shraga 0.1.48 → 0.1.50

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shraga",
-  "version": "0.1.48",
+  "version": "0.1.50",
   "description": "The teammate you delegate coding to — a self-hostable, multi-user AI coding agent web UI (Claude Code, with a pluggable engine seam).",
   "type": "module",
   "main": "./src/index.ts",

package/src/server/data-sync.ts

@@ -1,4 +1,5 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync, statSync } from 'node:fs';
+import { readFile, stat } from 'node:fs/promises';
 import path from 'node:path';
 import { hostname } from 'node:os';
 import { DATA_DIR } from './paths.ts';
@@ -116,10 +117,12 @@ export class DataSync {
     // Defer heavy sync I/O (reads all tracked files + execSync) to avoid blocking
     // WS connections and page loads during startup.
     setTimeout(() => {
-      this.scanForConflictMarkers().catch(err => {
-        console.warn(`${TAG} Post-init conflict scan failed:`, (err as Error).message);
-      });
-      this.runIntegrityAudit();
+      this.scanForConflictMarkers()
+        .catch(err => console.warn(`${TAG} Post-init conflict scan failed:`, (err as Error).message))
+        // execSync inside the audit blocks too — keep it off the scan's tick so the two
+        // never add up into one long freeze.
+        .then(() => new Promise<void>(r => setImmediate(r)))
+        .then(() => this.runIntegrityAudit());
     }, 60_000);
   }
 
@@ -442,13 +445,20 @@ export class DataSync {
     try {
       const tracked = (await this.git('ls-files')).split('\n').filter(Boolean);
       const conflicted: string[] = [];
-      for (const f of tracked) {
-        const abs = path.join(DATA_DIR, f);
+      // ASYNC + YIELDING on purpose. This walks every tracked file (1000+, GBs on a real
+      // deployment); doing it synchronously froze the event loop for ~45s — the server stopped
+      // answering /api/version entirely, which also made self-upgrade verification fail and
+      // auto-revert healthy versions. Deferring a synchronous freeze only moves it; it has to
+      // not block at all.
+      for (let i = 0; i < tracked.length; i++) {
+        const abs = path.join(DATA_DIR, tracked[i]);
         try {
-          if (!existsSync(abs) || statSync(abs).isDirectory()) continue;
-          const content = readFileSync(abs, 'utf-8');
-          if (/^<{7} /m.test(content)) conflicted.push(f);
+          const info = await stat(abs).catch(() => null);
+          if (!info || info.isDirectory()) continue;
+          const content = await readFile(abs, 'utf-8');
+          if (/^<{7} /m.test(content)) conflicted.push(tracked[i]);
         } catch { /* skip unreadable */ }
+        if (i % 25 === 24) await new Promise<void>(r => setImmediate(r)); // let the server breathe
       }
       if (!conflicted.length) return;
 

package/src/server/self-upgrade/index.ts

@@ -181,7 +181,13 @@ export class SelfUpgrade {
       return null;
     }
     try { unlinkSync(this.o.reportFile); } catch { /* report already gone; emit anyway */ }
-    try { unlinkSync(this.o.lockFile); } catch { /* no lock to clear */ }
+    // Clear the marker only if it belongs to THIS report. A boot can find a leftover report from
+    // the previous upgrade while a NEW one is already in flight (that is exactly the sequence when
+    // two upgrades run back to back) — deleting that marker would unguard the live attempt.
+    const marker = this.inFlight();
+    if (!marker || marker.target === report.target) {
+      try { unlinkSync(this.o.lockFile); } catch { /* no lock to clear */ }
+    }
 
     console.log(`${TAG} ${report.status}: ${report.detail}`);
     emitEvent('self-upgrade.finished', report);

package/src/server/self-upgrade/supervisor.sh

@@ -136,10 +136,22 @@ wait_for_version() { # version timeout
 
 # A server that boots, flips the version, then dies 20s later has NOT upgraded successfully — that is
 # exactly the crash-loop an unattended upgrade must catch. Keep probing for the whole soak window.
+# One dropped probe is not a crash-loop. This runs on a busy box where a single request can lose a
+# 10s race (MCP mounts, a GC pause, the drain window of the restart we just did), and a zero-
+# tolerance soak turns that blip into an automatic rollback of a perfectly good version — observed
+# reverting 0.1.48 on feedox while the process stayed up throughout. Require CONSECUTIVE misses, so
+# a real crash (which never answers again) still fails fast.
+SOAK_MISS_LIMIT="${SOAK_MISS_LIMIT:-3}"
 soak() { # version seconds
-  local deadline=$(( SECONDS + $2 ))
+  local deadline=$(( SECONDS + $2 )) misses=0
   while [ "$SECONDS" -lt "$deadline" ]; do
-    reports_version "$1" || return 1
+    if reports_version "$1"; then
+      misses=0
+    else
+      misses=$(( misses + 1 ))
+      say "soak probe missed ($misses/$SOAK_MISS_LIMIT)"
+      [ "$misses" -ge "$SOAK_MISS_LIMIT" ] && return 1
+    fi
     sleep 5
   done
   return 0