onbuzz 5.4.4 → 5.4.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "onbuzz",
-  "version": "5.4.4",
+  "version": "5.4.8",
   "description": "Loxia OnBuzz - Your AI Fleet",
   "type": "module",
   "main": "src/index.js",
@@ -33,9 +33,9 @@
     "electron:build:win": "npm run build:web-ui && electron-builder --win",
     "electron:build:mac": "npm run build:web-ui && electron-builder --mac",
     "electron:build:linux": "npm run build:web-ui && electron-builder --linux",
-    "electron:build:onbuzz:win": "cross-env VITE_BRAND=onbuzz npm run build:web-ui && cross-env LOXIA_BRAND=onbuzz electron-builder --win -c.productName=\"Loxia OnBuzz\" -c.appId=com.loxia.onbuzz -c.executableName=loxia-onbuzz -c.win.icon=electron/icon-onbuzz.png",
-    "electron:build:onbuzz:mac": "cross-env VITE_BRAND=onbuzz npm run build:web-ui && cross-env LOXIA_BRAND=onbuzz electron-builder --mac -c.productName=\"Loxia OnBuzz\" -c.appId=com.loxia.onbuzz -c.executableName=loxia-onbuzz -c.mac.icon=electron/icon-onbuzz.png",
-    "electron:build:onbuzz:linux": "cross-env VITE_BRAND=onbuzz npm run build:web-ui && cross-env LOXIA_BRAND=onbuzz electron-builder --linux -c.productName=\"Loxia OnBuzz\" -c.appId=com.loxia.onbuzz -c.executableName=loxia-onbuzz -c.linux.icon=electron/icon-onbuzz.png"
+    "electron:build:onbuzz:win": "cross-env VITE_BRAND=onbuzz npm run build:web-ui && cross-env LOXIA_BRAND=onbuzz electron-builder --win -c.productName=\"Loxia OnBuzz\" -c.appId=com.loxia.onbuzz -c.executableName=loxia-onbuzz -c.win.icon=electron/icon-onbuzz.png -c.nsis.artifactName=Loxia-OnBuzz-Setup-${version}.${ext}",
+    "electron:build:onbuzz:mac": "cross-env VITE_BRAND=onbuzz npm run build:web-ui && cross-env LOXIA_BRAND=onbuzz electron-builder --mac -c.productName=\"Loxia OnBuzz\" -c.appId=com.loxia.onbuzz -c.executableName=loxia-onbuzz -c.mac.icon=electron/icon-onbuzz.png -c.mac.artifactName=Loxia-OnBuzz-${version}-${arch}.${ext}",
+    "electron:build:onbuzz:linux": "cross-env VITE_BRAND=onbuzz npm run build:web-ui && cross-env LOXIA_BRAND=onbuzz electron-builder --linux -c.productName=\"Loxia OnBuzz\" -c.appId=com.loxia.onbuzz -c.executableName=loxia-onbuzz -c.linux.icon=electron/icon-onbuzz.png -c.linux.artifactName=Loxia-OnBuzz-${version}.${ext}"
   },
   "keywords": [
     "ai",
@@ -158,11 +158,16 @@
     },
     "mac": {
       "target": "dmg",
-      "icon": "electron/icon.png"
+      "icon": "electron/icon.png",
+      "artifactName": "Loxia-Autopilot-${version}-${arch}.${ext}"
     },
     "linux": {
       "target": "AppImage",
-      "icon": "electron/icon.png"
+      "icon": "electron/icon.png",
+      "artifactName": "Loxia-Autopilot-${version}.${ext}"
+    },
+    "nsis": {
+      "artifactName": "Loxia-Autopilot-Setup-${version}.${ext}"
     }
   },
   "pkg": {
@@ -204,4 +209,4 @@
     "glob",
     "rimraf"
   ]
-}
+}

package/scripts/bump-version.js

@@ -5,10 +5,25 @@
  * Bumps version across ALL files that track it, commits, tags, and pushes.
  *
  * Usage:
- *   node scripts/bump-version.js patch    → 3.6.0 → 3.6.1
- *   node scripts/bump-version.js minor    → 3.6.0 → 3.7.0
- *   node scripts/bump-version.js major    → 3.6.0 → 4.0.0
- *   node scripts/bump-version.js 3.8.0    → explicit version
+ *   node scripts/bump-version.js patch      → 3.6.0 → 3.6.1
+ *   node scripts/bump-version.js minor      → 3.6.0 → 3.7.0
+ *   node scripts/bump-version.js major      → 3.6.0 → 4.0.0
+ *   node scripts/bump-version.js 3.8.0      → explicit version
+ *   node scripts/bump-version.js --status   → print the version truth table
+ *                                             (package files, latest git tag,
+ *                                             npm latest) and exit
+ *   node scripts/bump-version.js <v> --dry-run
+ *                                           → run every guard + print the plan,
+ *                                             write/commit/push NOTHING
+ *
+ * Guards (all run BEFORE any file is written):
+ *   - explicit versions must be exact semver (x.y.z or x.y.z-pre)
+ *   - the target git tag must NOT already exist  → hard fail
+ *   - the target version must NOT be on npm      → hard fail
+ *   These exist because a release run that half-succeeds (tag pushed, npm
+ *   publish failed) leaves the ecosystem desynced — package.json said 5.4.7
+ *   while the operator believed 5.4.5, and npm was missing 5.4.5/5.4.6
+ *   entirely. Fail EARLY, before anything is mutated.
  */
 
 import fs from 'fs';
@@ -18,6 +33,7 @@ import { fileURLToPath } from 'url';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT = path.resolve(__dirname, '..');
+const NPM_PKG = '@loxia-labs/loxia-autopilot-one';
 
 // ─── All files that contain a version to sync ──────────────────────────────
 
@@ -46,6 +62,8 @@ function writeVersion(relPath, newVersion) {
 
 // ─── Bump logic ────────────────────────────────────────────────────────────
 
+const EXPLICIT_RE = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/;
+
 function bumpVersion(current, type) {
   const [major, minor, patch] = current.split('.').map(Number);
   switch (type) {
@@ -53,24 +71,131 @@ function bumpVersion(current, type) {
     case 'minor': return `${major}.${minor + 1}.0`;
     case 'patch': return `${major}.${minor}.${patch + 1}`;
     default:
-      // Explicit version string — validate format
-      if (/^\d+\.\d+\.\d+/.test(type)) return type;
+      // Explicit version string — must be EXACT semver, no trailing junk.
+      if (EXPLICIT_RE.test(type)) return type;
       throw new Error(`Invalid bump type: "${type}". Use: patch, minor, major, or explicit version (e.g. 3.7.0)`);
   }
 }
 
+// ─── Ecosystem truth (git tags + npm registry) ─────────────────────────────
+
+function gitTagExists(version) {
+  try {
+    const out = execSync(`git tag -l v${version}`, { cwd: ROOT, stdio: 'pipe' }).toString().trim();
+    return out === `v${version}`;
+  } catch { return false; }
+}
+
+function latestGitTag() {
+  try {
+    return execSync('git tag -l "v*" --sort=-v:refname', { cwd: ROOT, stdio: 'pipe' })
+      .toString().split('\n')[0].trim() || '(none)';
+  } catch { return '(unavailable)'; }
+}
+
+/** @returns {'exists'|'missing'|'unknown'} */
+function npmVersionState(version) {
+  try {
+    const out = execSync(`npm view ${NPM_PKG}@${version} version`, { cwd: ROOT, stdio: 'pipe' })
+      .toString().trim();
+    return out === version ? 'exists' : 'missing';
+  } catch (err) {
+    // npm view exits 1 with E404 when the version isn't published — that's
+    // the GOOD case. Anything else (network down) is genuinely unknown.
+    const msg = String(err?.stderr || err?.message || '');
+    return msg.includes('E404') ? 'missing' : 'unknown';
+  }
+}
+
+function npmLatest() {
+  try {
+    return execSync(`npm view ${NPM_PKG} version`, { cwd: ROOT, stdio: 'pipe' }).toString().trim();
+  } catch { return '(unavailable)'; }
+}
+
+// ─── Status panel ──────────────────────────────────────────────────────────
+
+function printStatus() {
+  const pkgV = readVersion('package.json');
+  let tplV = '(missing)';
+  try { tplV = readVersion('package.autopilot.json'); } catch { /* absent */ }
+  const tag = latestGitTag();
+  const npmV = npmLatest();
+
+  const sync = pkgV === tplV ? 'in sync' : '⚠ OUT OF SYNC';
+  console.log('');
+  console.log('  ── Version truth table ─────────────────────────');
+  console.log(`  package.json           : ${pkgV}`);
+  console.log(`  package.autopilot.json : ${tplV}   (${sync})`);
+  console.log(`  latest git tag         : ${tag}`);
+  console.log(`  npm latest (${NPM_PKG.split('/')[1]}) : ${npmV}`);
+  console.log(`  next patch would be    : ${bumpVersion(pkgV, 'patch')}`);
+  if (npmV !== '(unavailable)' && npmV !== pkgV) {
+    console.log(`  ⚠ package.json (${pkgV}) != npm latest (${npmV}) — pick your target deliberately.`);
+  }
+  console.log('  ────────────────────────────────────────────────');
+  console.log('');
+}
+
 // ─── Main ──────────────────────────────────────────────────────────────────
 
-const arg = process.argv[2];
+const args = process.argv.slice(2);
+const dryRun = args.includes('--dry-run');
+const positional = args.filter((a) => !a.startsWith('--'));
+const arg = positional[0];
+
+if (args.includes('--status')) {
+  printStatus();
+  process.exit(0);
+}
+
 if (!arg) {
-  console.log('Usage: node scripts/bump-version.js <patch|minor|major|x.y.z>');
+  console.log('Usage: node scripts/bump-version.js <patch|minor|major|x.y.z> [--dry-run] | --status');
   process.exit(1);
 }
 
 const currentVersion = readVersion('package.json');
-const newVersion = bumpVersion(currentVersion, arg);
+let newVersion;
+try {
+  newVersion = bumpVersion(currentVersion, arg);
+} catch (err) {
+  console.error(`\n  ❌ ${err.message}\n`);
+  process.exit(1);
+}
 
-console.log(`\n  Version bump: ${currentVersion} → ${newVersion}\n`);
+// ── Guards: fail BEFORE mutating anything ──────────────────────────────────
+
+if (gitTagExists(newVersion)) {
+  console.error(`\n  ❌ Tag v${newVersion} already exists — this version was already cut.`);
+  console.error(`     Pick a different version (check with: node scripts/bump-version.js --status)\n`);
+  process.exit(1);
+}
+
+const npmState = npmVersionState(newVersion);
+if (npmState === 'exists') {
+  console.error(`\n  ❌ ${NPM_PKG}@${newVersion} is already published on npm — npm will reject a republish.`);
+  console.error(`     Pick a different version (check with: node scripts/bump-version.js --status)\n`);
+  process.exit(1);
+}
+if (npmState === 'unknown') {
+  console.log(`  ⚠ Could not verify npm registry (offline?) — continuing, but publish may fail if ${newVersion} exists.`);
+}
+
+console.log(`\n  Version bump: ${currentVersion} → ${newVersion}${dryRun ? '   [DRY RUN — nothing will be written]' : ''}\n`);
+
+if (dryRun) {
+  for (const { file, independent } of VERSION_FILES) {
+    const fullPath = path.join(ROOT, file);
+    if (!fs.existsSync(fullPath)) { console.log(`  ⚠ Would skip (not found): ${file}`); continue; }
+    const target = independent && EXPLICIT_RE.test(arg)
+      ? bumpVersion(readVersion(file), 'patch')
+      : independent ? bumpVersion(readVersion(file), arg) : newVersion;
+    console.log(`  → would set ${file}: ${readVersion(file)} → ${target}`);
+  }
+  console.log(`  → would commit "v${newVersion}", tag v${newVersion}, push origin main --tags`);
+  console.log('\n  ✅ All guards passed (dry run).\n');
+  process.exit(0);
+}
 
 // Update all files
 for (const { file, independent } of VERSION_FILES) {
@@ -82,11 +207,11 @@ for (const { file, independent } of VERSION_FILES) {
 
   let targetVersion = newVersion;
 
-  // web-ui has its own version scheme — bump its patch independently
+  // web-ui has its own version scheme. For patch/minor/major it takes the
+  // same bump TYPE; for an EXPLICIT main version it takes a patch bump —
+  // an explicit "5.4.8" must not stomp web-ui's independent numbering.
   if (independent) {
-    const webVersion = readVersion(file);
-    const webNew = bumpVersion(webVersion, arg.match(/^\d/) ? arg : arg); // same bump type
-    targetVersion = webNew;
+    targetVersion = bumpVersion(readVersion(file), EXPLICIT_RE.test(arg) ? 'patch' : arg);
   }
 
   const old = writeVersion(file, targetVersion);
@@ -103,12 +228,9 @@ console.log(`  ✓ Staged ${filesToStage.length} files`);
 execSync(`git commit -m "v${newVersion}"`, { cwd: ROOT, stdio: 'pipe' });
 console.log(`  ✓ Committed: v${newVersion}`);
 
-try {
-  execSync(`git tag v${newVersion}`, { cwd: ROOT, stdio: 'pipe' });
-  console.log(`  ✓ Tagged: v${newVersion}`);
-} catch {
-  console.log(`  ⚠ Tag v${newVersion} already exists, skipping`);
-}
+// Guard ran pre-flight, so a collision here means a race — surface it loudly.
+execSync(`git tag v${newVersion}`, { cwd: ROOT, stdio: 'pipe' });
+console.log(`  ✓ Tagged: v${newVersion}`);
 
 execSync(`git push origin main --tags`, { cwd: ROOT, stdio: 'pipe' });
 console.log(`  ✓ Pushed to origin/main with tags`);

package/scripts/verify-optional-deps.js

@@ -77,6 +77,18 @@ const SOFT_REQUIRED = [
     breaks: 'Electron in-app auto-update dialog + background download',
     fixHint: 'npm install --save-optional electron-updater@^6.8.3',
   },
+  {
+    name: '@nut-tree-fork/nut-js',
+    // Used by src/tools/desktop/osController.js (lazy dynamic import).
+    // ~30MB native module — MUST stay in optionalDependencies so a failed
+    // native build (Wayland, minimal containers) degrades to the
+    // NATIVE_UNAVAILABLE fallback instead of breaking the whole install.
+    // This entry exists because the dep was MISSING from package.json for
+    // months (field report: agents told users to `npm install` it by
+    // hand) — never let an audit-fix quietly reintroduce that gap.
+    breaks: 'DesktopTool (OS-level mouse/keyboard/screen control) — agents instruct users to install it manually',
+    fixHint: 'npm install --save-optional @nut-tree-fork/nut-js@^4.2.6',
+  },
   {
     name: 'jsdom',
     // Required by widget runtime/acceptance tests (84 tests across
@@ -106,8 +118,15 @@ const SOFT_REQUIRED = [
   },
 ];
 
+// --simulate-missing=<name,name>: treat the named deps as missing even when
+// they resolve. Dry-run tool — lets an operator (or a test) verify the banner
+// and the emitted restore command without actually uninstalling anything.
+const simArg = process.argv.find((a) => a.startsWith('--simulate-missing='));
+const simulated = new Set(simArg ? simArg.split('=')[1].split(',').filter(Boolean) : []);
+
 const missing = [];
 for (const dep of SOFT_REQUIRED) {
+  if (simulated.has(dep.name)) { missing.push(dep); continue; }
   try {
     require.resolve(dep.name, { paths: [repoRoot] });
   } catch {
@@ -120,14 +139,29 @@ if (missing.length === 0) process.exit(0);
 // --emit-install: print a single composite `npm install ...` command to
 // stdout (separate from the stderr banner). release.bat captures stdout
 // for the [r]estore path. Newline-terminated, no extra logging on stdout.
+//
+// Deps are GROUPED by the save flag in their fixHint: restoring an
+// optionalDependency (electron-updater, nut-js) with a flat `--save` would
+// silently relocate it into hard `dependencies` — turning "native build may
+// fail, that's fine" into "native build failure breaks the whole install".
+// Groups are chained with ` && ` (cmd.exe and sh both honor it).
 if (process.argv.includes('--emit-install')) {
-  const args = missing.map((m) => {
+  const groups = { '--save': [], '--save-optional': [], '--save-dev': [] };
+  for (const m of missing) {
     // Pull the version pin out of the fixHint ("npm install pkg@^x.y.z   # …").
     // Falls back to no-pin if the hint doesn't follow the convention.
     const match = m.fixHint.match(/(@?[\w/.-]+@[\^~]?[\w.-]+)/);
-    return match ? match[1] : m.name;
-  }).join(' ');
-  process.stdout.write(`npm install --save ${args}\n`);
+    const spec = match ? match[1] : m.name;
+    const flag = m.fixHint.includes('--save-optional') ? '--save-optional'
+      : m.fixHint.includes('--save-dev') ? '--save-dev'
+      : '--save';
+    groups[flag].push(spec);
+  }
+  const cmd = Object.entries(groups)
+    .filter(([, specs]) => specs.length > 0)
+    .map(([flag, specs]) => `npm install ${flag} ${specs.join(' ')}`)
+    .join(' && ');
+  process.stdout.write(`${cmd}\n`);
   // Banner still went to stderr above.
   process.exit(1);
 }

package/src/core/__tests__/stateManager.atomicWrite.test.js

@@ -87,19 +87,39 @@ describe('saveJSON — atomic write', () => {
     expect(mockUnlink).not.toHaveBeenCalled(); // ultimately succeeded — no cleanup
   });
 
-  test('gives up after exhausting rename retries and cleans the temp', async () => {
+  // THE CRASH FIX. On Windows, rename over a file with an open read handle
+  // fails EPERM — and readers are constant (agent-list scans, UI polling).
+  // When retries exhaust, saveJSON must NOT reject: most persist calls are
+  // fire-and-forget, so the rejection would reach the global
+  // unhandledRejection handler, whose default branch process.exit(1)'s —
+  // that chain crashed the app at launch / during agent load. Instead it
+  // falls back to the pre-atomic DIRECT write (allowed alongside open read
+  // handles) and cleans the temp.
+  test('rename exhaustion under contention falls back to a direct write — NO rejection', async () => {
     const sm = makeSM();
     mockRename.mockRejectedValue(Object.assign(new Error('busy'), { code: 'EBUSY' }));
-    await expect(sm.saveJSON('/mock/userdata/state/r2.json', {})).rejects.toThrow('busy');
-    expect(mockRename).toHaveBeenCalledTimes(5);
+
+    await expect(sm.saveJSON('/mock/userdata/state/r2.json', { ok: 1 })).resolves.toBeUndefined();
+
+    expect(mockRename).toHaveBeenCalledTimes(8); // patient retry first
+    // Final write went DIRECTLY to the live path (the fallback)...
+    const lastWrite = mockWriteFile.mock.calls.at(-1);
+    expect(lastWrite[0]).toBe('/mock/userdata/state/r2.json');
+    expect(JSON.parse(lastWrite[1])).toEqual({ ok: 1 });
+    // ...and the orphaned temp was cleaned up.
     expect(mockUnlink).toHaveBeenCalledTimes(1);
-  });
+  }, 20000); // real backoff timers (~5.5s) run in this test
 
-  test('a non-transient rename error is NOT retried', async () => {
+  test('a non-transient rename error is NOT retried, NOT fallback-written, and still throws', async () => {
     const sm = makeSM();
     mockRename.mockRejectedValue(Object.assign(new Error('nospace'), { code: 'ENOSPC' }));
     await expect(sm.saveJSON('/mock/userdata/state/r3.json', {})).rejects.toThrow('nospace');
     expect(mockRename).toHaveBeenCalledTimes(1);
+    // No direct write to the live path — a real error must stay visible.
+    for (const [p] of mockWriteFile.mock.calls) {
+      expect(p).not.toBe('/mock/userdata/state/r3.json');
+    }
+    expect(mockUnlink).toHaveBeenCalledTimes(1); // temp cleaned
   });
 });
 

package/src/core/stateManager.js

@@ -1278,18 +1278,46 @@ class StateManager {
       await fs.writeFile(tmpPath, contents, 'utf8');
       await this._renameWithRetry(tmpPath, filePath);
     } catch (err) {
-      // Best-effort cleanup of the temp file; never mask the original error.
+      const transient = err && (err.code === 'EPERM' || err.code === 'EACCES' || err.code === 'EBUSY');
+      if (transient) {
+        // SHARING-VIOLATION FALLBACK — this branch is load-bearing. On
+        // Windows, rename over a file that ANY reader holds open fails with
+        // EPERM, and readers are constant here (agent-list scans, snippet
+        // enrichment, UI polling). When retries exhaust under sustained
+        // contention, DO NOT throw: most persist calls are fire-and-forget,
+        // so the rejection reaches process.on('unhandledRejection') — whose
+        // default branch calls process.exit(1). That exact chain crashed the
+        // app "sometimes at launch, sometimes while loading an agent".
+        // Fall back to the pre-atomic direct write instead: Windows allows
+        // in-place writes alongside open read handles, and our per-path
+        // write chain already guarantees no same-file write interleaving.
+        // Trade-off: this one write loses crash-atomicity — strictly no
+        // worse than the original implementation, and only under contention.
+        this.logger?.warn?.(
+          `Atomic rename blocked by open handles — falling back to direct write: ${path.basename(filePath)}`,
+          { filePath, code: err.code }
+        );
+        try {
+          await fs.writeFile(filePath, contents, 'utf8');
+          return;
+        } finally {
+          try { await fs.unlink(tmpPath); } catch { /* already gone */ }
+        }
+      }
+      // Non-transient (ENOSPC, EROFS, …): clean up and surface the real error.
       try { await fs.unlink(tmpPath); } catch { /* already gone */ }
       throw err;
     }
   }
 
   /**
-   * fs.rename with a small retry for the transient Windows sharing-violation
-   * errors that occur when a replace races an open read handle.
+   * fs.rename with retries for the transient Windows sharing-violation
+   * errors that occur when a replace races an open read handle. Backoff is
+   * patient (~9s worst case) because big conversation files (tens of MB)
+   * can legitimately hold read handles for seconds during agent load.
    * @private
    */
-  async _renameWithRetry(from, to, attempts = 5) {
+  async _renameWithRetry(from, to, attempts = 8) {
     for (let i = 0; i < attempts; i++) {
       try {
         await fs.rename(from, to);
@@ -1297,7 +1325,8 @@ class StateManager {
       } catch (err) {
         const transient = err && (err.code === 'EPERM' || err.code === 'EACCES' || err.code === 'EBUSY');
         if (!transient || i === attempts - 1) throw err;
-        await new Promise((r) => setTimeout(r, 15 * (i + 1)));
+        // 40ms, 120ms, 270ms, 520ms, 900ms, 1.4s, 2.2s → ~5.5s cumulative.
+        await new Promise((r) => setTimeout(r, 40 * (i + 1) * (i + 1) * 0.75 + 10));
       }
     }
   }

package/src/index.js

@@ -1012,7 +1012,16 @@ class LoxiaApplication {
         'ECONNRESET',
         'fetch failed',
         'AbortError',
-        'The operation was aborted'
+        'The operation was aborted',
+        // electron-updater failures (packaged app; backend shares the
+        // process). A broken/missing release asset must NEVER kill the app:
+        // v5.4.7's yml was published without its .exe and every installed
+        // 5.4.5 crash-looped ~40s after launch on exactly this rejection.
+        // The updater retries on its 6h cycle; crashing helps nobody.
+        'Cannot download',
+        'ERR_UPDATER',
+        'HttpError: 404',
+        'builder-util-runtime'
       ];
 
       const isNonCritical = nonCriticalPatterns.some(pattern =>