@rubytech/create-maxy-code 0.1.333 → 0.1.336

package/dist/__tests__/watchdog-deferred-arming.test.js

@@ -1,22 +1,29 @@
-// Contract for the hardware watchdog arming point.
+// Contract for the hardware watchdog feature.
 //
-// On a constrained Pi the installer's `RuntimeWatchdogSec=20s` drop-in,
-// armed at install step 1, reboot-looped its own install: the heavy npm/swap
-// steps stalled PID1 past 20s, the board reset, the relaunch stalled again.
-// The fix arms the watchdog only as the final install action, once the heavy
-// build/swap window is over, and applies it via `daemon-reexec` so it is
-// actually active (RuntimeWatchdogUSec non-zero) without waiting for a reboot.
+// History: an early version armed RuntimeWatchdogSec=20s at install step 1
+// and the install reboot-looped its own build. A follow-up deferred the
+// arm to install end and applied it via daemon-reexec. That arm landed at
+// the peak of post-install load (services initialising, chattr +i sweep
+// just finished, neo4j seeding); the 20s timer fired before PID1 caught up
+// and beacons reset immediately after install end with the connection
+// dropped mid-banner.
 //
-// Static-grep, not behaviour: the call site and the apply command live in the
-// top-level install flow of index.ts, which executes real sudo/systemctl.
-// Same pattern as base-toolchain-deps.test.ts — read src/index.ts at runtime
-// as the authoritative source.
+// Raising RuntimeWatchdogSec is inert above the kernel watchdog cap
+// (~15s on BCM2835), so the timer cannot simply be loosened. The feature
+// has been retired. The contract is now:
+//   1. configureHardwareWatchdog() arms nothing — no drop-in write, no
+//      daemon-reexec, no RuntimeWatchdogSec=20s reference.
+//   2. disableHardwareWatchdogForInstall() runs at install start and
+//      removes the drop-in (rm -f) on devices that carry one from an
+//      earlier installer version, plus a daemon-reexec to apply.
+//
+// Static-grep, not behaviour: the call sites live in the top-level install
+// flow of index.ts. Read src/index.ts at runtime as the authoritative source.
 import test from "node:test";
 import assert from "node:assert/strict";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, resolve } from "node:path";
-// dist/__tests__/watchdog-deferred-arming.test.js → ../../src/index.ts
 const here = dirname(fileURLToPath(import.meta.url));
 const INDEX_TS = resolve(here, "../../src/index.ts");
 const SRC = readFileSync(INDEX_TS, "utf-8");
@@ -28,35 +35,30 @@ function watchdogFnBody() {
     assert.ok(end > start, "could not bound configureHardwareWatchdog body");
     return SRC.slice(start, end);
 }
-test("watchdog is armed after buildPlatform and installService, not at step 1", () => {
-    const watchdogCall = SRC.indexOf("configureHardwareWatchdog();");
-    const build = SRC.indexOf("buildPlatform();");
-    const service = SRC.indexOf("installService();");
-    assert.ok(watchdogCall >= 0, "no configureHardwareWatchdog() call in the install flow");
-    assert.ok(build >= 0 && service >= 0, "expected buildPlatform()/installService() calls");
-    assert.ok(watchdogCall > build, "watchdog must be armed after buildPlatform()");
-    assert.ok(watchdogCall > service, "watchdog must be armed after installService()");
-    // the old step-1 placement (immediately after installSystemDeps()) is gone
-    assert.equal(SRC.includes("installSystemDeps();\n  configureHardwareWatchdog();"), false, "watchdog must not be armed at step 1, right after installSystemDeps()");
-});
-test("watchdog drop-in is applied with daemon-reexec, not daemon-reload", () => {
-    const body = watchdogFnBody();
-    // match the quoted systemctl argument so explanatory comments naming the old
-    // command do not skew the assertion.
-    assert.ok(body.includes('"daemon-reexec"'), "configureHardwareWatchdog must apply via daemon-reexec");
-    assert.equal(body.includes('"daemon-reload"'), false, "daemon-reload does not apply RuntimeWatchdogSec");
+/** Body of disableHardwareWatchdogForInstall(), up to the next top-level function. */
+function disableFnBody() {
+    const start = SRC.indexOf("function disableHardwareWatchdogForInstall");
+    assert.ok(start >= 0, "could not locate disableHardwareWatchdogForInstall in index.ts");
+    // The function lives immediately before configureHardwareWatchdog().
+    const end = SRC.indexOf("function configureHardwareWatchdog", start);
+    assert.ok(end > start, "could not bound disableHardwareWatchdogForInstall body");
+    return SRC.slice(start, end);
+}
+test("watchdog disable runs at install start, before any heavy step", () => {
+    const disableCall = SRC.indexOf("disableHardwareWatchdogForInstall();");
+    const installSystemDeps = SRC.indexOf("installSystemDeps();");
+    assert.ok(disableCall >= 0, "no disableHardwareWatchdogForInstall() call in the install flow");
+    assert.ok(installSystemDeps >= 0, "expected installSystemDeps() call");
+    assert.ok(disableCall < installSystemDeps, "disableHardwareWatchdogForInstall() must precede installSystemDeps() so the heavy steps run unarmed");
 });
-test("idempotent re-run only skips re-arming when the watchdog is live-armed", () => {
-    // A drop-in on disk does not prove the live PID1 has the watchdog active
-    // (prior daemon-reload, or a just-removed disable override). The function must
-    // read RuntimeWatchdogUSec and re-arm when it is 0, so the muvin remediation
-    // (drop-in present, previously disabled) actually arms.
+test("watchdog post-install arm is retired — no drop-in write, no daemon-reexec", () => {
     const body = watchdogFnBody();
-    assert.ok(body.includes("RuntimeWatchdogUSec"), "must read live RuntimeWatchdogUSec before skipping the arm");
-    assert.ok(body.includes('"--value"'), "must read the live watchdog value, not just the drop-in content");
+    assert.equal(body.includes("RuntimeWatchdogSec=20s"), false, "configureHardwareWatchdog must not re-introduce the 20s timer that reboot-looped constrained Pis");
+    assert.equal(body.includes("RebootWatchdogSec=2min"), false, "configureHardwareWatchdog must not re-introduce the reboot timer drop-in line");
+    assert.equal(body.includes('"daemon-reexec"'), false, "configureHardwareWatchdog must not arm via daemon-reexec — the post-install arm killed beacons");
 });
-test("watchdog keeps the 20s runtime / 2min reboot values", () => {
-    const body = watchdogFnBody();
-    assert.ok(body.includes("RuntimeWatchdogSec=20s"), "RuntimeWatchdogSec stays 20s");
-    assert.ok(body.includes("RebootWatchdogSec=2min"), "RebootWatchdogSec stays 2min");
+test("disable-for-install scrubs the drop-in (rm) and daemon-reexecs", () => {
+    const body = disableFnBody();
+    assert.ok(body.includes('"-f"') && body.includes("dropinPath"), "must remove the drop-in (rm -f dropinPath) so the live RuntimeWatchdogUSec returns to 0");
+    assert.ok(body.includes('"daemon-reexec"'), "must daemon-reexec after removing the drop-in so the change applies live without waiting for reboot");
 });

package/dist/index.js

@@ -625,98 +625,73 @@ function writeChromiumBinaryPathFile() {
 // after the build/swap window, then applying it with `daemon-reexec` so it is
 // active immediately (RuntimeWatchdogUSec non-zero), keeps kernel-hang recovery
 // without the loop.
-// Disable the hardware watchdog drop-in for the duration of the install.
-// configureHardwareWatchdog() writes /etc/systemd/system.conf.d/10-maxy-watchdog.conf
-// (RuntimeWatchdogSec=20s) at the END of every install. That file persists
-// across reboots, so on every install AFTER the first, PID1 already has the
-// watchdog armed from boot. The heavy npm/Playwright/swap step in step [3/11]
-// can stall PID1 past 20s on a constrained Pi, the SoC resets mid-install,
-// boot resumes with the watchdog re-armed, the install never completes, and
-// the box wedges (SSH never returns; observed on beacons).
+// Remove any prior hardware-watchdog drop-in this installer (or an earlier
+// version) wrote, then daemon-reexec so the live RuntimeWatchdogUSec
+// goes back to systemd's default (0 = off). The feature is permanently
+// disabled; configureHardwareWatchdog() no longer re-creates the file at
+// install end. See configureHardwareWatchdog() comment for the rationale
+// (the 20s timer reboot-looped constrained Pis when re-armed at install end).
 //
-// Neutralise the watchdog at install start by overwriting the drop-in with
-// RuntimeWatchdogSec=0 and daemon-reexec to apply it immediately. Re-armed
-// at install end by configureHardwareWatchdog(). If install fails between
-// the two, the box is unarmed — recoverable, far better than reboot-loop.
+// Runs unconditionally at install start. Idempotent: if no drop-in is on
+// disk, this is a no-op.
 function disableHardwareWatchdogForInstall() {
     try {
         if (!isLinux()) {
-            logFile("  hardware watchdog: disable-for-install skipped (not Linux)");
+            logFile("  hardware watchdog: scrub-on-install skipped (not Linux)");
             return;
         }
-        if (!existsSync("/dev/watchdog")) {
-            logFile("  hardware watchdog: disable-for-install skipped (/dev/watchdog absent)");
+        const dropinPath = "/etc/systemd/system.conf.d/10-maxy-watchdog.conf";
+        if (!existsSync(dropinPath)) {
+            logFile(`  hardware watchdog: no prior drop-in to scrub (${dropinPath})`);
             return;
         }
-        const disabled = "[Manager]\nRuntimeWatchdogSec=0\n";
-        const dropinDir = "/etc/systemd/system.conf.d";
-        const dropinPath = `${dropinDir}/10-maxy-watchdog.conf`;
-        const tmpPath = "/tmp/10-maxy-watchdog.conf";
-        writeFileSync(tmpPath, disabled);
-        console.log("  [privileged] disable hardware watchdog for install duration (RuntimeWatchdogSec=0)");
-        shell("mkdir", ["-p", dropinDir], { sudo: true });
-        shell("cp", [tmpPath, dropinPath], { sudo: true });
-        spawnSync("rm", ["-f", tmpPath]);
+        console.log(`  [privileged] remove prior hardware-watchdog drop-in (${dropinPath}) — feature retired`);
+        shell("rm", ["-f", dropinPath], { sudo: true });
         spawnSync("sudo", ["systemctl", "daemon-reexec"], { stdio: "inherit" });
-        logFile(`  hardware watchdog: disabled for install (${dropinPath}, RuntimeWatchdogSec=0; re-armed at install end)`);
+        logFile(`  hardware watchdog: drop-in removed; daemon-reexec applied — RuntimeWatchdogUSec back to default`);
     }
     catch (err) {
-        console.error(`  WARNING: failed to disable hardware watchdog for install: ${err instanceof Error ? err.message : String(err)}`);
+        console.error(`  WARNING: failed to scrub hardware-watchdog drop-in: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
 function configureHardwareWatchdog() {
+    // The hardware-watchdog drop-in was hostile to constrained Pis. Task 997
+    // deferred the arm to install end so a tight 20s timer would not reboot the
+    // box mid-build. But arming via daemon-reexec at install end lands the live
+    // timer at the very peak of post-install load (services initialising,
+    // chattr +i sweep just finished, neo4j seeding). PID1 cannot feed
+    // /dev/watchdog fast enough — the SoC resets, next boot starts the same
+    // services under the same load, resets again. Beacons reboot-looped on
+    // every install after the previous fix until the operator deleted the
+    // drop-in by hand.
+    //
+    // Raising RuntimeWatchdogSec is inert above the kernel watchdog cap
+    // (~15s on BCM2835), so the timer cannot simply be loosened. Until a
+    // version of this feature actually survives a constrained-Pi install
+    // unattended, it is removed. The disable-at-install-start path
+    // (disableHardwareWatchdogForInstall) stays — it scrubs any prior
+    // drop-in off devices that had it from earlier installer versions, so the
+    // hostile timer is cleared from the fleet on first run of this installer
+    // version. Kernel-freeze recovery is deferred to the in-server software
+    // watchdog (Type=notify WATCHDOG_USEC, already shipped on the brand
+    // service) which restarts the UI process, not the whole SoC.
     try {
         if (!isLinux()) {
             logFile("  hardware watchdog: skipped (not Linux)");
             return;
         }
-        if (!existsSync("/dev/watchdog")) {
-            logFile("  hardware watchdog: skipped (/dev/watchdog absent)");
-            return;
-        }
-        const desired = "[Manager]\nRuntimeWatchdogSec=20s\nRebootWatchdogSec=2min\n";
-        const dropinDir = "/etc/systemd/system.conf.d";
-        const dropinPath = `${dropinDir}/10-maxy-watchdog.conf`;
-        let current = "";
+        const dropinPath = "/etc/systemd/system.conf.d/10-maxy-watchdog.conf";
         if (existsSync(dropinPath)) {
-            try {
-                current = readFileSync(dropinPath, "utf-8");
-            }
-            catch {
-                // Unreadable existing drop-in — treat as changed so we rewrite.
-                current = "";
-            }
-        }
-        if (current !== desired) {
-            const tmpPath = "/tmp/10-maxy-watchdog.conf";
-            writeFileSync(tmpPath, desired);
-            console.log("  [privileged] install systemd hardware watchdog drop-in (RuntimeWatchdogSec=20s RebootWatchdogSec=2min)");
-            shell("mkdir", ["-p", dropinDir], { sudo: true });
-            shell("cp", [tmpPath, dropinPath], { sudo: true });
-            spawnSync("rm", ["-f", tmpPath]);
-        }
-        // Arm now, idempotently. The drop-in being on disk does NOT mean the live
-        // PID1 has the watchdog active — a prior install that only ran daemon-reload,
-        // or a just-removed disable override (RuntimeWatchdogSec=0), leaves the file
-        // present but RuntimeWatchdogUSec=0. So read the live value and only skip the
-        // re-exec when the watchdog is genuinely armed already; otherwise daemon-reexec
-        // re-execs PID1 in place (host-wide; running services are preserved) to apply
-        // the system-manager setting. daemon-reload does not apply RuntimeWatchdogSec.
-        const liveUsec = spawnSync("systemctl", ["show", "-p", "RuntimeWatchdogUSec", "--value"], {
-            encoding: "utf-8",
-            stdio: "pipe",
-            timeout: 5_000,
-        });
-        const usec = (liveUsec.stdout ?? "").trim();
-        if (current === desired && usec !== "" && usec !== "0") {
-            logFile(`  hardware watchdog: already active (${dropinPath}, RuntimeWatchdogUSec=${usec})`);
+            // Defence in depth — disableHardwareWatchdogForInstall() already runs
+            // at install start, but log here too so the install summary makes the
+            // policy explicit even if step 0 was skipped.
+            logFile(`  hardware watchdog: drop-in present at ${dropinPath} but feature is disabled (see disableHardwareWatchdogForInstall)`);
             return;
         }
-        spawnSync("sudo", ["systemctl", "daemon-reexec"], { stdio: "inherit" });
-        logFile(`  hardware watchdog: enabled (${dropinPath}; armed now via daemon-reexec, after the build/swap window)`);
+        logFile("  hardware watchdog: feature disabled (constrained-Pi reboot loops)");
     }
     catch (err) {
-        console.error(`  WARNING: failed to configure hardware watchdog: ${err instanceof Error ? err.message : String(err)}`);
+        console.error(`  WARNING: hardware watchdog post-install probe failed: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
 function installSystemDeps() {
@@ -1564,6 +1539,28 @@ WantedBy=multi-user.target
     spawnSync("sudo", ["systemctl", "daemon-reload"], { stdio: "inherit" });
     console.log("  [privileged] systemctl enable");
     shell("systemctl", ["enable", serviceName], { sudo: true });
+    // Tear down a legacy-package dedicated Neo4j unit pinning the same port.
+    // The `-code` rewrite packages (`create-<brand>-code`) replace the legacy
+    // `create-<brand>` packages. When migrating a device from legacy to -code,
+    // both packages' dedicated Neo4j units exist (`neo4j-<brand>.service` and
+    // `neo4j-<brand>-code.service`) and both try to bind the same dedicated
+    // bolt port. The legacy unit wins the race (it boots first because it's
+    // alphabetically earlier in systemd's load order), the new unit silently
+    // fails with `bind failed -98 Address already in use`, and the seed step
+    // talks to the legacy instance with the wrong password — auth fails with
+    // a misleading "client is unauthorized" (observed on beacons).
+    if (brandSuffix.endsWith("-code")) {
+        const legacyBrand = brandSuffix.slice(0, -"-code".length);
+        const legacyUnit = `neo4j-${legacyBrand}.service`;
+        const legacyUnitFile = `/etc/systemd/system/${legacyUnit}`;
+        if (existsSync(legacyUnitFile)) {
+            const legacyMsg = `  [neo4j] legacy unit detected (${legacyUnit}) — stopping + disabling so the -code unit owns port ${NEO4J_PORT}`;
+            console.log(legacyMsg);
+            logFile(legacyMsg);
+            shell("systemctl", ["stop", legacyUnit], { sudo: true, bestEffort: true });
+            shell("systemctl", ["disable", legacyUnit], { sudo: true, bestEffort: true });
+        }
+    }
     // skip stop+disable when a peer brand on this host still depends
     // on the apt `neo4j.service` (port 7687). Disabling it would kill the peer's
     // database reproducer on Neo's laptop. The kept-active path is
@@ -2856,7 +2853,29 @@ function writeInstallDefaults(accountId) {
     mkdirSync(publicDir, { recursive: true });
     const publicTemplatesDir = join(INSTALL_DIR, "platform/templates/agents/public");
     const publicIdentityDst = join(publicDir, "IDENTITY.md");
-    cpSync(join(publicTemplatesDir, "IDENTITY.md"), publicIdentityDst);
+    const publicIdentitySrc = join(publicTemplatesDir, "IDENTITY.md");
+    cpSync(publicIdentitySrc, publicIdentityDst);
+    // Defensive verify: a 0-byte IDENTITY.md silently traps the brand server
+    // in STARTING (the reachability auditor logs `reachable=false reason=files
+    // -missing IDENTITY.md:empty` every minute and the splash never clears).
+    // Observed on 192.168.88.16 after a re-install: source 1655 bytes, dest
+    // 0 bytes. Loud-fail here so a corrupt copy can never reach the device's
+    // runtime.
+    try {
+        const srcBytes = statSync(publicIdentitySrc).size;
+        const dstBytes = statSync(publicIdentityDst).size;
+        if (dstBytes === 0 || dstBytes !== srcBytes) {
+            throw new Error(`public-identity copy verify failed: src=${publicIdentitySrc} (${srcBytes} bytes) ` +
+                `dst=${publicIdentityDst} (${dstBytes} bytes). A 0-byte or partial copy traps the brand ` +
+                `server in STARTING forever — re-run the installer after restoring the template, or ` +
+                `report this as a copy regression.`);
+        }
+    }
+    catch (err) {
+        if (err instanceof Error && err.message.startsWith("public-identity copy verify failed"))
+            throw err;
+        throw new Error(`public-identity verify stat failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
     console.log(`  [install-defaults] public-identity path=${publicIdentityDst}`);
     logFile(`  [install-defaults] public-identity path=${publicIdentityDst}`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.333",
+  "version": "0.1.336",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/scripts/lib/provision-account-dir.sh

@@ -145,6 +145,15 @@ SETTINGS_EOF
     [ "$_AGENT_NAME" = "admin" ] && continue
     [ -f "$_AGENT_DIR/IDENTITY.md" ] || continue
     cp "$TEMPLATES_DIR/agents/public/IDENTITY.md" "$_AGENT_DIR/IDENTITY.md"
+    # Defensive verify — a 0-byte cp traps the brand server in STARTING (the
+    # reachability auditor reports `reachable=false reason=files-missing
+    # IDENTITY.md:empty` every minute). Observed on 192.168.88.16 after a
+    # re-install: source 1655 bytes, dest 0 bytes. Loud-fail here so the
+    # operator sees the bad write at install time, not the splash forever.
+    if [ ! -s "$_AGENT_DIR/IDENTITY.md" ]; then
+      echo "  [setup] FATAL agents/$_AGENT_NAME/IDENTITY.md is empty after copy from $TEMPLATES_DIR/agents/public/IDENTITY.md ($(wc -c < "$TEMPLATES_DIR/agents/public/IDENTITY.md") bytes); aborting before the brand server starts" >&2
+      return 1
+    fi
     echo "  agents/$_AGENT_NAME/IDENTITY.md re-synced"
   done