@rubytech/create-maxy-code 0.1.332 → 0.1.334

package/dist/__tests__/watchdog-deferred-arming.test.js

@@ -0,0 +1,62 @@
+// Contract for the hardware watchdog arming point.
+//
+// On a constrained Pi the installer's `RuntimeWatchdogSec=20s` drop-in,
+// armed at install step 1, reboot-looped its own install: the heavy npm/swap
+// steps stalled PID1 past 20s, the board reset, the relaunch stalled again.
+// The fix arms the watchdog only as the final install action, once the heavy
+// build/swap window is over, and applies it via `daemon-reexec` so it is
+// actually active (RuntimeWatchdogUSec non-zero) without waiting for a reboot.
+//
+// Static-grep, not behaviour: the call site and the apply command live in the
+// top-level install flow of index.ts, which executes real sudo/systemctl.
+// Same pattern as base-toolchain-deps.test.ts — read src/index.ts at runtime
+// as the authoritative source.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+// dist/__tests__/watchdog-deferred-arming.test.js → ../../src/index.ts
+const here = dirname(fileURLToPath(import.meta.url));
+const INDEX_TS = resolve(here, "../../src/index.ts");
+const SRC = readFileSync(INDEX_TS, "utf-8");
+/** Body of configureHardwareWatchdog(), up to the next top-level function. */
+function watchdogFnBody() {
+    const start = SRC.indexOf("function configureHardwareWatchdog");
+    assert.ok(start >= 0, "could not locate configureHardwareWatchdog in index.ts");
+    const end = SRC.indexOf("function installSystemDeps", start);
+    assert.ok(end > start, "could not bound configureHardwareWatchdog body");
+    return SRC.slice(start, end);
+}
+test("watchdog is armed after buildPlatform and installService, not at step 1", () => {
+    const watchdogCall = SRC.indexOf("configureHardwareWatchdog();");
+    const build = SRC.indexOf("buildPlatform();");
+    const service = SRC.indexOf("installService();");
+    assert.ok(watchdogCall >= 0, "no configureHardwareWatchdog() call in the install flow");
+    assert.ok(build >= 0 && service >= 0, "expected buildPlatform()/installService() calls");
+    assert.ok(watchdogCall > build, "watchdog must be armed after buildPlatform()");
+    assert.ok(watchdogCall > service, "watchdog must be armed after installService()");
+    // the old step-1 placement (immediately after installSystemDeps()) is gone
+    assert.equal(SRC.includes("installSystemDeps();\n  configureHardwareWatchdog();"), false, "watchdog must not be armed at step 1, right after installSystemDeps()");
+});
+test("watchdog drop-in is applied with daemon-reexec, not daemon-reload", () => {
+    const body = watchdogFnBody();
+    // match the quoted systemctl argument so explanatory comments naming the old
+    // command do not skew the assertion.
+    assert.ok(body.includes('"daemon-reexec"'), "configureHardwareWatchdog must apply via daemon-reexec");
+    assert.equal(body.includes('"daemon-reload"'), false, "daemon-reload does not apply RuntimeWatchdogSec");
+});
+test("idempotent re-run only skips re-arming when the watchdog is live-armed", () => {
+    // A drop-in on disk does not prove the live PID1 has the watchdog active
+    // (prior daemon-reload, or a just-removed disable override). The function must
+    // read RuntimeWatchdogUSec and re-arm when it is 0, so the muvin remediation
+    // (drop-in present, previously disabled) actually arms.
+    const body = watchdogFnBody();
+    assert.ok(body.includes("RuntimeWatchdogUSec"), "must read live RuntimeWatchdogUSec before skipping the arm");
+    assert.ok(body.includes('"--value"'), "must read the live watchdog value, not just the drop-in content");
+});
+test("watchdog keeps the 20s runtime / 2min reboot values", () => {
+    const body = watchdogFnBody();
+    assert.ok(body.includes("RuntimeWatchdogSec=20s"), "RuntimeWatchdogSec stays 20s");
+    assert.ok(body.includes("RebootWatchdogSec=2min"), "RebootWatchdogSec stays 2min");
+});

package/dist/index.js

@@ -617,6 +617,53 @@ function writeChromiumBinaryPathFile() {
 // warns, never aborts the install. Cannot recover a latched-off brownout (no
 // power = no watchdog) — that needs the external power-cycler documented in
 // deployment.md.
+//
+// Called as the FINAL install action (not step 1): RuntimeWatchdogSec=20s is a
+// tight timer, and the heavy npm-install/swap-thrash steps stall PID1 past 20s
+// on a constrained Pi. Arming early reboot-looped the install (the board reset
+// mid-build, relaunched under the same load, reset again). Deferring the arm to
+// after the build/swap window, then applying it with `daemon-reexec` so it is
+// active immediately (RuntimeWatchdogUSec non-zero), keeps kernel-hang recovery
+// without the loop.
+// Disable the hardware watchdog drop-in for the duration of the install.
+// configureHardwareWatchdog() writes /etc/systemd/system.conf.d/10-maxy-watchdog.conf
+// (RuntimeWatchdogSec=20s) at the END of every install. That file persists
+// across reboots, so on every install AFTER the first, PID1 already has the
+// watchdog armed from boot. The heavy npm/Playwright/swap step in step [3/11]
+// can stall PID1 past 20s on a constrained Pi, the SoC resets mid-install,
+// boot resumes with the watchdog re-armed, the install never completes, and
+// the box wedges (SSH never returns; observed on beacons).
+//
+// Neutralise the watchdog at install start by overwriting the drop-in with
+// RuntimeWatchdogSec=0 and daemon-reexec to apply it immediately. Re-armed
+// at install end by configureHardwareWatchdog(). If install fails between
+// the two, the box is unarmed — recoverable, far better than reboot-loop.
+function disableHardwareWatchdogForInstall() {
+    try {
+        if (!isLinux()) {
+            logFile("  hardware watchdog: disable-for-install skipped (not Linux)");
+            return;
+        }
+        if (!existsSync("/dev/watchdog")) {
+            logFile("  hardware watchdog: disable-for-install skipped (/dev/watchdog absent)");
+            return;
+        }
+        const disabled = "[Manager]\nRuntimeWatchdogSec=0\n";
+        const dropinDir = "/etc/systemd/system.conf.d";
+        const dropinPath = `${dropinDir}/10-maxy-watchdog.conf`;
+        const tmpPath = "/tmp/10-maxy-watchdog.conf";
+        writeFileSync(tmpPath, disabled);
+        console.log("  [privileged] disable hardware watchdog for install duration (RuntimeWatchdogSec=0)");
+        shell("mkdir", ["-p", dropinDir], { sudo: true });
+        shell("cp", [tmpPath, dropinPath], { sudo: true });
+        spawnSync("rm", ["-f", tmpPath]);
+        spawnSync("sudo", ["systemctl", "daemon-reexec"], { stdio: "inherit" });
+        logFile(`  hardware watchdog: disabled for install (${dropinPath}, RuntimeWatchdogSec=0; re-armed at install end)`);
+    }
+    catch (err) {
+        console.error(`  WARNING: failed to disable hardware watchdog for install: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
 function configureHardwareWatchdog() {
     try {
         if (!isLinux()) {
@@ -640,18 +687,33 @@ function configureHardwareWatchdog() {
                 current = "";
             }
         }
-        if (current === desired) {
-            logFile(`  hardware watchdog: already active (${dropinPath})`);
+        if (current !== desired) {
+            const tmpPath = "/tmp/10-maxy-watchdog.conf";
+            writeFileSync(tmpPath, desired);
+            console.log("  [privileged] install systemd hardware watchdog drop-in (RuntimeWatchdogSec=20s RebootWatchdogSec=2min)");
+            shell("mkdir", ["-p", dropinDir], { sudo: true });
+            shell("cp", [tmpPath, dropinPath], { sudo: true });
+            spawnSync("rm", ["-f", tmpPath]);
+        }
+        // Arm now, idempotently. The drop-in being on disk does NOT mean the live
+        // PID1 has the watchdog active — a prior install that only ran daemon-reload,
+        // or a just-removed disable override (RuntimeWatchdogSec=0), leaves the file
+        // present but RuntimeWatchdogUSec=0. So read the live value and only skip the
+        // re-exec when the watchdog is genuinely armed already; otherwise daemon-reexec
+        // re-execs PID1 in place (host-wide; running services are preserved) to apply
+        // the system-manager setting. daemon-reload does not apply RuntimeWatchdogSec.
+        const liveUsec = spawnSync("systemctl", ["show", "-p", "RuntimeWatchdogUSec", "--value"], {
+            encoding: "utf-8",
+            stdio: "pipe",
+            timeout: 5_000,
+        });
+        const usec = (liveUsec.stdout ?? "").trim();
+        if (current === desired && usec !== "" && usec !== "0") {
+            logFile(`  hardware watchdog: already active (${dropinPath}, RuntimeWatchdogUSec=${usec})`);
             return;
         }
-        const tmpPath = "/tmp/10-maxy-watchdog.conf";
-        writeFileSync(tmpPath, desired);
-        console.log("  [privileged] install systemd hardware watchdog drop-in (RuntimeWatchdogSec=20s RebootWatchdogSec=2min)");
-        shell("mkdir", ["-p", dropinDir], { sudo: true });
-        shell("cp", [tmpPath, dropinPath], { sudo: true });
-        spawnSync("rm", ["-f", tmpPath]);
-        spawnSync("sudo", ["systemctl", "daemon-reload"], { stdio: "inherit" });
-        logFile(`  hardware watchdog: enabled (wrote ${dropinPath}; arms on next boot or systemd re-exec)`);
+        spawnSync("sudo", ["systemctl", "daemon-reexec"], { stdio: "inherit" });
+        logFile(`  hardware watchdog: enabled (${dropinPath}; armed now via daemon-reexec, after the build/swap window)`);
     }
     catch (err) {
         console.error(`  WARNING: failed to configure hardware watchdog: ${err instanceof Error ? err.message : String(err)}`);
@@ -1502,6 +1564,28 @@ WantedBy=multi-user.target
     spawnSync("sudo", ["systemctl", "daemon-reload"], { stdio: "inherit" });
     console.log("  [privileged] systemctl enable");
     shell("systemctl", ["enable", serviceName], { sudo: true });
+    // Tear down a legacy-package dedicated Neo4j unit pinning the same port.
+    // The `-code` rewrite packages (`create-<brand>-code`) replace the legacy
+    // `create-<brand>` packages. When migrating a device from legacy to -code,
+    // both packages' dedicated Neo4j units exist (`neo4j-<brand>.service` and
+    // `neo4j-<brand>-code.service`) and both try to bind the same dedicated
+    // bolt port. The legacy unit wins the race (it boots first because it's
+    // alphabetically earlier in systemd's load order), the new unit silently
+    // fails with `bind failed -98 Address already in use`, and the seed step
+    // talks to the legacy instance with the wrong password — auth fails with
+    // a misleading "client is unauthorized" (observed on beacons).
+    if (brandSuffix.endsWith("-code")) {
+        const legacyBrand = brandSuffix.slice(0, -"-code".length);
+        const legacyUnit = `neo4j-${legacyBrand}.service`;
+        const legacyUnitFile = `/etc/systemd/system/${legacyUnit}`;
+        if (existsSync(legacyUnitFile)) {
+            const legacyMsg = `  [neo4j] legacy unit detected (${legacyUnit}) — stopping + disabling so the -code unit owns port ${NEO4J_PORT}`;
+            console.log(legacyMsg);
+            logFile(legacyMsg);
+            shell("systemctl", ["stop", legacyUnit], { sudo: true, bestEffort: true });
+            shell("systemctl", ["disable", legacyUnit], { sudo: true, bestEffort: true });
+        }
+    }
     // skip stop+disable when a peer brand on this host still depends
     // on the apt `neo4j.service` (port 7687). Disabling it would kill the peer's
     // database reproducer on Neo's laptop. The kept-active path is
@@ -2794,7 +2878,29 @@ function writeInstallDefaults(accountId) {
     mkdirSync(publicDir, { recursive: true });
     const publicTemplatesDir = join(INSTALL_DIR, "platform/templates/agents/public");
     const publicIdentityDst = join(publicDir, "IDENTITY.md");
-    cpSync(join(publicTemplatesDir, "IDENTITY.md"), publicIdentityDst);
+    const publicIdentitySrc = join(publicTemplatesDir, "IDENTITY.md");
+    cpSync(publicIdentitySrc, publicIdentityDst);
+    // Defensive verify: a 0-byte IDENTITY.md silently traps the brand server
+    // in STARTING (the reachability auditor logs `reachable=false reason=files
+    // -missing IDENTITY.md:empty` every minute and the splash never clears).
+    // Observed on 192.168.88.16 after a re-install: source 1655 bytes, dest
+    // 0 bytes. Loud-fail here so a corrupt copy can never reach the device's
+    // runtime.
+    try {
+        const srcBytes = statSync(publicIdentitySrc).size;
+        const dstBytes = statSync(publicIdentityDst).size;
+        if (dstBytes === 0 || dstBytes !== srcBytes) {
+            throw new Error(`public-identity copy verify failed: src=${publicIdentitySrc} (${srcBytes} bytes) ` +
+                `dst=${publicIdentityDst} (${dstBytes} bytes). A 0-byte or partial copy traps the brand ` +
+                `server in STARTING forever — re-run the installer after restoring the template, or ` +
+                `report this as a copy regression.`);
+        }
+    }
+    catch (err) {
+        if (err instanceof Error && err.message.startsWith("public-identity copy verify failed"))
+            throw err;
+        throw new Error(`public-identity verify stat failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
     console.log(`  [install-defaults] public-identity path=${publicIdentityDst}`);
     logFile(`  [install-defaults] public-identity path=${publicIdentityDst}`);
 }
@@ -4255,8 +4361,12 @@ console.log("");
 logDiagnostics("pre-flight");
 logFile(`  Neo4j instance: ${NEO4J_DEDICATED ? "dedicated" : "shared"} on bolt://localhost:${NEO4J_PORT}`);
 try {
+    // Disable any pre-existing hardware-watchdog drop-in BEFORE any heavy step.
+    // configureHardwareWatchdog() re-arms it at install end. Without this, the
+    // 20s deadline armed from boot reboots the box mid-install on every install
+    // after the first.
+    disableHardwareWatchdogForInstall();
     installSystemDeps();
-    configureHardwareWatchdog();
     installNodejs();
     installClaudeCode();
     installNeo4j();
@@ -4314,6 +4424,11 @@ try {
         const ok = freezing ? immutable : !immutable;
         console.log(`  [agent-guard] op=${ok ? op : `${op}-failed`} target=${target}`);
     }
+    // Arm the hardware watchdog as the final install action — after the heavy
+    // build/swap window, so a tight watchdog can never reboot the box mid-install
+    // (the reboot-loop this defends against). A partial/failed install exits
+    // before this point and never writes the drop-in.
+    configureHardwareWatchdog();
     console.log("");
     console.log("================================================================");
     console.log("");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.332",
+  "version": "0.1.334",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/scripts/lib/provision-account-dir.sh

@@ -145,6 +145,15 @@ SETTINGS_EOF
     [ "$_AGENT_NAME" = "admin" ] && continue
     [ -f "$_AGENT_DIR/IDENTITY.md" ] || continue
     cp "$TEMPLATES_DIR/agents/public/IDENTITY.md" "$_AGENT_DIR/IDENTITY.md"
+    # Defensive verify — a 0-byte cp traps the brand server in STARTING (the
+    # reachability auditor reports `reachable=false reason=files-missing
+    # IDENTITY.md:empty` every minute). Observed on 192.168.88.16 after a
+    # re-install: source 1655 bytes, dest 0 bytes. Loud-fail here so the
+    # operator sees the bad write at install time, not the splash forever.
+    if [ ! -s "$_AGENT_DIR/IDENTITY.md" ]; then
+      echo "  [setup] FATAL agents/$_AGENT_NAME/IDENTITY.md is empty after copy from $TEMPLATES_DIR/agents/public/IDENTITY.md ($(wc -c < "$TEMPLATES_DIR/agents/public/IDENTITY.md") bytes); aborting before the brand server starts" >&2
+      return 1
+    fi
     echo "  agents/$_AGENT_NAME/IDENTITY.md re-synced"
   done