plc-checkweigher 1.35.0 → 1.37.1

package/bin/plc_checkweigher

@@ -321,6 +321,45 @@ for k,d in failed: print('  [FAIL]  ', k, '-', d)
     esac
     ;;
 
+# ── Backup / restore ──────────────────────────────────────────────────────────
+backup)
+    banner "Configuration Backup"
+    echo ""
+    spin_start "Snapshotting durable configuration"
+    "${PYTHON}" -c "
+import sys; sys.path.insert(0, '${INSTALL_DIR}')
+import selfheal, os
+d = selfheal.backup_state()
+print('OK', os.path.basename(d)) if d else print('NOTHING')
+" 2>/dev/null | { read -r _r _n; \
+        if [[ "$_r" == "OK" ]]; then spin_ok "Snapshot written: ${_n}"; \
+        else spin_warn "Nothing to back up yet"; fi; }
+    echo ""
+    info "Snapshots: ${INSTALL_DIR}/data/backups/  (latest = snapshot_latest.tar.gz)"
+    ls -1t "${INSTALL_DIR}/data/backups/"snapshot_2*.tar.gz 2>/dev/null | head -5 | sed 's/^/   /' || true
+    echo ""
+    ;;
+restore)
+    banner "Configuration Restore"
+    need_sudo
+    echo ""
+    info "Restores lost/corrupt config (SMB creds, register map, console code)"
+    info "from the latest snapshot. Live batch data is never overwritten."
+    echo ""
+    spin_start "Checking configuration integrity"
+    sudo "${PYTHON}" -c "
+import sys; sys.path.insert(0, '${INSTALL_DIR}')
+import selfheal
+res = selfheal.restore_check()
+if res:
+    k, st, d = res
+    print(f'[{st}] {d}')
+else:
+    print('INTACT')
+" && spin_ok "Integrity check complete" || spin_warn "Restore check hit an error"
+    echo ""
+    ;;
+
 # ── Push test ─────────────────────────────────────────────────────────────────
 push-test)
     banner "SMB Push Test"
@@ -1398,6 +1437,14 @@ update)
     # Keep data/ writable by pi
     sudo chown -R pi:pi "${DATA_DIR}" 2>/dev/null || true
     sudo chmod 755 "${DATA_DIR}" 2>/dev/null || true
+    # Event journal must stay writable by BOTH pi (watcher/web) and root
+    # (selfheal) — it is the shared transmission/event log. Backups dir is
+    # pi-owned so snapshots and pruning work without sudo.
+    sudo touch "${DATA_DIR}/event_journal.jsonl" 2>/dev/null || true
+    sudo chown pi:pi "${DATA_DIR}/event_journal.jsonl" 2>/dev/null || true
+    sudo chmod 666 "${DATA_DIR}/event_journal.jsonl" 2>/dev/null || true
+    sudo mkdir -p "${DATA_DIR}/backups" 2>/dev/null || true
+    sudo chown pi:pi "${DATA_DIR}/backups" 2>/dev/null || true
     spin_ok "Source files locked  (root:root 644)"
 
     # ── Install updated CLI to /usr/local/bin/ ────────────────────────────────
@@ -1663,13 +1710,13 @@ PYEOF
     # 9b. Web maintenance sudoers rule (dashboard terminal)
     spin_start "Web maintenance sudoers rule"
     _SUDOERS_F="/etc/sudoers.d/010_plc-web-fix"
-    # Content-aware: rewrite if missing OR still the old fix-only version
+    # Content-aware: rewrite if missing OR not yet upgraded to the current set
     if [[ ! -f "$_SUDOERS_F" ]] \
-       || ! sudo grep -q "plc_checkweigher update" "$_SUDOERS_F" 2>/dev/null; then
+       || ! sudo grep -q "plc_checkweigher restore" "$_SUDOERS_F" 2>/dev/null; then
         cat > /tmp/010_plc-web-fix << 'SUDOEOF'
 # Web dashboard maintenance terminal — allows the locked, root-owned CLI
 # to run whitelisted maintenance subcommands from plc_web (User=pi).
-pi ALL=(root) NOPASSWD: /usr/local/bin/plc_checkweigher fix, /usr/local/bin/plc_checkweigher fix *, /usr/local/bin/plc_checkweigher status, /usr/local/bin/plc_checkweigher restart, /usr/local/bin/plc_checkweigher start, /usr/local/bin/plc_checkweigher stop, /usr/local/bin/plc_checkweigher update
+pi ALL=(root) NOPASSWD: /usr/local/bin/plc_checkweigher fix, /usr/local/bin/plc_checkweigher fix *, /usr/local/bin/plc_checkweigher status, /usr/local/bin/plc_checkweigher restart, /usr/local/bin/plc_checkweigher start, /usr/local/bin/plc_checkweigher stop, /usr/local/bin/plc_checkweigher update, /usr/local/bin/plc_checkweigher restore
 SUDOEOF
         if sudo visudo -c -f /tmp/010_plc-web-fix &>/dev/null; then
             sudo cp /tmp/010_plc-web-fix "$_SUDOERS_F"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "plc-checkweigher",
-  "version": "1.35.0",
+  "version": "1.37.1",
   "description": "One-command installer for the PLC Check-Weigher system on Raspberry Pi (PREEMPT_RT kernel, Python stack, WiFi, SMB, systemd RT services)",
   "scripts": {
     "postinstall": "node bin/cli.js"

package/setup.sh

@@ -176,7 +176,7 @@ install_cli() {
     cat > /tmp/010_plc-web-fix << 'EOF'
 # Web dashboard maintenance terminal — allows the locked, root-owned CLI
 # to run whitelisted maintenance subcommands from plc_web (User=pi).
-pi ALL=(root) NOPASSWD: /usr/local/bin/plc_checkweigher fix, /usr/local/bin/plc_checkweigher fix *, /usr/local/bin/plc_checkweigher status, /usr/local/bin/plc_checkweigher restart, /usr/local/bin/plc_checkweigher start, /usr/local/bin/plc_checkweigher stop, /usr/local/bin/plc_checkweigher update
+pi ALL=(root) NOPASSWD: /usr/local/bin/plc_checkweigher fix, /usr/local/bin/plc_checkweigher fix *, /usr/local/bin/plc_checkweigher status, /usr/local/bin/plc_checkweigher restart, /usr/local/bin/plc_checkweigher start, /usr/local/bin/plc_checkweigher stop, /usr/local/bin/plc_checkweigher update, /usr/local/bin/plc_checkweigher restore
 EOF
     if visudo -c -f /tmp/010_plc-web-fix &>/dev/null; then
         cp /tmp/010_plc-web-fix /etc/sudoers.d/010_plc-web-fix