shadok-ai 0.17.16 → 0.17.18

package/dist/privileged.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Running privileged account/filesystem commands for the multi-tenant migration
+ * and group provisioning (useradd, chown, cp over the data tree). Extracted from
+ * server.ts so the timeout behaviour — the one that broke a real migration — is
+ * unit-testable with harmless commands.
+ *
+ * The bug: every privileged command shared ONE fixed 60s timeout. That is ample
+ * for an account command (useradd/groupadd), but the migration's CORE step is a
+ * recursive `chown -R <commons> <tree>` over the WHOLE instance (workspace +
+ * every agent's worktree, `~/.claude/projects`, `~/.shadok-ai`). On a busy
+ * instance (measured: 28 running agents) that tree is hundreds of thousands of
+ * files and the chown ran past 60s, so the spawn timeout SIGTERM'd it. A killed
+ * child exits with a NULL code (`code: null, signal: 'SIGTERM'`), surfacing as
+ * `chown exited with code null` — and because the chown is a core step, the
+ * migration marker was withheld and the red "isolation did NOT complete" banner
+ * stuck. It never self-heals: the tree only grows, so every boot retry dies the
+ * same way. The fix gives the unbounded recursive operations a generous timeout
+ * (`TREE_OP_TIMEOUT_MS`) while the short account commands keep the 60s default.
+ * Safe because the migration is fire-and-forget off the boot path, so a slow run
+ * can never hang boot.
+ */
+/** The short account commands (useradd, groupadd, usermod, install, ln…). */
+export declare const DEFAULT_PRIVILEGED_TIMEOUT_MS = 60000;
+/** Recursive operations over the whole data tree (`chown -R`, `cp -r`): bounded
+ *  only by the instance's size, so they need minutes, not seconds. Generous on
+ *  purpose — the migration is fire-and-forget, so an over-long ceiling costs a
+ *  slow migration at worst, never a hung boot. */
+export declare const TREE_OP_TIMEOUT_MS: number;
+/** Decide what actually gets spawned: root runs the command directly; a non-root
+ *  server goes through NON-interactive sudo (`-n`) so a MISSING right fails fast
+ *  with a non-zero exit instead of prompting. Pure, so the sudo decision is
+ *  testable without being root. */
+export declare function privilegedInvocation(cmd: string, argv: string[], isRoot: boolean): {
+    cmd: string;
+    argv: string[];
+};
+/** Spawn `spawn.cmd spawn.argv` with a timeout, rejecting with `<label> exited
+ *  with code <code>` on a non-zero/null exit. `label` is the ORIGINAL command
+ *  name (not `sudo`), so the message names the real failing step; a timeout kill
+ *  gives `code: null` → "<label> exited with code null". */
+export declare function runWithTimeout(spawn: {
+    cmd: string;
+    argv: string[];
+}, label: string, timeoutMs: number): Promise<void>;
+/** Run a privileged account/filesystem command. Pass `{ timeoutMs:
+ *  TREE_OP_TIMEOUT_MS }` for an unbounded recursive operation; otherwise the 60s
+ *  default applies. */
+export declare function runPrivileged(cmd: string, argv: string[], opts?: {
+    timeoutMs?: number;
+}): Promise<void>;

package/dist/privileged.js

@@ -0,0 +1,55 @@
+import { spawn as spawnChild } from "node:child_process";
+/**
+ * Running privileged account/filesystem commands for the multi-tenant migration
+ * and group provisioning (useradd, chown, cp over the data tree). Extracted from
+ * server.ts so the timeout behaviour — the one that broke a real migration — is
+ * unit-testable with harmless commands.
+ *
+ * The bug: every privileged command shared ONE fixed 60s timeout. That is ample
+ * for an account command (useradd/groupadd), but the migration's CORE step is a
+ * recursive `chown -R <commons> <tree>` over the WHOLE instance (workspace +
+ * every agent's worktree, `~/.claude/projects`, `~/.shadok-ai`). On a busy
+ * instance (measured: 28 running agents) that tree is hundreds of thousands of
+ * files and the chown ran past 60s, so the spawn timeout SIGTERM'd it. A killed
+ * child exits with a NULL code (`code: null, signal: 'SIGTERM'`), surfacing as
+ * `chown exited with code null` — and because the chown is a core step, the
+ * migration marker was withheld and the red "isolation did NOT complete" banner
+ * stuck. It never self-heals: the tree only grows, so every boot retry dies the
+ * same way. The fix gives the unbounded recursive operations a generous timeout
+ * (`TREE_OP_TIMEOUT_MS`) while the short account commands keep the 60s default.
+ * Safe because the migration is fire-and-forget off the boot path, so a slow run
+ * can never hang boot.
+ */
+/** The short account commands (useradd, groupadd, usermod, install, ln…). */
+export const DEFAULT_PRIVILEGED_TIMEOUT_MS = 60_000;
+/** Recursive operations over the whole data tree (`chown -R`, `cp -r`): bounded
+ *  only by the instance's size, so they need minutes, not seconds. Generous on
+ *  purpose — the migration is fire-and-forget, so an over-long ceiling costs a
+ *  slow migration at worst, never a hung boot. */
+export const TREE_OP_TIMEOUT_MS = 20 * 60_000;
+/** Decide what actually gets spawned: root runs the command directly; a non-root
+ *  server goes through NON-interactive sudo (`-n`) so a MISSING right fails fast
+ *  with a non-zero exit instead of prompting. Pure, so the sudo decision is
+ *  testable without being root. */
+export function privilegedInvocation(cmd, argv, isRoot) {
+    return isRoot ? { cmd, argv } : { cmd: "sudo", argv: ["-n", cmd, ...argv] };
+}
+/** Spawn `spawn.cmd spawn.argv` with a timeout, rejecting with `<label> exited
+ *  with code <code>` on a non-zero/null exit. `label` is the ORIGINAL command
+ *  name (not `sudo`), so the message names the real failing step; a timeout kill
+ *  gives `code: null` → "<label> exited with code null". */
+export function runWithTimeout(spawn, label, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const p = spawnChild(spawn.cmd, spawn.argv, { stdio: ["ignore", "inherit", "inherit"], timeout: timeoutMs });
+        p.on("error", reject);
+        p.on("exit", (code) => (code === 0 ? resolve() : reject(new Error(`${label} exited with code ${code}`))));
+    });
+}
+/** Run a privileged account/filesystem command. Pass `{ timeoutMs:
+ *  TREE_OP_TIMEOUT_MS }` for an unbounded recursive operation; otherwise the 60s
+ *  default applies. */
+export function runPrivileged(cmd, argv, opts) {
+    const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
+    return runWithTimeout(privilegedInvocation(cmd, argv, isRoot), cmd, opts?.timeoutMs ?? DEFAULT_PRIVILEGED_TIMEOUT_MS);
+}
+//# sourceMappingURL=privileged.js.map

package/dist/privileged.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privileged.js","sourceRoot":"","sources":["../src/privileged.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAEpD;;;kDAGkD;AAClD,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AAE9C;;;mCAGmC;AACnC,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,IAAc,EACd,MAAe;IAEf,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;4DAG4D;AAC5D,MAAM,UAAU,cAAc,CAC5B,KAAsC,EACtC,KAAa,EACb,SAAiB;IAEjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7G,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtB,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,qBAAqB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5G,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;uBAEuB;AACvB,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,IAAc,EAAE,IAA6B;IACtF,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9E,OAAO,cAAc,CAAC,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,IAAI,6BAA6B,CAAC,CAAC;AACxH,CAAC"}

package/dist/server.js

@@ -48,6 +48,7 @@ import { cancelPairingCode, issuePairingCode, pairingStatus } from "./tg-pairing
 import { migrateTgBindings } from "./channels.js";
 import { viewerFor, canResumeAs, canRestartInto, canSeeGroup, membershipVerdict, canSeeSession, listableGroups, visibleChannels, secretOwnGroupIds, ledgerGroupsFor, groupsPutFlow, privateGroupFor, newPrivateGroup, accountDeleteGroups, MAIN_GROUP_ID, } from "./groups.js";
 import { resolveSpawnIsolation, osUserFor, homeForUser, runAsUser, provisionGroupUser, teardownGroupUser, reconcileGroupProvisioning, DEFAULT_HOME_BASE, createGroupFlow, deleteGroupFlow, SHARED_POT_GROUP, DEFAULT_SHARED_POT_PATH, } from "./osusers.js";
+import { runPrivileged, TREE_OP_TIMEOUT_MS } from "./privileged.js";
 import { instanceKey } from "./paths.js";
 import { peerFileFor, loadPeers, savePeers, peerFromToken, signPeerToken, newPeer, withSalts, redeemVerdict, redeemPeer, normPeerName, removePeer, ownedByPeer, peersOutFileFor, agentInvitePrompt, peerScope, } from "./peers.js";
 import { loadCrons, saveCrons, upsertCron, removeCron, resolveCronId, nextRunFor, nextRunAfterFailure, isTransient, CRON_MAX_RETRIES, markCronPrompt, normalizeSchedule, onceAt, stateAfterFire, scheduleLabel, cronTimeZone, defaultTimeZone, systemTimeZone, isValidTimeZone, } from "./crons.js";
@@ -2316,23 +2317,6 @@ if (DEPLOYMENT_MODE === "multi-tenant") {
             (e instanceof Error ? e.message : String(e)));
     }
 }
-/** Run a privileged account command. Root runs it directly; otherwise go through
- *  NON-interactive sudo (`-n`) so a MISSING right fails fast with a non-zero exit
- *  instead of prompting — the T3 false positive (sudoers allows `true` but not
- *  `useradd`) surfaces here and `provisionGroupUser` turns it into a refusal. */
-function runPrivileged(cmd, argv) {
-    return new Promise((resolve, reject) => {
-        let c = cmd;
-        let a = argv;
-        if (typeof process.getuid === "function" && process.getuid() !== 0) {
-            a = ["-n", c, ...a];
-            c = "sudo";
-        }
-        const p = spawnChild(c, a, { stdio: ["ignore", "inherit", "inherit"], timeout: 60_000 });
-        p.on("error", reject);
-        p.on("exit", (code) => (code === 0 ? resolve() : reject(new Error(`${cmd} exited with code ${code}`))));
-    });
-}
 /**
  * Make a freshly-created worktree (or self-repo clone) usable by the DROP USER.
  * The server creates it as ROOT, so the checkout AND git's own worktree admin
@@ -2617,7 +2601,11 @@ async function migChownTreeToCommons() {
     for (const t of targets) {
         if (!t || !fs.existsSync(t))
             continue;
-        await runPrivileged("chown", ["-R", owner, t]);
+        // Unbounded: the whole workspace (every agent's worktree + node_modules),
+        // `~/.shadok-ai` and `~/.claude`. On a busy instance this is the step that
+        // ran past the old fixed 60s and was SIGTERM'd (`chown exited with code
+        // null`), withholding the migration marker — see `src/privileged.ts`.
+        await runPrivileged("chown", ["-R", owner, t], { timeoutMs: TREE_OP_TIMEOUT_MS });
     }
     // RELOCATE the commons agent's Claude state into its OWN HOME. Chowning
     // ~/.claude alone is useless: the files stay under `/root` (0700), which `main`
@@ -2638,8 +2626,9 @@ async function migChownTreeToCommons() {
                 continue;
             const d = path.join(dstClaude, sub);
             await runPrivileged("install", ["-d", "-o", COMMONS_USER, "-g", COMMONS_USER, d]);
-            await runPrivileged("cp", ["-rn", `${s}/.`, `${d}/`]);
-            await runPrivileged("chown", ["-R", owner, d]);
+            // `projects` holds every agent's full transcript history — also unbounded.
+            await runPrivileged("cp", ["-rn", `${s}/.`, `${d}/`], { timeoutMs: TREE_OP_TIMEOUT_MS });
+            await runPrivileged("chown", ["-R", owner, d], { timeoutMs: TREE_OP_TIMEOUT_MS });
         }
         const hist = path.join(srcClaude, "history.jsonl");
         const dhist = path.join(dstClaude, "history.jsonl");