@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.10 → 0.1.12

package/bin/reconcile-host

@@ -0,0 +1,111 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# `sudo adl reconcile --host NAME [--mode plan|apply]` -- one full pass of what
+# the 12-hourly job does (the job's program is `adl reconcile`, which runs this),
+# also run on demand:
+#
+#   1. tools: this package's bin/sync-and-reconcile with
+#      `--source npm --device NAME --owner OWNER` (npm update, then tools
+#      reconcile). The owner is the device's `administrator` in this package's
+#      manifest (bin/lib/fleet-host.sh, the lookup bin/setup shares). --mode is
+#      forwarded only when given, so the default is apply.
+#   2. repositories: `adl maintain --location <repo_location> --expect-user
+#      OWNER`, the package's own bin/adl, run AS THE ADMINISTRATOR -- never as
+#      root. sudo resets PATH to its secure_path, which has neither Homebrew nor
+#      /usr/local/bin, so PATH is always handed over explicitly with `env PATH=`
+#      (every sudo -u call that ends up running adl, git or bun must). --mode
+#      plan becomes --dry-run.
+#
+# Both steps always run (a failed tools step does not hide a repository problem,
+# and vice versa); the exit code is the first failure's, and each failure is
+# reported as an ERROR line. A host that declares no repo_location skips step 2
+# with a log line.
+#
+# ADL_SETUP_TEST_ROOT is the same single test switch bin/setup has: unset in
+# every real run; when set it only keeps the caller's PATH so `id`, `uname` and
+# `sudo` can be stubbed (packages/fleet/tests/reconcile-host.test.ts).
+
+if [[ -n "${ADL_SETUP_TEST_ROOT:-}" ]]; then
+  export PATH="${PATH:-/usr/bin:/bin}"
+else
+  export PATH="/usr/local/bin:/opt/homebrew/bin:/home/linuxbrew/.linuxbrew/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+fi
+
+host=""
+mode=""
+while [[ "$#" -gt 0 ]]; do
+  case "$1" in
+    --host) host="${2:-}"; shift 2 ;;
+    --mode) mode="${2:-}"; shift 2 ;;
+    *) echo "ERROR unknown argument: $1" >&2; exit 2 ;;
+  esac
+done
+[[ -n "$host" ]] || { echo "ERROR usage: sudo adl reconcile --host NAME [--mode plan|apply]" >&2; exit 2; }
+if [[ -n "$mode" && "$mode" != plan && "$mode" != apply ]]; then
+  echo "ERROR unsupported mode: $mode (expected plan or apply)" >&2
+  exit 2
+fi
+[[ "$(id -u)" -eq 0 ]] || { echo "ERROR adl reconcile must run as root: sudo adl reconcile --host $host" >&2; exit 1; }
+
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+package_dir="$(cd -- "$script_dir/.." && pwd)"
+# shellcheck source=lib/fleet-host.sh
+source "$script_dir/lib/fleet-host.sh"
+fleet_host_resolve "adl reconcile" "$package_dir/packages/fleet/manifest.json" "$host" || exit $?
+owner="$fleet_host_owner"
+repo_location="$fleet_host_repo_location"
+
+[[ -x "$script_dir/sync-and-reconcile" ]] || { echo "ERROR adl reconcile: package scheduler script is missing: $script_dir/sync-and-reconcile" >&2; exit 1; }
+
+# One lock around both steps: an on-demand run overlapping the timer must not
+# run a second repository pass after its tools step lost sync's own lock.
+if [[ -n "${ADL_SETUP_TEST_ROOT:-}" ]]; then
+  lock_dir="${ADL_SETUP_TEST_ROOT%/}/adl-reconcile.lock"
+else
+  lock_dir=/var/run/adl-reconcile.lock
+fi
+if ! mkdir "$lock_dir" 2>/dev/null; then
+  echo "ERROR adl reconcile: another reconcile is running (lock: $lock_dir)" >&2
+  exit 1
+fi
+trap 'rmdir -- "$lock_dir"' EXIT
+
+# 1. tools
+sync_args=(--source npm --device "$host" --owner "$owner")
+if [[ -n "$mode" ]]; then sync_args+=(--mode "$mode"); fi
+tools_rc=0
+"$script_dir/sync-and-reconcile" "${sync_args[@]}" || tools_rc=$?
+if [[ "$tools_rc" -ne 0 ]]; then
+  echo "ERROR global-tools: tools reconcile failed (exit $tools_rc)" >&2
+fi
+
+# 2. repositories
+repos_rc=0
+if [[ -z "$repo_location" ]]; then
+  echo "global-tools: repo maintenance skipped: $host declares no repo_location"
+else
+  adl_bin="$package_dir/bin/adl"
+  if [[ ! -x "$adl_bin" ]]; then
+    echo "ERROR global-tools: package adl is missing or not executable: $adl_bin" >&2
+    repos_rc=1
+  else
+    if [[ "$fleet_host_platform" == mac ]]; then
+      brew_bin_dir=/opt/homebrew/bin
+    else
+      brew_bin_dir=/home/linuxbrew/.linuxbrew/bin
+    fi
+    maintain_args=(maintain --location "$repo_location" --expect-user "$owner")
+    if [[ "$mode" == plan ]]; then maintain_args+=(--dry-run); fi
+    # /usr/local/bin first: git must resolve to the managed controller, which
+    # routes Azure DevOps traffic through the agent identity; Homebrew's git
+    # would bypass it.
+    sudo -u "$owner" -H env PATH="/usr/local/bin:$brew_bin_dir:/usr/bin:/bin" "$adl_bin" "${maintain_args[@]}" || repos_rc=$?
+    if [[ "$repos_rc" -ne 0 ]]; then
+      echo "ERROR global-tools: repository maintenance failed (exit $repos_rc)" >&2
+    fi
+  fi
+fi
+
+if [[ "$tools_rc" -ne 0 ]]; then exit "$tools_rc"; fi
+exit "$repos_rc"

package/bin/setup

@@ -0,0 +1,216 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# `sudo adl setup --host NAME` -- the whole onboarding of a host after
+# `npm install -g @amsterdamdatalabs/adl-agent-control`:
+#
+#   1. check this is THE package the job manages (the one in the owner's global
+#      npm root), and that its bin/adl is there
+#   2. run the first reconcile: `<this package>/bin/adl reconcile --host NAME`
+#   3. only if that succeeded, arm the job that re-runs the same command every
+#      12 hours
+#
+# A host that cannot reconcile is never left with a timer that fails unseen.
+# The job's program is the package's own bin/adl, not a shell script: on macOS
+# the one-time Full Disk Access grant (needed to read the repositories under the
+# host's repo_location) goes to that binary, and the launchd/systemd job and
+# `sudo adl reconcile --host NAME` are then literally the same command.
+#
+# Everything comes from this package: it locates itself from its own path and
+# reads packages/fleet/manifest.json beside it (no git checkout, no source
+# flag -- npm is the only source). The account the job runs npm as is the
+# device's `administrator` in that manifest; there is no owner flag.
+#
+# ADL_SETUP_TEST_ROOT is the one test switch (packages/fleet/tests/setup.test.ts):
+# unset in every real run. When set it relocates the system paths under that
+# directory and keeps the caller's PATH so the system commands can be stubbed.
+
+if [[ -n "${ADL_SETUP_TEST_ROOT:-}" ]]; then
+  export PATH="${PATH:-/usr/bin:/bin}"
+  # The sourced sync-and-reconcile has its own test switch; one switch here
+  # drives both, so a test sets only ADL_SETUP_TEST_ROOT.
+  export SYNC_AND_RECONCILE_TEST_ROOT="$ADL_SETUP_TEST_ROOT"
+else
+  export PATH="/usr/local/bin:/opt/homebrew/bin:/home/linuxbrew/.linuxbrew/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+fi
+
+host=""
+while [[ "$#" -gt 0 ]]; do
+  case "$1" in
+    --host) host="${2:-}"; shift 2 ;;
+    *) echo "ERROR unknown argument: $1" >&2; exit 2 ;;
+  esac
+done
+[[ -n "$host" ]] || { echo "ERROR usage: sudo adl setup --host NAME" >&2; exit 2; }
+[[ "$(id -u)" -eq 0 ]] || { echo "ERROR adl setup must run as root: sudo adl setup --host $host" >&2; exit 1; }
+
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+package_dir="$(cd -- "$script_dir/.." && pwd)"
+package_dir_real="$(cd -P -- "$script_dir/.." && pwd -P)"
+# shellcheck source=lib/fleet-host.sh
+source "$script_dir/lib/fleet-host.sh"
+fleet_host_resolve "adl setup" "$package_dir/packages/fleet/manifest.json" "$host" || exit $?
+owner="$fleet_host_owner"
+minute="$fleet_host_minute"
+
+# The job keeps THE package installed in the owner's global npm root up to date
+# and reconciles from it. This must be that package, or the host would be armed
+# to manage a different copy than the one the operator just ran. Ask npm the same
+# way the job does (the functions are the job's own, from the sibling
+# sync-and-reconcile), and compare real paths.
+[[ -f "$script_dir/sync-and-reconcile" ]] || { echo "ERROR adl setup: package scheduler script is missing: $script_dir/sync-and-reconcile" >&2; exit 1; }
+# shellcheck source=sync-and-reconcile
+SYNC_AND_RECONCILE_SOURCE_ONLY=1 source "$script_dir/sync-and-reconcile"
+os_name="$(uname -s)"
+npm_root="$(npm_global_root "$owner" "$os_name")" || {
+  echo "ERROR adl setup: cannot resolve the global npm root as $owner" >&2
+  exit 1
+}
+managed_dir="$(npm_platform_package_dir "$npm_root" "$os_name" "$(uname -m)")" || exit 1
+managed_real="$(cd -P -- "$managed_dir" 2>/dev/null && pwd -P)" || managed_real=""
+if [[ -z "$managed_real" || "$package_dir_real" != "$managed_real" ]]; then
+  {
+    echo "ERROR adl setup: this package ($package_dir_real) is not the package the scheduled job manages ($managed_dir)."
+    echo "ERROR adl setup: install it where the job looks, as $owner, then run setup again:"
+    echo "ERROR adl setup:   Linux: npm install -g --prefix /usr/local @amsterdamdatalabs/adl-agent-control"
+    echo "ERROR adl setup:   macOS: npm install -g @amsterdamdatalabs/adl-agent-control"
+  } >&2
+  exit 1
+fi
+
+adl_bin="$package_dir_real/bin/adl"
+[[ -x "$adl_bin" ]] || { echo "ERROR adl setup: the package adl is missing or not executable: $package_dir/bin/adl" >&2; exit 1; }
+
+if [[ -n "${ADL_SETUP_TEST_ROOT:-}" ]]; then
+  system_root="${ADL_SETUP_TEST_ROOT%/}"
+else
+  system_root=""
+fi
+legacy_adl_sync="$system_root/usr/local/libexec/adl-sync"
+launch_daemons_dir="$system_root/Library/LaunchDaemons"
+systemd_dir="$system_root/etc/systemd/system"
+brew_prefix="$system_root/home/linuxbrew/.linuxbrew"
+
+# Preflight that must hold before the first reconcile: the Linux job runs
+# Homebrew as a non-root owner, and that owner needs git's safe.directory for
+# the brew repositories or every `brew update` inside the reconcile fails.
+if [[ "$fleet_host_platform" == linux ]]; then
+  if [[ -d "$brew_prefix" ]]; then
+    brew_owner="$(stat -c '%U' "$brew_prefix")"
+    [[ "$brew_owner" != root ]] || {
+      echo "ERROR Homebrew prefix must be owned by a non-root account: /home/linuxbrew/.linuxbrew" >&2
+      exit 1
+    }
+  else
+    echo "ERROR Homebrew prefix missing: /home/linuxbrew/.linuxbrew" >&2
+    exit 1
+  fi
+  for brew_repo in \
+    "$brew_prefix/Homebrew" \
+    "$brew_prefix/Homebrew/Library/Taps/adl-tan-theta/homebrew-tap"; do
+    [[ -d "$brew_repo/.git" ]] || continue
+    if ! (cd /tmp && sudo -u "$brew_owner" -H git config --global --get-all safe.directory 2>/dev/null) | grep -Fxq "$brew_repo"; then
+      (cd /tmp && sudo -u "$brew_owner" -H git config --global --add safe.directory "$brew_repo")
+    fi
+  done
+fi
+
+mkdir -p "$system_root/var/lib/adl" "$system_root/var/log/adl"
+
+echo "adl setup: first reconcile for $host (owner $owner)"
+reconcile_rc=0
+"$adl_bin" reconcile --host "$host" || reconcile_rc=$?
+if [[ "$reconcile_rc" -ne 0 ]]; then
+  echo "ERROR adl setup: first reconcile failed (exit $reconcile_rc); scheduler NOT armed. Fix the failure and re-run: sudo adl setup --host $host" >&2
+  exit "$reconcile_rc"
+fi
+
+case "$fleet_host_platform" in
+  mac)
+    mkdir -p "$launch_daemons_dir"
+    plist="$launch_daemons_dir/com.adl.global-tools.plist"
+    {
+      printf '%s\n' '<?xml version="1.0" encoding="UTF-8"?>'
+      printf '%s\n' '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">'
+      printf '%s\n' '<plist version="1.0"><dict>'
+      printf '%s\n' '<key>Label</key><string>com.adl.global-tools</string>'
+      printf '%s\n' '<key>ProgramArguments</key><array>'
+      printf '<string>%s</string>\n' "$adl_bin"
+      printf '%s\n' '<string>reconcile</string>'
+      printf '<string>--host</string><string>%s</string>\n' "$host"
+      printf '%s\n' '</array>'
+      printf '%s\n' '<key>StartCalendarInterval</key><array>'
+      for hour in 0 12; do printf '<dict><key>Hour</key><integer>%s</integer><key>Minute</key><integer>%s</integer></dict>\n' "$hour" "$minute"; done
+      printf '%s\n' '</array><key>ProcessType</key><string>Background</string>'
+      printf '%s\n' '<key>StandardOutPath</key><string>/var/log/adl/stdout.log</string>'
+      printf '%s\n' '<key>StandardErrorPath</key><string>/var/log/adl/stderr.log</string>'
+      printf '%s\n' '</dict></plist>'
+    } >"$plist"
+    chown root:wheel "$plist"
+    chmod 0644 "$plist"
+    plutil -lint "$plist"
+    # bootout fails when the job is not loaded, so ask first instead of
+    # swallowing the error: a bootout that fails on a loaded job must stop us.
+    if launchctl print system/com.adl.global-tools >/dev/null 2>&1; then
+      launchctl bootout system/com.adl.global-tools
+      # bootout returns before launchd has finished unloading, and a
+      # bootstrap in that window fails with an I/O error. Wait until the
+      # label is really gone, bounded, and fail loud if it is not.
+      unloaded=0
+      for _ in 1 2 3 4 5 6 7 8 9 10; do
+        if ! launchctl print system/com.adl.global-tools >/dev/null 2>&1; then unloaded=1; break; fi
+        sleep 0.5
+      done
+      [[ "$unloaded" -eq 1 ]] || {
+        echo "ERROR adl setup: com.adl.global-tools is still loaded after bootout (waited 5s); not bootstrapping. Run: sudo launchctl bootout system/com.adl.global-tools" >&2
+        exit 1
+      }
+    fi
+    launchctl bootstrap system "$plist"
+    ;;
+  linux)
+    mkdir -p "$systemd_dir"
+    cat > "$systemd_dir/adl-global-tools.service" <<EOF
+[Unit]
+Description=Reconcile Adl global tools and repositories (adl reconcile)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=$adl_bin reconcile --host $host
+StandardOutput=append:/var/log/adl/stdout.log
+StandardError=append:/var/log/adl/stderr.log
+Nice=10
+IOSchedulingClass=best-effort
+IOSchedulingPriority=7
+TimeoutStartSec=3h
+EOF
+    cat > "$systemd_dir/adl-global-tools.timer" <<EOF
+[Unit]
+Description=Run Adl global-tool reconciliation every 12 hours
+
+[Timer]
+OnCalendar=*-*-* 00,12:$minute:00
+Persistent=true
+Unit=adl-global-tools.service
+
+[Install]
+WantedBy=timers.target
+EOF
+    systemctl daemon-reload
+    systemctl enable --now adl-global-tools.timer
+    # enable --now leaves an already-active timer on its old schedule.
+    systemctl restart adl-global-tools.timer
+    ;;
+esac
+
+# The job used to run a copy of bin/sync-and-reconcile installed here. Its
+# definition now points at the package's adl, so the copy is dead weight that
+# would keep running stale update logic if anyone invoked it.
+if [[ -e "$legacy_adl_sync" ]]; then
+  rm -f -- "$legacy_adl_sync"
+  echo "adl setup: removed the legacy scheduler copy $legacy_adl_sync"
+fi
+
+echo "adl setup: $host reconciled and armed (every 12 hours at minute $minute); run on demand with: sudo adl reconcile --host $host"

package/bin/sync-and-reconcile

@@ -13,14 +13,14 @@ sync_and_reconcile_platform() {
   case "$(uname -s)" in
     Darwin) printf '%s\n' mac ;;
     Linux) printf '%s\n' linux ;;
-    *) echo "unsupported operating system for scheduled sync: $(uname -s)" >&2; return 1 ;;
+    *) echo "ERROR unsupported operating system for scheduled sync: $(uname -s)" >&2; return 1 ;;
   esac
 }
 
 require_linux_automation_root() {
   local platform="$1" owner="$2"
   if [[ "$platform" == linux && "$owner" != root ]]; then
-    echo "global-tools: Linux scheduled sync must run as root; got --owner $owner" >&2
+    echo "ERROR global-tools: Linux scheduled sync must run as root; got --owner $owner" >&2
     return 1
   fi
 }
@@ -35,7 +35,7 @@ parse_sync_source() {
   done
   case "$sync_source" in
     npm|checkout) ;;
-    *) echo "unsupported source: $sync_source" >&2; return 2 ;;
+    *) echo "ERROR unsupported source: $sync_source" >&2; return 2 ;;
   esac
 }
 
@@ -45,12 +45,12 @@ npm_package_spec() {
     latest-stable) printf '%s@latest\n' '@amsterdamdatalabs/adl-agent-control' ;;
     pinned)
       [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$ ]] || {
-        echo "pinned update_policy requires a valid installed package version" >&2
+        echo "ERROR pinned update_policy requires a valid installed package version" >&2
         return 1
       }
       printf '%s@%s\n' '@amsterdamdatalabs/adl-agent-control' "$version"
       ;;
-    *) echo "unsupported update_policy: $policy" >&2; return 1 ;;
+    *) echo "ERROR unsupported update_policy: $policy" >&2; return 1 ;;
   esac
 }
 
@@ -59,9 +59,33 @@ npm_platform_package_dir() {
   case "$os:$arch" in
     Darwin:arm64) platform=darwin-arm64 ;;
     Linux:x86_64) platform=linux-x64 ;;
-    *) echo "unsupported platform for npm package: $os $arch" >&2; return 1 ;;
+    *) echo "ERROR unsupported platform for npm package: $os $arch" >&2; return 1 ;;
   esac
-  printf '%s/@amsterdamdatalabs/adl-agent-control-%s\n' "${npm_root%/}" "$platform"
+  # A global install nests optionalDependencies under the wrapper; npm never
+  # hoists them to the global root.
+  printf '%s/@amsterdamdatalabs/adl-agent-control/node_modules/@amsterdamdatalabs/adl-agent-control-%s\n' "${npm_root%/}" "$platform"
+}
+
+# Sets the `npm_env` array the owner's npm runs under: the same PATH and, on
+# Linux, the same /usr/local prefix for every npm call this job makes. bin/setup
+# sources this file and uses npm_global_root below, so it asks npm the very
+# same question the scheduled job does.
+resolve_npm_env() {
+  local os="$1" npm_path
+  case "$os" in
+    Darwin) npm_path=/opt/homebrew/bin:/usr/bin:/bin ;;
+    Linux) npm_path=/home/linuxbrew/.linuxbrew/bin:/usr/bin:/bin ;;
+    *) echo "ERROR unsupported operating system for npm package: $os" >&2; return 1 ;;
+  esac
+  npm_env=(PATH="$npm_path")
+  if [[ "$os" == Linux ]]; then npm_env=(npm_config_prefix=/usr/local PATH="$npm_path"); fi
+}
+
+# Prints OWNER's global npm root (`npm root -g` as that user, under npm_env).
+npm_global_root() {
+  local owner="$1" os="$2"
+  resolve_npm_env "$os" || return 1
+  sudo -u "$owner" -H env "${npm_env[@]}" npm root -g
 }
 
 prepare_adl_npm_migration() {
@@ -72,7 +96,7 @@ prepare_adl_npm_migration() {
   previous_executable="$(jq -r --arg platform "$platform" --arg device "$device" '(.[$platform].common.tools // {}) * (.[$platform].devices[$device].tools // {}) | .adl.executable // empty' "$applied_manifest")" || return 1
   [[ "$previous_manager" == bun-compile && "$previous_executable" == /usr/local/bin/adl ]] || return 0
   [[ -f "$legacy_adl" && ! -L "$legacy_adl" ]] || {
-    echo "prior manifest proves adl was a Bun binary, but the expected regular file is missing or is a symlink: $legacy_adl" >&2
+    echo "ERROR prior manifest proves adl was a Bun binary, but the expected regular file is missing or is a symlink: $legacy_adl" >&2
     return 1
   }
   rm -f -- "$legacy_adl"
@@ -96,39 +120,37 @@ while [[ "$#" -gt 0 ]]; do
     --repo) repo="${2:-}"; shift 2 ;;
     --owner) owner="${2:-}"; shift 2 ;;
     --mode) mode="${2:-}"; shift 2 ;;
-    *) echo "unknown argument: $1" >&2; exit 2 ;;
+    *) echo "ERROR unknown argument: $1" >&2; exit 2 ;;
   esac
 done
 case "$sync_source" in
   npm|checkout) ;;
-  *) echo "unsupported source: $sync_source" >&2; exit 2 ;;
+  *) echo "ERROR unsupported source: $sync_source" >&2; exit 2 ;;
 esac
 [[ -n "$device" && -n "$owner" ]] || {
-  echo "usage: sync-and-reconcile [--source npm|checkout] --device NAME --owner USER [--repo PATH] [--mode audit|plan|apply]" >&2
+  echo "ERROR usage: sync-and-reconcile [--source npm|checkout] --device NAME --owner USER [--repo PATH] [--mode audit|plan|apply]" >&2
   exit 2
 }
 [[ "$mode" == audit || "$mode" == plan || "$mode" == apply ]] || {
-  echo "unsupported reconcile mode: $mode" >&2
+  echo "ERROR unsupported reconcile mode: $mode" >&2
   exit 2
 }
 if [[ "$sync_source" == checkout && -z "$repo" ]]; then
-  echo "checkout source requires --repo PATH" >&2
+  echo "ERROR checkout source requires --repo PATH" >&2
   exit 2
 fi
 if [[ "$sync_source" == npm && -n "$repo" ]]; then
-  echo "npm source does not accept --repo; use --source checkout for a checkout path" >&2
+  echo "ERROR npm source does not accept --repo; use --source checkout for a checkout path" >&2
   exit 2
 fi
 
 if [[ -n "${SYNC_AND_RECONCILE_TEST_ROOT:-}" ]]; then
   lock_dir="${SYNC_AND_RECONCILE_TEST_ROOT%/}/adl-sync.lock"
-  scheduler_path="${SYNC_AND_RECONCILE_TEST_ROOT%/}/scheduler"
 else
   lock_dir=/var/run/adl-sync.lock
-  scheduler_path=/usr/local/libexec/adl-sync
 fi
 if ! mkdir "$lock_dir" 2>/dev/null; then
-  echo "global-tools: another reconciliation is running (lock: $lock_dir)" >&2
+  echo "ERROR global-tools: another reconciliation is running (lock: $lock_dir)" >&2
   exit 1
 fi
 trap 'rmdir "$lock_dir" 2>/dev/null || true' EXIT
@@ -137,28 +159,22 @@ host_platform="$(sync_and_reconcile_platform)"
 require_linux_automation_root "$host_platform" "$owner" || exit 1
 
 if [[ "$sync_source" == checkout ]]; then
-  [[ -e "$repo/.git" ]] || { echo "developer checkout missing: $repo" >&2; exit 1; }
+  [[ -e "$repo/.git" ]] || { echo "ERROR developer checkout missing: $repo" >&2; exit 1; }
   manifest="$repo/packages/fleet/manifest.json"
-  [[ -f "$manifest" ]] || { echo "developer checkout manifest missing: $manifest" >&2; exit 1; }
-  [[ -x "$repo/bin/reconcile" ]] || { echo "developer checkout reconcile is missing: $repo/bin/reconcile" >&2; exit 1; }
+  [[ -f "$manifest" ]] || { echo "ERROR developer checkout manifest missing: $manifest" >&2; exit 1; }
+  [[ -x "$repo/bin/reconcile" ]] || { echo "ERROR developer checkout reconcile is missing: $repo/bin/reconcile" >&2; exit 1; }
   echo "global-tools: source=checkout (developer mode)"
   reconcile_dir="$repo/bin"
 else
   os="$(uname -s)"
   arch="$(uname -m)"
-  case "$os" in
-    Darwin) npm_path=/opt/homebrew/bin:/usr/bin:/bin ;;
-    Linux) npm_path=/home/linuxbrew/.linuxbrew/bin:/usr/bin:/bin ;;
-    *) echo "unsupported operating system for npm package: $os" >&2; exit 1 ;;
-  esac
-  npm_env=(PATH="$npm_path")
-  if [[ "$os" == Linux ]]; then npm_env=(npm_config_prefix=/usr/local PATH="$npm_path"); fi
-  npm_root="$(sudo -u "$owner" -H env "${npm_env[@]}" npm root -g)" || {
-    echo "cannot resolve the global npm root as $owner" >&2
+  resolve_npm_env "$os" || exit 1
+  npm_root="$(npm_global_root "$owner" "$os")" || {
+    echo "ERROR cannot resolve the global npm root as $owner" >&2
     exit 1
   }
   [[ "$npm_root" == /*/lib/node_modules ]] || {
-    echo "global npm root has an unsupported path: $npm_root" >&2
+    echo "ERROR global npm root has an unsupported path: $npm_root" >&2
     exit 1
   }
   npm_prefix="${npm_root%/lib/node_modules}"
@@ -167,14 +183,14 @@ else
   package_spec=""
   if [[ -f "$installed_manifest" ]]; then
     update_policy="$(jq -er '.config.update_policy | select(type == "string")' "$installed_manifest")" || {
-      echo "installed adl package manifest has no config.update_policy: $installed_manifest" >&2
+      echo "ERROR installed adl package manifest has no config.update_policy: $installed_manifest" >&2
       exit 1
     }
     case "$update_policy" in
       latest-stable) package_spec="$(npm_package_spec latest-stable)" ;;
       pinned)
         pinned_version="$(jq -er --arg platform "$host_platform" '.[$platform].common.tools.adl.version | select(type == "string")' "$installed_manifest")" || {
-          echo "installed adl package manifest requires a version for pinned update_policy: $installed_manifest" >&2
+          echo "ERROR installed adl package manifest requires a version for pinned update_policy: $installed_manifest" >&2
           exit 1
         }
         package_spec="$(npm_package_spec pinned "$pinned_version")" || exit 1
@@ -199,15 +215,12 @@ else
   prepare_adl_npm_migration "$applied_manifest" "$device" "$host_platform" "$legacy_adl" "$legacy_hash"
 
   sudo -u "$owner" -H env "${npm_env[@]}" npm install --global --prefix "$npm_prefix" --no-audit --no-fund "$package_spec"
-  [[ -d "$platform_dir" ]] || { echo "npm install did not create the platform package: $platform_dir" >&2; exit 1; }
+  [[ -d "$platform_dir" ]] || { echo "ERROR npm install did not create the platform package: $platform_dir" >&2; exit 1; }
   installed_manifest="$platform_dir/packages/fleet/manifest.json"
-  [[ -f "$installed_manifest" ]] || { echo "installed adl package manifest missing: $installed_manifest" >&2; exit 1; }
-  [[ -x "$platform_dir/bin/reconcile" ]] || { echo "installed adl package reconcile is missing: $platform_dir/bin/reconcile" >&2; exit 1; }
-  [[ -x "$platform_dir/bin/sync-and-reconcile" ]] || { echo "installed adl package scheduler is missing: $platform_dir/bin/sync-and-reconcile" >&2; exit 1; }
-  [[ -x "$platform_dir/bin/validate-manifest" ]] || { echo "installed adl package manifest validator is missing: $platform_dir/bin/validate-manifest" >&2; exit 1; }
+  [[ -f "$installed_manifest" ]] || { echo "ERROR installed adl package manifest missing: $installed_manifest" >&2; exit 1; }
+  [[ -x "$platform_dir/bin/reconcile" ]] || { echo "ERROR installed adl package reconcile is missing: $platform_dir/bin/reconcile" >&2; exit 1; }
+  [[ -x "$platform_dir/bin/validate-manifest" ]] || { echo "ERROR installed adl package manifest validator is missing: $platform_dir/bin/validate-manifest" >&2; exit 1; }
   "$platform_dir/bin/validate-manifest" "$installed_manifest"
-  install -m 0755 "$platform_dir/bin/sync-and-reconcile" "$scheduler_path.new"
-  mv "$scheduler_path.new" "$scheduler_path"
   reconcile_dir="$platform_dir/bin"
 fi
 

package/bin/validate-manifest

@@ -15,7 +15,7 @@ if ! jq -e '
   .config.schema == 1 and
   (.config.repository | type == "string" and test("^https://dev\\.azure\\.com/[A-Za-z0-9._-]+/[A-Za-z0-9._-]+/_git/[A-Za-z0-9._-]+$")) and
   .config.branch == "main" and
-  .config.interval_seconds == 21600 and
+  .config.interval_seconds == 43200 and
   .config.update_policy == "latest-stable" and
   .config.allow_major_updates == true and
   .config.remove_deleted_entries == true and
@@ -43,28 +43,21 @@ if ! jq -e '
     all(.minimum_free_gib >= 1) and
     all((.home | type) == "string" and (.home | startswith("/"))) and
     all((.default_agent | type) == "string" and (.default_agent | test("^agent-[a-z0-9-]+$"))) and
-    all((keys - ["administrator", "default_agent", "home", "launch_agents", "minimum_free_gib", "schedule_minute", "scratch_repos", "brew_upgrade_all", "surface_clis", "git_maintain_repos", "tools"] | length) == 0) and
+    all((keys - ["administrator", "default_agent", "home", "minimum_free_gib", "schedule_minute", "scratch_repos", "brew_upgrade_all", "surface_clis", "repo_location", "tools"] | length) == 0) and
     all((.scratch_repos // []) | type == "array" and (. | unique | length) == length and
       all(type == "string" and startswith("/") and . != "/" and
         (endswith("/") | not) and (contains("..") | not) and (test("\\s") | not))) and
-    # git_maintain_repos (2026-09-30): an explicit, closed list of
-    # repositories bin/reconcile passes to git-maintain via --repo argv --
-    # never a recursive scan root, deliberately, since these devices own
-    # checkouts that sit at a fixed path outside any device home (the Linux
-    # VPSes use /opt/adl-azdo) and a recursive scan of a shared parent like
-    # /opt would also walk into unrelated, explicitly off-limits
-    # directories. The azagent/vsts.agent substring bans are exactly that
-    # guard, enforced at the schema layer (case-insensitively -- a manifest
-    # value could be typed AzAgent2 as easily as azagent2) so a mistyped or
-    # copy-pasted entry can never point there. git-maintain itself refuses
-    # the same names again, case-insensitively and by realpath too, at the
-    # point of actual use (jobs/git-maintain/src/main.ts,
-    # isForbiddenAzurePipelinesPath) -- this schema check alone only ever
-    # sees the manifest literal string, never what a symlink resolves to.
-    all((.git_maintain_repos // []) | type == "array" and (. | unique | length) == length and
-      all(type == "string" and startswith("/") and . != "/" and
-        (endswith("/") | not) and (contains("..") | not) and (test("\\s") | not) and
-        (ascii_downcase | contains("azagent") | not) and (ascii_downcase | contains("vsts.agent") | not))) and
+    # repo_location (2026-09-30): the ONE directory `adl reconcile` maintains
+    # repositories under (immediate children carrying adl-config.toml only). It
+    # is the whole scope of that step, so it must be an exact absolute directory
+    # path: never "/", no trailing slash, no "..", no whitespace. The
+    # azagent/vsts.agent substring bans keep it off Azure Pipelines agent
+    # installs (case-insensitively -- a value could be typed AzAgent2 as easily
+    # as azagent2); the maintenance step refuses the same names again, by
+    # realpath too, at the point of use.
+    all((.repo_location // "/ok") | type == "string" and startswith("/") and . != "/" and
+      (endswith("/") | not) and (contains("..") | not) and (test("\\s") | not) and
+      (ascii_downcase | contains("azagent") | not) and (ascii_downcase | contains("vsts.agent") | not)) and
     all((.brew_upgrade_all // false) | type == "boolean") and
     all(
       (.surface_clis // []) as $surfaces |
@@ -159,30 +152,8 @@ if ! jq -e '
       ((.allow_scripts // []) | type == "array" and
         all(type == "string" and test("^(@[a-z0-9][a-z0-9._-]*/)?[a-z0-9][a-z0-9._-]*$")))
     else true end)) and
-  (.linux.common | has("launch_agents") | not) and
-  ([.linux.devices[] | has("launch_agents")] | any | not) and
-  (.mac.common.launch_agents["git-maintain"] as $job |
-    ($job | type == "object") and
-    ($job.repo_scope | type == "object" and keys == ["glob", "recursive", "root"] and
-      (.root | relpath) and .glob == "*" and .recursive == true) and
-    ($job.environment | has("GIT_MAINTAIN_ROOT") | not) and
-    ($job.environment | has("GIT_MAINTAIN_GLOB") | not)) and
-  ([.mac.common.launch_agents, .mac.devices[].launch_agents] | map(. // {}) |
-    all(type == "object") and
-    ([.[] | to_entries[] | .value] |
-      all(
-        type == "object" and
-        (keys - ["label", "source", "entry", "start_interval_seconds", "run_at_load", "environment", "log", "replaces", "repo_scope"] | length == 0) and
-        ((.label | type) == "string" and (.label | test("^[A-Za-z0-9][A-Za-z0-9._-]*$"))) and
-        (.source | relpath) and
-        (.entry | relpath) and
-        ((.start_interval_seconds | type) == "number" and .start_interval_seconds >= 60 and (.start_interval_seconds | floor) == .start_interval_seconds) and
-        ((.run_at_load | type) == "boolean") and
-        ((.environment | type) == "object" and (.environment | to_entries | all((.key | test("^[A-Z_][A-Z0-9_]*$")) and (.value | type) == "string"))) and
-        (.log | relpath) and
-        ((.replaces // []) | type == "array" and all(relpath))
-      ) and
-      (map(.label) | length == (unique | length))))
+  # launch_agents are gone (2026-09-30): a stale declaration must fail loud.
+  ([.mac.common, .linux.common] | all(keys - ["os_upgrade", "tools"] | length == 0))
 ' "$manifest" >/dev/null; then
   echo "global-tools manifest: INVALID ($manifest does not satisfy bin/validate-manifest's schema)" >&2
   exit 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amsterdamdatalabs/adl-agent-control-linux-x64",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "description": "adl CLI binary for linux/x64 (agent identity + Azure DevOps front door — see docs/architecture/cli-design.md)",
   "license": "UNLICENSED",
   "os": [
@@ -14,8 +14,6 @@
     "packages/fleet/manifest.json",
     "packages/fleet/manifest.schema.json",
     "packages/fleet/src",
-    "packages/fleet/jobs",
-    "packages/fleet/systemd",
     "packages/agent-settings/surface-policy.json",
     "packages/agent-settings/protected.json",
     "packages/agent-settings/src",

package/packages/agent-hooks/package.json

@@ -8,8 +8,7 @@
     "start": "bun src/main.ts",
     "build": "bun ../../workflows/scripts/build/agent-hooks/build.ts",
     "typecheck": "tsc --noEmit",
-    "test": "bun test --timeout 30000",
-    "test:coverage": "bun test --coverage --timeout 30000",
+    "test": "bun test --coverage --timeout 30000",
     "check": "bun run typecheck && bun test --coverage"
   },
   "dependencies": {