[billg-splunk]

No description provided.

[billg-splunk]

Important Note: Given how much code was changed for this, I strongly suggest we test the updates on all operating systems before merging this PR.

[billg-splunk]

Here are the recommendations to test this out (from Claude):

1. Create a local fake remote with your branch as main

git init --bare ~/src/tm-update-remote.git
git push ~/src/tm-update-remote.git update-fix:main
git clone ~/src/tm-update-remote.git ~/src/tm-update-test
git -C ~/src/tm-update-test status -sb   # should show: ## main...origin/main

The updater only runs from a main branch tracking a remote main, and this clone meets that.

2. Set aside the managed checkout and the stuck status file

mv ~/.local/share/token-meter/source ~/.local/share/token-meter/source.bak
mv ~/.token-meter/update-status.json ~/.token-meter/update-status.json.bak

Moving the status file means you start clean. Otherwise you'd see the old Sep 1 entry until the new recovery logic clears it.

3. Install from the test clone

cd ~/src/tm-update-test
./scripts/install-linux
cat ~/.local/share/token-meter/runtime/SOURCE_CHECKOUT       # .../token-meter/source
git -C ~/.local/share/token-meter/source remote get-url origin   # ~/src/tm-update-remote.git
cat ~/.local/share/token-meter/runtime/INSTALLED_REVISION    # your fix's short SHA

The installer creates a fresh managed checkout whose origin is your local fake remote. That's the checkout the updater will fetch from.

4. Publish a "new version" to the fake remote

cd ~/src/tm-update-test
git commit --allow-empty -m "test: update bump 1"
git push origin main
git rev-parse --short HEAD   # note this SHA

5. Run the update and watch it
   In the dashboard (http://127.0.0.1:8722/), click Check for updates. It should report that a new version is available.

Click Install. (Your auto_install setting is off, so it won't install by itself.)

In a terminal, watch the updater run as its own unit:

journalctl --user -u token-meter-update.service -f

When it finishes, check the result:

cat ~/.token-meter/update-status.json                      # "phase": "complete"
cat ~/.local/share/token-meter/runtime/INSTALLED_REVISION   # the SHA from step 5
systemctl --user is-active token-meter-server.service       # active
curl -fsS http://127.0.0.1:8722/health

The fix works if the server restarts and the status ends at complete. The old behavior was the server stopping and the status sticking at installing. To repeat the test, run step 5 again with "bump 2".

6. Restore your normal setup

rm -rf ~/.local/share/token-meter/source    # the test-managed checkout
mv ~/.local/share/token-meter/source.bak ~/.local/share/token-meter/source
mv ~/.token-meter/update-status.json.bak ~/.token-meter/update-status.json   # optional; deleting it is also fine
cd ~/src/token-meter-src && ./scripts/install-linux

The final reinstall runs from your dev checkout and keeps your fix running. After the PR merges, reinstall from a main checkout of splunk/token-meter, and normal automatic updates will take over from there. When you're done, you can delete ~/src/tm-update-remote.git and ~/src/tm-update-test.

[bhavsarpratik]

Thanks @billg-splunk for tracking down the Linux update failure and for the thorough test plan.

Status at e1e4b8f: ready to merge, pending Pratik's merge decision. It has not been merged yet.

• Your fix (6553634): the Linux updater runs as a transient systemd user unit so it survives the server restart during install, and an update stuck in progress now recovers.
• Review fixes (e1e4b8f): stale-update recovery falls back to checked_at and never recovers an undated record, so a healthy Windows update is no longer marked failed after a few seconds. systemd-run is used only when the server runs under systemd; a server started by hand keeps the direct launch. POSIX path handling now passes its tests on Windows hosts.
• Cross-OS testing (d260d8d): on your note about testing on every OS, CI now runs install checks on Linux, macOS and Windows, plus a Linux update test. That test publishes a newer commit, clicks Install through the dashboard API, and checks that the update completes, the installed revision matches, the server restarts and /health is ok. All 9 jobs pass on this head, along with the unit tests on all three OSes and two independent reviews.
• Known limits: CI doesn't run a live Windows update. If an earlier update unit is still running, a retried launch can stay at "starting" until the 30-minute recovery clears it. A fully Windows-clean test suite is tracked separately.

The next step is Pratik's merge decision.

— Pratik's agent