shraga 0.1.50 → 0.1.52

package/defaults/skills/self-aware.md

@@ -100,6 +100,9 @@ curl -s -H "$AUTH" -H 'content-type: application/json' \
   therefore refused by design: this cannot fire unattended.
 - **Check `blockers` first and relay them.** A source checkout (upgrade with git instead) and a
   local dev symlink at `node_modules/shraga` are both refused on purpose — do not work around either.
+- **A scheduled job mid-run also blocks it.** The restart would kill that run (SIGTERM/143), so the
+  default is to wait for idle. Say so and offer to retry shortly; only send `{"force":true}` if the
+  owner, told what is running, asks for it anyway.
 - **202 means started, not succeeded.** The upgrade restarts the server, so the POST cannot report
   the outcome. A detached supervisor installs, restarts, waits for `/api/version` to report the new
   version, soaks it, and **reverts to the previous version automatically** if it doesn't hold.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shraga",
-  "version": "0.1.50",
+  "version": "0.1.52",
   "description": "The teammate you delegate coding to — a self-hostable, multi-user AI coding agent web UI (Claude Code, with a pluggable engine seam).",
   "type": "module",
   "main": "./src/index.ts",

package/src/server/boot.ts

@@ -210,7 +210,7 @@ app.get('/api/self-upgrade', requireAuth, async (req, res) => {
 app.post('/api/self-upgrade', requireAuth, async (req, res) => {
   if (!(req as any).user?.isOwner) return void res.status(403).json({ error: 'Only the owner can manage upgrades' });
   try {
-    const plan = await selfUpgrade.start({ version: req.body?.version });
+    const plan = await selfUpgrade.start({ version: req.body?.version, force: req.body?.force === true });
     // 409, not 500: a refusal is a well-formed answer about the deployment's state, and the caller
     // (often the agent, relaying to a human) needs the reason, not a stack trace.
     res.status(plan.started ? 202 : 409).json(plan);

package/src/server/data-sync.ts

@@ -1,9 +1,8 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync, statSync } from 'node:fs';
 import { readFile, stat } from 'node:fs/promises';
 import path from 'node:path';
-import { hostname } from 'node:os';
 import { DATA_DIR } from './paths.ts';
-import { emitEvent } from './events/bus.ts';
+import { notifyOwners } from './notify-owners.ts';
 import { runTextQuery } from './sdk-utils.ts';
 
 const TAG = '[data-sync]';
@@ -576,24 +575,10 @@ export class DataSync {
       console.warn(`${TAG} notification suppressed (not the authoritative instance):\n${text}`);
       return;
     }
-    // No Slack coupling here — resolve owner contacts and publish a deploy notice on the event bus.
-    // The Slack feature (slackFeature) subscribes and DMs each owner. Owner resolution uses the
-    // contacts store only, so data-sync stays transport-agnostic.
-    const { getAll } = await import('./contacts.ts');
-    const ownerEmails = (process.env.OWNERS ?? '').split(',').map(s => s.trim().toLowerCase()).filter(Boolean);
-    const owners = getAll()
-      .filter(c => c.slackIds.length > 0 && c.emails.some(e => ownerEmails.includes(e.toLowerCase())))
-      .map(c => ({ name: c.name, slackId: c.slackIds[0] }));
-    if (!owners.length) {
-      console.warn(`${TAG} No owners (OWNERS env) with Slack IDs found, skipping notification`);
-      return;
-    }
-    // Stamp the sender: every owner alert must name the instance it came from, so "is this back?"
-    // is answerable without log archaeology across hosts.
-    const from = `${this.options.deploymentId || 'shraga'}@${hostname()}`;
-    emitEvent('data-sync', { kind: 'deploy', owners, text: `${text}\n\n_from ${from}_` });
+    await notifyOwners('data-sync', text);
   }
 
+
   /**
    * Routed through the Claude Code SDK (runTextQuery), same as the rest of the platform —
    * authenticates via the CC subscription, no ANTHROPIC_API_KEY required. Past incident:

package/src/server/notify-owners.ts

@@ -0,0 +1,41 @@
+// Reaching a human, transport-agnostically. Resolve the deployment's owners from the contacts
+// store and publish a "deploy notice" on the event bus; the Slack feature subscribes and DMs each
+// one. Callers stay free of Slack (and of owner-resolution) entirely.
+//
+// This lives on its own because more than one subsystem needs it — data-sync's merge/integrity
+// alerts and self-upgrade's outcome report — and the second one silently had NO delivery at all:
+// it emitted an event nobody subscribed to, so a finished upgrade never reached anyone.
+import { hostname } from 'node:os';
+import { emitEvent } from './events/bus.ts';
+
+export type Owner = { name?: string; slackId: string };
+
+/** Owners of THIS deployment (OWNERS env ∩ contacts that have a Slack id). */
+export async function resolveOwners(): Promise<Owner[]> {
+  const { getAll } = await import('./contacts.ts');
+  const ownerEmails = (process.env.OWNERS ?? '').split(',').map(s => s.trim().toLowerCase()).filter(Boolean);
+  return getAll()
+    .filter(c => c.slackIds.length > 0 && c.emails.some(e => ownerEmails.includes(e.toLowerCase())))
+    .map(c => ({ name: c.name, slackId: c.slackIds[0] }));
+}
+
+/** `APP_NAME@host` — every owner-facing alert names the instance it came from, so "is this back?"
+ *  is answerable without log archaeology across hosts. */
+export function senderStamp(): string {
+  return `${process.env.APP_NAME || 'shraga'}@${hostname()}`;
+}
+
+/**
+ * DM the owners. `source` is the event-bus source (used for logging/filtering only) — delivery is
+ * keyed on the notice `kind`, so a new subsystem needs no change on the Slack side.
+ * Returns false when there was nobody to tell.
+ */
+export async function notifyOwners(source: string, text: string): Promise<boolean> {
+  const owners = await resolveOwners();
+  if (!owners.length) {
+    console.warn(`[${source}] No owners (OWNERS env) with Slack IDs found, skipping notification`);
+    return false;
+  }
+  emitEvent(source as any, { kind: 'deploy', owners, text: `${text}\n\n_from ${senderStamp()}_` });
+  return true;
+}

package/src/server/self-upgrade/index.ts

@@ -14,6 +14,7 @@ import { spawn, spawnSync } from 'node:child_process';
 import path from 'node:path';
 import { APP_ROOT, PACKAGE_ROOT, dataPath } from '../paths.ts';
 import { emitEvent } from '../events/bus.ts';
+import { notifyOwners } from '../notify-owners.ts';
 
 const TAG = '[self-upgrade]';
 const PKG = 'shraga';
@@ -60,8 +61,18 @@ export class SelfUpgrade {
    *                            the running process disagreeing with no way to reconcile.
    *   - upgrade in flight    → two supervisors racing on package.json is how you get a tree that
    *                            matches neither version. */
-  public blockers(): string[] {
+  public blockers(opts: { force?: boolean } = {}): string[] {
     const reasons: string[] = [];
+
+    // An upgrade restarts the process, which kills any scheduled run mid-flight — observed taking
+    // out the morning social recon (SIGTERM/143) during a routine upgrade. Wait for idle instead;
+    // `force` is the deliberate escape hatch for an owner who wants it now anyway.
+    if (!opts.force) {
+      const running = this.o.runningJobs();
+      if (running.length) {
+        reasons.push(`${running.length} scheduled job(s) still running (${running.join(', ')}) — restarting now would kill them mid-flight; retry when idle or pass {"force":true}`);
+      }
+    }
     const pkgPath = path.join(this.o.appRoot, 'package.json');
 
     if (!existsSync(pkgPath)) {
@@ -113,11 +124,11 @@ export class SelfUpgrade {
    * Start an upgrade. Resolves as soon as the supervisor is detached — the result arrives later, in
    * the report file, because this process is about to be restarted by that supervisor.
    */
-  public async start(opts: { version?: string } = {}): Promise<UpgradePlan> {
+  public async start(opts: { version?: string; force?: boolean } = {}): Promise<UpgradePlan> {
     const from = this.currentVersion();
     const target = !opts.version || opts.version === 'latest' ? await this.latestVersion() : opts.version.replace(/^v/, '');
 
-    const blockers = this.blockers();
+    const blockers = this.blockers({ force: opts.force });
     if (blockers.length) return { started: false, from, target, reason: blockers.join('; ') };
     if (from === target) return { started: false, from, target, reason: `already on ${target}` };
     if (!await this.versionExists(target)) return { started: false, from, target, reason: `${this.o.pkg}@${target} does not exist on the registry` };
@@ -191,6 +202,12 @@ export class SelfUpgrade {
 
     console.log(`${TAG} ${report.status}: ${report.detail}`);
     emitEvent('self-upgrade.finished', report);
+    // ...and actually tell a human. The event alone reached nobody: no subscriber existed, so every
+    // upgrade outcome — including `revert-failed`, which needs hands — was silently dropped.
+    const icon = report.status === 'ok' ? '✅' : report.status === 'reverted' ? '↩️' : '🚨';
+    notifyOwners('self-upgrade', `${icon} Self-upgrade ${report.status}: ${report.detail}\n\n` +
+      `${report.package} ${report.from} → ${report.target} (now on ${report.installed})\nLog: \`${report.log}\``)
+      .catch(err => console.warn(`${TAG} could not notify owners:`, (err as Error).message));
     return report;
   }
 
@@ -229,6 +246,14 @@ export class SelfUpgradeOptions {
   public soakSec: number = 60;
   /** After this, an in-flight marker is treated as abandoned (supervisor killed by a reboot). */
   public maxRunMs: number = 30 * 60 * 1000;
+  /** Scheduled runs currently in flight. Lazy + guarded: the scheduler is not always mounted (and
+   *  must not be imported at module load), and a preflight that throws is worse than one that
+   *  assumes idle. Injectable so the preflight is testable without a running scheduler. */
+  public runningJobs: () => string[] = () => {
+    try { return require('../scheduler/engine.ts').getRunningIds() as string[]; }
+    catch (err) { console.warn(`${TAG} could not read running jobs:`, (err as Error).message); return []; }
+  };
+
   /** Injectable so the preflight is testable without depending on the test host's PATH. */
   public hasPython3: () => boolean = () => {
     try { return spawnSync('python3', ['--version'], { stdio: 'ignore' }).status === 0; }

package/src/server/slack/feature.ts

@@ -25,11 +25,12 @@ export const slackFeature: ServerFeature = {
 
     if (!oauthMounted) { oauthMounted = true; registerSlackOAuthRoutes(ctx.app); }
 
-    // Data-sync deploy notices arrive on the event bus (data-sync.ts has no Slack coupling); DM owners.
+    // Owner notices arrive on the event bus (see notify-owners.ts — no subsystem couples to Slack);
+    // DM owners. Keyed on the notice KIND, not the source: self-upgrade emitted its outcome under
+    // its own source and a source-gated subscriber silently dropped every one of them.
     if (!ctx.passive && !busSubscribed) {
       busSubscribed = true;
       subscribeEvents((evt) => {
-        if (evt.source !== 'data-sync') return;
         const payload = evt.payload as DeployNotice;
         if (payload?.kind !== 'deploy' || !payload.owners?.length) return;
         for (const owner of payload.owners) {