shraga 0.1.35 → 0.1.36

package/defaults/skills/self-aware.md

@@ -86,12 +86,18 @@ List checkpoints with `git -C "$APP_DIR" log --oneline`; reset to any of them.
 When the deployment consumes `shraga` as an npm dependency, you can move your own pinned version.
 **Only when the user asks** — there is no timer on this.
 
+Both routes need auth — use your internal token, as with any other `/api/` call:
+
 ```bash
-curl -s $ORIGIN/api/self-upgrade                                  # current, latest, blockers
-curl -s -XPOST $ORIGIN/api/self-upgrade -d '{"version":"latest"}'  # or a specific "0.1.35"
+AUTH="x-internal-token: $INTERNAL_API_TOKEN"
+curl -s -H "$AUTH" http://localhost:$PORT/api/self-upgrade      # current, latest, blockers
+curl -s -H "$AUTH" -H 'content-type: application/json' \
+  -XPOST http://localhost:$PORT/api/self-upgrade -d '{"version":"latest"}'   # or "0.1.35"
 ```
 
-- **Owner only.** Both routes 403 for anyone else.
+- **Owner only.** Your internal token carries the identity of whoever you are acting for, so a 403
+  means *that person* is not an owner — not a bug. A scheduled run is `agent-internal` and is
+  therefore refused by design: this cannot fire unattended.
 - **Check `blockers` first and relay them.** A source checkout (upgrade with git instead) and a
   local dev symlink at `node_modules/shraga` are both refused on purpose — do not work around either.
 - **202 means started, not succeeded.** The upgrade restarts the server, so the POST cannot report

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shraga",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "description": "The teammate you delegate coding to — a self-hostable, multi-user AI coding agent web UI (Claude Code, with a pluggable engine seam).",
   "type": "module",
   "main": "./src/index.ts",

package/src/server/self-upgrade/index.ts

@@ -10,7 +10,7 @@
 // entry point. Deployments that want it scheduled can point a schedule at that route, which keeps
 // the "should I upgrade tonight?" policy out of the mechanism.
 import { existsSync, lstatSync, readFileSync, writeFileSync, unlinkSync, mkdirSync } from 'node:fs';
-import { spawn } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
 import path from 'node:path';
 import { APP_ROOT, PACKAGE_ROOT, dataPath } from '../paths.ts';
 import { emitEvent } from '../events/bus.ts';
@@ -79,6 +79,18 @@ export class SelfUpgrade {
       reasons.push('no restart command configured (RESTART_CMD / SHRAGA_RESTART_CMD) — an installed version could never be started');
     }
 
+    // The supervisor is detached with stdio ignored, so a missing script fails INVISIBLY: nothing
+    // happens, no report is ever written, and the in-flight marker sits there until it ages out.
+    if (!existsSync(this.o.supervisorScript)) {
+      reasons.push(`upgrade supervisor missing at ${this.o.supervisorScript}`);
+    }
+
+    // The supervisor needs python3 to edit package.json. Better to say so now than to find out
+    // mid-upgrade, with the pin already rewritten.
+    if (!this.o.hasPython3()) {
+      reasons.push('python3 not found on PATH — the upgrade supervisor needs it to edit package.json');
+    }
+
     const active = this.inFlight();
     if (active) reasons.push(`an upgrade to ${active.target} is already in flight (started ${active.startedAt})`);
 
@@ -111,27 +123,34 @@ export class SelfUpgrade {
     mkdirSync(path.dirname(this.o.reportFile), { recursive: true });
     writeFileSync(this.o.lockFile, JSON.stringify({ target, startedAt: new Date().toISOString(), at: Date.now() }));
 
-    // detached + ignored stdio: the supervisor must outlive us, and it will — we are its first
-    // casualty. It logs to a file of its own (see supervisor.sh).
-    const child = spawn('bash', [this.o.supervisorScript], {
-      cwd: this.o.appRoot,
-      detached: true,
-      stdio: 'ignore',
-      env: {
-        ...process.env,
-        APP_ROOT: this.o.appRoot,
-        PKG: this.o.pkg,
-        TARGET: target,
-        FROM: from ?? '',
-        RESTART_CMD: this.o.restartCmd,
-        HEALTH_URL: this.o.healthUrl,
-        REPORT: this.o.reportFile,
-        BUN: this.o.bun,
-        BOOT_TIMEOUT: String(this.o.bootTimeoutSec),
-        SOAK: String(this.o.soakSec),
-      },
-    });
-    child.unref();
+    let child;
+    try {
+      // detached + ignored stdio: the supervisor must outlive us, and it will — we are its first
+      // casualty. It logs to a file of its own (see supervisor.sh).
+      child = spawn('bash', [this.o.supervisorScript], {
+        cwd: this.o.appRoot,
+        detached: true,
+        stdio: 'ignore',
+        env: {
+          ...process.env,
+          APP_ROOT: this.o.appRoot,
+          PKG: this.o.pkg,
+          TARGET: target,
+          FROM: from ?? '',
+          RESTART_CMD: this.o.restartCmd,
+          HEALTH_URL: this.o.healthUrl,
+          REPORT: this.o.reportFile,
+          BUN: this.o.bun,
+          BOOT_TIMEOUT: String(this.o.bootTimeoutSec),
+          SOAK: String(this.o.soakSec),
+        },
+      });
+      child.unref();
+    } catch (err) {
+      // Nothing was started, so the marker would otherwise block every retry until it ages out.
+      try { unlinkSync(this.o.lockFile); } catch { /* best effort */ }
+      return { started: false, from, target, reason: `could not start the upgrade supervisor: ${(err as Error).message}` };
+    }
 
     console.log(`${TAG} handed off ${this.o.pkg} ${from} -> ${target} to supervisor pid ${child.pid}`);
     return { started: true, from, target, reason: `upgrading to ${target}; the result will be reported when the server comes back` };
@@ -178,6 +197,11 @@ export class SelfUpgradeOptions {
   public soakSec: number = 60;
   /** After this, an in-flight marker is treated as abandoned (supervisor killed by a reboot). */
   public maxRunMs: number = 30 * 60 * 1000;
+  /** Injectable so the preflight is testable without depending on the test host's PATH. */
+  public hasPython3: () => boolean = () => {
+    try { return spawnSync('python3', ['--version'], { stdio: 'ignore' }).status === 0; }
+    catch { return false; }
+  };
 }
 
 export interface UpgradePlan {

package/src/server/self-upgrade/supervisor.sh

@@ -32,6 +32,15 @@ BACKUP="$(mktemp -d)"
 LOG="${REPORT%.json}.log"
 exec >>"$LOG" 2>&1
 
+# python3 edits package.json and escapes the report. Check it BEFORE anything is touched: discovering
+# it missing halfway through means a rewritten pin we can no longer safely put back. SelfUpgrade
+# .blockers() checks this too, so a deployment normally learns about it at request time, not here.
+if ! command -v python3 >/dev/null 2>&1; then
+  printf '{"status":"failed","detail":"python3 not found on PATH — nothing was changed","from":"%s","target":"%s","installed":"%s","package":"%s","log":"%s","finishedAt":"%s"}\n' \
+    "$FROM" "$TARGET" "$FROM" "$PKG" "$LOG" "$(date -u '+%FT%TZ')" > "$REPORT"
+  exit 1
+fi
+
 ts() { date '+%F %T'; }
 say() { echo "[upgrade] $(ts) $*"; }
 
@@ -67,15 +76,25 @@ restore() {
   return 0
 }
 
-pin() { # version — rewrite only this dep's pin, leaving the rest of package.json byte-identical
-  PKG="$PKG" V="$1" python3 - <<'PY'
-import json, os, re
-pkg, ver = os.environ['PKG'], os.environ['V']
+# Rewrite ONLY this dep's pin, leaving the rest of package.json byte-identical (a JSON round-trip
+# would reformat a file the deployment owns). Text editing a structured file is only safe if it is
+# unambiguous, so this refuses unless exactly ONE "<pkg>": "<version>" pair exists AND its current
+# value is the one we expect — a package.json that also names the package under overrides/
+# resolutions/peerDependencies must not be edited by guesswork.
+pin() { # new-version expected-current-version
+  PKG="$PKG" NEW="$1" EXPECT="$2" python3 - <<'PY'
+import os, re, sys
+pkg, new, expect = os.environ['PKG'], os.environ['NEW'], os.environ['EXPECT']
 src = open('package.json').read()
-pat = re.compile(r'("%s"\s*:\s*")[^"]*(")' % re.escape(pkg))
-if not pat.search(src):
-    raise SystemExit(f'{pkg} not found in package.json')
-open('package.json', 'w').write(pat.sub(lambda m: m.group(1) + ver + m.group(2), src, count=1))
+pat = re.compile(r'("%s"\s*:\s*")([^"]*)(")' % re.escape(pkg))
+hits = list(pat.finditer(src))
+if len(hits) != 1:
+    sys.exit(f'expected exactly one "{pkg}" version entry in package.json, found {len(hits)}')
+current = hits[0].group(2).lstrip('^~')
+if expect and current != expect:
+    sys.exit(f'package.json has {pkg}@{hits[0].group(2)}, expected {expect} — refusing to edit')
+m = hits[0]
+open('package.json', 'w').write(src[:m.start()] + m.group(1) + new + m.group(3) + src[m.end():])
 PY
 }
 
@@ -108,9 +127,9 @@ soak() { # version seconds
   return 0
 }
 
-install_and_restart() { # version label
-  say "installing $PKG@$1 ($2)"
-  if ! pin "$1"; then say "pin failed"; return 1; fi
+install_and_restart() { # version expected-current label
+  say "installing $PKG@$1 ($3)"
+  if ! pin "$1" "$2"; then say "pin failed"; return 1; fi
   if ! "$BUN" install; then say "bun install failed"; return 1; fi
   say "restarting via: $RESTART_CMD"
   eval "$RESTART_CMD" || say "restart command returned non-zero (continuing — some managers do)"
@@ -124,7 +143,7 @@ if ! snapshot; then
   exit 1
 fi
 
-if ! install_and_restart "$TARGET" upgrade; then
+if ! install_and_restart "$TARGET" "$FROM" upgrade; then
   restore && "$BUN" install >/dev/null 2>&1
   write_report failed "install of $PKG@$TARGET failed; package.json restored, service untouched" "$FROM"
   exit 1
@@ -142,7 +161,7 @@ if ! restore; then
   write_report revert-failed "upgrade to $TARGET failed AND the backup could not be restored — MANUAL FIX NEEDED. Backup: $BACKUP" unknown
   exit 1
 fi
-if ! install_and_restart "$FROM" revert; then
+if ! install_and_restart "$FROM" "" revert; then
   write_report revert-failed "upgrade to $TARGET failed and reinstalling $FROM ALSO failed — MANUAL FIX NEEDED. Backup: $BACKUP" unknown
   exit 1
 fi