shraga 0.1.40 → 0.1.42

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shraga",
-  "version": "0.1.40",
+  "version": "0.1.42",
   "description": "The teammate you delegate coding to — a self-hostable, multi-user AI coding agent web UI (Claude Code, with a pluggable engine seam).",
   "type": "module",
   "main": "./src/index.ts",

package/src/server/scheduler/engine.ts

@@ -78,6 +78,18 @@ export function start(broadcast: Broadcast): void {
       s.lastRun.error = 'interrupted by server restart';
     }
     if (!s.enabled) { s.nextRun = undefined; continue; }
+    // A one-off that already ran must never be armed again. It is normally DELETED on success,
+    // but schedules.json is a whole-file JSON array shared by this process and by humans over
+    // git — a conflicting rebase, or data-sync's union-merge conflict resolver, can bring the
+    // deleted entry back. If its `at` is still in the future the past-due guard below cannot
+    // see it, and a completed campaign send would go out twice. Refuse it here instead.
+    const ranBefore = oneShotAlreadyRan(s);
+    if (ranBefore) {
+      console.warn(`[scheduler] ⚠️ refusing to re-arm completed one-off ${s.id} ("${s.name}") — ${ranBefore}. Disabled; delete it or create a new schedule.`);
+      s.enabled = false;
+      s.nextRun = undefined;
+      continue;
+    }
     const next = computeNextRun(s.trigger);
     if (next === null) {
       if (s.trigger.kind === 'once') s.enabled = false;
@@ -164,6 +176,10 @@ export function getSchedule(id: string): Schedule | undefined {
 export function upsertSchedule(s: Schedule): { ok: true; schedule: Schedule } | { ok: false; error: string } {
   const err = validateTrigger(s.trigger);
   if (err) return { ok: false, error: err };
+  // Same guard as boot: re-adding a spent one-off under its old id is a resurrection, not an
+  // edit. A genuinely new job gets a new id.
+  const ranBefore = oneShotAlreadyRan(s);
+  if (ranBefore) return { ok: false, error: `This one-off schedule already ran — ${ranBefore}. Create a new schedule instead of re-adding this one.` };
   if (s.onMissed !== undefined && !MISSED_POLICIES.includes(s.onMissed)) {
     return { ok: false, error: `Invalid onMissed "${s.onMissed}" (expected ${MISSED_POLICIES.join(' | ')})` };
   }
@@ -361,6 +377,31 @@ export function resumeRun(scheduleId: string, sessionId: string, prompt: string)
 
 // ── Internals ───────────────────────────────────────────────────────────────
 
+/**
+ * Evidence that a `once` schedule has ALREADY had its single run — i.e. this entry is a
+ * resurrection of one the engine deleted on success, not a new job. Returns a human-readable
+ * reason, or null when the schedule is not a spent one-off.
+ *
+ * Two independent witnesses, because neither survives everything:
+ *  - the completion marker (data/scheduler/completions/<id>.json), which is per-id, gitignored
+ *    and local to the firing instance — so a git merge can never carry it away, but a rebuilt
+ *    data dir loses it;
+ *  - the entry's own `lastRun.status === 'ok'`, which travels inside schedules.json — so it
+ *    survives a wiped data dir, but only if the resurrected copy is from after that run.
+ */
+function oneShotAlreadyRan(s: Schedule): string | null {
+  if (s.trigger.kind !== 'once') return null;
+  const marker = readCompletionMarker(s.id);
+  // `completedAt` is the last SUCCESSFUL completion, and 0 when there has never been one. A
+  // marker is also written at fire time (`markRunStarted`) and on failure
+  // (`recordAttemptOutcome`), so its mere existence proves only an attempt. A future-dated
+  // one-off whose manual test-run errored has a marker but has never sent — retiring it would
+  // cancel a send that never happened, and report it as completed at epoch 0.
+  if (marker && marker.completedAt > 0) return `it completed at ${new Date(marker.completedAt).toISOString()} (${marker.triggeredBy})`;
+  if (s.lastRun?.status === 'ok') return `its own lastRun records a successful run at ${new Date(s.lastRun.at).toISOString()}`;
+  return null;
+}
+
 const MISSED_POLICIES: MissedPolicy[] = ['run', 'skip', 'offer'];
 
 function refuse(reason: RunRefusal, message: string): RunOutcome {

package/src/server/self-upgrade/supervisor.sh

@@ -27,6 +27,24 @@ BUN="${BUN:-bun}"
 BOOT_TIMEOUT="${BOOT_TIMEOUT:-180}"
 SOAK="${SOAK:-60}"
 
+# ── Escape the service cgroup ─────────────────────────────────────────────────
+# Under systemd the default KillMode=control-group kills EVERY process in the unit's cgroup on
+# restart — and a detached child of the server is in that cgroup. So the supervisor would be killed
+# by the very restart it triggers, taking the verify AND the rollback with it: exactly the guarantees
+# it exists to provide. Re-exec into a transient scope (same uid, so `bun install` doesn't leave
+# root-owned files) and we live outside the unit. Best-effort: where systemd-run or passwordless sudo
+# is absent, carry on in-cgroup — an unsupervised upgrade still beats no upgrade.
+if [ -z "${UPGRADE_DETACHED:-}" ]; then
+  export UPGRADE_DETACHED=1
+  if command -v systemd-run >/dev/null 2>&1 && sudo -n true >/dev/null 2>&1; then
+    escape=(sudo -n systemd-run --scope --quiet --collect --uid="$(id -u)" --gid="$(id -g)")
+    for v in APP_ROOT PKG TARGET FROM RESTART_CMD HEALTH_URL REPORT BUN BOOT_TIMEOUT SOAK PATH UPGRADE_DETACHED; do
+      escape+=("--setenv=$v=${!v-}")
+    done
+    exec "${escape[@]}" bash "$0"
+  fi
+fi
+
 cd "$APP_ROOT" || exit 1
 BACKUP="$(mktemp -d)"
 LOG="${REPORT%.json}.log"

package/src/server/slack/questions.ts

@@ -43,6 +43,13 @@ function buildBlocks(id: string, questions: AskQuestion[]): unknown[] {
   return blocks;
 }
 
+/** Replace a question message's blocks with a final state, so its buttons stop looking live. */
+async function retire(p: Pending, text: string) {
+  if (!p.messageTs) return;
+  await slackPost('chat.update', { channel: p.channel, ts: p.messageTs, text, blocks: [{ type: 'section', text: { type: 'mrkdwn', text } }] }, p.useUserToken)
+    .catch((err) => console.error(`${PREFIX} retire failed:`, (err as Error)?.message));
+}
+
 /** Build a QuestionHandler bound to a Slack channel/thread for the current turn. */
 export function makeSlackQuestionHandler(ctx: Ctx): QuestionHandler {
   return async (id, questions) => {
@@ -55,7 +62,12 @@ export function makeSlackQuestionHandler(ctx: Ctx): QuestionHandler {
     console.log(`${PREFIX} posted question ${id} (${questions.length}q) to ${ctx.channel}`);
     return new Promise<QuestionAnswers | null>((resolve) => {
       const timer = setTimeout(() => {
-        if (pending.delete(id)) { console.log(`${PREFIX} ${id} timed out`); resolve(null); }
+        const p = pending.get(id);
+        if (!p) return;
+        pending.delete(id);
+        console.log(`${PREFIX} ${id} timed out`);
+        void retire(p, '⌛ This question expired — I went ahead without an answer. Reply in the thread to steer me.');
+        resolve(null);
       }, TTL_MS);
       pending.set(id, { ...ctx, resolve, questions, messageTs: res.ts, timer });
     });
@@ -98,14 +110,22 @@ export async function handleSlackInteraction(payload: any): Promise<boolean> {
   if (!submit) return false;
   const id = submit.value as string;
   const p = pending.get(id);
-  if (!p) return false;
+  if (!p) {
+    // Expired or lost to a restart: the buttons are still clickable but nothing is listening.
+    // Silence reads as a broken app, so always answer the click.
+    console.warn(`${PREFIX} submit for unknown/expired question ${id}`);
+    const channel = payload.channel?.id;
+    if (channel && userId) {
+      await slackPost('chat.postEphemeral', { channel, user: userId, text: '⌛ That question is no longer active (expired or I restarted). Just reply in the thread and I\'ll pick it up.' })
+        .catch((err) => console.error(`${PREFIX} ephemeral failed:`, (err as Error)?.message));
+    }
+    return false;
+  }
   pending.delete(id);
   clearTimeout(p.timer);
   const answers = parseAnswers(payload.state?.values, p.questions);
-  if (p.messageTs) {
-    const summary = Object.entries(answers).map(([q, a]) => `• *${q}* — ${Array.isArray(a) ? a.join(', ') : a}`).join('\n') || '_(no selection)_';
-    await slackPost('chat.update', { channel: p.channel, ts: p.messageTs, text: '✅ Got your answers.', blocks: [{ type: 'section', text: { type: 'mrkdwn', text: `✅ Got your answers:\n${summary}` } }] }, p.useUserToken).catch(() => {});
-  }
+  const summary = Object.entries(answers).map(([q, a]) => `• *${q}* — ${Array.isArray(a) ? a.join(', ') : a}`).join('\n') || '_(no selection)_';
+  await retire(p, `✅ Got your answers:\n${summary}`);
   console.log(`${PREFIX} resolved question ${id} (${Object.keys(answers).length} answered)`);
   p.resolve(Object.keys(answers).length ? answers : null);
   return true;