nothumanallowed 15.1.8 → 15.1.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "15.1.8",
+  "version": "15.1.9",
   "description": "NotHumanAllowed — 38 AI agents, 80 tools, Studio (visual agentic workflows). Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, Alexandria E2E messaging, GitHub, Notion, Slack, voice chat, free AI (Liara), 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '15.1.8';
+export const VERSION = '15.1.9';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';
 

package/src/server/routes/config.mjs

@@ -88,80 +88,150 @@ export function register(router) {
   });
 
   // POST /api/npm-update
+  //
+  // Two-phase update:
+  //   1. Sync part: run `npm install -g nothumanallowed@latest --prefer-online`
+  //      with cache bypass. Bypass is critical — without --prefer-online, npm
+  //      can install the same version it had cached locally and the user sees
+  //      "nothing changed" (the classic stale-manifest trap).
+  //   2. Async part: spawn a DETACHED helper that watches our PID, waits until
+  //      we exit, sleeps 1 s so the port frees, then re-spawns this process
+  //      with the SAME argv. The newly installed code runs because node will
+  //      re-read the entry script from disk on the next invocation.
+  //
+  // The response is sent BEFORE the parent exits, so the client knows what
+  // version to expect and can poll /api/health for the restart to complete.
   router.post('/api/npm-update', async (req, res) => {
     try {
-      const { exec } = await import('child_process');
+      const { exec, spawn } = await import('child_process');
       const { promisify } = await import('util');
       const execAsync = promisify(exec);
 
-      // Detect the package manager and global prefix to handle permissions correctly
-      let cmd = 'npm install -g nothumanallowed@latest';
-
-      // On macOS/Linux, check if we need special handling for permission
+      // Permission preflight on POSIX
       if (process.platform !== 'win32') {
         try {
-          // Check if npm global dir is writable by current user
           const { stdout: prefix } = await execAsync('npm config get prefix', { timeout: 5000 });
           const globalDir = prefix.trim();
           await fs.promises.access(path.join(globalDir, 'lib'), fs.constants.W_OK);
         } catch {
-          // Global dir not writable — return error with clear instructions
           sendJSON(res, 200, {
             success: false,
             error: 'EACCES: permission denied',
-            message: 'Permission denied. Run: sudo npm install -g nothumanallowed@latest'
+            message: 'Permission denied. Run: sudo npm install -g nothumanallowed@latest --prefer-online',
           });
           return;
         }
       }
 
+      // Clean the metadata cache first — defeats the stale-cache trap that
+      // makes `npm install -g <pkg>` silently install an older version.
+      try { await execAsync('npm cache clean --force', { timeout: 10_000 }); } catch { /* non-fatal */ }
+
+      const cmd = 'npm install -g nothumanallowed@latest --registry=https://registry.npmjs.org/ --prefer-online --no-fund --no-audit';
       const { stdout, stderr } = await execAsync(cmd, {
         timeout: 120_000,
         env: { ...process.env, NODE_ENV: 'production' },
       });
 
-      // Get the installed version from npm output or registry
+      // Resolve the version that actually landed on disk
       let newVersion = '';
       try {
-        // Extract version from npm install output (e.g. "+ nothumanallowed@14.4.18")
         const verMatch = stdout.match(/nothumanallowed@(\d+\.\d+\.\d+)/);
         if (verMatch) {
           newVersion = verMatch[1];
         } else {
-          // Fallback: check registry
           const regResp = await fetch('https://registry.npmjs.org/nothumanallowed/latest');
           const regData = await regResp.json();
           newVersion = regData.version || '';
         }
       } catch { /* ignore */ }
 
-      // Restart ops daemon if running (so Telegram/Discord reconnect with new code)
+      // Stop the ops daemon if it's running — it must reconnect with new code
       try {
         const { isRunning, stopDaemon } = await import('../../services/ops-daemon.mjs');
-        if (isRunning()) {
-          await stopDaemon();
-          const { execSync: ex2 } = await import('child_process');
-          try { ex2('nha ops start', { timeout: 10_000, stdio: 'ignore' }); } catch {}
-        }
-      } catch {}
+        if (isRunning()) await stopDaemon();
+      } catch { /* ignore */ }
 
+      // Send the response NOW, before we kick off the restart. The client
+      // needs this payload to know what version to wait for during polling.
       sendJSON(res, 200, {
         success: true,
-        message: newVersion ? `Updated to v${newVersion}! Restart the server to apply.` : 'Update completed',
+        message: newVersion ? `Updated to v${newVersion}. Restarting server...` : 'Update completed. Restarting...',
         newVersion,
-        restart: false, // Do NOT auto-restart — it never works reliably
-        needsManualRestart: true,
-        stdout: stdout.trim(),
-        stderr: stderr.trim()
+        restart: true,
+        restarting: true,
+        needsManualRestart: false,
+        stdout: stdout.trim().slice(-2000),
+        stderr: stderr.trim().slice(-2000),
       });
+
+      // ── Schedule the self-restart ──
+      // We do this OUTSIDE the response cycle: a detached child that survives
+      // our death, watches our PID, then re-spawns with the same argv.
+      // On POSIX we use `sh -c`. On Windows we use a detached spawn directly
+      // because cmd.exe handles the "wait for PID" idiom differently.
+      const parentPid = process.pid;
+      const respawnNode = process.execPath;             // absolute path to node
+      const respawnArgs = process.argv.slice(1);        // [cli.mjs, "ui", ...]
+      const argvJson = JSON.stringify({ node: respawnNode, args: respawnArgs, parentPid });
+
+      setTimeout(() => {
+        try {
+          if (process.platform === 'win32') {
+            // Windows: schedule via PowerShell — wait-process then start the new node.
+            const psScript = `
+              try { Wait-Process -Id ${parentPid} -Timeout 30 } catch {};
+              Start-Sleep -Milliseconds 1200;
+              Start-Process -FilePath "${respawnNode.replace(/\\/g, '\\\\')}" -ArgumentList ${JSON.stringify(respawnArgs).replace(/"/g, '\\"')} -WindowStyle Hidden
+            `.replace(/\s+/g, ' ').trim();
+            spawn('powershell.exe', ['-NoProfile', '-Command', psScript], {
+              detached: true,
+              stdio: 'ignore',
+              windowsHide: true,
+            }).unref();
+          } else {
+            // POSIX: shell loop that polls `kill -0 PID`, then re-exec the cmd.
+            // Using exec replaces the shell process so we don't leave a wrapper.
+            const escapedArgs = respawnArgs.map(a => `'${a.replace(/'/g, `'\\''`)}'`).join(' ');
+            const escapedNode = `'${respawnNode.replace(/'/g, `'\\''`)}'`;
+            const sh = `
+              i=0
+              while kill -0 ${parentPid} 2>/dev/null && [ $i -lt 60 ]; do
+                sleep 0.2
+                i=$((i+1))
+              done
+              sleep 1
+              exec ${escapedNode} ${escapedArgs}
+            `;
+            spawn('sh', ['-c', sh], {
+              detached: true,
+              stdio: 'ignore',
+            }).unref();
+          }
+
+          // Mark the restart so the next process knows it was self-spawned
+          try {
+            const home = os.homedir();
+            const nhaDir = path.join(home, '.nha');
+            if (!fs.existsSync(nhaDir)) fs.mkdirSync(nhaDir, { recursive: true });
+            fs.writeFileSync(
+              path.join(nhaDir, 'last-restart.json'),
+              JSON.stringify({ at: new Date().toISOString(), fromVersion: VERSION, toVersion: newVersion, meta: argvJson }, null, 2),
+            );
+          } catch { /* non-fatal */ }
+        } catch { /* spawn failed — user will need to restart manually */ }
+
+        // Give the response a moment, then exit so the helper can take over.
+        setTimeout(() => process.exit(0), 200);
+      }, 600);
     } catch (e) {
       const isPermission = e.message?.includes('EACCES') || e.message?.includes('permission denied');
       sendJSON(res, 200, {
         success: false,
         error: isPermission ? 'EACCES: permission denied' : e.message,
         message: isPermission
-          ? 'Permission denied. Run: sudo npm install -g nothumanallowed@latest'
-          : 'Update failed. Try running: npm install -g nothumanallowed@latest'
+          ? 'Permission denied. Run: sudo npm install -g nothumanallowed@latest --prefer-online'
+          : `Update failed: ${e.message}. Try manually: npm cache clean --force && npm install -g nothumanallowed@latest --prefer-online`,
       });
     }
   });