omp-conductor 0.16.1 → 0.17.0

package/src/ui/progress.ts

@@ -0,0 +1,32 @@
+/** Whether the CLI owns an interactive terminal rather than a pipe or plain-UI session. */
+export function interactiveUi(): boolean {
+  return Boolean(
+    process.stdin.isTTY &&
+      process.stdout.isTTY &&
+      !process.env.OMP_CONDUCTOR_PLAIN_UI,
+  );
+}
+
+/** Run one long, silent operation with safe Clack progress on an interactive TTY. */
+export async function withProgress<T>(
+  message: string,
+  success: string,
+  operation: () => Promise<T>,
+  options: { plainMessage?: boolean } = {},
+): Promise<T> {
+  if (!interactiveUi()) {
+    if (options.plainMessage) process.stdout.write(`${message}\n`);
+    return operation();
+  }
+
+  const { log } = await import("@clack/prompts");
+  log.step(message);
+  try {
+    const result = await operation();
+    log.success(success);
+    return result;
+  } catch (err) {
+    log.error(`${message} failed`);
+    throw err;
+  }
+}

package/src/ui/style.ts

@@ -0,0 +1,11 @@
+import { styleText } from "node:util";
+
+function styled(format: Parameters<typeof styleText>[0], text: string): string {
+  return process.stdout.isTTY ? styleText(format, text) : text;
+}
+
+export const heading = (text: string): string => styled(["bold", "cyan"], text);
+export const ok = (text: string): string => styled("green", text);
+export const warn = (text: string): string => styled("yellow", text);
+export const fail = (text: string): string => styled("red", text);
+export const dim = (text: string): string => styled("dim", text);

package/src/upgrade-verify.ts

@@ -382,6 +382,19 @@ function resumeUpgradePause(deps: UpgradeVerifyDeps, request: PendingUpgradeRequ
   }
 }
 
+/**
+ * Doctor findings that only a privileged `setup host` can clear — the systemd
+ * units (and the recovery pair they name), and the herdr pane-shell key. A
+ * release that re-renders any of those templates fails them on every host
+ * whose `setup host` has not been re-run, so they are not rollback-worthy
+ * regression evidence: the upgrade is deliberately unable to perform the
+ * privileged install, and rolling back over drift it cannot clear would
+ * strand the fleet on the previous release with the same outstanding `setup
+ * host` (#598). The verifier escalates them instead — the doctor check's
+ * detail and the verify report name the drift and its fix.
+ */
+const PRIVILEGED_INSTALL_DRIFT = new Set(["systemd-unit", "systemd-recovery", "herdr-resume"]);
+
 /**
  * The independent checks the returning process runs. Each compares a live
  * fact with the journal's record of the world the install began in:
@@ -392,7 +405,9 @@ function resumeUpgradePause(deps: UpgradeVerifyDeps, request: PendingUpgradeRequ
  *    same predicate the in-process upgrade used, so a fleet that was armed
  *    stays armed and a live pane stays live;
  *  - `health` — the daemon that came back answers `/healthz`;
- *  - `doctor` — no failing finding.
+ *  - `doctor` — no failing finding beyond the privileged-install drift
+ *    ({@link PRIVILEGED_INSTALL_DRIFT}) only `setup host` can clear, which is
+ *    escalated rather than rolled back.
  */
 export async function runUpgradeChecks(
   deps: UpgradeVerifyDeps,
@@ -423,10 +438,17 @@ export async function runUpgradeChecks(
 
   const doctor = await deps.doctor(deps.projectName);
   const failing = doctor.findings.filter((finding) => finding.status === "fail");
+  const drift = failing.filter((finding) => PRIVILEGED_INSTALL_DRIFT.has(finding.id));
+  const regression = failing.filter((finding) => !PRIVILEGED_INSTALL_DRIFT.has(finding.id));
   checks.push({
     name: "doctor",
-    ok: failing.length === 0,
-    detail: failing.length === 0 ? `status ${doctor.status}` : `${failing[0]!.id}: ${failing[0]!.summary}`,
+    ok: regression.length === 0,
+    detail:
+      regression.length > 0
+        ? `${regression[0]!.id}: ${regression[0]!.summary}`
+        : drift.length > 0
+          ? `status ${doctor.status}; ${drift.map((f) => f.id).join(", ")} — privileged-install drift, run \`omp-conductor setup host\` from the fleet account`
+          : `status ${doctor.status}`,
   });
 }
 

package/src/upgrade.ts

@@ -14,9 +14,9 @@ import { livingDaemon, restartDaemon } from "./lifecycle.ts";
 import { configBackupDir, configPath, findProject, loadConfig, resolveCaps, stateDir, writeConfigRaw } from "./config.ts";
 import { renderBriefForProject } from "./setup.ts";
 import {
-  STAGED_SERVICE_NAME,
   planHostRuntime,
-  writeHostRuntime,
+  totalConfiguredWorkers,
+  type HostRuntimePlan,
 } from "./setup-host.ts";
 import {
   appendJournal,
@@ -95,6 +95,17 @@ export interface UpgradeDeps {
   sleep(ms: number): Promise<void>;
   env: NodeJS.ProcessEnv;
   log(message: string): void;
+  /**
+   * The host runtime this version's package renders, compared against what is
+   * actually installed: the daemon and herdr units, the recovery unit and its
+   * playbook at {@link RECOVER_SCRIPT_INSTALL_PATH}, the herdr pane-shell
+   * config and the herdr-conductor `config.env`. `upgrade` prints
+   * {@link HostRuntimePlan.drift} after a release that re-rendered those
+   * files, so the operator is told that `setup host` is owed before a later
+   * `doctor` has to discover it. Read-only: the plan renders and compares,
+   * it never writes a host file.
+   */
+  hostRuntime(): HostRuntimePlan;
   /**
    * The durable journal sink for the detached fleet installer (#486). Wired
    * to the state-dir journal by `upgrade-install`/`upgrade-rollback`; absent
@@ -135,6 +146,13 @@ export const DEFAULT_DEPS: UpgradeDeps = {
   restartDaemon: async () => {
     await restartDaemon({});
   },
+  // The bare host-global plan — the same render the advisory's `setup host`
+  // command would install: no per-project tail, the recovery unit encoding no
+  // one project's name, and FLEET_CWDS derived from every configured project.
+  hostRuntime: () => {
+    const cfg = loadConfig();
+    return planHostRuntime(undefined, cfg.defaults, telegramStateDir(), undefined, totalConfiguredWorkers(cfg));
+  },
   sleep: Bun.sleep,
   env: process.env,
   log: (message) => process.stdout.write(`${message}\n`),
@@ -821,6 +839,37 @@ export async function rollbackUpgrade(
   if (failures.length > 0) throw new Error(failures.join("; "));
 }
 
+/**
+ * Name the host-runtime destinations this version's render no longer matches,
+ * after a successful upgrade — the installed units, the recovery playbook at
+ * {@link RECOVER_SCRIPT_INSTALL_PATH}, the herdr pane-shell config and the
+ * herdr-conductor `config.env`. A release that re-renders any of those files
+ * silently invalidates the installed copies; telling the operator here — with
+ * the exact command — is what stops the drift from surviving until a later
+ * `doctor` finds it (#598).
+ *
+ * The plan *is* the comparison: {@link UpgradeDeps.hostRuntime} renders every
+ * destination against disk, so a current host prints nothing and a drifted one
+ * names exactly the files only a privileged `setup host` can refresh. This
+ * never mutates a host file and never fails the upgrade — an unreadable host
+ * state is a warning line, not a reason to roll a successful install back.
+ */
+function logHostRuntimeDrift(deps: UpgradeDeps): void {
+  let plan: HostRuntimePlan;
+  try {
+    plan = deps.hostRuntime();
+  } catch (err) {
+    deps.log(
+      `host runtime: could not compare against this version's render — ${err instanceof Error ? err.message : String(err)}`,
+    );
+    return;
+  }
+  if (plan.drift.length === 0) return;
+  deps.log("host runtime:");
+  for (const path of plan.drift) deps.log(`  ${path} differs from this version's render`);
+  deps.log("fix: run `omp-conductor setup host` from the fleet account to re-install the host units");
+}
+
 export async function upgradeConductor(
   options: UpgradeOptions = {},
   overrides: Partial<UpgradeDeps> = {},
@@ -871,6 +920,11 @@ export async function upgradeConductor(
         detail: "all three surfaces and every brief were already pinned to the target release",
       });
     }
+    // Packages are current, but the host units they render may be behind: the
+    // same drift this advisory names after an install applies when a release
+    // re-rendered a template since the operator's last `setup host`. Silent on
+    // a host whose runtime matches (#598).
+    logHostRuntimeDrift(deps);
     return {
       previousVersion: surfaces.cliVersion,
       ...release,
@@ -1118,6 +1172,11 @@ export async function upgradeConductor(
     throw new Error(`upgrade failed: ${failure}; previous installation restored; dispatch remains paused`);
   }
 
+  // The install landed; name any host-runtime destination this version no
+  // longer renders identically, so the operator knows `setup host` is owed
+  // before a later `doctor` reports it as drift (#598).
+  logHostRuntimeDrift(deps);
+
   return {
     previousVersion: surfaces.cliVersion,
     ...release,

package/src/wizard-ui.ts

@@ -24,6 +24,15 @@
  * (`Cancelled`). The terminal UI guarantees the readline interface is closed on
  * every exit path so the verb cannot hang the terminal.
  */
+export interface PromptOptions {
+  /** Stable answer-file key. This is a permanent CLI API, not display copy. */
+  key: string;
+}
+
+export interface SelectOptions extends PromptOptions {
+  initialIndex?: number;
+}
+
 export interface WizardUi {
   notify(message: string, type?: "info" | "warning" | "error"): void;
   /**
@@ -32,17 +41,17 @@ export interface WizardUi {
    * `Cancelled` and abandons the run. Collapsing the two is how Ctrl-C at a
    * confirm used to record a silent "no" and carry on to the next question.
    */
-  confirm(title: string, message: string): Promise<boolean | undefined>;
+  confirm(title: string, message: string, promptOptions: PromptOptions): Promise<boolean | undefined>;
   /** Single-line text prompt. `undefined` dismisses it; an empty submit accepts
    *  the placeholder. */
-  input(title: string, placeholder?: string): Promise<string | undefined>;
+  input(title: string, placeholder: string | undefined, promptOptions: PromptOptions): Promise<string | undefined>;
   /** Single-choice list. On an interactive TTY the current option is rendered
    *  inline and moved with ↑/↓ or j/k; on a pipe it stays the numbered wall.
    *  Resolves the chosen option's label, or `undefined` when dismissed. */
   select(
     title: string,
     options: { label: string; description?: string }[],
-    dialogOptions?: { initialIndex?: number },
+    dialogOptions: SelectOptions,
   ): Promise<string | undefined>;
 }
 
@@ -83,8 +92,8 @@ import type { Readable, Writable } from "node:stream";
  * rather than only through a spawned CLI; production callers pass nothing.
  */
 export interface TerminalUi extends WizardUi {
-  /** Releases stdin. Idempotent; call it from a `finally`. */
-  close(): void;
+  /** Releases stdin; interactive drivers may render the outcome message. Idempotent. */
+  close(message?: string): void;
 }
 
 export function terminalUi(io: { input?: Readable; output?: Writable } = {}): TerminalUi {

package/systemd/omp-conductor-recover.sh

@@ -273,7 +273,7 @@ fresh_rollback_snapshot() {
   newest=$(ls -t "$BACKUP_ROOT"/config.json.pre-upgrade-* 2>/dev/null | head -n 1 || true)
   [[ -n $newest ]] || return 1
   now=$(epoch_now)
-  ts=$(stat -c %Y "$newest" 2>/dev/null || true)
+  ts=$(stat -c %Y "$newest" 2>/dev/null || stat -f %m "$newest" 2>/dev/null || true)
   [[ -n $ts && $((now - ts)) -le $ROLLBACK_AGE_S ]] || return 1
   printf '%s\n' "$newest"
 }

package/systemd/recover-unit-test.sh

@@ -126,14 +126,14 @@ unit_state() { # <case-dir> <unit> <state|absent>
 }
 
 # A pre-upgrade snapshot `upgrade` durably keeps (configBackupDir()):
-# config.json.pre-upgrade-<ts>. The test pass the age in seconds.
+# config.json.pre-upgrade-<ts>. The test passes the age in seconds.
 write_snapshot() { # <case-dir> <age-seconds>
   local d="$1" age="${2:-0}" now
   now=$(date +%s)
   local snap="$d/state/backups/config/config.json.pre-upgrade-$now"
   printf '%s\n' '{"preUpgrade":true}' >"$snap"
   if (( age > 0 )); then
-    touch -d "@$(( now - age ))" "$snap"
+    perl -e 'utime $ARGV[1], $ARGV[1], $ARGV[0] or die "utime: $!"' "$snap" "$(( now - age ))"
   fi
   printf '%s\n' "$snap"
 }