sync: update from private repo (2336949a)

scripts/server.sh

@@ -113,7 +113,12 @@ do_start() {
     echo "         If a previous run was not stopped cleanly, stop it first to avoid port/DB conflicts."
   fi
 
+  # The log captures stdout, which on a fresh non-loopback install includes the
+  # generated admin password (#1024). Keep it owner-only — the password file it
+  # is printed alongside is 0600, and a world-readable copy in logs/ would undo
+  # that. Applied every start so an existing log gets tightened too.
   mkdir -p "$(dirname "$LOG_FILE")"
+  touch "$LOG_FILE" && chmod 600 "$LOG_FILE"
 
   echo "Checking runtime dependencies..."
   "$SCRIPT_DIR/prepare.sh"
@@ -121,6 +126,11 @@ do_start() {
   echo "Building..."
   npm run build --silent 2>&1 | tail -1
 
+  if [[ "${AAO_MODE:-worker}" == "worker" ]]; then
+    echo "Running database migrations..."
+    node dist/scripts/migrate-db.js
+  fi
+
   echo "Starting server on port $PORT..."
   # AAO is a single binary with two modes (dist/main.js dispatches):
   #   AAO_MODE=worker  (default) — full orchestrator (DB + bridge API + workers)
@@ -145,7 +155,10 @@ do_start() {
   else
     rm -f "$PID_FILE"
     echo "Server failed to start. Check $LOG_FILE"
-    tail -5 "$LOG_FILE"
+    # 20 lines, not 5 (#1235): a fatal error is logged as one multi-line record
+    # whose stack trace lands *after* the explanation, so a short tail shows the
+    # call sites and cuts off the part that says how to fix it.
+    tail -20 "$LOG_FILE"
     return 1
   fi
 }