fix: webui auto-update silent failure + bump to v0.5.9

Root cause of auto-update never working:

1. Missing NODE_OPTIONS=--max-old-space-size=4096
Upstream Dockerfile uses this. HF Space CPU-only has limited RAM.
Vite build (vue-tsc + vite + esbuild) OOMs silently without it.

2. Missing npm rebuild node-pty
node-pty is a native C++ module. 'npm install --ignore-scripts'
skips compilation. Without 'npm rebuild node-pty', the module
has no compiled .node binary at runtime.

3. All error output went to stdout (lost after 'exec python3 entry.py')
The auto-update runs in background, then exec replaces the shell.
All error messages are silently discarded — no way to diagnose failures.
Fix: Write everything to /data/hermes/logs/auto-update.log

4. No retry on transient failure
Network timeout, disk pressure, etc. caused single-attempt failures.
Fix: 2-attempt retry with 10s backoff.

Changes:
- Dockerfile: v0.5.8 -> v0.5.9 + NODE_OPTIONS + npm rebuild node-pty
- start.sh: Complete rewrite of update_webui_background()
- Full logging to auto-update.log
- NODE_OPTIONS=--max-old-space-size=4096
- npm rebuild node-pty step
- timeout on npm install (120s) and build (180s)
- 2-attempt retry loop
- Clean hot-swap (kill old, rm old dirs, install new, restart)
- Proper environment variable export on restart

Dockerfile

@@ -82,13 +82,15 @@ RUN mkdir -p /usr/share/fonts/truetype/noto && \
 RUN git clone --depth 1 https://github.com/jnMetaCode/agency-agents-zh.git /app/agency-agents && \
     echo "agency-agents-zh cloned ($(find /app/agency-agents -name '*.md' ! -name 'README*' ! -name 'CATALOG*' ! -name 'AGENT-LIST*' ! -name 'CONTRIBUTING*' ! -name 'LICENSE*' ! -name 'UPSTREAM*' | wc -l) agent files)"
 
-# Build hermes-web-ui v0.5.8
+# Build hermes-web-ui v0.5.9
+# Aligned with upstream Dockerfile: NODE_OPTIONS + npm rebuild node-pty
 RUN rm -rf /tmp/hermes-web-ui && \
-    git clone --depth 1 --branch v0.5.8 https://github.com/EKKOLearnAI/hermes-web-ui.git /tmp/hermes-web-ui && \
+    git clone --depth 1 --branch v0.5.9 https://github.com/EKKOLearnAI/hermes-web-ui.git /tmp/hermes-web-ui && \
     cd /tmp/hermes-web-ui && \
-    echo "build-v0.5.8-$(date +%Y%m%d)" > .buildstamp && \
+    echo "build-v0.5.9-$(date +%Y%m%d)" > .buildstamp && \
     npm install --ignore-scripts 2>&1 | tail -5 && \
-    npm run build 2>&1 | tail -10 && \
+    npm rebuild node-pty 2>&1 | tail -5 && \
+    NODE_OPTIONS=--max-old-space-size=4096 npm run build 2>&1 | tail -10 && \
     mkdir -p /app/webui-server && \
     cp -r dist/server/* /app/webui-server/ && \
     mkdir -p /app/webui-client && \
@@ -97,8 +99,8 @@ RUN rm -rf /tmp/hermes-web-ui && \
     npm prune --omit=dev --prefix /tmp/hermes-web-ui 2>&1 | tail -3 && \
     cp -r node_modules /app/webui-server/node_modules && \
     rm -rf /tmp/hermes-web-ui && \
-    echo "v0.5.8" > /app/webui.version && \
-    echo "hermes-web-ui v0.5.8 build done"
+    echo "v0.5.9" > /app/webui.version && \
+    echo "hermes-web-ui v0.5.9 build done"
 
 # Create hermes home
 RUN mkdir -p /root/.hermes/plugins/image_gen/pollinations

start.sh

@@ -622,7 +622,7 @@ update_hermes_agent_background() {
 
 # ── Auto-update hermes-web-ui if newer release exists ──
 # Runs asynchronously so it doesn't block startup.
-# Check: GitHub releases/latest → compare with saved version → build if newer.
+# All output goes to /data/hermes/logs/auto-update.log (not stdout, which gets eaten by exec).
 # Set WEBUI_AUTO_UPDATE=false to disable.
 update_webui_background() {
     [ "${WEBUI_AUTO_UPDATE}" = "false" ] && return
@@ -634,6 +634,13 @@ update_webui_background() {
     WEBUI_INSTALL="/app/webui-server"
     WEBUI_CLIENT="/app/webui-client"
     API_URL="https://api.github.com/repos/${WEBUI_REPO}/releases/latest"
+    UPDATE_LOG="/data/hermes/logs/auto-update.log"
+
+    # Tee all output to log file for diagnostics
+    _log() { echo "[$(date)] $*"; }
+    _log_and_tee() { _log "$*" | tee -a "$UPDATE_LOG"; }
+
+    _log_and_tee "=== WebUI auto-update starting ==="
 
     # ── Detect rebuild: Dockerfile writes /app/webui.version, persistent is /data/hermes/ ──
     BUILD_VERSION="$(cat "$BUILD_VERSION_FILE" 2>/dev/null | head -1)"
@@ -641,10 +648,8 @@ update_webui_background() {
     NEED_FORCE=false
 
     if [ -n "$BUILD_VERSION" ] && [ -n "$RECORDED_VERSION" ] && [ "$BUILD_VERSION" != "$RECORDED_VERSION" ]; then
-        echo "[$(date)] WebUI auto-update: REBUILD DETECTED (Dockerfile=$BUILD_VERSION, recorded=$RECORDED_VERSION)"
-        echo "[$(date)] WebUI auto-update: code was reset to $BUILD_VERSION by container rebuild"
+        _log_and_tee "REBUILD DETECTED (Dockerfile=$BUILD_VERSION, recorded=$RECORDED_VERSION)"
         NEED_FORCE=true
-        # Reset baseline so version comparison works correctly
         CURRENT_VERSION="$BUILD_VERSION"
     elif [ -n "$RECORDED_VERSION" ]; then
         CURRENT_VERSION="$RECORDED_VERSION"
@@ -655,95 +660,124 @@ update_webui_background() {
         echo "$CURRENT_VERSION" > "$VERSION_FILE"
     fi
 
-    echo "[$(date)] WebUI auto-update: checking (current: $CURRENT_VERSION, Dockerfile: $BUILD_VERSION, latest: querying...)"
+    _log_and_tee "Checking: current=$CURRENT_VERSION, Dockerfile=$BUILD_VERSION, latest=?"
 
     # Query GitHub API for latest release tag
     LATEST_JSON=$(curl -sf --connect-timeout 10 --max-time 20 "$API_URL" 2>/dev/null)
     if [ $? -ne 0 ] || [ -z "$LATEST_JSON" ]; then
-        echo "[$(date)] WebUI auto-update: failed to reach GitHub API, skipping"
+        _log_and_tee "ERROR: failed to reach GitHub API, skipping"
         return
     fi
 
     LATEST_TAG=$(echo "$LATEST_JSON" | python3 -c "import json,sys; print(json.load(sys.stdin).get('tag_name',''))" 2>/dev/null)
     if [ -z "$LATEST_TAG" ]; then
-        echo "[$(date)] WebUI auto-update: could not parse latest tag, skipping"
+        _log_and_tee "ERROR: could not parse latest tag, skipping"
         return
     fi
 
-    echo "[$(date)] WebUI auto-update: latest release is $LATEST_TAG"
+    _log_and_tee "Latest release: $LATEST_TAG"
 
-    # Compare versions (strip leading 'v' for comparison)
+    # Compare versions
     CURRENT_NUM="${CURRENT_VERSION#v}"
     LATEST_NUM="${LATEST_TAG#v}"
 
-    # Skip if same or current is newer (unless rebuild detected)
     if [ "$CURRENT_NUM" = "$LATEST_NUM" ] && [ "$NEED_FORCE" = "false" ]; then
-        echo "[$(date)] WebUI auto-update: already on latest ($CURRENT_VERSION)"
+        _log_and_tee "Already on latest ($CURRENT_VERSION)"
         return
     fi
 
-    # Simple version comparison: split by dots and compare
     update_needed=false
     IFS='.' read -ra C <<< "$CURRENT_NUM"
     IFS='.' read -ra L <<< "$LATEST_NUM"
     for i in 0 1 2; do
         c=${C[$i]:-0}; l=${L[$i]:-0}
-        if [ "$l" -gt "$c" ] 2>/dev/null; then
-            update_needed=true; break
-        elif [ "$l" -lt "$c" ] 2>/dev/null; then
-            break
-        fi
+        if [ "$l" -gt "$c" ] 2>/dev/null; then update_needed=true; break; fi
+        if [ "$l" -lt "$c" ] 2>/dev/null; then break; fi
     done
 
     if [ "$update_needed" = "false" ] && [ "$NEED_FORCE" = "false" ]; then
-        echo "[$(date)] WebUI auto-update: current $CURRENT_VERSION is up to date"
+        _log_and_tee "Current $CURRENT_VERSION is up to date"
         return
     fi
 
     if [ "$NEED_FORCE" = "true" ] && [ "$update_needed" = "false" ]; then
-        echo "[$(date)] WebUI auto-update: re-applying $LATEST_TAG after rebuild (code was reset to $BUILD_VERSION)"
+        _log_and_tee "Re-applying $LATEST_TAG after rebuild (code reset to $BUILD_VERSION)"
     else
-        echo "[$(date)] WebUI auto-update: upgrading $CURRENT_VERSION → $LATEST_TAG ..."
+        _log_and_tee "Upgrading $CURRENT_VERSION -> $LATEST_TAG"
     fi
 
-    # Build in temp directory
-    rm -rf "$BUILD_TMP"
-    if ! git clone --depth 1 --branch "$LATEST_TAG" "https://github.com/${WEBUI_REPO}.git" "$BUILD_TMP" 2>&1 | tail -3; then
-        echo "[$(date)] WebUI auto-update: git clone failed, aborting"
-        rm -rf "$BUILD_TMP"
-        return
-    fi
+    # ── Build with retry (2 attempts) ──
+    for attempt in 1 2; do
+        _log_and_tee "Build attempt $attempt/2..."
 
-    cd "$BUILD_TMP"
-    if ! npm install --ignore-scripts 2>&1 | tail -5; then
-        echo "[$(date)] WebUI auto-update: npm install failed, aborting"
+        # Clone
         rm -rf "$BUILD_TMP"
-        return
-    fi
+        if ! git clone --depth 1 --branch "$LATEST_TAG" "https://github.com/${WEBUI_REPO}.git" "$BUILD_TMP" 2>&1 | tee -a "$UPDATE_LOG" | tail -3; then
+            _log_and_tee "ERROR: git clone failed"
+            rm -rf "$BUILD_TMP"
+            [ "$attempt" -lt 2 ] && sleep 10 && continue
+            return
+        fi
 
-    if ! npm run build 2>&1 | tail -10; then
-        echo "[$(date)] WebUI auto-update: npm build failed, aborting"
-        rm -rf "$BUILD_TMP"
-        return
-    fi
+        cd "$BUILD_TMP"
 
-    # Verify build output exists
-    if [ ! -d "$BUILD_TMP/dist/server" ] || [ ! -d "$BUILD_TMP/dist/client" ]; then
-        echo "[$(date)] WebUI auto-update: build output missing, aborting"
-        rm -rf "$BUILD_TMP"
-        return
-    fi
+        # Install (with timeout)
+        _log_and_tee "Running npm install..."
+        if ! timeout 120 npm install --ignore-scripts 2>&1 | tee -a "$UPDATE_LOG" | tail -5; then
+            _log_and_tee "ERROR: npm install failed/timed out"
+            rm -rf "$BUILD_TMP"
+            [ "$attempt" -lt 2 ] && sleep 10 && continue
+            return
+        fi
+
+        # Rebuild native modules (required by node-pty, matching upstream Dockerfile)
+        _log_and_tee "Running npm rebuild node-pty..."
+        npm rebuild node-pty 2>&1 | tee -a "$UPDATE_LOG" | tail -5
+
+        # Build (with memory limit, matching upstream Dockerfile)
+        _log_and_tee "Running npm run build (NODE_OPTIONS=--max-old-space-size=4096)..."
+        if ! timeout 180 env NODE_OPTIONS=--max-old-space-size=4096 npm run build 2>&1 | tee -a "$UPDATE_LOG" | tail -15; then
+            _log_and_tee "ERROR: npm build failed/timed out"
+            rm -rf "$BUILD_TMP"
+            [ "$attempt" -lt 2 ] && sleep 10 && continue
+            return
+        fi
+
+        # Verify build output
+        if [ ! -d "$BUILD_TMP/dist/server" ] || [ ! -d "$BUILD_TMP/dist/client" ]; then
+            _log_and_tee "ERROR: build output missing (no dist/server or dist/client)"
+            ls -la "$BUILD_TMP/dist/" 2>&1 | tee -a "$UPDATE_LOG"
+            rm -rf "$BUILD_TMP"
+            [ "$attempt" -lt 2 ] && sleep 10 && continue
+            return
+        fi
+
+        _log_and_tee "Build succeeded!"
+        break  # exit retry loop
+    done
 
     # Hot-swap: kill old WebUI process, replace files, restart
-    echo "[$(date)] WebUI auto-update: replacing files and restarting BFF..."
+    _log_and_tee "Hot-swapping: stopping old WebUI, replacing files..."
     OLD_WEBUI_PID=$(pgrep -f "node index.js" 2>/dev/null | head -1)
-    [ -n "$OLD_WEBUI_PID" ] && kill "$OLD_WEBUI_PID" 2>/dev/null && sleep 1
-
-    # Backup old, install new
-    cp -r "$BUILD_TMP/dist/server/"* "$WEBUI_INSTALL/" 2>/dev/null
-    cp -r "$BUILD_TMP/dist/client/"* "$WEBUI_CLIENT/" 2>/dev/null
+    if [ -n "$OLD_WEBUI_PID" ]; then
+        kill "$OLD_WEBUI_PID" 2>/dev/null
+        sleep 2
+        # Force kill if still running
+        kill -9 "$OLD_WEBUI_PID" 2>/dev/null
+        _log_and_tee "Killed old WebUI PID=$OLD_WEBUI_PID"
+    fi
+
+    # Install new files
+    rm -rf "$WEBUI_INSTALL" "$WEBUI_CLIENT"
+    mkdir -p "$WEBUI_INSTALL" "$WEBUI_CLIENT"
+    cp -r "$BUILD_TMP/dist/server/"* "$WEBUI_INSTALL/"
+    cp -r "$BUILD_TMP/dist/client/"* "$WEBUI_CLIENT/"
     cp "$BUILD_TMP/package.json" "$WEBUI_INSTALL/package.json"
-    cp -rn "$BUILD_TMP/node_modules/"* "$WEBUI_INSTALL/node_modules/" 2>/dev/null
+
+    # Install production-only node_modules
+    cd "$BUILD_TMP"
+    npm prune --omit=dev 2>&1 | tail -3
+    cp -r node_modules "$WEBUI_INSTALL/node_modules"
 
     # Save new version
     echo "$LATEST_TAG" > "$VERSION_FILE"
@@ -751,19 +785,22 @@ update_webui_background() {
 
     # Restart WebUI
     cd "$WEBUI_INSTALL"
+    export PORT=6060 UPSTREAM=http://127.0.0.1:8642 HERMES_HOME=/root/.hermes
+    export AUTH_TOKEN="${AUTH_TOKEN:-hermes-bot-2026}" CORS_ORIGINS="*" NODE_ENV=production
     node index.js >> /data/hermes/logs/webui.log 2>&1 &
     NEW_PID=$!
-    echo "[$(date)] WebUI auto-update: upgraded to $LATEST_TAG (new PID: $NEW_PID)"
+    _log_and_tee "WebUI upgraded to $LATEST_TAG (new PID: $NEW_PID)"
 
     # Verify
     sleep 3
-    if curl -s http://127.0.0.1:6060/health > /dev/null 2>&1; then
-        echo "[$(date)] WebUI auto-update: $LATEST_TAG is running and healthy ✓"
+    if curl -sf http://127.0.0.1:6060/health > /dev/null 2>&1; then
+        _log_and_tee "$LATEST_TAG is running and healthy"
     else
-        echo "[$(date)] WebUI auto-update: WARNING - new version health check failed"
+        _log_and_tee "WARNING: health check failed after upgrade"
     fi
 
     rm -rf "$BUILD_TMP"
+    _log_and_tee "=== WebUI auto-update complete ==="
 }
 
 # ── Start hermes-web-ui Node.js BFF server on :6060 ──