@danypops/pi-packed 0.26.0 → 0.27.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danypops/pi-packed",
-  "version": "0.26.0",
+  "version": "0.27.1",
   "description": "Pi package lifecycle, validation, daemon, tools, profiles, and TUI",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
     "typecheck": "bunx tsc --noEmit"
   },
   "dependencies": {
-    "@danypops/armada": "^0.4.8",
+    "@danypops/armada": "^0.4.9",
     "@danypops/packed": "^0.7.0",
     "@danypops/pi-extension-harness": "^0.7.0",
     "@danypops/vehicle-client": "^0.8.1",

package/service/src/daemon/daemon-service.ts

@@ -25,8 +25,10 @@
  * step isn't a real convention, so detection reads what's already true
  * on disk instead of asking for one more declaration.
  */
+import { spawn } from "node:child_process";
 import { readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { createVehicleRegistrar, type VehicleRegistrar, type VehicleRegistrationOutcome, type VehicleSpec } from "@danypops/armada";
 import { resolveDaemonPaths } from "@danypops/vehicle-server/paths";
 import {
@@ -439,6 +441,63 @@ const PACKED_PACKAGE_NAME = "@danypops/pi-packed";
  * daemonOptions() -- vehicleName: PACKED_VEHICLE_NAME). One canonical name, not two. */
 export const PACKED_VEHICLE_NAME = "pi-packed";
 const SELF_REGISTRATION_REASON = "Packed cannot replace its own Armada service from inside the running daemon";
+const SELF_RESTART_SCHEDULED_REASON = "self-restart scheduled via a detached armada CLI process";
+/** Long enough for the HTTP response carrying this reason back to the caller to flush before the
+ * detached child's `armada restart` stops this very process. */
+const SELF_RESTART_DELAY_MS = 500;
+
+/**
+ * Builds the command to launch armada's own `restart pi-packed` out-of-process. Plain
+ * `spawn(..., { detached: true }).unref()` is NOT enough on Linux: systemd's default
+ * KillMode=control-group kills every process in a unit's cgroup on `stop`, including a
+ * detached+unref'd child -- setsid() escapes a Unix process group, not a cgroup. Confirmed
+ * live: a bare detached spawn was killed mid-restart the instant the child's own `armada
+ * restart`'s `stop` step fired, because the child was still inside armada-pi-packed's own
+ * cgroup. `systemd-run --user --collect --unit=<name>` launches it as an independent
+ * transient unit with its own cgroup instead, immune to this unit's stop (confirmed live:
+ * a probe unit's child outlived its own service being stopped). launchd/Windows don't tear
+ * down a detached child's process tree the same way, so they use a plain spawn.
+ */
+export function selfRestartCommand(
+	platform: NodeJS.Platform,
+	execPath: string,
+	cliPath: string,
+	unitName: string,
+): { readonly command: string; readonly arguments: readonly string[] } {
+	if (platform === "linux") {
+		return {
+			command: "systemd-run",
+			arguments: ["--user", "--collect", `--unit=${unitName}`, "--", execPath, cliPath, "restart", PACKED_VEHICLE_NAME, "--json"],
+		};
+	}
+	return { command: execPath, arguments: [cliPath, "restart", PACKED_VEHICLE_NAME, "--json"] };
+}
+
+/** Fire-and-forget: schedule Packed's own Vehicle to restart from OUTSIDE this process (see
+ * selfRestartCommand for why a plain detached spawn alone doesn't survive on Linux). Runs a
+ * beat later so the response reporting "scheduled" has time to flush first. Swallows a
+ * resolution/spawn failure silently: worst case is the pre-existing behavior (a human restarts
+ * the service by hand), never a crash. */
+export type SelfRestartScheduler = (spec: ServiceSpec) => void;
+
+export const scheduleSelfRestart: SelfRestartScheduler = (_spec) => {
+	let cliPath: string;
+	try {
+		cliPath = fileURLToPath(import.meta.resolve("@danypops/armada/cli"));
+	} catch {
+		return;
+	}
+	setTimeout(() => {
+		try {
+			const unitName = `armada-selfrestart-${PACKED_VEHICLE_NAME}-${process.pid}-${Date.now()}`;
+			const { command, arguments: arguments_ } = selfRestartCommand(process.platform, process.execPath, cliPath, unitName);
+			const child = spawn(command, arguments_, { detached: true, stdio: "ignore" });
+			child.unref();
+		} catch {
+			/* best-effort -- a human can still restart the service by hand */
+		}
+	}, SELF_RESTART_DELAY_MS).unref();
+};
 
 /**
  * Sweeps every installed Packed package (global scope, plus a project's own
@@ -557,7 +616,10 @@ export interface DaemonServiceInstaller {
  * path/native controller are resolved once, not on every call.
  */
 export class RealDaemonServiceInstaller implements DaemonServiceInstaller {
-	constructor(private readonly registrar: VehicleRegistrar = createVehicleRegistrar()) {}
+	constructor(
+		private readonly registrar: VehicleRegistrar = createVehicleRegistrar(),
+		private readonly selfRestart: SelfRestartScheduler = scheduleSelfRestart,
+	) {}
 
 	async listRegisteredVehicles(): Promise<readonly VehicleSpec[]> {
 		return this.registrar.listRegistered();
@@ -600,7 +662,8 @@ export class RealDaemonServiceInstaller implements DaemonServiceInstaller {
 		const resolved = resolveDaemonServiceSpec(piHome, source);
 		if (!resolved.ok) return resolved;
 		if (resolved.spec.name === PACKED_VEHICLE_NAME) {
-			return { ok: true, restarted: false, reason: SELF_REGISTRATION_REASON, spec: resolved.spec };
+			this.selfRestart(resolved.spec);
+			return { ok: true, restarted: true, reason: SELF_RESTART_SCHEDULED_REASON, spec: resolved.spec };
 		}
 		if (!(await isVehicleServiceRegistered(resolved.spec.name, this.registrar))) {
 			return { ok: true, restarted: false, reason: `no persistent service is registered for ${resolved.spec.name}`, spec: resolved.spec };

package/service/test/daemon-service.test.ts

@@ -9,8 +9,12 @@ import {
 	detectVehicleDaemonService,
 	listManagedPackages,
 	listUnconfiguredDaemonDependencies,
+	PACKED_VEHICLE_NAME,
 	RealDaemonServiceInstaller,
 	resolveDaemonServiceSpec,
+	scheduleSelfRestart,
+	selfRestartCommand,
+	type SelfRestartScheduler,
 } from "../src/daemon/daemon-service.ts";
 
 const roots: string[] = [];
@@ -470,6 +474,62 @@ describe("RealDaemonServiceInstaller -- Armada registration through the in-proce
 		}
 	});
 
+	it("restart() schedules an out-of-process self-restart for Packed's own Vehicle, never touching Armada in-process", async () => {
+		const piHome = fakePiHome();
+		writePackage(piHome, "@danypops/pi-packed", { binPath: "service/src/cli/cli.ts", args: ["serve"] });
+		const harness = await createArmadaTestHarness();
+		const scheduled: Array<{ name: string }> = [];
+		const selfRestart: SelfRestartScheduler = (spec) => {
+			scheduled.push({ name: spec.name });
+		};
+		try {
+			const installer = new RealDaemonServiceInstaller(harness.registrar, selfRestart);
+			const outcome = await installer.restart(piHome, "npm:@danypops/pi-packed");
+
+			expect(outcome).toMatchObject({ ok: true, restarted: true, spec: { name: "pi-packed" } });
+			expect(scheduled).toEqual([{ name: PACKED_VEHICLE_NAME }]);
+			// never asked Armada to stop/replace/start the very process running this test
+			expect(harness.events()).toEqual([]);
+		} finally {
+			await harness.dispose();
+		}
+	});
+
+	it("scheduleSelfRestart resolves armada's real CLI module -- proves the wiring is live, not just typechecked", () => {
+		expect(() => import.meta.resolve("@danypops/armada/cli")).not.toThrow();
+		expect(typeof scheduleSelfRestart).toBe("function");
+	});
+
+	it("selfRestartCommand routes through systemd-run's own transient unit on Linux, not a bare detached spawn", () => {
+		// A bare `spawn(..., {detached:true}).unref()` alone does NOT escape systemd's
+		// KillMode=control-group -- confirmed live: it was killed mid-restart the instant the
+		// unit it was spawned from was stopped, because cgroups (unlike a Unix process group)
+		// aren't escaped by setsid(). systemd-run's own transient unit has an independent cgroup.
+		const result = selfRestartCommand("linux", "/usr/bin/node", "/opt/armada/dist/cli.js", "armada-selfrestart-pi-packed-123-456");
+		expect(result.command).toBe("systemd-run");
+		expect(result.arguments).toEqual([
+			"--user",
+			"--collect",
+			"--unit=armada-selfrestart-pi-packed-123-456",
+			"--",
+			"/usr/bin/node",
+			"/opt/armada/dist/cli.js",
+			"restart",
+			PACKED_VEHICLE_NAME,
+			"--json",
+		]);
+	});
+
+	it("selfRestartCommand spawns the CLI directly on non-Linux platforms -- no systemd cgroup to escape", () => {
+		for (const platform of ["darwin", "win32"] as const) {
+			const result = selfRestartCommand(platform, "/usr/local/bin/node", "/opt/armada/dist/cli.js", "unused-on-this-platform");
+			expect(result).toEqual({
+				command: "/usr/local/bin/node",
+				arguments: ["/opt/armada/dist/cli.js", "restart", PACKED_VEHICLE_NAME, "--json"],
+			});
+		}
+	});
+
 	it("install() reports a non-daemon package without touching Armada", async () => {
 		const piHome = fakePiHome();
 		writePackage(piHome, "some-pkg", undefined);