dsh-autorestart 0.7.0 → 0.8.1

package/scripts/drill-watchdog.mjs

@@ -0,0 +1,341 @@
+/**
+ * THE WATCHDOG DRILL: three real scenarios, and the tiers on a real machine.
+ *
+ * Nothing here touches the profile of a running DSH: the drill works in its
+ * own directory under the temp directory, with a FAKE host (a small script
+ * that either comes up and writes the ready marker, or stays down).
+ *
+ *   1. the host comes up            -> the watchdog stands down, NO restore
+ *   2. the host never comes up      -> restore, start again, RECOVERED
+ *   3. the host stays down          -> restore ONCE, start again, FAILED
+ *
+ * And then the tiers, for real:
+ *
+ *   - the Windows scheduled task is registered, read back, and REALLY FIRES
+ *     (a marker file appears), and is deleted completely afterwards;
+ *   - the detached process tier runs inside WSL (setsid nohup), and the
+ *     systemd tier runs there too.
+ *
+ * The drill cleans up after itself: no leftover task, no leftover process,
+ * no leftover directory.
+ */
+
+import { execFileSync, spawn } from 'node:child_process';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import {
+  buildPending,
+  readReport,
+  readyPath,
+  writePending,
+  writeReady,
+} from '../lib/watchdog.js';
+import {
+  detachedPidPath,
+  localIso,
+  registerDetachedProcess,
+  registerScheduledTask,
+  removeScheduledTask,
+} from '../lib/watchdog-schedule.js';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const pluginDir = path.join(here, '..');
+const drillRoot = path.join(os.tmpdir(), 'dsh-watchdog-drill-' + crypto.randomUUID());
+
+/** The checks of the drill: every one of them must pass. */
+const failures = [];
+/**
+ * @param {string} what
+ * @param {boolean} ok
+ * @param {string} [detail]
+ */
+function check(what, ok, detail = '') {
+  const line = (ok ? '  ok   ' : '  FAIL ') + what + (detail ? ' (' + detail + ')' : '');
+  console.log(line);
+  if (!ok) failures.push(line);
+}
+
+/**
+ * Wait for a file to appear.
+ *
+ * @param {string} file
+ * @param {number} timeoutMs
+ * @returns {Promise<boolean>}
+ */
+async function waitForFile(file, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (fs.existsSync(file)) return true;
+    await new Promise((resolve) => setTimeout(resolve, 200));
+  }
+  return fs.existsSync(file);
+}
+
+/**
+ * The fake host: it comes up (and writes the ready marker) or it stays down.
+ *
+ * @param {string} dir
+ * @param {'up'|'down'} behaviour
+ */
+function fakeHost(dir, behaviour) {
+  const marker = path.join(dir, 'restore.log');
+  const script = path.join(dir, 'fake-host.mjs');
+  fs.writeFileSync(script, [
+    "import fs from 'node:fs';",
+    "import path from 'node:path';",
+    "const dir = process.argv[2];",
+    "const behaviour = process.argv[3];",
+    "if (behaviour === 'up') {",
+    "  fs.writeFileSync(path.join(dir, 'watchdog-ready.json'), JSON.stringify({ at: Date.now() }));",
+    "}",
+    "fs.appendFileSync(path.join(dir, 'host.log'), behaviour + '\\n');",
+    "setTimeout(() => process.exit(0), 30000);",
+    '',
+  ].join('\n'), 'utf8');
+  return { script, marker };
+}
+
+/**
+ * The fake restore: it counts the attempts, and it can make the host come up.
+ *
+ * @param {string} dir
+ * @param {boolean} fixIt whether the restore makes the host come up
+ */
+function fakeRestore(dir, fixIt) {
+  const script = path.join(dir, 'fake-restore.mjs');
+  fs.writeFileSync(script, [
+    "import fs from 'node:fs';",
+    "import path from 'node:path';",
+    "const dir = process.argv[2];",
+    "fs.appendFileSync(path.join(dir, 'restore.log'), 'restore\\n');",
+    fixIt
+      ? "fs.writeFileSync(path.join(dir, 'behaviour.txt'), 'up');"
+      : "fs.writeFileSync(path.join(dir, 'behaviour.txt'), 'down');",
+    '',
+  ].join('\n'), 'utf8');
+  return script;
+}
+
+/**
+ * The "start the host again" command: it reads the behaviour file.
+ *
+ * @param {string} dir
+ */
+function fakeStart(dir) {
+  const script = path.join(dir, 'fake-start.mjs');
+  fs.writeFileSync(script, [
+    "import { spawn } from 'node:child_process';",
+    "import fs from 'node:fs';",
+    "import path from 'node:path';",
+    "const dir = process.argv[2];",
+    "const behaviour = fs.existsSync(path.join(dir, 'behaviour.txt'))",
+    "  ? fs.readFileSync(path.join(dir, 'behaviour.txt'), 'utf8').trim()",
+    "  : 'down';",
+    "const child = spawn(process.execPath, [path.join(dir, 'fake-host.mjs'), dir, behaviour], { detached: true, stdio: 'ignore' });",
+    "child.unref();",
+    '',
+  ].join('\n'), 'utf8');
+  return script;
+}
+
+/**
+ * Run one scenario of the drill.
+ *
+ * @param {{ name: string, behaviour: 'up'|'down', fixIt: boolean, expect: string }} options
+ */
+async function scenario({ name, behaviour, fixIt, expect }) {
+  const dir = path.join(drillRoot, name);
+  fs.mkdirSync(dir, { recursive: true });
+  const restoreLog = path.join(dir, 'restore.log');
+  const readyMarker = readyPath(dir);
+  const host = fakeHost(dir, behaviour);
+  const restore = fakeRestore(dir, fixIt);
+  const start = fakeStart(dir);
+  fs.writeFileSync(path.join(dir, 'behaviour.txt'), behaviour);
+
+  // The pending marker: what the plugin writes before the restart.
+  writePending(dir, buildPending({
+    tier: 'detached-process',
+    tierReason: 'the drill starts the watchdog directly',
+    restoreCommand: { file: process.execPath, args: [restore, dir] },
+    relaunchCommand: { file: process.execPath, args: [start, dir] },
+    timeoutMs: 4000,
+    recheckMs: 1500,
+    readyTimeoutMs: 6000,
+    now: Date.now(),
+  }));
+
+  // Scenario 1: the host comes up. The others: it stays down.
+  if (behaviour === 'up') {
+    const child = spawn(process.execPath, [host.script, dir, 'up'], { detached: true, stdio: 'ignore' });
+    child.unref();
+  }
+
+  // The watchdog itself: the real CLI, in its own process.
+  const watchdog = spawn(process.execPath, [path.join(here, 'watchdog.mjs'), '--state-dir', dir], { stdio: 'ignore' });
+  await new Promise((resolve) => watchdog.on('exit', resolve));
+
+  const report = readReport(dir);
+  const restores = fs.existsSync(restoreLog) ? fs.readFileSync(restoreLog, 'utf8').trim().split('\n').filter(Boolean).length : 0;
+  check(name + ': the report says ' + expect, report !== null && report.result === expect, report ? report.result : 'no report');
+  if (expect === 'not-needed') {
+    check(name + ': nothing was restored', restores === 0, restores + ' restore(s)');
+  } else {
+    check(name + ': the restore ran exactly once', restores === 1, restores + ' restore(s)');
+    check(name + ': the report says which tier was used', report !== null && typeof report.tier === 'string' && report.tier !== '', report ? report.tier : '');
+  }
+  check(name + ': the pending marker is gone', !fs.existsSync(path.join(dir, 'watchdog-pending.json')));
+  check(name + ': the report was kept', fs.existsSync(path.join(dir, 'last-watchdog-report.json')));
+  return report;
+}
+
+/**
+ * The Windows scheduled task, for real: register it, read it back, let it
+ * fire, delete it.
+ */
+async function windowsTier() {
+  const dir = path.join(drillRoot, 'tier-windows');
+  fs.mkdirSync(dir, { recursive: true });
+  const marker = path.join(dir, 'fired.txt');
+  const taskName = 'dsh-autorestart-drill-' + crypto.randomUUID().slice(0, 8);
+  const xmlPath = path.join(dir, 'task.xml');
+  const start = new Date(Date.now() + 60 * 1000);
+  const end = new Date(Date.now() + 10 * 60 * 1000);
+  const registered = registerScheduledTask({
+    taskName,
+    startIso: localIso(start),
+    endIso: localIso(end),
+    command: 'echo fired > "' + marker + '"',
+    xmlPath,
+  });
+  check('tier 1: the task was registered and read back', registered.ok === true, registered.error || '');
+  if (!registered.ok) return;
+  // It must REALLY fire.
+  const fired = await waitForFile(marker, 100000);
+  check('tier 1: the task really fired', fired);
+  const removed = removeScheduledTask({ taskName });
+  check('tier 1: the task was deleted', removed.ok === true, removed.error || '');
+  let gone = false;
+  try {
+    execFileSync('schtasks', ['/Query', '/TN', taskName], { stdio: 'ignore', timeout: 15000 });
+  } catch {
+    gone = true;
+  }
+  check('tier 1: the task is really gone', gone);
+  try {
+    fs.rmSync(xmlPath, { force: true });
+  } catch {
+    // It is gone either way.
+  }
+}
+
+/**
+ * The Linux tiers, for real: inside WSL.
+ */
+async function linuxTiers() {
+  const dir = path.join(drillRoot, 'tier-linux');
+  fs.mkdirSync(dir, { recursive: true });
+  const marker = path.join(dir, 'fired.txt');
+  const wslDir = wslPath(dir);
+  const helper = path.join(dir, 'tier.mjs');
+  fs.writeFileSync(helper, [
+    "import { registerDetachedProcess, registerSystemdRun, cleanupSystemdUnit } from '" + wslPath(path.join(pluginDir, 'lib', 'watchdog-schedule.js')).replace(/\\/g, '/') + "';",
+    "const dir = process.argv[2];",
+    "const marker = process.argv[3];",
+    "const which = process.argv[4];",
+    "if (which === 'systemd') {",
+    "  const unit = 'dsh-watchdog-drill-' + Date.now();",
+    "  const answer = registerSystemdRun({ unitId: unit, delaySeconds: 2, command: ['sh', '-c', 'sleep 1; echo fired > ' + marker] });",
+    "  console.log(JSON.stringify({ ok: answer.ok, error: answer.error }));",
+    "  setTimeout(() => { cleanupSystemdUnit({ unitId: unit }); }, 6000);",
+    "} else {",
+    "  const answer = registerDetachedProcess({ delaySeconds: 2, command: \"sh -c 'echo fired > \" + marker + \"'\", pidPath: dir + '/pid' });",
+    "  console.log(JSON.stringify({ ok: answer.ok, pid: answer.pid, error: answer.error }));",
+    "}",
+    '',
+  ].join('\n'), 'utf8');
+
+  // Tier 3: the detached process of our own.
+  try {
+    const out = execFileSync('wsl.exe', ['-e', 'node', wslPath(helper), wslDir, wslPath(marker), 'detached'], { encoding: 'utf8', timeout: 60000 });
+    const answer = JSON.parse(String(out).trim().split('\n').pop());
+    check('tier 3: the background process was started', answer.ok === true, answer.error || '');
+    check('tier 3: it really ran later', await waitForFile(marker, 20000));
+  } catch (error) {
+    check('tier 3: the background process was started', false, String(error && error.message ? error.message : error));
+  }
+  try {
+    fs.rmSync(marker, { force: true });
+  } catch {
+    // It is gone either way.
+  }
+
+  // Tier 2: the systemd user timer.
+  try {
+    const out = execFileSync('wsl.exe', ['-e', 'node', wslPath(helper), wslDir, wslPath(marker), 'systemd'], { encoding: 'utf8', timeout: 60000 });
+    const answer = JSON.parse(String(out).trim().split('\n').pop());
+    check('tier 2: the systemd unit was registered', answer.ok === true, answer.error || '');
+    check('tier 2: it really ran later', await waitForFile(marker, 30000));
+  } catch (error) {
+    check('tier 2: the systemd unit was registered', false, String(error && error.message ? error.message : error));
+  }
+}
+
+/**
+ * The WSL path of a Windows path.
+ *
+ * @param {string} target
+ * @returns {string}
+ */
+function wslPath(target) {
+  const normalized = target.replace(/\\/g, '/');
+  const match = /^[A-Za-z]:\/(.*)$/.exec(normalized);
+  if (!match) return normalized;
+  return '/mnt/' + normalized[0].toLowerCase() + '/' + match[1];
+}
+
+/**
+ * Wait a moment (the drill is not in a hurry).
+ *
+ * @param {number} ms
+ */
+function wait(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+console.log('dsh-autorestart watchdog drill');
+console.log('  workspace: ' + drillRoot);
+console.log('');
+
+console.log('--- the three scenarios ---');
+await scenario({ name: 'scenario-1-normal', behaviour: 'up', fixIt: false, expect: 'not-needed' });
+await scenario({ name: 'scenario-2-recovered', behaviour: 'down', fixIt: true, expect: 'recovered' });
+await scenario({ name: 'scenario-3-failed', behaviour: 'down', fixIt: false, expect: 'failed' });
+
+console.log('');
+console.log('--- the tiers, for real ---');
+await windowsTier();
+await linuxTiers();
+
+console.log('');
+console.log('--- cleanup ---');
+try {
+  fs.rmSync(drillRoot, { recursive: true, force: true });
+  check('the drill directory is gone', !fs.existsSync(drillRoot));
+} catch (error) {
+  check('the drill directory is gone', false, String(error && error.message ? error.message : error));
+}
+await wait(500);
+
+console.log('');
+if (failures.length === 0) {
+  console.log('the watchdog drill passed: every scenario behaved as it should, every tier really fires.');
+  process.exit(0);
+}
+console.log('the watchdog drill FAILED:');
+for (const line of failures) console.log('  ' + line);
+process.exit(1);

package/scripts/emergency-disable.sh

@@ -0,0 +1,314 @@
+#!/bin/sh
+# dsh-autorestart - the emergency switch (POSIX: Linux, WSL, macOS).
+#
+# Three traps this file avoids (the whole story: scripts/README.md):
+#   1. the wording lives in rescue-strings.zh.json and is NESTED - it is read
+#      by path with node, never by a flat grep;
+#   2. the English fallbacks below must NOT contain parentheses: dash counts
+#      them even inside single quotes, and one stray ")" breaks the script;
+#   3. the sed expressions stay single-quoted: the shell eats the backslashes
+#      in a double-quoted sed program and truncates it.
+#
+# "I enabled the plugin and DSH does not start any more" is the hardest moment
+# for a plugin: fixing it needs the plugin itself. This script touches ONE file
+# - the package.json of the profile - and ONE array in it:
+# `dsh.profile.bundles`.
+#
+#     - disable: take "dsh-autorestart" out of the bundles (it was not there
+#       anyway -> report "already disabled", that is not a failure);
+#     - enable : put "dsh-autorestart" back into the bundles;
+#     - status : read only, says whether it is in the bundles right now.
+#
+# Two hard rules:
+#
+#   1. the file is backed up as `package.json.bak-emergency-<stamp>` before
+#      anything is written;
+#   2. after writing, the JSON is parsed again and checked; if the check
+#      fails, the backup is put back and the failure is reported honestly.
+#
+# The indentation and the line endings of the file are kept as they are (the
+# TEXT is edited, the JSON is not re-serialized).
+#
+# The file is pure ASCII on purpose: the Chinese wording lives in
+# rescue-strings.zh.json (UTF-8 without a BOM).
+set -eu
+
+PACKAGE_NAME='dsh-autorestart'
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+STRINGS_FILE="$SCRIPT_DIR/rescue-strings.zh.json"
+
+ACTION='disable'
+DRY_RUN=0
+PACKAGE_JSON=''
+
+usage() {
+  printf 'Usage: %s [--action disable|enable|status] [--dry-run] [--package FILE]\n' "$0"
+  printf '  --action ...   what to do (default: disable)\n'
+  printf '  --dry-run      say what would be written, change nothing\n'
+  printf '  --package FILE the package.json to work on (default: the profile of this machine)\n'
+}
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --action) ACTION="${2:-}"; shift ;;
+    --dry-run|-n) DRY_RUN=1 ;;
+    --package) PACKAGE_JSON="${2:-}"; shift ;;
+    --help|-h) usage; exit 0 ;;
+    *) printf 'unknown argument: %s\n' "$1" >&2; usage >&2; exit 2 ;;
+  esac
+  shift
+done
+
+case "$ACTION" in
+  disable|enable|status) ;;
+  *) printf 'unknown action: %s\n' "$ACTION" >&2; usage >&2; exit 2 ;;
+esac
+
+NODE_BIN=''
+if command -v node >/dev/null 2>&1; then
+  NODE_BIN=$(command -v node)
+fi
+
+# t <key> <english fallback>
+#
+# The key is a PATH into the strings file ("emergency.done"), because that file
+# is nested. Node reads it (it is on every machine that runs DSH); without
+# node every message falls back to English.
+t() {
+  key="$1"
+  fallback="$2"
+  if [ -n "$NODE_BIN" ] && [ -f "$STRINGS_FILE" ]; then
+    value=$("$NODE_BIN" -e '
+      const fs = require("fs");
+      try {
+        const doc = JSON.parse(fs.readFileSync(process.argv[1], "utf8").replace(/^\uFEFF/, ""));
+        let value = doc;
+        for (const part of process.argv[2].split(".")) value = value == null ? undefined : value[part];
+        if (typeof value !== "string" || value === "") process.exit(1);
+        process.stdout.write(value);
+      } catch (error) { process.exit(1); }
+    ' "$STRINGS_FILE" "$key" 2>/dev/null) || value=''
+    if [ -n "$value" ]; then
+      printf '%s' "$value"
+      return 0
+    fi
+  fi
+  printf '%s' "$fallback"
+}
+
+# fmt <text> <value> ...
+#
+# Node does the replacement when it is there: the Chinese wording is UTF-8 and
+# a byte-wise sed would mangle it. Without node only the English fallbacks are
+# used, and those are plain ASCII.
+fmt() {
+  text="$1"
+  shift
+  if [ -n "$NODE_BIN" ]; then
+    if "$NODE_BIN" -e '
+      let text = process.argv[1];
+      process.argv.slice(2).forEach((value, index) => { text = text.split("{" + index + "}").join(value); });
+      process.stdout.write(text);
+    ' "$text" "$@" 2>/dev/null; then
+      return 0
+    fi
+  fi
+  index=0
+  for value in "$@"; do
+    safe=$(printf '%s' "$value" | sed 's/[&|\\]/\\&/g')
+    text=$(printf '%s' "$text" | sed "s|{$index}|$safe|g")
+    index=$((index + 1))
+  done
+  printf '%s' "$text"
+}
+
+say() {
+  printf '%s\n' "$1"
+}
+
+fail() {
+  printf '%s%s\n' "$(t 'emergency.failed' 'the emergency switch failed: {0}')" "$1" >&2
+  exit 1
+}
+
+full_path() {
+  target="${1:-}"
+  [ -n "$target" ] || return 0
+  case "$target" in
+    /*) resolved="$target" ;;
+    *) resolved="$PWD/$target" ;;
+  esac
+  while [ "${resolved%/}" != "$resolved" ] && [ "${resolved%/}" != '' ]; do
+    resolved="${resolved%/}"
+  done
+  printf '%s' "$resolved"
+}
+
+dsh_home() {
+  if [ -n "${DSH_HOME:-}" ]; then
+    full_path "$DSH_HOME"
+    return 0
+  fi
+  if [ -n "${HOME:-}" ]; then
+    full_path "$HOME/.dsh"
+    return 0
+  fi
+  printf ''
+}
+
+# The package.json of the profile of this machine.
+default_package_json() {
+  if [ -n "${DSH_PROFILE_DIR:-}" ]; then
+    explicit=$(full_path "$DSH_PROFILE_DIR")
+    if [ -n "$explicit" ] && [ -f "$explicit/package.json" ]; then
+      printf '%s' "$explicit/package.json"
+      return 0
+    fi
+  fi
+  root=$(dsh_home)
+  if [ -n "$root" ]; then
+    profiles="$root/profiles"
+    if [ -d "$profiles" ]; then
+      match=''
+      count=0
+      for entry in "$profiles"/*; do
+        [ -f "$entry/package.json" ] || continue
+        if grep -q "\"$PACKAGE_NAME\"" "$entry/package.json" 2>/dev/null; then
+          match="$entry/package.json"
+          count=$((count + 1))
+        fi
+      done
+      if [ "$count" -eq 1 ]; then
+        printf '%s' "$match"
+        return 0
+      fi
+    fi
+    if [ -n "${DSH_PROFILE:-}" ]; then
+      printf '%s' "$profiles/$DSH_PROFILE/package.json"
+      return 0
+    fi
+    printf '%s' "$profiles/desktop/package.json"
+    return 0
+  fi
+  printf ''
+}
+
+# The bundles of a package.json, one per line.
+bundles_list() {
+  file="$1"
+  [ -f "$file" ] || return 1
+  if [ -n "$NODE_BIN" ]; then
+    "$NODE_BIN" -e 'try { const d = JSON.parse(require("fs").readFileSync(process.argv[1], "utf8").replace(/^\uFEFF/, "")); const b = d && d.dsh && d.dsh.profile && d.dsh.profile.bundles; if (!Array.isArray(b)) process.exit(1); process.stdout.write(b.join("\n")) } catch (error) { process.exit(1) }' "$file" 2>/dev/null
+    return $?
+  fi
+  sed -n 's/.*"bundles"[[:space:]]*:[[:space:]]*\[\([^]]*\)\].*/\1/p' "$file" | tr ',' '\n' | sed 's/["[:space:]]//g'
+}
+
+json_parses() {
+  file="$1"
+  [ -f "$file" ] || return 1
+  if [ -n "$NODE_BIN" ]; then
+    "$NODE_BIN" -e 'try { JSON.parse(require("fs").readFileSync(process.argv[1], "utf8").replace(/^\uFEFF/, "")); process.exit(0) } catch (error) { process.exit(1) }' "$file" >/dev/null 2>&1
+    return $?
+  fi
+  head -c 1 "$file" | grep -q '{' || return 1
+  return 0
+}
+
+# --- Start ---
+
+if [ -n "$PACKAGE_JSON" ]; then
+  pkg=$(full_path "$PACKAGE_JSON")
+else
+  pkg=$(default_package_json)
+fi
+if [ -z "$pkg" ]; then
+  fail "$(t 'emergency.notFound' 'the package.json of the profile cannot be found: {0}')" ''
+fi
+if [ ! -f "$pkg" ]; then
+  fail "$(fmt "$(t 'emergency.notFound' 'the package.json of the profile cannot be found: {0}')" "$pkg")"
+fi
+if ! json_parses "$pkg"; then
+  fail "$(fmt "$(t 'emergency.badJson' 'this package.json is not valid JSON: {0}')" "$pkg")"
+fi
+say "$(fmt "$(t 'emergency.file' 'file: {0}')" "$pkg")"
+
+list=$(bundles_list "$pkg" || printf '')
+if [ -z "$list" ]; then
+  fail "$(fmt "$(t 'emergency.noBundles' 'this profile has no dsh.profile.bundles list')" '')"
+fi
+
+in_bundles=0
+if printf '%s\n' "$list" | grep -qx "$PACKAGE_NAME"; then
+  in_bundles=1
+fi
+
+if [ "$ACTION" = 'status' ]; then
+  if [ "$in_bundles" -eq 1 ]; then
+    say "$(fmt "$(t 'emergency.enabled' 'enabled: {0} is in the bundles.')" "$PACKAGE_NAME")"
+  else
+    say "$(fmt "$(t 'emergency.disabled' 'disabled: {0} is not in the bundles.')" "$PACKAGE_NAME")"
+  fi
+  exit 0
+fi
+
+if [ "$ACTION" = 'disable' ] && [ "$in_bundles" -eq 0 ]; then
+  say "$(fmt "$(t 'emergency.alreadyDisabled' 'already disabled: {0} was not in the bundles (no file was changed).')" "$PACKAGE_NAME")"
+  exit 0
+fi
+if [ "$ACTION" = 'enable' ] && [ "$in_bundles" -eq 1 ]; then
+  say "$(fmt "$(t 'emergency.alreadyEnabled' 'already enabled: {0} was in the bundles (no file was changed).')" "$PACKAGE_NAME")"
+  exit 0
+fi
+
+if [ "$DRY_RUN" -eq 1 ]; then
+  if [ "$ACTION" = 'disable' ]; then
+    say "$(fmt "$(t 'emergency.dryRunWill' '[dry run] {0} would be taken out of the bundles.')" "$PACKAGE_NAME")"
+  else
+    say "$(fmt "$(t 'emergency.dryRunWill' '[dry run] {0} would be taken out of the bundles.')" "$PACKAGE_NAME")"
+  fi
+  say "$(fmt "$(t 'emergency.dryRunBackup' '[dry run] it would be backed up as: {0}.bak-emergency-<stamp>')" "$pkg")"
+  say "$(t 'emergency.dryRunNoChange' '[dry run] no file was changed.')"
+  exit 0
+fi
+
+# --- Back up, then write ---
+stamp=$(date -u +%Y%m%d-%H%M%S)
+backup="$pkg.bak-emergency-$stamp"
+if ! cp -- "$pkg" "$backup"; then
+  fail "$(fmt "$(t 'emergency.backupFailed' 'the backup failed - the original file was not touched: {0}')" "$backup")"
+fi
+
+tmp="$pkg.tmp-emergency-$$"
+if [ "$ACTION" = 'disable' ]; then
+  sed "/^[[:space:]]*\"$PACKAGE_NAME\"[[:space:]]*,\{0,1\}[[:space:]]*$/d" "$pkg" > "$tmp"
+else
+  sed "s/^\\([[:space:]]*\"bundles\"[[:space:]]*:[[:space:]]*\\[\\)$/\\1\\n    \"$PACKAGE_NAME\",/" "$pkg" > "$tmp"
+fi
+if ! mv -- "$tmp" "$pkg"; then
+  rm -f -- "$tmp" 2>/dev/null || true
+  fail "$(fmt "$(t 'emergency.writeFailed' 'the write failed - the backup is at {0}: {1}')" "$backup" "$pkg")"
+fi
+
+# --- Read it back ---
+if ! json_parses "$pkg"; then
+  cp -- "$backup" "$pkg" || true
+  fail "$(fmt "$(t 'emergency.verifyFailedRolledBack' 'the check failed - it was rolled back: {0}')" "$backup")"
+fi
+after=$(bundles_list "$pkg" || printf '')
+if [ "$ACTION" = 'disable' ]; then
+  if printf '%s\n' "$after" | grep -qx "$PACKAGE_NAME"; then
+    cp -- "$backup" "$pkg" || true
+    fail "$(fmt "$(t 'emergency.verifyFailedRolledBack' 'the check failed - it was rolled back: {0}')" "$backup")"
+  fi
+  say "$(fmt "$(t 'emergency.done' 'done: {0}.')" "$(fmt "$(t 'emergency.summaryRemove' 'dsh-autorestart was taken out of the bundles')" '')")"
+else
+  if ! printf '%s\n' "$after" | grep -qx "$PACKAGE_NAME"; then
+    cp -- "$backup" "$pkg" || true
+    fail "$(fmt "$(t 'emergency.verifyFailedRolledBack' 'the check failed - it was rolled back: {0}')" "$backup")"
+  fi
+  say "$(fmt "$(t 'emergency.done' 'done: {0}.')" "$(fmt "$(t 'emergency.summaryAdd' 'dsh-autorestart was put back into the bundles')" '')")"
+fi
+say "$(fmt "$(t 'emergency.backup' 'backup: {0}')" "$backup")"
+say "$(t 'emergency.restartHint' 'Restart DSH for it to take effect.')"
+exit 0