smart-home-engine 3.0.0-beta.0 → 3.0.0-beta.2

package/dist/web/assets/{tsMode-BquNtbO5.js → tsMode-BhjG23dq.js}

@@ -1,4 +1,4 @@
-import{m as O}from"./monaco-langs-DKJI_o9J.js";import{t as I}from"./index-BZWF5ORr.js";/*!-----------------------------------------------------------------------------
+import{m as O}from"./monaco-langs-DKJI_o9J.js";import{t as I}from"./index-DbYEAVZF.js";/*!-----------------------------------------------------------------------------
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Version: 0.52.2(404545bded1df6ffa41ea0af4e8ddb219018c6c1)
  * Released under the MIT license

package/dist/web/index.html

@@ -175,10 +175,10 @@
                 }
             })();
         </script>
-      <script type="module" crossorigin src="/assets/index-BZWF5ORr.js"></script>
+      <script type="module" crossorigin src="/assets/index-DbYEAVZF.js"></script>
       <link rel="modulepreload" crossorigin href="/assets/monaco-langs-DKJI_o9J.js">
       <link rel="stylesheet" crossorigin href="/assets/monaco-langs-DyX1CsEw.css">
-      <link rel="stylesheet" crossorigin href="/assets/index-CdLKmsX4.css">
+      <link rel="stylesheet" crossorigin href="/assets/index-eopsqoPx.css">
     </head>
     <body>
         <div id="app"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "smart-home-engine",
-    "version": "3.0.0-beta.0",
+    "version": "3.0.0-beta.2",
     "description": "Node.js based script runner for use in MQTT based Smart Home environments",
     "main": "src/index.js",
     "scripts": {

package/service/install.sh

@@ -45,6 +45,9 @@ install -m 755 -o root -g root "$HELPER_SRC" "$HELPER_DST"
 echo "installed $HELPER_DST"
 
 # --- sudoers rules -------------------------------------------------------
+# she's own update runs through the helper (she-servicectl she-update <version>). The npm line is
+# the fallback for a daemon that still updates with the literal command (she up to 3.0.0-beta.1);
+# it goes away in a later release.
 NPM_BIN="$(command -v npm)"
 SUDOERS_FILE=/etc/sudoers.d/she
 cat > "$SUDOERS_FILE" <<EOF

package/service/she-servicectl

@@ -34,6 +34,7 @@
 #   she-servicectl node update [--lts|--latest|--stable|--version X.Y.Z]  install/refresh tj/n (downloaded, no npm), then n install <label|version> — JSON with the version before and after
 #   she-servicectl restart-all                                     restart every running instance on this host (after a node update, say)
 #   she-servicectl self-update                                     replace this script with the one on stdin (she ships it)
+#   she-servicectl she-update <version>                            she's own update: npm install -g smart-home-engine@<version> (the she host only)
 #   she-servicectl remove-key                                      drop the public key on stdin from the calling user's authorized_keys
 #   she-servicectl teardown [--force]                              remove she from this host: that key, the sudoers rule, this script,
 #                                                                  the she-services user (adapters and their instances stay untouched)
@@ -45,7 +46,7 @@
 
 set -eu
 
-VERSION=15
+VERSION=16
 BROKER_ENV=/etc/mqtt-interfaces/broker.env
 UNIT_DIR=/etc/systemd/system
 
@@ -62,6 +63,9 @@ die() { printf 'she-servicectl: %s\n' "$*" >&2; exit 2; }
 
 valid_adapter() { printf '%s' "$1" | grep -Eq '^[a-z0-9][a-z0-9._-]{0,213}$'; }
 valid_instance() { printf '%s' "$1" | grep -Eq '^[A-Za-z0-9_.-]{1,64}$'; }
+# a release version as npm publishes it (pre-release suffix allowed): nothing npm could read as a
+# range, a dist-tag, a URL or a second package
+valid_she_version() { printf '%s' "$1" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$'; }
 
 # a template unit written by mqtt-interfaces-core's installer: per-instance env file under /etc/<adapter>/
 installed_adapter() {
@@ -632,6 +636,22 @@ cmd_self_update() {
     printf 'she-servicectl updated %s -> %s at %s\n' "$VERSION" "$newver" "$self"
 }
 
+# ── she's own update ────────────────────────────────────────────────────────────
+# The update button of the she daemon (v16). she's update channels install an exact version, and
+# the sudoers line `she --install` used to write for that — `npm install -g smart-home-engine`,
+# matched literally by sudo — cannot take one; this command can, through the rule the helper
+# already has. The version is checked strictly, npm's exit code is the command's, and the npm is
+# the one next to the node that runs she (as for the adapters). Meant for the she host: the daemon
+# calls it locally only, and the command refuses where no she is installed.
+cmd_she_update() {
+    [ $# -eq 1 ] || die "usage: she-update <version>"
+    valid_she_version "$1" || die "invalid version: $1"
+    adapter_cmd she >/dev/null 2>&1 || die "she is not installed on this host"
+    npm=$(adapter_npm she)
+    node=$(adapter_node she)
+    PATH="$(dirname "$node"):$PATH" exec "$npm" install -g "smart-home-engine@$1" --no-audit --no-fund
+}
+
 # ── removing she from this host ─────────────────────────────────────────────────
 # The account she logs in as is the sudo caller (root when she connects as root).
 caller_user() { printf '%s' "${SUDO_USER:-$(id -un)}"; }
@@ -869,6 +889,7 @@ case "$c" in
     file) cmd_file "$@" ;;
     asset) cmd_asset "$@" ;;
     self-update) cmd_self_update "$@" ;;
+    she-update) cmd_she_update "$@" ;;
     migrate) cmd_migrate "$@" ;;
     remove-key) cmd_remove_key "$@" ;;
     teardown) cmd_teardown "$@" ;;

package/src/index.js

@@ -245,6 +245,7 @@ if (typeof config.port !== 'undefined') {
             process.exit(1);
         });
     require('./web/broker-api').setLogger(log);
+    require('./web/server').setLogger(log);
 }
 
 const chokidar = require('chokidar');

package/src/lib/self-update.js

@@ -0,0 +1,136 @@
+'use strict';
+/**
+ * she's own update: how the version the update check offers gets installed, and when the daemon
+ * may restart afterwards.
+ *
+ * The daemon runs as the `she` user without a general sudo. Since 3.0.0-beta.2 the install goes
+ * through the privileged helper — `she-servicectl she-update <version>` (helper v16) — which checks
+ * the version strictly and runs `npm install -g smart-home-engine@<version>` as root through the one
+ * sudoers rule every installation has. Before that, `she --install` wrote a second rule allowing
+ * exactly `npm install -g smart-home-engine`: sudo matches arguments literally, so the exact-version
+ * install the update channels need (3.0.0-beta.0) was refused — and the daemon restarted on the old
+ * version regardless, which made the failure invisible. That literal command installs npm's `latest`
+ * and is kept as the fallback for a host whose helper is still older than v16, but only when the
+ * offered version *is* `latest`; otherwise the update asks for the helper update first.
+ *
+ * The restart happens only after npm exited 0. A failure keeps the daemon running and reports npm's
+ * exit code and the last lines of its output.
+ */
+
+const VERSION_RX = /^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$/;
+/** the first helper version with the `she-update` command */
+const HELPER_SHE_UPDATE_VERSION = 16;
+const PACKAGE = 'smart-home-engine';
+const HELPER = '/usr/local/bin/she-servicectl';
+const HELPER_NEEDED = 'update needs the current she-servicectl helper — Update helper on the Services → Hosts tab, or run `sudo she --install` once';
+/** output lines kept for the log and the error message */
+const TAIL_LINES = 12;
+const TAIL_LINES_IN_ERROR = 3;
+
+/** A release version as npm publishes it: `3.0.0`, `3.0.0-beta.2` — no ranges, tags, URLs or spaces. */
+function isValidVersion(v) {
+    return typeof v === 'string' && VERSION_RX.test(v);
+}
+
+/** The helper version a driver reports, or null when the helper is missing, denied or unreadable. */
+async function helperVersionOf(driver) {
+    try {
+        const { stdout } = await driver.exec(['version'], { timeout: 20000 });
+        const n = Number(String(stdout).trim());
+        return Number.isInteger(n) && n > 0 ? n : null;
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * How to install `version`: through the helper when it has `she-update`, through the old literal
+ * sudo rule when the version is npm's `latest`, otherwise not at all.
+ * @param {{version: string, helperVersion: number|null, npmLatest?: string|null}} ctx
+ * @returns {{mode: 'helper'|'npm-latest'}|{error: string}}
+ */
+function planUpdate({ version, helperVersion, npmLatest }) {
+    if (!isValidVersion(version)) return { error: `not a release version: ${version}` };
+    if (Number.isInteger(helperVersion) && helperVersion >= HELPER_SHE_UPDATE_VERSION) return { mode: 'helper' };
+    if (npmLatest && npmLatest === version) return { mode: 'npm-latest' };
+    return { error: HELPER_NEEDED };
+}
+
+/** The command a plan runs: `[cmd, argv]`. */
+function commandFor(plan, version, { helper = HELPER } = {}) {
+    if (plan.mode === 'helper') return ['sudo', ['-n', helper, 'she-update', version]];
+    if (plan.mode === 'npm-latest') return ['sudo', ['npm', 'install', '-g', PACKAGE]];
+    throw new Error('no command for this plan');
+}
+
+/**
+ * Run the install and wait for it. Never rejects.
+ * @param {[string, string[]]} command
+ * @param {{spawn: Function, onLine?: (line: string) => void}} opts spawn: child_process.spawn or a stub
+ * @returns {Promise<{ok: boolean, code: number|null, signal: string|null, tail: string[], reason: string}>}
+ */
+function runInstall([cmd, argv], { spawn, onLine } = {}) {
+    return new Promise((resolve) => {
+        const tail = [];
+        let partial = '';
+        const take = (chunk) => {
+            partial += String(chunk);
+            const lines = partial.split(/\r?\n/);
+            partial = lines.pop();
+            for (const raw of lines) {
+                const line = raw.replace(/\r/g, '').trimEnd();
+                if (!line.trim()) continue;
+                tail.push(line);
+                if (tail.length > TAIL_LINES) tail.shift();
+                if (onLine) onLine(line);
+            }
+        };
+        const finish = (ok, code, signal, reason) => {
+            if (partial.trim()) take('\n');
+            resolve({ ok, code, signal, tail: tail.slice(), reason });
+        };
+        let child;
+        try {
+            child = spawn(cmd, argv, { stdio: ['ignore', 'pipe', 'pipe'] });
+        } catch (err) {
+            finish(false, null, null, `could not start ${cmd}: ${err.message}`);
+            return;
+        }
+        if (child.stdout) child.stdout.on('data', take);
+        if (child.stderr) child.stderr.on('data', take);
+        let done = false;
+        child.on('error', (err) => {
+            if (done) return;
+            done = true;
+            finish(false, null, null, `could not start ${cmd}: ${err.message}`);
+        });
+        child.on('close', (code, signal) => {
+            if (done) return;
+            done = true;
+            if (code === 0) finish(true, 0, null, 'ok');
+            else finish(false, code, signal, signal ? `npm was killed by ${signal}` : `npm exited ${code}`);
+        });
+    });
+}
+
+/**
+ * Install `version` as planned and restart only when npm succeeded.
+ * @param {{plan: {mode: string}, version: string, spawn: Function, onRestart: Function, log?: (level: string, msg: string) => void, helper?: string}} opts
+ * @returns {Promise<{ok: true}|{ok: false, error: string}>} `error` is what the UI shows
+ */
+async function performUpdate({ plan, version, spawn, onRestart, log = () => {}, helper }) {
+    const command = commandFor(plan, version, { helper });
+    log('info', `update: installing ${PACKAGE}@${version} ${plan.mode === 'helper' ? 'through she-servicectl' : "through the literal sudo rule (npm's latest)"}`);
+    const r = await runInstall(command, { spawn, onLine: (line) => log('info', `update: ${line}`) });
+    if (r.ok) {
+        log('info', `update: ${version} installed, restarting`);
+        onRestart();
+        return { ok: true };
+    }
+    const tail = r.tail.slice(-TAIL_LINES_IN_ERROR).join(' | ');
+    const error = `update to ${version} failed: ${r.reason}${tail ? ' — ' + tail : ''}`;
+    log('error', `${error}${r.tail.length ? '\n' + r.tail.join('\n') : ''}`);
+    return { ok: false, error };
+}
+
+module.exports = { HELPER_SHE_UPDATE_VERSION, HELPER_NEEDED, PACKAGE, VERSION_RX, isValidVersion, helperVersionOf, planUpdate, commandFor, runInstall, performUpdate };

package/src/lib/services-host.js

@@ -26,7 +26,7 @@ const { execFile, spawn } = require('child_process');
 const sshDeploy = require('./ssh-deploy');
 
 const HELPER = '/usr/local/bin/she-servicectl';
-const HELPER_VERSION = 15; // must match VERSION in service/she-servicectl (test/unit/helper-version.test.js)
+const HELPER_VERSION = 16; // must match VERSION in service/she-servicectl (test/unit/helper-version.test.js)
 /** Default identity for services.hosts[].ssh — one key for all managed hosts (I5). */
 const DEFAULT_SERVICES_IDENTITY = '~/.she/ssh/services_id_ed25519';
 /** The helper as shipped with this she version (copied to remote hosts by the deploy route). */

package/src/lib/update-channel.js

@@ -97,6 +97,21 @@ async function existsOnNpm(version) {
     return data && data.version === version;
 }
 
+/**
+ * npm's `latest` dist-tag of the package, or null when the registry does not answer. Only the
+ * self-update's fallback asks (the literal `npm install -g smart-home-engine` installs exactly this).
+ */
+async function npmLatest() {
+    try {
+        const res = await _fetch(`${NPM_REGISTRY}/${PACKAGE}/latest`, { signal: AbortSignal.timeout(10000) });
+        if (!res.ok) return null;
+        const data = await res.json();
+        return data && VERSION_RX.test(String(data.version)) ? data.version : null;
+    } catch {
+        return null;
+    }
+}
+
 /**
  * Check for an update on a channel.
  * @param {object} opts
@@ -149,4 +164,4 @@ async function checkUpdate(opts) {
     return result;
 }
 
-module.exports = { CHANNELS, PACKAGE, checkUpdate, newestOf, offeredVersion, versionOfTag, isPrerelease, normalizeChannel, setFetch };
+module.exports = { CHANNELS, PACKAGE, checkUpdate, npmLatest, newestOf, offeredVersion, versionOfTag, isPrerelease, normalizeChannel, setFetch };

package/src/web/server.js

@@ -6,6 +6,8 @@ const { spawn } = require('child_process');
 const pkg = require('../../package.json');
 const { router: configRouter, DEFAULT_CONFIG_PATH } = require('./config-api');
 const updateChannel = require('../lib/update-channel');
+const selfUpdate = require('../lib/self-update');
+const servicesHost = require('../lib/services-host');
 const { router: scriptsRouter } = require('./scripts-api');
 const { router: shedbRouter } = require('./shedb-api');
 const { router: matterRouter } = require('./matter-api');
@@ -127,7 +129,9 @@ function _updateFields() {
     }
     if (_update && _update.stable) f.latestStable = _update.stable;
     if (_update && _update.prerelease) f.latestBeta = _update.prerelease;
-    if (_update && _update.error) f.updateError = _update.error;
+    if (_updateFailed) f.updateError = _updateFailed;
+    else if (_update && _update.error) f.updateError = _update.error;
+    if (_updating) f.updating = true;
     return f;
 }
 
@@ -137,21 +141,51 @@ app.post('/she/check-update', async (req, res) => {
     res.json({ latestVersion: r.latest, ..._updateFields() });
 });
 
-// Update — install the offered version exactly, then restart. Without a known version there is
-// nothing to install: `npm install -g smart-home-engine` would take npm's `latest`, which can be
-// older than a running pre-release.
-app.post('/she/update', (req, res) => {
+// Update — install the offered version exactly, then restart — but only after npm succeeded.
+// The install runs through the helper (`she-servicectl she-update <version>`, v16) when the host
+// has it; a host with an older helper falls back to the literal `sudo npm install -g
+// smart-home-engine` of the old sudoers rule when the offered version is npm's `latest`, and is
+// asked to update the helper otherwise. Without a known version there is nothing to install.
+let _updating = false; // an install is running
+let _updateFailed = null; // the last failed install's message, until the next attempt
+
+function _log(level, msg) {
+    if (_logger) _logger[level](msg);
+    else (level === 'error' || level === 'warn' ? console.error : console.log)(msg);
+}
+
+async function _planUpdate(version) {
+    const helperVersion = await selfUpdate.helperVersionOf(servicesHost.createLocalDriver());
+    // npm's `latest` matters only for the fallback, so it is fetched only when the helper is too old
+    const helperOk = Number.isInteger(helperVersion) && helperVersion >= selfUpdate.HELPER_SHE_UPDATE_VERSION;
+    return selfUpdate.planUpdate({ version, helperVersion, npmLatest: helperOk ? null : await updateChannel.npmLatest() });
+}
+
+app.post('/she/update', async (req, res) => {
     const version = _update && _update.latest;
     if (!version || _isDocker) {
         res.status(409).json({ ok: false, error: _isDocker ? 'a Docker container is updated by pulling a new image' : 'no update known — check for updates first' });
         return;
     }
-    res.json({ ok: true, version });
-    setTimeout(() => {
-        // Use async spawn so the HTTP server (and event loop) remain responsive
-        // while npm runs. spawnSync would block all HTTP polling from the UI.
-        const child = spawn('sudo', ['npm', 'install', '-g', `${updateChannel.PACKAGE}@${version}`], { stdio: 'inherit' });
-        child.on('close', () => _systemdRestart());
+    if (_updating) {
+        res.status(409).json({ ok: false, error: 'an update is already running' });
+        return;
+    }
+    const plan = await _planUpdate(version);
+    if (plan.error) {
+        _updateFailed = plan.error;
+        _log('warn', `update to ${version} not possible: ${plan.error}`);
+        res.status(409).json({ ok: false, error: plan.error });
+        return;
+    }
+    _updating = true;
+    _updateFailed = null;
+    res.json({ ok: true, version, via: plan.mode });
+    // async spawn, so the HTTP server (and the UI's polling) stays responsive while npm runs
+    setTimeout(async () => {
+        const r = await selfUpdate.performUpdate({ plan, version, spawn, onRestart: _systemdRestart, log: _log });
+        _updating = false;
+        if (!r.ok) _updateFailed = r.error;
     }, 200);
 });
 
@@ -356,4 +390,10 @@ function stopServer() {
     });
 }
 
-module.exports = { app, registerRoute, unregisterRoutesByScript, setStatsProvider, setHealthProvider, startServer, stopServer };
+let _logger = null;
+/** The daemon's logger; without one the update path writes to the console. */
+function setLogger(log) {
+    _logger = log;
+}
+
+module.exports = { app, registerRoute, unregisterRoutesByScript, setStatsProvider, setHealthProvider, setLogger, startServer, stopServer };