@rubytech/create-maxy-code 0.1.332 → 0.1.333

package/dist/__tests__/watchdog-deferred-arming.test.js

@@ -0,0 +1,62 @@
+// Contract for the hardware watchdog arming point.
+//
+// On a constrained Pi the installer's `RuntimeWatchdogSec=20s` drop-in,
+// armed at install step 1, reboot-looped its own install: the heavy npm/swap
+// steps stalled PID1 past 20s, the board reset, the relaunch stalled again.
+// The fix arms the watchdog only as the final install action, once the heavy
+// build/swap window is over, and applies it via `daemon-reexec` so it is
+// actually active (RuntimeWatchdogUSec non-zero) without waiting for a reboot.
+//
+// Static-grep, not behaviour: the call site and the apply command live in the
+// top-level install flow of index.ts, which executes real sudo/systemctl.
+// Same pattern as base-toolchain-deps.test.ts — read src/index.ts at runtime
+// as the authoritative source.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+// dist/__tests__/watchdog-deferred-arming.test.js → ../../src/index.ts
+const here = dirname(fileURLToPath(import.meta.url));
+const INDEX_TS = resolve(here, "../../src/index.ts");
+const SRC = readFileSync(INDEX_TS, "utf-8");
+/** Body of configureHardwareWatchdog(), up to the next top-level function. */
+function watchdogFnBody() {
+    const start = SRC.indexOf("function configureHardwareWatchdog");
+    assert.ok(start >= 0, "could not locate configureHardwareWatchdog in index.ts");
+    const end = SRC.indexOf("function installSystemDeps", start);
+    assert.ok(end > start, "could not bound configureHardwareWatchdog body");
+    return SRC.slice(start, end);
+}
+test("watchdog is armed after buildPlatform and installService, not at step 1", () => {
+    const watchdogCall = SRC.indexOf("configureHardwareWatchdog();");
+    const build = SRC.indexOf("buildPlatform();");
+    const service = SRC.indexOf("installService();");
+    assert.ok(watchdogCall >= 0, "no configureHardwareWatchdog() call in the install flow");
+    assert.ok(build >= 0 && service >= 0, "expected buildPlatform()/installService() calls");
+    assert.ok(watchdogCall > build, "watchdog must be armed after buildPlatform()");
+    assert.ok(watchdogCall > service, "watchdog must be armed after installService()");
+    // the old step-1 placement (immediately after installSystemDeps()) is gone
+    assert.equal(SRC.includes("installSystemDeps();\n  configureHardwareWatchdog();"), false, "watchdog must not be armed at step 1, right after installSystemDeps()");
+});
+test("watchdog drop-in is applied with daemon-reexec, not daemon-reload", () => {
+    const body = watchdogFnBody();
+    // match the quoted systemctl argument so explanatory comments naming the old
+    // command do not skew the assertion.
+    assert.ok(body.includes('"daemon-reexec"'), "configureHardwareWatchdog must apply via daemon-reexec");
+    assert.equal(body.includes('"daemon-reload"'), false, "daemon-reload does not apply RuntimeWatchdogSec");
+});
+test("idempotent re-run only skips re-arming when the watchdog is live-armed", () => {
+    // A drop-in on disk does not prove the live PID1 has the watchdog active
+    // (prior daemon-reload, or a just-removed disable override). The function must
+    // read RuntimeWatchdogUSec and re-arm when it is 0, so the muvin remediation
+    // (drop-in present, previously disabled) actually arms.
+    const body = watchdogFnBody();
+    assert.ok(body.includes("RuntimeWatchdogUSec"), "must read live RuntimeWatchdogUSec before skipping the arm");
+    assert.ok(body.includes('"--value"'), "must read the live watchdog value, not just the drop-in content");
+});
+test("watchdog keeps the 20s runtime / 2min reboot values", () => {
+    const body = watchdogFnBody();
+    assert.ok(body.includes("RuntimeWatchdogSec=20s"), "RuntimeWatchdogSec stays 20s");
+    assert.ok(body.includes("RebootWatchdogSec=2min"), "RebootWatchdogSec stays 2min");
+});

package/dist/index.js

@@ -617,6 +617,53 @@ function writeChromiumBinaryPathFile() {
 // warns, never aborts the install. Cannot recover a latched-off brownout (no
 // power = no watchdog) — that needs the external power-cycler documented in
 // deployment.md.
+//
+// Called as the FINAL install action (not step 1): RuntimeWatchdogSec=20s is a
+// tight timer, and the heavy npm-install/swap-thrash steps stall PID1 past 20s
+// on a constrained Pi. Arming early reboot-looped the install (the board reset
+// mid-build, relaunched under the same load, reset again). Deferring the arm to
+// after the build/swap window, then applying it with `daemon-reexec` so it is
+// active immediately (RuntimeWatchdogUSec non-zero), keeps kernel-hang recovery
+// without the loop.
+// Disable the hardware watchdog drop-in for the duration of the install.
+// configureHardwareWatchdog() writes /etc/systemd/system.conf.d/10-maxy-watchdog.conf
+// (RuntimeWatchdogSec=20s) at the END of every install. That file persists
+// across reboots, so on every install AFTER the first, PID1 already has the
+// watchdog armed from boot. The heavy npm/Playwright/swap step in step [3/11]
+// can stall PID1 past 20s on a constrained Pi, the SoC resets mid-install,
+// boot resumes with the watchdog re-armed, the install never completes, and
+// the box wedges (SSH never returns; observed on beacons).
+//
+// Neutralise the watchdog at install start by overwriting the drop-in with
+// RuntimeWatchdogSec=0 and daemon-reexec to apply it immediately. Re-armed
+// at install end by configureHardwareWatchdog(). If install fails between
+// the two, the box is unarmed — recoverable, far better than reboot-loop.
+function disableHardwareWatchdogForInstall() {
+    try {
+        if (!isLinux()) {
+            logFile("  hardware watchdog: disable-for-install skipped (not Linux)");
+            return;
+        }
+        if (!existsSync("/dev/watchdog")) {
+            logFile("  hardware watchdog: disable-for-install skipped (/dev/watchdog absent)");
+            return;
+        }
+        const disabled = "[Manager]\nRuntimeWatchdogSec=0\n";
+        const dropinDir = "/etc/systemd/system.conf.d";
+        const dropinPath = `${dropinDir}/10-maxy-watchdog.conf`;
+        const tmpPath = "/tmp/10-maxy-watchdog.conf";
+        writeFileSync(tmpPath, disabled);
+        console.log("  [privileged] disable hardware watchdog for install duration (RuntimeWatchdogSec=0)");
+        shell("mkdir", ["-p", dropinDir], { sudo: true });
+        shell("cp", [tmpPath, dropinPath], { sudo: true });
+        spawnSync("rm", ["-f", tmpPath]);
+        spawnSync("sudo", ["systemctl", "daemon-reexec"], { stdio: "inherit" });
+        logFile(`  hardware watchdog: disabled for install (${dropinPath}, RuntimeWatchdogSec=0; re-armed at install end)`);
+    }
+    catch (err) {
+        console.error(`  WARNING: failed to disable hardware watchdog for install: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
 function configureHardwareWatchdog() {
     try {
         if (!isLinux()) {
@@ -640,18 +687,33 @@ function configureHardwareWatchdog() {
                 current = "";
             }
         }
-        if (current === desired) {
-            logFile(`  hardware watchdog: already active (${dropinPath})`);
+        if (current !== desired) {
+            const tmpPath = "/tmp/10-maxy-watchdog.conf";
+            writeFileSync(tmpPath, desired);
+            console.log("  [privileged] install systemd hardware watchdog drop-in (RuntimeWatchdogSec=20s RebootWatchdogSec=2min)");
+            shell("mkdir", ["-p", dropinDir], { sudo: true });
+            shell("cp", [tmpPath, dropinPath], { sudo: true });
+            spawnSync("rm", ["-f", tmpPath]);
+        }
+        // Arm now, idempotently. The drop-in being on disk does NOT mean the live
+        // PID1 has the watchdog active — a prior install that only ran daemon-reload,
+        // or a just-removed disable override (RuntimeWatchdogSec=0), leaves the file
+        // present but RuntimeWatchdogUSec=0. So read the live value and only skip the
+        // re-exec when the watchdog is genuinely armed already; otherwise daemon-reexec
+        // re-execs PID1 in place (host-wide; running services are preserved) to apply
+        // the system-manager setting. daemon-reload does not apply RuntimeWatchdogSec.
+        const liveUsec = spawnSync("systemctl", ["show", "-p", "RuntimeWatchdogUSec", "--value"], {
+            encoding: "utf-8",
+            stdio: "pipe",
+            timeout: 5_000,
+        });
+        const usec = (liveUsec.stdout ?? "").trim();
+        if (current === desired && usec !== "" && usec !== "0") {
+            logFile(`  hardware watchdog: already active (${dropinPath}, RuntimeWatchdogUSec=${usec})`);
             return;
         }
-        const tmpPath = "/tmp/10-maxy-watchdog.conf";
-        writeFileSync(tmpPath, desired);
-        console.log("  [privileged] install systemd hardware watchdog drop-in (RuntimeWatchdogSec=20s RebootWatchdogSec=2min)");
-        shell("mkdir", ["-p", dropinDir], { sudo: true });
-        shell("cp", [tmpPath, dropinPath], { sudo: true });
-        spawnSync("rm", ["-f", tmpPath]);
-        spawnSync("sudo", ["systemctl", "daemon-reload"], { stdio: "inherit" });
-        logFile(`  hardware watchdog: enabled (wrote ${dropinPath}; arms on next boot or systemd re-exec)`);
+        spawnSync("sudo", ["systemctl", "daemon-reexec"], { stdio: "inherit" });
+        logFile(`  hardware watchdog: enabled (${dropinPath}; armed now via daemon-reexec, after the build/swap window)`);
     }
     catch (err) {
         console.error(`  WARNING: failed to configure hardware watchdog: ${err instanceof Error ? err.message : String(err)}`);
@@ -4255,8 +4317,12 @@ console.log("");
 logDiagnostics("pre-flight");
 logFile(`  Neo4j instance: ${NEO4J_DEDICATED ? "dedicated" : "shared"} on bolt://localhost:${NEO4J_PORT}`);
 try {
+    // Disable any pre-existing hardware-watchdog drop-in BEFORE any heavy step.
+    // configureHardwareWatchdog() re-arms it at install end. Without this, the
+    // 20s deadline armed from boot reboots the box mid-install on every install
+    // after the first.
+    disableHardwareWatchdogForInstall();
     installSystemDeps();
-    configureHardwareWatchdog();
     installNodejs();
     installClaudeCode();
     installNeo4j();
@@ -4314,6 +4380,11 @@ try {
         const ok = freezing ? immutable : !immutable;
         console.log(`  [agent-guard] op=${ok ? op : `${op}-failed`} target=${target}`);
     }
+    // Arm the hardware watchdog as the final install action — after the heavy
+    // build/swap window, so a tight watchdog can never reboot the box mid-install
+    // (the reboot-loop this defends against). A partial/failed install exits
+    // before this point and never writes the drop-in.
+    configureHardwareWatchdog();
     console.log("");
     console.log("================================================================");
     console.log("");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.332",
+  "version": "0.1.333",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"