shadok-ai 0.17.12 → 0.17.14

package/README.md

@@ -859,6 +859,7 @@ machine, which silently shifts every daily prompt on a server running in UTC.
 | `SHADOK_PILOT_PROMPT=0` | don't inject the cockpit system prompt |
 | `SHADOK_GREETING=0` | the lead agent starts silent — no first-message greeting |
 | `SHADOK_LEDGER=0` | turn OFF the shared-ledger reflex — a per-instance state table siblings read/write so they stop re-surfacing resolved work, plus a `⟦ledger⟧` delta pushed ahead of each message (**ON by default**; `SHADOK_LEDGER=0` or the GUI/config setting turns it off) |
+| `SHADOK_SEED_SKILLS=0` | don't rewrite the machine-wide skill scripts at boot — for a build run side by side with another instance, so it doesn't hand that instance's agents scripts newer than the server they call |
 | `SHADOK_RESUME_SUMMARY=1` | don't auto-answer the resume-from-summary prompt |
 | `SHADOK_SSH_IDENTITY=0` · `SHADOK_FORCE_SSH_IDENTITY=1` | disable / force the Docker SSH identity |
 | `TELEGRAM_BOT_TOKEN` · `TELEGRAM_ALLOWED_CHATS` | override the stored config |

package/context/ledger-skill/ledger.mjs

@@ -14,6 +14,14 @@
 // with no port/key), it reads and writes the local file directly —
 // SHADOK_LEDGER_FILE if the server handed one, else the legacy global file.
 // Nothing about the single-group / off-server case changes.
+//
+// The SAME fallback catches a server that is reachable but OLDER than this
+// script: skills are seeded machine-wide at every boot, so any build booted on
+// the host (a side-by-side verification run) rewrites them under the running
+// server, and a route this file calls may simply not exist there. A 404 is that
+// fact, and it must degrade to the local table instead of failing the write —
+// see invariant 57. Only a 404: a 401/403 is a real auth problem with a human
+// action behind it (invariant 33) and stays loud.
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -61,8 +69,10 @@ function mintId(rows) {
 }
 
 /** Call the server. Exits with a clear message on a transport/HTTP failure —
- *  the same shape as the secrets skill. */
-async function api(method, p, body) {
+ *  the same shape as the secrets skill. With `soft404`, a 404 returns null
+ *  instead of exiting: the caller then has a local-file path to degrade to, and
+ *  a 404 means THIS ROUTE does not exist on the running build (invariant 57). */
+async function api(method, p, body, { soft404 = false } = {}) {
   let res;
   try {
     res = await fetch(BASE + p, {
@@ -82,6 +92,14 @@ async function api(method, p, body) {
     process.exit(1);
   }
   const raw = await res.text();
+  if (res.status === 404 && soft404) {
+    console.error(
+      `ledger: the running cockpit does not serve ${method} ${p} (it predates this skill copy) — ` +
+        `using the local table ${FILE}. Skills are re-seeded at every boot, so a newer build ` +
+        `booted on this host can leave them ahead of the running server.`,
+    );
+    return null;
+  }
   if (!res.ok) {
     let msg = raw.slice(0, 300);
     try {
@@ -131,7 +149,10 @@ function fmt(e, now) {
 /** The rows a read works over: on-server, the server-scoped table (own group ∪
  *  public); off-server, the local file. */
 async function visibleRows() {
-  if (useServer) return (await api("GET", "/ledger")).entries ?? [];
+  if (useServer) {
+    const r = await api("GET", "/ledger", undefined, { soft404: true });
+    if (r) return r.entries ?? [];
+  }
   return loadFile(FILE);
 }
 
@@ -199,13 +220,9 @@ async function doRecord(rest) {
     public: f.public === true ? true : undefined,
   };
 
-  let row;
-  if (useServer) {
-    // The server stamps the authoring group (from the session) and scopes the
-    // upsert to it, so a cross-group clobber is impossible by construction.
-    row = (await api("POST", "/ledger/record", patch)).row;
-  } else {
-    // Off-server fallback: write the local file directly (mono-tenant / hand-run).
+  // Off-server (or older-server) fallback: write the local file directly
+  // (mono-tenant / hand-run / a build that does not serve the route).
+  const recordLocally = () => {
     const rows0 = loadFile(FILE);
     let next;
     try {
@@ -219,8 +236,29 @@ async function doRecord(rest) {
       console.error(String(e?.message ?? e));
       process.exit(2);
     }
-    saveFile(FILE, next);
-    row = byId ? resolveId(next, f.id) : next.find((r) => normEntity(r.entity) === normEntity(f.entity));
+    try {
+      saveFile(FILE, next);
+    } catch (e) {
+      // Worth naming rather than a stack: on a multi-tenant instance the table
+      // is 0600 in the SERVER's home, so a dropped agent cannot write it — the
+      // row is lost and a human has to update/restart the instance.
+      console.error(
+        `ledger: could not write ${FILE} — ${e?.message ?? e}. The record was NOT saved; ` +
+          `tell the operator (the cockpit is older than this skill copy, see invariant 57).`,
+      );
+      process.exit(1);
+    }
+    return byId ? resolveId(next, f.id) : next.find((r) => normEntity(r.entity) === normEntity(f.entity));
+  };
+
+  let row;
+  if (useServer) {
+    // The server stamps the authoring group (from the session) and scopes the
+    // upsert to it, so a cross-group clobber is impossible by construction.
+    const r = await api("POST", "/ledger/record", patch, { soft404: true });
+    row = r ? r.row : recordLocally();
+  } else {
+    row = recordLocally();
   }
 
   const k = rowKind(row);

package/dist/server.js

@@ -1728,6 +1728,27 @@ function mtTokenGate(req, res) {
     }
     return true;
 }
+/**
+ * The READ counterpart of `mtTokenGate`: multi-tenant + admin, but WITHOUT the
+ * `requestFromBrowser` (Origin) check. A browser omits `Origin` on a same-origin
+ * GET, so gating a READ on it 403s the cockpit's own status fetch — which is
+ * exactly what hid the per-user sign-in list (the GET returned 403, so it never
+ * rendered, while the POST writes that DO send Origin worked). The Origin check
+ * is CSRF protection for WRITES (invariant 26); a read of login status (labels +
+ * loggedIn booleans, never a token) has no such surface, so it must not require
+ * one.
+ */
+function mtReadGate(req, res) {
+    if (DEPLOYMENT_MODE !== "multi-tenant") {
+        res.status(400).json({ error: "not applicable: this instance is single-tenant" });
+        return false;
+    }
+    if (currentAccount(req)?.role !== "admin") {
+        res.status(403).json({ error: "admins only" });
+        return false;
+    }
+    return true;
+}
 app.post("/mt-token/start", async (req, res) => {
     if (!mtTokenGate(req, res))
         return;
@@ -1780,7 +1801,10 @@ function loginUsers() {
     return out;
 }
 app.get("/agent-login", (req, res) => {
-    if (!mtTokenGate(req, res))
+    // A READ: use the origin-less gate. A browser sends no `Origin` on a
+    // same-origin GET, so `mtTokenGate` (which requires one) would 403 the
+    // cockpit's own status fetch and the per-user sign-in list would never render.
+    if (!mtReadGate(req, res))
         return;
     const mode = agentAuthForCwd(loadConfig(), process.cwd());
     const users = loginUsers().map(({ user, home, label }) => {
@@ -7350,6 +7374,25 @@ try {
 catch {
     /* best effort — the CTA still starts an agent, just without the role */
 }
+/**
+ * Do we rewrite the machine-wide skill scripts at this boot?
+ *
+ * The skills below are seeded OUTSIDE the running tree — the server user's
+ * `~/.claude/skills`, plus `/etc/claude-code/.claude/skills` in multi-tenant —
+ * and they are rewritten at EVERY boot. That is what makes a merged SKILL.md
+ * reach existing agents with no reload, and it is also a trap: a build started
+ * side by side to verify a change (the sanctioned way, see CLAUDE.md "Running
+ * YOUR build") rewrites the shared skills UNDER the running production server,
+ * leaving every agent on the host with scripts newer than the server they call.
+ * Measured: the ledger skill began posting a route the running build did not
+ * serve, so `record` answered 404 host-wide while `check` kept working — a
+ * half-broken tool, which is worse than a broken one (invariant 57).
+ *
+ * `SHADOK_SEED_SKILLS=0` is the fourth property of a safe side-by-side run,
+ * next to `PORT`, `SHADOK_VERSION_CHECK_MIN=0` and the per-dir Telegram token.
+ * Default ON: an ordinary boot must keep refreshing them.
+ */
+const SEED_SKILLS = (process.env.SHADOK_SEED_SKILLS ?? "").trim() !== "0";
 // Install/refresh the bundled "shadok-scheduler" skill so agents can set up
 // their own channel's crons in plain language. Server-owned, overwritten each
 // boot to stay current.
@@ -7374,7 +7417,8 @@ function seedSchedulerSkill() {
         /* best effort — scheduling still works via the GUI/Telegram/API */
     }
 }
-seedSchedulerSkill();
+if (SEED_SKILLS)
+    seedSchedulerSkill();
 // Install/refresh the bundled "shadok-secrets" skill, so an agent that obtains
 // a credential can keep it for the next one. Server-owned, overwritten each
 // boot to stay current — same contract as the scheduler skill above.
@@ -7396,7 +7440,8 @@ function seedSecretsSkill() {
         /* best effort — the vault still works from the GUI and Telegram */
     }
 }
-seedSecretsSkill();
+if (SEED_SKILLS)
+    seedSecretsSkill();
 // Install/refresh the bundled "shadok-reload" skill so an agent can respawn
 // itself to pick up a changed pilot prompt or newly-seeded skills. Server-owned,
 // overwritten each boot — same contract as the skills above.
@@ -7416,7 +7461,8 @@ function seedReloadSkill() {
         /* best effort — no self-reload skill just means a manual restart, never a crash */
     }
 }
-seedReloadSkill();
+if (SEED_SKILLS)
+    seedReloadSkill();
 // Install/refresh the bundled "shadok-ledger" skill so agents can verify a
 // status before asserting/acting, and record resolutions. Server-owned,
 // overwritten each boot — same contract as the skills above. Seeded regardless
@@ -7438,7 +7484,8 @@ function seedLedgerSkill() {
         /* best effort — an absent skill just means no ledger, never a crash */
     }
 }
-seedLedgerSkill();
+if (SEED_SKILLS)
+    seedLedgerSkill();
 /**
  * The `shadok-files` skill — handing a file to the person driving the cockpit.
  *
@@ -7462,7 +7509,8 @@ function seedFilesSkill() {
         /* best effort — a missing skill means paths get printed, not a broken boot */
     }
 }
-seedFilesSkill();
+if (SEED_SKILLS)
+    seedFilesSkill();
 // Install/refresh the bundled "shadok-ai-agents" skill so an agent in ANY repo
 // (not just this one) can spawn/pilot other agents via pilotctl. It used to live
 // only in the repo's .claude/skills — a project skill invisible to agents working
@@ -7484,13 +7532,18 @@ function seedAgentsSkill() {
         /* best effort — no agents skill just means no cross-agent piloting, never a crash */
     }
 }
-seedAgentsSkill();
+if (SEED_SKILLS)
+    seedAgentsSkill();
 // Multi-tenant: also install every skill machine-wide (Enterprise tier), so the
 // per-tenant `sk-*` agents — which run under their own HOME, not the server's —
 // get them without a per-HOME copy. Mono-tenant/dev keeps the personal install
 // above and never touches /etc.
-if (DEPLOYMENT_MODE === "multi-tenant")
+if (DEPLOYMENT_MODE === "multi-tenant" && SEED_SKILLS)
     seedSystemSkills();
+// Say it: a boot that did NOT refresh the shared skills must be visible, or a
+// side-by-side run and a broken seed look the same in the log.
+if (!SEED_SKILLS)
+    console.log("skills: SHADOK_SEED_SKILLS=0 — left the machine-wide skills alone");
 /** Run a package-manager install. Linux managers need root; if we aren't root,
  *  go through NON-interactive sudo so a password prompt fails fast rather than
  *  hanging the boot. brew (needsRoot:false) must never be sudo'd. */