shraga 0.1.82 → 0.1.84

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shraga",
-  "version": "0.1.82",
+  "version": "0.1.84",
   "description": "The teammate you delegate coding to — a self-hostable, multi-user AI coding agent web UI (Claude Code, with a pluggable engine seam).",
   "type": "module",
   "main": "./src/index.ts",

package/src/server/background-jobs.ts

@@ -239,6 +239,11 @@ export async function startJob(owner: JobOwner, command: string): Promise<string
         // so one started in the foreground orphans silently when its 60s tool call is killed.
         SHRAGA_JOB_ID: id,
         SHRAGA_BG_JOB: '1',
+        // The owning session, so a launcher never has to be HANDED it. A model writing the command
+        // has to remember `export` for a var to survive into `sh script.sh`; a plain assignment
+        // silently doesn't, which failed every scheduled social run for a day. The runner already
+        // knows whose job this is — passing it removes the caller from the loop entirely.
+        SHRAGA_SESSION_ID: owner.sessionId,
       },
       detached: true, stdio: ['ignore', fd, fd],
     });

package/src/server/boot.ts

@@ -44,6 +44,7 @@ import { hydrateSlackUserToken } from './slack/oauth.ts';
 import { registerMcpOAuthRoutes } from './mcp-oauth.ts';
 import { registerEventRoutes } from './events/routes.ts';
 import { reclaimStalePort } from './port-reclaim.ts';
+import { listenWithRetry } from './listen-retry.ts';
 import { startHeartbeat, recordBootGap, buildReport } from './downtime.ts';
 import { registerWebhook } from './events/webhook.ts';
 import { startEventDispatcher } from './events/dispatcher.ts';
@@ -2127,26 +2128,18 @@ await new Promise<void>((resolve) => {
   // forever: process running, port unbound, nothing served. The service manager sees a healthy job
   // and a port watchdog sees a dead one, so it kickstarts on a loop and shreds in-flight runs.
   // EADDRINUSE is the common case: `kickstart -k` starts the replacement while the old process is
-  // still draining (up to 90s). Exiting non-zero is the correct answer — the manager restarts us,
-  // and by then the port is free.
+  // still draining (up to 90s). Exiting used to be the answer, but the manager respawns on a ~10s
+  // throttle and meets the same owner: MEASURED 2026-09-06, one watchdog kick became ~20 start/exit
+  // cycles across five minutes, and every scheduled run in that window died with them. Wait the
+  // drain out here instead — one process holding still, rather than N racing (see listen-retry.ts).
   //
   // EXCEPT when the holder is an ORPHANED copy of ourselves: nothing will ever signal it, so it
-  // holds the port forever and every respawn dies here while the orphan serves stale code. That is
-  // not a transient drain and exiting cannot fix it — reclaim the port once, then bind.
+  // holds the port forever and waiting alone cannot fix it — reclaim it, then the next retry binds.
   let reclaimed = false;
-  server.once('error', (err: NodeJS.ErrnoException) => {
-    if (err.code === 'EADDRINUSE' && !reclaimed && reclaimStalePort(PORT)) {
-      reclaimed = true; // once only: a second EADDRINUSE means a live owner we must not fight
-      server.listen(PORT);
-      return;
-    }
-    const why = err.code === 'EADDRINUSE'
-      ? `port ${PORT} is already in use (previous instance still draining?)`
-      : (err.message ?? String(err));
-    console.error(`[server] FATAL: cannot listen on ${PORT} — ${why}. Exiting so the service manager restarts us.`);
-    process.exit(1);
-  });
-  server.listen(PORT, () => {
+  listenWithRetry(server, PORT, {
+    onBusy: () => { if (!reclaimed) reclaimed = reclaimStalePort(PORT); },
+    onWaiting: (ms) => console.warn(`[server] port ${PORT} is held (previous instance draining?) — waiting up to ${Math.round(ms / 1000)}s for it`),
+  }).then(() => {
     console.log(`[server] Running on http://0.0.0.0:${PORT}`);
     resolve();
     if (PASSIVE) return; // no sidecars, recovery, or MCP warmers in passive mode
@@ -2160,6 +2153,12 @@ await new Promise<void>((resolve) => {
     // The disk MCP catalog is warmed off the turn path by whichever engine consumes it — the CE default
     // (Claude Code) hands MCP servers straight to its SDK and needs no catalog. An add-on engine that
     // uses the shared catalog registers its own boot/interval warm-up through the overlay.
+  }, (err: NodeJS.ErrnoException) => {
+    const why = err.code === 'EADDRINUSE'
+      ? `port ${PORT} is still in use after waiting for the previous instance to drain`
+      : (err.message ?? String(err));
+    console.error(`[server] FATAL: cannot listen on ${PORT} — ${why}. Exiting so the service manager restarts us.`);
+    process.exit(1);
   });
 });
 

package/src/server/listen-retry.ts

@@ -0,0 +1,59 @@
+/**
+ * Bind the HTTP port, waiting out a predecessor that is still draining.
+ *
+ * `kickstart -k` starts the replacement while the old process drains (up to 90s), so the new one
+ * meets EADDRINUSE. Exiting immediately hands the problem to the service manager — which respawns
+ * on a ~10s throttle, meets the same still-draining owner, and exits again. MEASURED 2026-09-06 on
+ * the feedox box: one watchdog kick produced ~20 start/exit cycles over five minutes, every one of
+ * them `port already in use`, and every scheduled run in that window died with it. The manager was
+ * doing exactly what it was asked to; the retry it was standing in for just belonged here, where
+ * the wait is one process holding still instead of N processes racing.
+ *
+ * So: retry the bind on a fixed cadence for a bounded window. A drain finishes and we bind; a
+ * genuinely occupied port still ends in a non-zero exit, just once instead of twenty times.
+ */
+
+import type { Server } from 'node:http';
+
+export interface ListenRetryOptions {
+  /** Total time to keep retrying EADDRINUSE before giving up. Sized over the ~90s drain ceiling. */
+  waitMs?: number;
+  /** Gap between attempts. */
+  intervalMs?: number;
+  /** Called once, on the first EADDRINUSE, so a wait is never silent. */
+  onWaiting?: (waitMs: number) => void;
+  /** Called on EVERY EADDRINUSE, before the wait — a caller may use it to reclaim an orphan holder. */
+  onBusy?: () => void;
+  /** Injectable clock for tests. */
+  sleep?: (ms: number) => Promise<void>;
+  now?: () => number;
+}
+
+/**
+ * Resolves when `server` is listening on `port`. Rejects with the underlying error if the port is
+ * held for the whole window, or immediately for any error that waiting cannot fix.
+ */
+export function listenWithRetry(server: Server, port: number, opts: ListenRetryOptions = {}): Promise<void> {
+  const waitMs = opts.waitMs ?? (Number(process.env.SHRAGA_BIND_WAIT_MS) || 120_000);
+  const intervalMs = opts.intervalMs ?? 2_000;
+  const sleep = opts.sleep ?? ((ms: number) => new Promise<void>((r) => setTimeout(r, ms)));
+  const now = opts.now ?? Date.now;
+  const deadline = now() + waitMs;
+  let announced = false;
+
+  return new Promise<void>((resolve, reject) => {
+    const attempt = (): void => {
+      const onError = (err: NodeJS.ErrnoException): void => {
+        // Only a busy port is worth waiting on: a bad address, EACCES, or anything else is as true
+        // in two minutes as it is now, and retrying it would only delay the operator's error.
+        if (err.code !== 'EADDRINUSE' || now() >= deadline) { reject(err); return; }
+        try { opts.onBusy?.(); } catch { /* a caller's reclaim attempt must not abort the wait */ }
+        if (!announced) { announced = true; opts.onWaiting?.(waitMs); }
+        void sleep(intervalMs).then(attempt);
+      };
+      server.once('error', onError);
+      server.listen(port, () => { server.off('error', onError); resolve(); });
+    };
+    attempt();
+  });
+}