaving it world-readable, even for a
+ * moment: written 0600 to a temp file and renamed into place.
+ */
+export function writeEnv(file, updates) {
+  const existing = {};
+  if (existsSync(file)) {
+    for (const line of readFileSync(file, "utf8").split("\n")) {
+      const i = line.indexOf("=");
+      if (i > 0 && !line.trim().startsWith("#")) existing[line.slice(0, i).trim()] = line.slice(i + 1).trim();
+    }
+  }
+  const merged = { ...existing, ...updates };
+  mkdirSync(dirname(file), { recursive: true });
+  const tmp = `${file}.tmp-${process.pid}`;
+  writeFileSync(
+    tmp,
+    Object.entries(merged)
+      .map(([k, v]) => `${k}=${v}`)
+      .join("\n") + "\n",
+    { mode: 0o600 },
+  );
+  chmodSync(tmp, 0o600);
+  renameSync(tmp, file);
+}

package/worker/lock.js

@@ -35,7 +35,7 @@ export function acquireWorkerLock(name, { label, stopHint }) {
   const file = join(LOCK_DIR, `${name}.pid`);
 
   const holder = readHolder(file);
-  if (holder && isAlive(holder.pid)) {
+  if (holder && isAlive(holder.pid, holder.script)) {
     console.log(
       `\n${label} is already running on this computer (pid ${holder.pid}${
         holder.since ? `, since ${holder.since}` : ""
@@ -58,7 +58,9 @@ export function acquireWorkerLock(name, { label, stopHint }) {
     console.log(`\n${label} started somewhere else a moment ago. Stopping here.\n`);
     process.exit(0);
   }
-  writeSync(fd, `${process.pid}\n${new Date().toISOString()}\n`);
+  // The script path lets a later start tell THIS worker apart from another
+  // process that has since been given the same pid.
+  writeSync(fd, `${process.pid}\n${new Date().toISOString()}\n${process.argv[1] ?? ""}\n`);
   closeSync(fd);
 
   const release = () => rmSync(file, { force: true });
@@ -74,29 +76,35 @@ export function acquireWorkerLock(name, { label, stopHint }) {
 function readHolder(file) {
   if (!existsSync(file)) return null;
   try {
-    const [pid, since] = readFileSync(file, "utf8").split("\n");
+    const [pid, since, script] = readFileSync(file, "utf8").split("\n");
     const n = Number.parseInt(pid, 10);
-    return Number.isFinite(n) ? { pid: n, since: since?.trim() || null } : null;
+    return Number.isFinite(n)
+      ? { pid: n, since: since?.trim() || null, script: script?.trim() || null }
+      : null;
   } catch {
     return null;
   }
 }
 
 // A pid file outlives a SIGKILLed worker, and pids get reused — so "is that
-// pid alive" isn't enough on its own. Checking that it's a node process is
-// cheap and rules out the reuse case that would otherwise lock out the daemon
-// until someone deleted the file by hand.
-function isAlive(pid) {
+// pid alive" isn't enough on its own. And "is it a node process" isn't either:
+// all four workers are node processes started together at login, so after a
+// crash and reboot a sibling worker can inherit the dead one's pid and lock it
+// out indefinitely. So the lock records the worker's script, and only a
+// process running that script counts. (Older lock files without it fall back
+// to the node check.)
+function isAlive(pid, script) {
   try {
     process.kill(pid, 0);
   } catch {
     return false;
   }
   try {
-    return /node/.test(execFileSync("ps", ["-p", String(pid), "-o", "command="], {
+    const command = execFileSync("ps", ["-p", String(pid), "-o", "command="], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
-    }));
+    });
+    return script ? command.includes(script) : /node/.test(command);
   } catch {
     return false;
   }

package/worker/service-core.js

@@ -22,7 +22,6 @@
 
 import { execSync } from "node:child_process";
 import {
-  chmodSync,
   existsSync,
   mkdirSync,
   readFileSync,
@@ -32,6 +31,7 @@ import {
 } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+import { installExact, latestPublished, stableNodePath, writeEnv } from "./install-helpers.js";
 
 export const GOOSE_DIR = join(homedir(), ".goosetools");
 const ENV_FILE = join(GOOSE_DIR, "env");
@@ -65,7 +65,7 @@ function npmGlobalBin() {
 // `claude` lives), plus the usual suspects.
 function servicePath() {
   const parts = [
-    dirname(process.execPath),
+    dirname(stableNodePath()),
     npmGlobalBin(),
     ...(process.platform === "win32"
       ? [process.env.PATH ?? ""]
@@ -93,10 +93,9 @@ function readEnvFile() {
   );
 }
 
+// Keeps keys other tools put there, and is never world-readable (install-helpers).
 function writeEnvFile({ url, token }) {
-  mkdirSync(GOOSE_DIR, { recursive: true });
-  writeFileSync(ENV_FILE, `GOOSETOOLS_URL=${url}\nWORKER_TOKEN=${token}\n`);
-  chmodSync(ENV_FILE, 0o600);
+  writeEnv(ENV_FILE, { GOOSETOOLS_URL: url, WORKER_TOKEN: token });
 }
 
 function compareVersions(a, b) {
@@ -163,12 +162,15 @@ export function createService(cfg) {
     console.log("Setting up the background copy (this can take a minute)…");
     mkdirSync(APP_PREFIX, { recursive: true });
     // From a git checkout (development), install the checkout itself; normal
-    // npx users get the published package.
-    const source = isCheckout(root) ? `"${root}"` : `${cfg.pkg}@latest`;
-    execSync(`npm install --no-fund --no-audit --loglevel=error --prefix "${APP_PREFIX}" ${source}`, {
-      stdio: ["ignore", "inherit", "inherit"],
-      shell: true,
-    });
+    // npx users get exactly the newest published version (install-helpers).
+    if (isCheckout(root)) {
+      execSync(`npm install --no-fund --no-audit --loglevel=error --prefix "${APP_PREFIX}" "${root}"`, {
+        stdio: ["ignore", "inherit", "inherit"],
+        shell: true,
+      });
+    } else {
+      installExact({ pkg: cfg.pkg, prefix: APP_PREFIX, installedVersion });
+    }
     if (!existsSync(INSTALLED_CLI)) {
       throw new Error("background copy did not install where expected");
     }
@@ -186,7 +188,7 @@ export function createService(cfg) {
     <string>${cfg.macLabel}</string>
     <key>ProgramArguments</key>
     <array>
-        <string>${esc(process.execPath)}</string>
+        <string>${esc(stableNodePath())}</string>
         <string>${esc(INSTALLED_CLI)}</string>
         <string>run</string>
     </array>
@@ -272,11 +274,7 @@ export function createService(cfg) {
   }
 
   function latestVersion() {
-    try {
-      return sh(`npm view ${cfg.pkg} version`, { shell: true, timeout: 15000 });
-    } catch {
-      return null; // offline, or npm unreachable — not an error worth failing on
-    }
+    return latestPublished(cfg.pkg); // null when offline — not worth failing on
   }
 
   // launchctl prints "<pid>\t<last exit>\t<label>"; a "-" pid means registered