[grade=pending] QA sprint: commit 103 at-risk files from multi-agent sprint work

Committed by Hermes autonomous QA sprint 2026-08-13.
These files were modified during the Aug 12 sprint but never committed.

dashcaddy-api/src/docker/self-updater.js

@@ -10,12 +10,13 @@
 const EventEmitter = require('events');
 const https = require('https');
 const http = require('http');
+const { log } = require('../utils/logging');
 const fs = require('fs');
 const fsp = require('fs').promises;
 const path = require('path');
 const crypto = require('crypto');
 const os = require('os');
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 const platformPaths = require('../../platform-paths');
 const isWindows = platformPaths.isWindows;
 
@@ -86,7 +87,7 @@ class SelfUpdater extends EventEmitter {
   start() {
     if (!this.config.enabled || this.checkTimer) return;
 
-    console.log('[SelfUpdater] Starting auto-update checks every %ds', this.config.checkInterval / 1000);
+    log.info('updater', 'Starting auto-update checks', { intervalMs: this.config.checkInterval });
 
     // First check after a short delay (let server finish startup)
     setTimeout(() => {
@@ -124,7 +125,7 @@ class SelfUpdater extends EventEmitter {
         return { version: pkg.version, commit };
       } catch { /* try next candidate */ }
     }
-    console.error('[SelfUpdater] getLocalVersion failed: no candidate package.json found');
+    log.error('updater', 'getLocalVersion failed: no candidate package.json found');
     return { version: '0.0.0', commit: null };
   }
 
@@ -158,7 +159,7 @@ class SelfUpdater extends EventEmitter {
     // Fire-and-forget; the response shouldn't block on the container rebuild.
     setImmediate(() => {
       this._autoCheckAndApply().catch(err =>
-        console.error('[SelfUpdater] %s-triggered update error: %s', triggeredBy, err.message)
+        log.error('updater', err, { triggeredBy })
       );
     });
     return { accepted: true, triggeredBy };
@@ -174,7 +175,7 @@ class SelfUpdater extends EventEmitter {
       try {
         remote = await this._fetchJson(`${this.config.updateUrl}/version.json`);
       } catch (primaryErr) {
-        console.warn('[SelfUpdater] Primary server failed:', primaryErr.message, '— trying mirror');
+        log.warn('updater', 'Primary server failed, trying mirror', { error: primaryErr.message });
         try {
           remote = await this._fetchJson(`${this.config.mirrorUrl}/version.json`);
           sourceUrl = this.config.mirrorUrl;
@@ -240,7 +241,7 @@ class SelfUpdater extends EventEmitter {
       try {
         await this._downloadFile(primaryUrl, tarballPath);
       } catch (dlErr) {
-        console.warn('[SelfUpdater] Primary download failed:', dlErr.message, '— trying mirror');
+        log.warn('updater', 'Primary download failed, trying mirror', { error: dlErr.message });
         // Ensure file is fully cleaned up before mirror attempt
         try { fs.unlinkSync(tarballPath); } catch { /* ignore */ }
         await this._downloadFile(mirrorUrl, tarballPath);
@@ -468,11 +469,11 @@ class SelfUpdater extends EventEmitter {
     try {
       const result = await this.checkForUpdate();
       if (result.available && result.remote) {
-        console.log('[SelfUpdater] Update available: %s → %s', result.local.version, result.remote.version);
+        log.info('updater', 'Update available', { localVersion: result.local.version, remoteVersion: result.remote.version });
         await this.applyUpdate(result.remote);
       }
     } catch (e) {
-      console.error('[SelfUpdater] Auto-update error:', e.message);
+      log.error('updater', e, { phase: 'autoUpdate' });
     }
   }
 
@@ -606,7 +607,7 @@ class SelfUpdater extends EventEmitter {
       fs.mkdirSync(path.dirname(this.notifySecretFile), { recursive: true });
       fs.writeFileSync(this.notifySecretFile, `${secret}\n`, { mode: 0o600 });
     } catch (error) {
-      console.warn('[SelfUpdater] Failed to persist notify secret:', error.message);
+      log.warn('updater', 'Failed to persist notify secret', { error: error.message });
     }
     return secret;
   }
@@ -626,7 +627,7 @@ class SelfUpdater extends EventEmitter {
       fs.mkdirSync(path.dirname(this.config.instanceIdFile), { recursive: true });
       fs.writeFileSync(this.config.instanceIdFile, `${instanceId}\n`, 'utf8');
     } catch (error) {
-      console.warn('[SelfUpdater] Failed to persist instance ID:', error.message);
+      log.warn('updater', 'Failed to persist instance ID', { error: error.message });
     }
     return instanceId;
   }
@@ -644,7 +645,7 @@ class SelfUpdater extends EventEmitter {
     try {
       fs.writeFileSync(historyPath, JSON.stringify(history, null, 2));
     } catch (e) {
-      console.error('[SelfUpdater] Failed to save history:', e.message);
+      log.error('updater', e, { operation: 'saveHistory' });
     }
   }
 
@@ -713,7 +714,7 @@ class SelfUpdater extends EventEmitter {
     await fsp.mkdir(destDir, { recursive: true });
     // Use tar command (available on Linux, and Git Bash on Windows)
     try {
-      execSync(`tar xzf "${tarballPath}" -C "${destDir}" --strip-components=1`, { stdio: 'pipe' });
+      execFileSync('tar', ['xzf', tarballPath, '-C', destDir, '--strip-components=1'], { stdio: 'pipe' });
     } catch (e) {
       throw new Error('Failed to extract tarball: ' + e.message);
     }