omp-conductor 0.14.0 → 0.15.0

package/src/privileged.ts

@@ -0,0 +1,264 @@
+/**
+ * The one place conductor runs a command as root.
+ *
+ * Every host-provisioning step used to be *printed* as a `sudo …` line for the
+ * operator to retype, which is not caution — it is an audit trail nobody keeps
+ * and a transcription error nobody catches. This module keeps the audit and
+ * removes the retyping: the caller composes structured steps, this renders all
+ * of them with their exact argv, takes **one** confirm, and then runs them.
+ *
+ * Three invariants, each of which a convenient shortcut would break:
+ *
+ *   - **The CLI never escalates itself.** Only the individual steps below are
+ *     privileged. `sudo omp-conductor setup host` would resolve the config,
+ *     `$OMP_CONDUCTOR_HOME`, `homedir()` and the unit's own `User=` as root and
+ *     bake the wrong account into a unit for a fleet that runs as somebody
+ *     else — a timer that goes green while writing state no worker can read.
+ *     {@link assertNoSelfExec} refuses to build such a step at all.
+ *   - **One confirm, everything named.** A confirm that authorises commands it
+ *     did not print is not consent, so the render happens first and lists the
+ *     exact argv — including which steps deliberately run *without* `sudo`.
+ *   - **A failure hands the work back.** The first non-`bestEffort` failure
+ *     stops the batch and prints the failed title, its stderr, and every
+ *     not-yet-run command verbatim, so an operator can finish by hand from the
+ *     terminal they are already looking at.
+ */
+
+import type { WizardUi } from "./wizard-ui.ts";
+
+export interface PrivilegedStep {
+  /** One line naming what this step accomplishes, shown in the plan. */
+  title: string;
+  /** The exact argv. No shell: no quoting rules, no word splitting, no `&&`. */
+  argv: readonly string[];
+  /**
+   * A failure here is reported and the batch continues. For steps whose failure
+   * is not a broken install — reloading a systemd that was never running, say.
+   */
+  bestEffort?: boolean;
+  /**
+   * Runs as the invoking account with **no** `sudo` prefix, while still
+   * appearing in the same plan under the same confirm.
+   *
+   * `setup graph`'s index-only clones are the case this exists for: a
+   * root-owned clone under the fleet user's cache is precisely the failure the
+   * escalation guard exists to prevent, but the operator must still see the
+   * clone and the timer install as one plan they approve once.
+   */
+  unprivileged?: boolean;
+}
+
+/** One spawn the runner needs. Injectable so tests never touch a real `sudo`. */
+export interface PrivilegedSpawn {
+  argv: readonly string[];
+  /**
+   * `sudo -v` needs the terminal for its password prompt, so its stdio is
+   * inherited whole and nothing is captured.
+   */
+  interactive: boolean;
+}
+
+export interface PrivilegedResult {
+  exitCode: number;
+  /** Captured stderr, or `""` for an interactive spawn that owned the terminal. */
+  stderr: string;
+}
+
+export interface PrivilegedDeps {
+  spawn(request: PrivilegedSpawn): Promise<PrivilegedResult>;
+  /** `undefined` on a platform without uids, which is never privileged here. */
+  getuid(): number | undefined;
+}
+
+export type PrivilegedOutcome =
+  /** The confirm was answered no, or dismissed. Nothing ran. */
+  | { kind: "declined" }
+  /** Every step ran; `bestEffort` failures are listed but did not stop the batch. */
+  | { kind: "completed"; softFailures: { step: PrivilegedStep; stderr: string }[] }
+  /** A required step failed. `remaining` are the steps that never ran. */
+  | {
+      kind: "failed";
+      step: PrivilegedStep;
+      exitCode: number;
+      stderr: string;
+      remaining: readonly PrivilegedStep[];
+    };
+
+export interface RunPrivilegedOptions {
+  deps?: PrivilegedDeps;
+  /** Confirm title. Defaults to a generic one; callers name their verb. */
+  title?: string;
+  /** Extra lines shown above the step list — what this batch is for. */
+  preamble?: readonly string[];
+}
+
+/**
+ * Shell-quoted rendering of one step, exactly as an operator would type it.
+ *
+ * The steps are argv precisely so nothing here is load-bearing at execution
+ * time; this is for the plan, the failure remainder and the print-only modes.
+ */
+export function formatStep(step: PrivilegedStep, asRoot = false): string {
+  const prefix = step.unprivileged || asRoot ? [] : ["sudo"];
+  return [...prefix, ...step.argv].map(shellQuote).join(" ");
+}
+
+function shellQuote(value: string): string {
+  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+}
+
+/**
+ * Refuses to build a step that re-runs conductor itself.
+ *
+ * Called on every step before anything is rendered, because the failure it
+ * prevents is invisible: `sudo omp-conductor …` exits 0 and leaves a unit
+ * naming the wrong account. Cheap, and it turns a future refactor's mistake
+ * into a test failure rather than a broken fleet.
+ */
+function assertNoSelfExec(steps: readonly PrivilegedStep[]): void {
+  for (const step of steps) {
+    const offender = step.argv.find((a) => {
+      const base = a.split("/").pop() ?? a;
+      return base === "omp-conductor" || base === "cli.ts";
+    });
+    if (offender !== undefined) {
+      throw new Error(
+        `privileged step "${step.title}" would re-exec conductor (${offender}) — ` +
+          "only individual structured steps are ever privileged",
+      );
+    }
+  }
+}
+
+async function spawnReal(request: PrivilegedSpawn): Promise<PrivilegedResult> {
+  const proc = Bun.spawn(request.argv as string[], {
+    // stdin is inherited even for captured steps: a `sudo` whose timestamp
+    // expired mid-batch must be able to prompt rather than fail on a closed fd.
+    stdin: "inherit",
+    // stdout is inherited so a long step (`systemctl start` on a oneshot that
+    // indexes for minutes) is visible while it runs instead of after it.
+    stdout: "inherit",
+    stderr: request.interactive ? "inherit" : "pipe",
+  });
+  const [exitCode, stderr] = await Promise.all([
+    proc.exited,
+    request.interactive ? Promise.resolve("") : new Response(proc.stderr).text(),
+  ]);
+  return { exitCode, stderr };
+}
+
+export const DEFAULT_PRIVILEGED_DEPS: PrivilegedDeps = {
+  spawn: spawnReal,
+  getuid: () => process.getuid?.(),
+};
+
+/**
+ * Renders `steps`, takes one confirm, then runs them in order.
+ *
+ * As root, every step runs directly: there is nothing to escalate, and a `sudo`
+ * prefix on a root-run fleet is an extra dependency for no gain. Otherwise one
+ * `sudo -v` primes the credential with the terminal it needs, and each
+ * privileged step then runs as `sudo -- <argv>` — `--` so a step whose first
+ * argument begins with a dash cannot be read as a `sudo` flag.
+ */
+export async function runPrivileged(
+  steps: readonly PrivilegedStep[],
+  ui: WizardUi,
+  options: RunPrivilegedOptions = {},
+): Promise<PrivilegedOutcome> {
+  assertNoSelfExec(steps);
+  const deps = options.deps ?? DEFAULT_PRIVILEGED_DEPS;
+  const asRoot = deps.getuid() === 0;
+  const needsSudo = !asRoot && steps.some((s) => s.unprivileged !== true);
+
+  ui.notify(
+    [
+      ...(options.preamble ?? []),
+      ...(options.preamble === undefined || options.preamble.length === 0 ? [] : [""]),
+      ...steps.flatMap((step, index) => [
+        `${index + 1}. ${step.title}${step.unprivileged === true && !asRoot ? "  (as you, not root)" : ""}`,
+        `   ${formatStep(step, asRoot)}`,
+      ]),
+      "",
+      asRoot
+        ? "Running as root — these run directly, with no sudo."
+        : needsSudo
+          ? "sudo will ask for your password once, before the first step."
+          : "None of these need root.",
+      "Nothing has been run yet.",
+    ].join("\n"),
+    "info",
+  );
+
+  const go = await ui.confirm(
+    options.title ?? "Run these steps now?",
+    `${steps.length} step(s), in the order shown. Anything that fails stops the rest and prints what is left.`,
+  );
+  // `undefined` is a dismissal rather than a "no", but for a batch that has not
+  // started they mean the same thing: run nothing.
+  if (go !== true) return { kind: "declined" };
+
+  if (needsSudo) {
+    const primed = await deps.spawn({ argv: ["sudo", "-v"], interactive: true });
+    if (primed.exitCode !== 0) {
+      return {
+        kind: "failed",
+        step: { title: "authenticate with sudo", argv: ["sudo", "-v"] },
+        exitCode: primed.exitCode,
+        stderr: primed.stderr,
+        remaining: steps,
+      };
+    }
+  }
+
+  const softFailures: { step: PrivilegedStep; stderr: string }[] = [];
+  for (const [index, step] of steps.entries()) {
+    ui.notify(`[${index + 1}/${steps.length}] ${step.title}`, "info");
+    const argv =
+      step.unprivileged === true || asRoot ? step.argv : ["sudo", "--", ...step.argv];
+    const result = await deps.spawn({ argv, interactive: false });
+    if (result.exitCode === 0) continue;
+    if (step.bestEffort === true) {
+      softFailures.push({ step, stderr: result.stderr });
+      ui.notify(`  continued past a best-effort failure: ${firstLine(result.stderr)}`, "warning");
+      continue;
+    }
+    const remaining = steps.slice(index + 1);
+    ui.notify(formatFailure(step, result, remaining, asRoot), "error");
+    return { kind: "failed", step, exitCode: result.exitCode, stderr: result.stderr, remaining };
+  }
+  return { kind: "completed", softFailures };
+}
+
+function firstLine(stderr: string): string {
+  const line = stderr.trim().split("\n")[0];
+  return line === undefined || line === "" ? "no stderr" : line;
+}
+
+/**
+ * What the operator is left holding when a step fails: the step, why, and the
+ * rest of the batch verbatim so finishing by hand is a paste rather than a
+ * reconstruction.
+ */
+export function formatFailure(
+  step: PrivilegedStep,
+  result: PrivilegedResult,
+  remaining: readonly PrivilegedStep[],
+  asRoot = false,
+): string {
+  return [
+    `Stopped: ${step.title} exited ${result.exitCode}.`,
+    `  ${formatStep(step, asRoot)}`,
+    ...(result.stderr.trim() === ""
+      ? ["  (no stderr — its output is above)"]
+      : result.stderr.trimEnd().split("\n").map((l) => `  ${l}`)),
+    ...(remaining.length === 0
+      ? ["", "Nothing was left to run."]
+      : [
+          "",
+          `${remaining.length} step(s) did NOT run. To finish by hand:`,
+          "",
+          ...remaining.map((s) => `  ${formatStep(s, asRoot)}`),
+        ]),
+  ].join("\n");
+}

package/src/reports.ts

@@ -284,7 +284,7 @@ export function telegramReportSend(p: ProjectConfig): ReportSend {
         "definitive",
       );
     }
-    return await sendTelegram(token, chatId, text);
+    return await sendTelegram(token, chatId, text, { topicId: p.escalation.telegramTopicId });
   };
 }
 

package/src/session-host.ts

@@ -49,6 +49,8 @@ export interface SessionHostSpec {
    * Absent, the verbs are registered and every one of them fails closed.
    */
   verbSocketPath?: string;
+  /** Deny every tool but reading and searching (#307) — the setup probes. */
+  readOnly?: boolean;
 }
 
 /** Parent → child. */
@@ -184,6 +186,7 @@ export async function runSessionHost(
       ...(spec.resume === undefined ? {} : { resume: spec.resume }),
       ...(spec.releaseGrants === undefined ? {} : { releaseGrants: spec.releaseGrants }),
       ...(spec.verbSocketPath === undefined ? {} : { verbSocketPath: spec.verbSocketPath }),
+      ...(spec.readOnly === undefined ? {} : { readOnly: spec.readOnly }),
       // The release audit lives in the daemon's state directory, which this
       // process may not be able to write and must not be trusted to. It
       // becomes a message; the parent performs the durable write.

package/src/setup-host.ts

@@ -1,7 +1,8 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
 import { homedir, userInfo } from "node:os";
 import { dirname, join } from "node:path";
-import { configPath, stateDir } from "./config.ts";
+import { configPath, loadConfig, resolveCaps, stateDir } from "./config.ts";
 import { isPaused, runDaemon, statusSnapshot, type StatusSnapshot } from "./daemon.ts";
 import { DEFAULT_FLEET_AGENT_NAME } from "./fleet.ts";
 import {
@@ -14,11 +15,13 @@ import {
   type StopResult,
 } from "./lifecycle.ts";
 import {
+  legacyArmedMarkerPath,
   readTickConfig,
   TICK_CONFIG_FILE,
+  tickConfigMatchesProject,
   type TickConfig,
 } from "./orchestrator-tick.ts";
-import type { Caps, ProjectConfig } from "./types.ts";
+import type { Caps, ConductorConfig, ProjectConfig } from "./types.ts";
 
 export const DEFAULT_TICK_INTERVAL_SECONDS = 900;
 export const STAGED_SERVICE_NAME = "omp-conductor.service";
@@ -36,6 +39,21 @@ export interface HostRuntimePlan {
   tick?: PlannedWrite<TickConfig>;
   installCommands: readonly string[];
   cliSource: "global" | "plugin";
+  /** Absolute path of the unit systemd actually reads. */
+  installedPath: string;
+  /**
+   * What installing would do to the unit **systemd reads**, which is a different
+   * question from {@link HostRuntimePlan.service}'s action — that one compares the
+   * staged copy under the state directory.
+   *
+   * The distinction is load-bearing: staging has always happened during setup,
+   * so on any fleet configured before the install was executed the staged file is
+   * already current (`service.action === "keep"`) while `/etc/systemd/system`
+   * holds nothing at all. Gating the install offer on the staged action therefore
+   * skipped exactly the fleets that had never installed the unit, and told them
+   * the installed unit matched.
+   */
+  installedAction: PlannedWrite<string>["action"];
 }
 
 export interface ServiceRuntime {
@@ -66,6 +84,143 @@ function actionFor(path: string, content: string): PlannedWrite<string>["action"
     return "update";
   }
 }
+/**
+ * Which account this host's fleet belongs to, and how we know.
+ *
+ * Two sources, in order of authority: the installed unit's own `User=` is what
+ * systemd will actually run as, and the owner of `$OMP_CONDUCTOR_HOME` is what
+ * owns the config, the store and the state directory. Either one disagreeing
+ * with the invoking account means staging would write the wrong identity.
+ */
+export interface FleetAccount {
+  name: string | undefined;
+  source: "installed unit" | "$OMP_CONDUCTOR_HOME owner" | "nothing on this host";
+}
+
+export interface EscalationDeps {
+  invokingUser(): string;
+  /** `$SUDO_USER`, which `sudo` sets and `sudo -i` / `su -` clear. */
+  sudoUser(): string | undefined;
+  /** `User=` from the installed unit, or `undefined` when there is no unit. */
+  unitUser(): string | undefined;
+  /** Owner of `$OMP_CONDUCTOR_HOME`, or `undefined` when it does not exist. */
+  homeOwner(): string | undefined;
+  conductorHome(): string;
+}
+
+/** uid → account name. `id -un` because no Node builtin maps a foreign uid. */
+function accountName(uid: number): string {
+  const ran = spawnSync("id", ["-un", String(uid)], { encoding: "utf8" });
+  const name = ran.status === 0 ? (ran.stdout ?? "").trim() : "";
+  return name === "" ? `uid ${uid}` : name;
+}
+
+function installedUnitUser(): string | undefined {
+  try {
+    const unit = readFileSync(join(SYSTEMD_UNIT_DIR, STAGED_SERVICE_NAME), "utf8");
+    const match = /^User=(.*)$/m.exec(unit);
+    if (match === null) return undefined;
+    // Unquoted in what we generate, but systemd accepts quotes and a
+    // hand-edited unit is exactly the case this guard has to read correctly.
+    const value = match[1]?.trim().replace(/^"(.*)"$/, "$1") ?? "";
+    return value === "" ? undefined : value;
+  } catch {
+    return undefined;
+  }
+}
+
+export const DEFAULT_ESCALATION_DEPS: EscalationDeps = {
+  invokingUser: () => userInfo().username,
+  sudoUser: () => process.env["SUDO_USER"],
+  unitUser: installedUnitUser,
+  homeOwner: () => {
+    try {
+      return accountName(statSync(dirname(configPath())).uid);
+    } catch {
+      return undefined;
+    }
+  },
+  conductorHome: () => dirname(configPath()),
+};
+
+/** The account this host's fleet runs as, from whichever source knows. */
+export function resolveFleetAccount(deps: EscalationDeps = DEFAULT_ESCALATION_DEPS): FleetAccount {
+  const fromUnit = deps.unitUser();
+  if (fromUnit !== undefined) return { name: fromUnit, source: "installed unit" };
+  const fromHome = deps.homeOwner();
+  if (fromHome !== undefined) return { name: fromHome, source: "$OMP_CONDUCTOR_HOME owner" };
+  return { name: undefined, source: "nothing on this host" };
+}
+
+export type EscalationVerdict = { kind: "ok" } | { kind: "refuse"; message: string };
+
+/**
+ * Refuses an *escalated* invocation of any setup path — and only that.
+ *
+ * The distinction is the whole point. Staging derives the unit's `User=` and
+ * `HOME=` from the invoking account ({@link defaultServiceRuntime}), so a
+ * `sudo omp-conductor setup host` writes `User=root` + `HOME=/root` into a unit
+ * for a fleet that runs as somebody else, and the config it loads, the state
+ * directory it writes and the indexes it points at all resolve as root too.
+ * Nothing about that announces itself: the unit starts, the timer goes green,
+ * and the fleet reads none of it. So it is refused rather than accommodated.
+ *
+ * `uid 0` is *not* the test. A fleet that legitimately runs as root — root owns
+ * `$OMP_CONDUCTOR_HOME` and the unit says `User=root` — is the case this verb
+ * exists for on single-tenant boxes, and refusing there would break exactly the
+ * hosts it targets. Two checks instead:
+ *
+ *   - `$SUDO_USER` is set, which is `sudo` announcing the escalation itself;
+ *   - the invoking account disagrees with the fleet account, which is what
+ *     catches `sudo -i` and `su -` — both clear `$SUDO_USER`, so the
+ *     environment check alone is not sufficient.
+ */
+export function checkEscalation(
+  verb: string,
+  deps: EscalationDeps = DEFAULT_ESCALATION_DEPS,
+): EscalationVerdict {
+  const invoking = deps.invokingUser();
+  const sudoUser = deps.sudoUser();
+  const fleet = resolveFleetAccount(deps);
+
+  if (sudoUser !== undefined && sudoUser !== "") {
+    return {
+      kind: "refuse",
+      message: refusal(verb, invoking, sudoUser, fleet, deps.conductorHome()),
+    };
+  }
+  if (fleet.name !== undefined && fleet.name !== invoking) {
+    return {
+      kind: "refuse",
+      message: refusal(verb, invoking, undefined, fleet, deps.conductorHome()),
+    };
+  }
+  return { kind: "ok" };
+}
+
+function refusal(
+  verb: string,
+  invoking: string,
+  sudoUser: string | undefined,
+  fleet: FleetAccount,
+  home: string,
+): string {
+  const fleetName = fleet.name ?? sudoUser ?? "the fleet's own account";
+  return [
+    `omp-conductor: run ${verb} as the account the fleet runs as, not escalated.`,
+    sudoUser === undefined
+      ? `This is running as "${invoking}", but the fleet runs as "${fleetName}" (${fleet.source}).`
+      : `This is running as "${invoking}" under sudo from "${sudoUser}"` +
+        (fleet.name === undefined ? "." : `, and the fleet runs as "${fleet.name}" (${fleet.source}).`),
+    `As "${invoking}" the config, ${home}, ~/.cache and the unit's own User= all resolve`,
+    `as "${invoking}" instead, and the result is a unit that starts and a fleet that reads`,
+    "none of it. Nothing has been written.",
+    "",
+    `Run it as "${fleetName}". Only the individual install steps need root, and`,
+    `${verb} runs those for you with sudo after showing you each one.`,
+  ].join("\n");
+}
+
 
 function defaultServiceRuntime(telegramStateDir: string): ServiceRuntime {
   const home = homedir();
@@ -86,16 +241,19 @@ function defaultServiceRuntime(telegramStateDir: string): ServiceRuntime {
   };
 }
 
-export function renderDaemonService(
-  project: ProjectConfig,
-  caps: Caps,
-  runtime: ServiceRuntime,
-): string {
+export function totalConfiguredWorkers(cfg: ConductorConfig = loadConfig()): number {
+  return cfg.projects.reduce(
+    (total, project) => total + resolveCaps(project, cfg.defaults).maxConcurrentWorkers,
+    0,
+  );
+}
+
+export function renderDaemonService(runtime: ServiceRuntime, totalWorkers: number): string {
   const command =
     runtime.cli === undefined
-      ? [runtime.bun, runtime.packageCli, "daemon", "--project", project.name, "--port", String(DEFAULT_PORT)]
-      : [runtime.cli, "daemon", "--project", project.name, "--port", String(DEFAULT_PORT)];
-  const memoryMax = caps.maxConcurrentWorkers <= 1 ? "3G" : "5G";
+      ? [runtime.bun, runtime.packageCli, "daemon", "--port", String(DEFAULT_PORT)]
+      : [runtime.cli, "daemon", "--port", String(DEFAULT_PORT)];
+  const memoryMax = totalWorkers <= 1 ? "3G" : "5G";
   return [
     "[Unit]",
     "Description=omp-conductor dispatch daemon",
@@ -128,6 +286,19 @@ function tickSearchRoots(project: ProjectConfig): string[] {
   return roots.filter((root, index) => roots.indexOf(root) === index);
 }
 
+/**
+ * The tick config for one project's fleet cwd.
+ *
+ * Everything per-project here used to be shared, and that was two bugs: one
+ * `<stateDir>/armed` marker meant arming project A armed B as well, and one
+ * `agentName` meant every pane claimed the identity `fleet`, so herdr recovery
+ * and tick ownership could not tell two fleets apart.
+ *
+ * An existing config keeps an explicit `armedFile`/`agentName` only when it
+ * differs from those shared defaults. A value equal to a shared default cannot
+ * have been a deliberate per-project choice — it *is* the collision — so it is
+ * rewritten; anything else is operator intent and survives untouched.
+ */
 function planTick(project: ProjectConfig, telegramStateDir: string): PlannedWrite<TickConfig> {
   let existing: { path: string; config: TickConfig } | undefined;
   for (const root of tickSearchRoots(project)) {
@@ -135,24 +306,37 @@ function planTick(project: ProjectConfig, telegramStateDir: string): PlannedWrit
     if (result.kind === "invalid") {
       throw new Error(`tick config invalid at ${result.path}: ${result.problem}; fix or remove it before setup`);
     }
-    if (result.kind === "ok") {
+    // A config stamped for another project is that project's file: the search
+    // roots overlap, and restamping it here would hand this project's identity
+    // to the other fleet's cwd.
+    if (result.kind === "ok" && tickConfigMatchesProject(result.config, project.name)) {
       existing = { path: result.path, config: result.config };
       break;
     }
   }
 
+  const armedFile = join(stateDir(), `armed-${project.name}`);
   const path = existing?.path ?? join(project.workspaceRoot, TICK_CONFIG_FILE);
   const config: TickConfig = existing === undefined
     ? {
         intervalSeconds: DEFAULT_TICK_INTERVAL_SECONDS,
-        armedFile: join(stateDir(), "armed"),
+        project: project.name,
+        armedFile,
         accessFile: join(telegramStateDir, "access.json"),
-        agentName: DEFAULT_FLEET_AGENT_NAME,
+        agentName: project.name,
       }
     : {
         ...existing.config,
-        armedFile: existing.config.armedFile ?? join(stateDir(), "armed"),
+        project: project.name,
+        armedFile:
+          existing.config.armedFile === undefined || existing.config.armedFile === legacyArmedMarkerPath()
+            ? armedFile
+            : existing.config.armedFile,
         accessFile: existing.config.accessFile ?? join(telegramStateDir, "access.json"),
+        agentName:
+          existing.config.agentName === undefined || existing.config.agentName === DEFAULT_FLEET_AGENT_NAME
+            ? project.name
+            : existing.config.agentName,
       };
   const content = `${JSON.stringify(config, null, 2)}\n`;
   return { path, action: actionFor(path, content), content, value: config };
@@ -160,12 +344,16 @@ function planTick(project: ProjectConfig, telegramStateDir: string): PlannedWrit
 
 export function planHostRuntime(
   project: ProjectConfig,
-  caps: Caps,
+  _caps: Caps,
   telegramStateDir: string,
   runtime: ServiceRuntime = defaultServiceRuntime(telegramStateDir),
+  // Callers that know the fleet pass the sum of resolved maxConcurrentWorkers.
+  // Defaulting through loadConfig() would throw in install tests that stage
+  // files before a config exists, and would hide a missing total at the call site.
+  totalWorkers: number = 1,
 ): HostRuntimePlan {
   const servicePath = join(stateDir(), STAGED_SERVICE_NAME);
-  const serviceContent = renderDaemonService(project, caps, runtime);
+  const serviceContent = renderDaemonService(runtime, totalWorkers);
   const service: PlannedWrite<string> = {
     path: servicePath,
     action: actionFor(servicePath, serviceContent),
@@ -185,6 +373,8 @@ export function planHostRuntime(
       `sudo systemctl restart ${STAGED_SERVICE_NAME}`,
     ],
     cliSource: runtime.cli === undefined ? "plugin" : "global",
+    installedPath,
+    installedAction: actionFor(installedPath, serviceContent),
   };
 }
 
@@ -242,7 +432,7 @@ export interface SetupSmokeResult {
 }
 
 export interface SetupSmokeDeps {
-  paused(): boolean;
+  paused(project: string): boolean;
   runOnce(project: string): Promise<void>;
   living(): DaemonRecord | undefined;
   health(port: number): Promise<{ ok: boolean; body?: string }>;
@@ -265,7 +455,7 @@ export async function runSetupSmoke(
   project: string,
   deps: SetupSmokeDeps = DEFAULT_SMOKE_DEPS,
 ): Promise<SetupSmokeResult> {
-  if (!deps.paused()) throw new Error("setup smoke requires paused dispatch");
+  if (!deps.paused(project)) throw new Error("setup smoke requires paused dispatch");
   await deps.runOnce(project);
   const existing = deps.living();
   if (existing !== undefined) {
@@ -283,8 +473,3 @@ export async function runSetupSmoke(
     await deps.stop();
   }
 }
-
-/** Absolute path of the unit systemd actually reads. */
-export function installedUnitPath(): string {
-  return join(SYSTEMD_UNIT_DIR, STAGED_SERVICE_NAME);
-}