shraga 0.1.47 → 0.1.49

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shraga",
-  "version": "0.1.47",
+  "version": "0.1.49",
   "description": "The teammate you delegate coding to — a self-hostable, multi-user AI coding agent web UI (Claude Code, with a pluggable engine seam).",
   "type": "module",
   "main": "./src/index.ts",

package/src/server/self-upgrade/index.ts

@@ -25,6 +25,8 @@ export class SelfUpgrade {
 
   private get o(): SelfUpgradeOptions { return this.options as SelfUpgradeOptions; }
 
+  private watching = false;
+
   /** Version of `pkg` this deployment currently has pinned in its app-root package.json. */
   public currentVersion(): string | null {
     try {
@@ -170,14 +172,42 @@ export class SelfUpgrade {
    */
   public deliverPendingReport(): UpgradeReport | null {
     const report = this.lastReport();
-    if (!report) return null;
+    if (!report) {
+      // The supervisor writes the report only AFTER this process has booted and soaked, so on a
+      // successful upgrade there is NOTHING here yet — boot always loses the race. Without this
+      // watch the outcome DM was never delivered, and the in-flight marker sat until it aged out
+      // (30m), blocking every retry in between. Keep watching while the marker is live.
+      if (this.inFlight()) this.watchForReport();
+      return null;
+    }
     try { unlinkSync(this.o.reportFile); } catch { /* report already gone; emit anyway */ }
-    try { unlinkSync(this.o.lockFile); } catch { /* no lock to clear */ }
+    // Clear the marker only if it belongs to THIS report. A boot can find a leftover report from
+    // the previous upgrade while a NEW one is already in flight (that is exactly the sequence when
+    // two upgrades run back to back) — deleting that marker would unguard the live attempt.
+    const marker = this.inFlight();
+    if (!marker || marker.target === report.target) {
+      try { unlinkSync(this.o.lockFile); } catch { /* no lock to clear */ }
+    }
 
     console.log(`${TAG} ${report.status}: ${report.detail}`);
     emitEvent('self-upgrade.finished', report);
     return report;
   }
+
+  /** Poll until the supervisor's report lands (or its marker ages out), then deliver it exactly
+   *  once. Unref'd: a pending upgrade watch must never hold the process open. */
+  private watchForReport(): void {
+    if (this.watching) return;
+    this.watching = true;
+    const timer = setInterval(() => {
+      if (!this.inFlight()) { clearInterval(timer); this.watching = false; return; } // aged out
+      if (!existsSync(this.o.reportFile)) return;
+      clearInterval(timer);
+      this.watching = false;
+      this.deliverPendingReport();
+    }, this.o.reportPollMs);
+    timer.unref?.();
+  }
 }
 
 export class SelfUpgradeOptions {
@@ -193,6 +223,8 @@ export class SelfUpgradeOptions {
   public supervisorScript: string = path.join(PACKAGE_ROOT, 'src', 'server', 'self-upgrade', 'supervisor.sh');
   public reportFile: string = dataPath('.self-upgrade', 'report.json');
   public lockFile: string = dataPath('.self-upgrade', 'in-flight.json');
+  /** How often the post-boot watch looks for the supervisor's report. */
+  public reportPollMs: number = 5_000;
   public bootTimeoutSec: number = 180;
   public soakSec: number = 60;
   /** After this, an in-flight marker is treated as abandoned (supervisor killed by a reboot). */

package/src/server/self-upgrade/supervisor.sh

@@ -136,10 +136,22 @@ wait_for_version() { # version timeout
 
 # A server that boots, flips the version, then dies 20s later has NOT upgraded successfully — that is
 # exactly the crash-loop an unattended upgrade must catch. Keep probing for the whole soak window.
+# One dropped probe is not a crash-loop. This runs on a busy box where a single request can lose a
+# 10s race (MCP mounts, a GC pause, the drain window of the restart we just did), and a zero-
+# tolerance soak turns that blip into an automatic rollback of a perfectly good version — observed
+# reverting 0.1.48 on feedox while the process stayed up throughout. Require CONSECUTIVE misses, so
+# a real crash (which never answers again) still fails fast.
+SOAK_MISS_LIMIT="${SOAK_MISS_LIMIT:-3}"
 soak() { # version seconds
-  local deadline=$(( SECONDS + $2 ))
+  local deadline=$(( SECONDS + $2 )) misses=0
   while [ "$SECONDS" -lt "$deadline" ]; do
-    reports_version "$1" || return 1
+    if reports_version "$1"; then
+      misses=0
+    else
+      misses=$(( misses + 1 ))
+      say "soak probe missed ($misses/$SOAK_MISS_LIMIT)"
+      [ "$misses" -ge "$SOAK_MISS_LIMIT" ] && return 1
+    fi
     sleep 5
   done
   return 0