shraga 0.1.63 → 0.1.65

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shraga",
-  "version": "0.1.63",
+  "version": "0.1.65",
   "description": "The teammate you delegate coding to — a self-hostable, multi-user AI coding agent web UI (Claude Code, with a pluggable engine seam).",
   "type": "module",
   "main": "./src/index.ts",

package/src/server/boot.ts

@@ -41,6 +41,7 @@ import { registerModuleRoutes, reconcileInstalledModules } from './modules/index
 import { hydrateSlackUserToken } from './slack/oauth.ts';
 import { registerMcpOAuthRoutes } from './mcp-oauth.ts';
 import { registerEventRoutes } from './events/routes.ts';
+import { reclaimStalePort } from './port-reclaim.ts';
 import { startHeartbeat, recordBootGap, buildReport } from './downtime.ts';
 import { registerWebhook } from './events/webhook.ts';
 import { startEventDispatcher } from './events/dispatcher.ts';
@@ -1989,12 +1990,13 @@ async function recoverInterruptedSessions() {
 }
 
 let _draining = false;
+const DRAIN_MS = Number(process.env.SHRAGA_DRAIN_MS) || 8_000;
 
 async function gracefulShutdown(signal: string, opts: { exit?: boolean } = {}) {
   const exit = opts.exit ?? true;
   if (_draining) return;
   _draining = true;
-  console.log(`[server] ${signal} — draining (up to 90s)…`);
+  console.log(`[server] ${signal} — draining (up to ${Math.round(DRAIN_MS / 1000)}s)…`);
   setShuttingDown();
   stopSidecars();
 
@@ -2007,7 +2009,12 @@ async function gracefulShutdown(signal: string, opts: { exit?: boolean } = {}) {
   // index at shutdown (the crash-recovery marker), so index entries can never go idle mid-drain —
   // polling the index made every restart with an active session (or a stale marker from a prior
   // crash) sit out the full 90s.
-  const deadline = Date.now() + 90_000;
+  // Bounded by what the service manager ACTUALLY grants, not by what we'd like. launchd's default
+  // ExitTimeOut is 20s and our power-guard wrapper SIGKILLs the child 10s after SIGTERM, so a 90s
+  // drain was fiction: we never reached the clean exit below, and the in-flight turn was shredded
+  // mid-write instead of aborted and persisted as a resumable partial. Override with
+  // SHRAGA_DRAIN_MS where the manager really does grant longer.
+  const deadline = Date.now() + DRAIN_MS;
   while (Date.now() < deadline) {
     const running = getActiveLockCount();
     if (running === 0) break;
@@ -2071,7 +2078,17 @@ await new Promise<void>((resolve) => {
   // EADDRINUSE is the common case: `kickstart -k` starts the replacement while the old process is
   // still draining (up to 90s). Exiting non-zero is the correct answer — the manager restarts us,
   // and by then the port is free.
+  //
+  // EXCEPT when the holder is an ORPHANED copy of ourselves: nothing will ever signal it, so it
+  // holds the port forever and every respawn dies here while the orphan serves stale code. That is
+  // not a transient drain and exiting cannot fix it — reclaim the port once, then bind.
+  let reclaimed = false;
   server.once('error', (err: NodeJS.ErrnoException) => {
+    if (err.code === 'EADDRINUSE' && !reclaimed && reclaimStalePort(PORT)) {
+      reclaimed = true; // once only: a second EADDRINUSE means a live owner we must not fight
+      server.listen(PORT);
+      return;
+    }
     const why = err.code === 'EADDRINUSE'
       ? `port ${PORT} is already in use (previous instance still draining?)`
       : (err.message ?? String(err));

package/src/server/engine/claude-code.ts

@@ -225,6 +225,15 @@ export class ClaudeCodeEngine implements AgentEngine {
     sdkEnv.SHRAGA_USER_UID = sdkEnv.UNCLAW_USER_UID = opts.uid;
     if (opts.userEmail) sdkEnv.SHRAGA_USER_EMAIL = sdkEnv.UNCLAW_USER_EMAIL = opts.userEmail;
     sdkEnv.SHRAGA_SESSION_ID = sdkEnv.UNCLAW_SESSION_ID = opts.sessionId ?? '';
+    // Per-command wall-clock cap for the SDK's Bash tool. Without it a single unbounded command
+    // (e.g. `curl` with no `-m` against an SSE endpoint that streams nothing) eats the whole turn and
+    // the agent answers with "reads were interrupted". The model still sees `[exit 124]` + partial
+    // output and can adapt, and may ask for up to BASH_MAX_TIMEOUT_MS on a legitimately slow command.
+    // `??=` is not enough: the SDK treats a set-but-empty var as absent and silently falls back to
+    // its own 120s, so a blank host value must take our default too — only a real value wins.
+    const setIfBlank = (key: string, value: string) => { if (!sdkEnv[key]?.trim()) sdkEnv[key] = value; };
+    setIfBlank('BASH_DEFAULT_TIMEOUT_MS', process.env.AGENT_SHELL_TIMEOUT_MS?.trim() || '60000');
+    setIfBlank('BASH_MAX_TIMEOUT_MS', process.env.AGENT_SHELL_MAX_TIMEOUT_MS?.trim() || '600000');
     sdkEnv.INTERNAL_API_TOKEN = signInternalToken(opts.uid, opts.userEmail || 'unknown');
 
     const baseAllowed = config.allowedTools ?? DEFAULT_ALLOWED_TOOLS;

package/src/server/port-reclaim.ts

@@ -0,0 +1,73 @@
+import { execFileSync } from 'node:child_process';
+
+/** Reclaim the listen port from a STALE COPY OF OURSELVES.
+ *
+ * The EADDRINUSE handler's assumption — "the old instance is draining, it will free the port, the
+ * service manager restarts us" — holds only while something still owns that old process. It doesn't
+ * when the server's launchd/systemd parent dies first: the server reparents to pid 1, nothing will
+ * ever signal it, and it holds the port FOREVER. The replacement then dies on every respawn while
+ * the orphan keeps serving the OLD code, so `kickstart -k` looks successful and changes nothing
+ * (observed on feedox 2026-08-28: a deploy "restarted" the service four times, and the process
+ * answering :3032 was three hours and one version old).
+ *
+ * Reclaiming is deliberately narrow — an over-broad "kill whatever holds my port" is how a deploy
+ * takes down an unrelated service. Every condition must hold: the holder is orphaned (ppid 1, so no
+ * manager owns it), it runs THIS deployment's entrypoint from THIS working directory, and it isn't
+ * us. Anything else (a sibling deployment, a manager-owned process mid-drain, an unrelated server)
+ * is left alone and the caller keeps today's exit-and-let-the-manager-retry behavior. */
+export function reclaimStalePort(port: number, opts: { entrypoint?: string; cwd?: string; termGraceMs?: number } = {}): boolean {
+  const entrypoint = opts.entrypoint ?? 'src/main.ts';
+  const cwd = opts.cwd ?? process.cwd();
+  const grace = opts.termGraceMs ?? 5000;
+
+  const holders = listeners(port).filter((pid) => pid !== process.pid && isStaleSelf(pid, entrypoint, cwd));
+  if (!holders.length) return false;
+
+  for (const pid of holders) {
+    console.warn(`[server] port ${port} held by ORPHANED stale instance pid=${pid} (ppid 1, same cwd + entrypoint) — reclaiming`);
+    signal(pid, 'SIGTERM');
+    if (!waitGone(pid, grace)) {
+      console.warn(`[server] pid=${pid} ignored SIGTERM for ${grace}ms — SIGKILL`);
+      signal(pid, 'SIGKILL');
+      waitGone(pid, 2000);
+    }
+  }
+  const free = listeners(port).filter((pid) => pid !== process.pid).length === 0;
+  console.warn(`[server] port ${port} ${free ? 'reclaimed' : 'STILL held after reclaim'}`);
+  return free;
+}
+
+function listeners(port: number): number[] {
+  return sh('lsof', ['-ti', `tcp:${port}`, '-sTCP:LISTEN'])
+    .split('\n').map((l) => Number(l.trim())).filter((n) => Number.isInteger(n) && n > 0);
+}
+
+/** Orphaned (ppid 1) + our entrypoint + our cwd. All three, or it is not ours to kill. */
+function isStaleSelf(pid: number, entrypoint: string, cwd: string): boolean {
+  if (sh('ps', ['-o', 'ppid=', '-p', String(pid)]).trim() !== '1') return false;
+  if (!sh('ps', ['-o', 'command=', '-p', String(pid)]).includes(entrypoint)) return false;
+  // `lsof -d cwd -Fn` prints the cwd on an `n`-prefixed line.
+  const holderCwd = sh('lsof', ['-a', '-p', String(pid), '-d', 'cwd', '-Fn'])
+    .split('\n').find((l) => l.startsWith('n'))?.slice(1).trim();
+  return !!holderCwd && holderCwd === cwd;
+}
+
+function signal(pid: number, sig: NodeJS.Signals): void {
+  try { process.kill(pid, sig); } catch (err: any) { console.warn(`[server] ${sig} pid=${pid} failed: ${err?.message ?? err}`); }
+}
+
+function waitGone(pid: number, ms: number): boolean {
+  const deadline = Date.now() + ms;
+  while (Date.now() < deadline) {
+    try { process.kill(pid, 0); } catch { return true; }
+    // Synchronous on purpose: this runs inside the listen-error path, before the event loop is
+    // serving anything, and the caller must decide bind-or-exit before returning.
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 100);
+  }
+  try { process.kill(pid, 0); return false; } catch { return true; }
+}
+
+function sh(cmd: string, args: string[]): string {
+  try { return execFileSync(cmd, args, { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }); }
+  catch { return ''; } // non-zero exit = no match (lsof) or no such pid (ps) — both mean "nothing there"
+}