omp-conductor 0.3.25 → 0.4.1

package/src/upgrade.ts

@@ -1,10 +1,18 @@
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { inspectBriefLayout, type BriefLayout } from "./brief-upgrade.ts";
 import { setPaused, statusSnapshot } from "./daemon.ts";
-import { fleetLayers, type DispatchLayer, type FleetLayers } from "./fleet.ts";
+import { fleetLayers, telegramStateDir, type DispatchLayer, type FleetLayers } from "./fleet.ts";
 import { livingDaemon, restartDaemon } from "./lifecycle.ts";
-import { findProject, loadConfig } from "./config.ts";
+import { findProject, loadConfig, resolveCaps } from "./config.ts";
 import { renderBriefForProject } from "./setup.ts";
+import {
+  STAGED_SERVICE_NAME,
+  parseEffectiveUnit,
+  planHostRuntime,
+  unitDriftReason,
+  writeHostRuntime,
+  type EffectiveUnit,
+} from "./setup-host.ts";
 
 const PACKAGE = "omp-conductor";
 const HERDR_PLUGIN = "herdr-conductor";
@@ -33,6 +41,15 @@ export interface UpgradeResult {
   dispatch: DispatchLayer;
 }
 
+/** What the unit check reads, and how it repairs what it can. */
+export interface UnitFiles {
+  rendered: string;
+  /** What systemd loaded, not what is on disk. Undefined means no systemd here. */
+  effective: EffectiveUnit | undefined;
+  /** Writes the corrected unit to the state dir; returns the commands root must run. */
+  stage?(): readonly string[];
+}
+
 export interface UpgradeDeps {
   run(command: string, args: readonly string[]): Promise<UpgradeCommandResult>;
   snapshot(project?: string): { liveWorkers: number };
@@ -44,6 +61,12 @@ export interface UpgradeDeps {
   sleep(ms: number): Promise<void>;
   env: NodeJS.ProcessEnv;
   log(message: string): void;
+  /**
+   * What this version would render as the unit, and what systemd actually
+   * booted from. Injected so the drift check is testable without a systemd host
+   * — and defaulted, so no production caller has to know it exists.
+   */
+  unitFiles?(): Promise<UnitFiles | undefined> | UnitFiles | undefined;
 }
 
 async function runCommand(command: string, args: readonly string[]): Promise<UpgradeCommandResult> {
@@ -381,6 +404,49 @@ async function rollbackUpgrade(
   if (failures.length > 0) throw new Error(failures.join("; "));
 }
 
+/**
+ * The rendered-vs-installed pair for {@link unitDriftReason}.
+ *
+ * Best-effort by design: a host with no config, no project, or no systemd is
+ * not a host with a broken unit, and an upgrade must not fail because it could
+ * not answer a question that does not apply there.
+ */
+async function defaultUnitFiles(deps: UpgradeDeps): Promise<UnitFiles | undefined> {
+  try {
+    const cfg = loadConfig();
+    const project = cfg.projects[0];
+    if (project === undefined) return undefined;
+    const plan = planHostRuntime(project, resolveCaps(project, cfg.defaults), telegramStateDir());
+    const shown = await deps.run("systemctl", [
+      "show",
+      STAGED_SERVICE_NAME,
+      "-p",
+      "AmbientCapabilities",
+      "-p",
+      "CapabilityBoundingSet",
+      "-p",
+      "Environment",
+      "-p",
+      "NeedDaemonReload",
+    ]);
+    return {
+      rendered: plan.service.content,
+      effective: shown.code === 0 ? parseEffectiveUnit(shown.stdout) : undefined,
+      // Staging needs no privilege, so the repair is reduced to the two lines
+      // that genuinely do. Installing the unit is root's, and this command runs
+      // as the fleet user by design — so it goes as far as it can and then says
+      // exactly what is left, rather than sending the operator back through a
+      // wizard to regenerate a file it could write itself.
+      stage: () => {
+        writeHostRuntime(plan);
+        return plan.installCommands;
+      },
+    };
+  } catch {
+    return undefined;
+  }
+}
+
 export async function upgradeConductor(
   options: UpgradeOptions = {},
   overrides: Partial<UpgradeDeps> = {},
@@ -407,6 +473,22 @@ export async function upgradeConductor(
   const surfaces = await inspectSurfaces(deps);
   const brief = deps.brief(project);
   const installNeeded = !surfacesCurrent(surfaces, release.version, release.gitHead);
+  // Computed BEFORE the no-op decision, not inside verification, and that
+  // placement is the whole point. The upgrade that installs a version is run by
+  // the *previous* CLI, so a check living only in the new code never executes
+  // for the release that introduces it — and re-running afterwards would take
+  // the already-current early return and skip it forever. A fleet whose unit is
+  // stale is not current, whatever its package identities say.
+  const files = await (deps.unitFiles === undefined ? defaultUnitFiles(deps) : deps.unitFiles());
+  const drift = files === undefined ? undefined : unitDriftReason(files.rendered, files.effective);
+  if (drift !== undefined) {
+    const commands = files?.stage?.() ?? [];
+    throw new Error(
+      commands.length === 0
+        ? drift
+        : `${drift}\n\nThe corrected unit has been staged. Run:\n${commands.map((c) => `  ${c}`).join("\n")}`,
+    );
+  }
   if (!installNeeded && brief.current) {
     return {
       previousVersion: surfaces.cliVersion,
@@ -489,6 +571,17 @@ export async function upgradeConductor(
       const active = await mustRun(deps, "systemctl", ["is-active", HERDR_UNIT]);
       if (active.stdout.trim() !== "active") throw new Error(`${HERDR_UNIT} is not active after restart`);
     }
+    // The unit is the one surface `upgrade` never looked at, and since 0.4.0 it
+    // is the difference between a working per-run fleet and one that refuses
+    // every issue. Fatal rather than a warning: the whole point of this command
+    // is that a fleet is either upgraded or explicitly left paused, and a
+    // "verified" fleet that cannot dispatch is the worse outcome.
+    // Re-read rather than trust the earlier pass: the daemon has restarted
+    // since, and an operator who installed a unit mid-upgrade should not get a
+    // green verification for a file nobody checked.
+    const after = await (deps.unitFiles === undefined ? defaultUnitFiles(deps) : deps.unitFiles());
+    const stillDrifted = after === undefined ? undefined : unitDriftReason(after.rendered, after.effective);
+    if (stillDrifted !== undefined) throw new Error(stillDrifted);
     await waitForRecovery(deps, initial, project);
     deps.log("verify 2/2: recovered fleet remains stable");
     await deps.sleep(1_000);