omp-conductor 0.8.0 → 0.9.0

package/src/upgrade.ts

@@ -1,9 +1,10 @@
 import { existsSync, readFileSync } from "node:fs";
+import { backupTimestamp, copyToUniqueBackup } from "./backups.ts";
 import { inspectBriefLayout, type BriefLayout } from "./brief-upgrade.ts";
 import { setPaused, statusSnapshot } from "./daemon.ts";
 import { fleetLayers, telegramStateDir, type DispatchLayer, type FleetLayers } from "./fleet.ts";
 import { livingDaemon, restartDaemon } from "./lifecycle.ts";
-import { configPath, findProject, loadConfig, resolveCaps, writeConfigRaw } from "./config.ts";
+import { configBackupDir, configPath, findProject, loadConfig, resolveCaps, writeConfigRaw } from "./config.ts";
 import { renderBriefForProject } from "./setup.ts";
 import {
   STAGED_SERVICE_NAME,
@@ -327,6 +328,7 @@ async function rollbackUpgrade(
   herdrReloadStarted: boolean,
   daemonReloadStarted: boolean,
   configBefore?: string,
+  preUpgradeBackup?: string,
 ): Promise<void> {
   const failures: string[] = [];
 
@@ -344,12 +346,23 @@ async function rollbackUpgrade(
       const path = configPath();
       if (readFileSync(path, "utf8") !== configBefore) {
         deps.log("rollback: conductor config.json");
+        // Name the durable snapshot: the in-memory restore only runs while
+        // this process is alive, and an upgrade that died mid-flight leaves
+        // the operator needing exactly these bytes from disk.
+        deps.log(
+          preUpgradeBackup === undefined
+            ? "rollback: config.json changed during the upgrade; no durable snapshot was persisted"
+            : `rollback: config.json changed during the upgrade; pre-upgrade snapshot at ${preUpgradeBackup}`,
+        );
         // Exact bytes. `writeConfigFile(JSON.parse(...))` returns canonically
         // formatted output, which restores the keys but not the file.
         writeConfigRaw(configBefore);
       }
     } catch (err) {
-      failures.push(`could not restore config.json: ${err instanceof Error ? err.message : String(err)}`);
+      failures.push(
+        `could not restore config.json: ${err instanceof Error ? err.message : String(err)}` +
+          (preUpgradeBackup === undefined ? "" : `; pre-upgrade snapshot at ${preUpgradeBackup}`),
+      );
     }
   }
   const restore = async (label: string, command: string, args: readonly string[]): Promise<void> => {
@@ -496,13 +509,23 @@ export async function upgradeConductor(
   // Snapshotted before anything is installed, because the new daemon starts
   // during this transaction and may migrate the file — see the restore in
   // `rollbackUpgrade`. Read as bytes, not through the loader: the point is to
-  // put back exactly what was there, dialect and all.
+  // put back exactly what was there, dialect and all. The same bytes are also
+  // persisted under state, so a process death between here and the rollback
+  // cannot take the only pre-upgrade copy with it.
   let configBefore: string | undefined;
+  let preUpgradeBackup: string | undefined;
   try {
     configBefore = readFileSync(configPath(), "utf8");
+    preUpgradeBackup = copyToUniqueBackup(
+      configPath(),
+      configBackupDir(),
+      `config.json.pre-upgrade-${backupTimestamp()}`,
+    );
+    deps.log(`config backed up to ${preUpgradeBackup}`);
   } catch {
     // No readable config is not a reason to refuse an upgrade; there is simply
-    // nothing to put back.
+    // nothing to put back. A snapshot that failed to persist is not fatal
+    // either — the in-memory restore below still covers a clean rollback.
   }
 
   if (brief.kind === "missing") throw new Error("no ORCHESTRATOR.md exists for the configured project");
@@ -608,6 +631,7 @@ export async function upgradeConductor(
         herdrReloadStarted,
         daemonReloadStarted,
         configBefore,
+        preUpgradeBackup,
       );
     } catch (rollbackErr) {
       const rollback = rollbackErr instanceof Error ? rollbackErr.message : String(rollbackErr);