Add Plutonium version checks and scheduled rolling restarts

src/lib/plutonium.ts

@@ -0,0 +1,55 @@
+export interface MaintenanceSchedule {
+    enabled: boolean;
+    time: string;
+    nextAt: string | null;
+}
+export interface PlutoniumRelease {
+    revision: number | null;
+    checkedAt: string | null;
+    error: string | null;
+}
+export interface PlutoniumVersion {
+    server: string;
+    revision: number | null;
+    checked_at: string | null;
+    error: string | null;
+}
+export interface MaintenanceJob {
+    id: number;
+    server: string;
+    state: 'queued' | 'restarting' | 'done' | 'failed' | 'cancelled';
+    target_revision: number | null;
+    requested_at: string;
+    restarted_at: string | null;
+    finished_at: string | null;
+    detail: string | null;
+}
+export interface PlutoniumStatus {
+    release: PlutoniumRelease;
+    schedule: MaintenanceSchedule;
+    servers: PlutoniumVersion[];
+    jobs: MaintenanceJob[];
+}
+
+/** Accept explicit revision tokens only, never engine versions or build dates. */
+export function parsePlutoniumRevision(text: string): number | null {
+    const match = text.replace(/\^[0-9]/g, '').match(/\br([1-9]\d{2,8})\b/i);
+    return match ? Number(match[1]) : null;
+}
+
+export function parseChangelogRevision(html: string): number {
+    const headings = [...html.matchAll(/<h2\b[^>]*>([\s\S]*?)<\/h2>/gi)];
+    const revisions = headings.map(h => parsePlutoniumRevision(h[1].replace(/<[^>]*>/g, ' ')))
+        .filter((r): r is number => r !== null);
+    if (!revisions.length) throw new Error('The Plutonium changelog did not contain a release heading.');
+    return Math.max(...revisions);
+}
+
+export function nextMaintenanceAt(time: string, now = new Date()): string {
+    if (!/^([01]\d|2[0-3]):[0-5]\d$/.test(time)) throw new Error('Choose a valid UTC time (HH:mm).');
+    const next = new Date(now);
+    const [hour, minute] = time.split(':').map(Number);
+    next.setUTCHours(hour, minute, 0, 0);
+    if (next <= now) next.setUTCDate(next.getUTCDate() + 1);
+    return next.toISOString();
+}

src/lib/server/db/schema.sql

@@ -362,6 +362,24 @@ CREATE TABLE IF NOT EXISTS settings (
     key   TEXT PRIMARY KEY,
     value TEXT NOT NULL
 );
+CREATE TABLE IF NOT EXISTS plutonium_versions (
+    server TEXT PRIMARY KEY REFERENCES servers(name) ON DELETE CASCADE,
+    revision INTEGER,
+    checked_at TEXT NOT NULL,
+    error TEXT
+);
+CREATE TABLE IF NOT EXISTS maintenance_jobs (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    server TEXT NOT NULL,
+    state TEXT NOT NULL DEFAULT 'queued',
+    target_revision INTEGER,
+    requested_at TEXT NOT NULL,
+    restarted_at TEXT,
+    finished_at TEXT,
+    detail TEXT
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_maintenance_pending ON maintenance_jobs(server)
+    WHERE state IN ('queued', 'restarting');
 CREATE TABLE IF NOT EXISTS server_telemetry (
     server TEXT PRIMARY KEY REFERENCES servers(name) ON DELETE CASCADE,
     round INTEGER NOT NULL,

src/lib/server/fleet/plutonium.ts

@@ -0,0 +1,173 @@
+import { db } from '../db/index.js';
+import { config, komodoConfigured, rconConfigured } from '../config.js';
+import { getServer, listServers } from './servers.js';
+import { rconGetPlayerCount, rconPlutoniumVersion } from '../integrations/rcon.js';
+import { refreshRestartRollout, restartInRollout, rolloutHealth, rolloutWaitReason } from '../pipeline/restart-rollout.js';
+import { nextMaintenanceAt, parseChangelogRevision } from '../../plutonium.js';
+import type { MaintenanceJob, MaintenanceSchedule, PlutoniumRelease, PlutoniumStatus, PlutoniumVersion } from '../../plutonium.js';
+
+const CHANGELOG = 'https://plutonium.pw/docs/changelog/';
+const HOUR = 60 * 60 * 1000;
+const nowIso = () => new Date().toISOString();
+function readSetting<T>(key: string, fallback: T): T {
+    const row = db().prepare('SELECT value FROM settings WHERE key = ?').get(key) as { value: string } | undefined;
+    return row ? JSON.parse(row.value) : fallback;
+}
+function writeSetting(key: string, value: unknown): void {
+    db().prepare('INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value')
+        .run(key, JSON.stringify(value));
+}
+function release(): PlutoniumRelease {
+    return readSetting('plutonium_release', { revision: null, checkedAt: null, error: null });
+}
+function schedule(): MaintenanceSchedule {
+    return readSetting('plutonium_schedule', { enabled: false, time: '06:00', nextAt: null });
+}
+export function saveMaintenanceSchedule(enabled: boolean, time: string): void {
+    const nextAt = nextMaintenanceAt(time);
+    writeSetting('plutonium_schedule', { enabled, time, nextAt: enabled ? nextAt : null });
+}
+export function plutoniumStatus(): PlutoniumStatus {
+    const versions = db().prepare('SELECT * FROM plutonium_versions').all() as PlutoniumVersion[];
+    return {
+        release: release(), schedule: schedule(),
+        servers: listServers().map(s => versions.find(v => v.server === s.name)
+            ?? { server: s.name, revision: null, checked_at: null, error: null }),
+        jobs: db().prepare(`SELECT * FROM maintenance_jobs WHERE state IN ('queued','restarting')
+            OR id IN (SELECT id FROM maintenance_jobs ORDER BY id DESC LIMIT 100) ORDER BY id DESC`).all() as MaintenanceJob[]
+    };
+}
+
+async function probeVersion(server: string): Promise<number | null> {
+    const recovering = db().prepare('SELECT 1 FROM restart_rollout WHERE server = ? AND healthy_at IS NULL').get(server);
+    const result = recovering ? { revision: null, error: 'Waiting for restart recovery.' }
+        : await rconPlutoniumVersion(server).catch(() => ({ revision: null, error: 'Version check failed.' }));
+    // Clear the old revision on failure: it is no longer evidence of what is running.
+    db().prepare(`INSERT INTO plutonium_versions (server, revision, checked_at, error) VALUES (?, ?, ?, ?)
+        ON CONFLICT(server) DO UPDATE SET revision = excluded.revision, checked_at = excluded.checked_at, error = excluded.error`)
+        .run(server, result.revision, nowIso(), result.error);
+    return result.revision;
+}
+
+let checking: Promise<void> | null = null;
+export function checkPlutonium(): Promise<void> {
+    if (checking) return checking;
+    checking = check().finally(() => { checking = null; });
+    return checking;
+}
+async function check(): Promise<void> {
+    const previous = release();
+    try {
+        const response = await fetch(CHANGELOG, { signal: AbortSignal.timeout(config.httpTimeoutMs), redirect: 'error' });
+        if (!response.ok) throw new Error(`Changelog request failed (HTTP ${response.status}).`);
+        const html = await response.text();
+        if (html.length > 2_000_000) throw new Error('Changelog response was too large.');
+        writeSetting('plutonium_release', { revision: parseChangelogRevision(html), checkedAt: nowIso(), error: null });
+    } catch (err) {
+        writeSetting('plutonium_release', { ...previous, checkedAt: nowIso(), error: (err as Error).message });
+    }
+    const servers = listServers();
+    for (let i = 0; i < servers.length; i += 4) {
+        await Promise.all(servers.slice(i, i + 4).map(s => probeVersion(s.name)));
+    }
+}
+
+export function queueMaintenance(servers: string[]): number {
+    const names = new Set(listServers().map(s => s.name));
+    if (!servers.length || servers.some(s => !names.has(s))) throw new Error('Choose existing fleet servers.');
+    return db().transaction(() => {
+        const latest = release();
+        // An old cached release is still displayed, but never used as a fresh target.
+        const target = !latest.error && latest.checkedAt && Date.now() - Date.parse(latest.checkedAt) < HOUR
+            ? latest.revision : null;
+        let added = 0;
+        for (const server of new Set(servers)) {
+            added += db().prepare(`INSERT OR IGNORE INTO maintenance_jobs (server, target_revision, requested_at)
+                VALUES (?, ?, ?)`).run(server, target, nowIso()).changes;
+        }
+        return added;
+    })();
+}
+export function cancelMaintenance(id: number): boolean {
+    return db().prepare(`UPDATE maintenance_jobs SET state = 'cancelled', finished_at = ?, detail = 'Cancelled by operator'
+        WHERE id = ? AND state = 'queued'`).run(nowIso(), id).changes > 0;
+}
+
+function conflictingWork(server: string): boolean {
+    return !!db().prepare(`SELECT 1 FROM server_deployments WHERE server = ? AND state IN ('queued','running','awaiting-health')
+        UNION ALL SELECT 1 FROM deployment_servers WHERE server = ? AND restart_state IN ('pending','failed')
+        UNION ALL SELECT 1 FROM beta_servers bs JOIN betas b ON b.id = bs.beta_id
+            WHERE bs.server = ? AND b.state IN ('running','ready-promote') LIMIT 1`).get(server, server, server);
+}
+function finish(job: MaintenanceJob, state: 'done' | 'failed' | 'cancelled', detail: string) {
+    db().prepare('UPDATE maintenance_jobs SET state = ?, detail = ?, finished_at = ? WHERE id = ?')
+        .run(state, detail, nowIso(), job.id);
+}
+function hold(job: MaintenanceJob, detail: string) {
+    db().prepare('UPDATE maintenance_jobs SET detail = ? WHERE id = ?').run(detail, job.id);
+}
+
+let ticking: Promise<void> | null = null;
+export function maintenanceTick(): Promise<void> {
+    if (ticking) return ticking;
+    ticking = runTick().finally(() => { ticking = null; });
+    return ticking;
+}
+async function runTick(): Promise<void> {
+    const latest = release();
+    if (!latest.checkedAt || Date.now() - Date.parse(latest.checkedAt) >= HOUR) await checkPlutonium();
+    db().transaction(() => {
+        const plan = schedule();
+        if (plan.enabled && plan.nextAt && plan.nextAt <= nowIso()) {
+            const names = listServers().map(s => s.name);
+            if (names.length) queueMaintenance(names);
+            // Coalesce missed days after downtime into one run; no restart backlog.
+            writeSetting('plutonium_schedule', { ...plan, nextAt: nextMaintenanceAt(plan.time) });
+        }
+    })();
+    await refreshRestartRollout();
+    const jobs = db().prepare(`SELECT * FROM maintenance_jobs WHERE state IN ('queued','restarting') ORDER BY id`).all() as MaintenanceJob[];
+    for (const job of jobs) {
+        try { await processJob(job); }
+        catch { hold(job, 'Maintenance check failed; waiting for the next check.'); }
+    }
+    db().prepare(`DELETE FROM maintenance_jobs WHERE finished_at < ? AND state IN ('done','failed','cancelled')`)
+        .run(new Date(Date.now() - 30 * 24 * HOUR).toISOString());
+}
+async function processJob(job: MaintenanceJob): Promise<void> {
+    const server = getServer(job.server);
+    if (!server || server.destroyed_at) return finish(job, 'cancelled', 'Server removed.');
+    if (job.state === 'restarting') {
+        const slot = db().prepare('SELECT requested_at FROM restart_rollout WHERE server = ?').get(job.server) as { requested_at: string } | undefined;
+        if (!slot || !job.restarted_at || slot.requested_at < job.restarted_at) {
+            return finish(job, 'failed', 'Restart submission was interrupted. Inspect the server before queuing another restart.');
+        }
+        const health = rolloutHealth(job.server);
+        if (!health.ok) return hold(job, health.reason);
+        const revision = await probeVersion(job.server);
+        if (job.target_revision && (revision === null || revision < job.target_revision)) {
+            return finish(job, 'failed', `Server recovered, but r${job.target_revision} was not verified (${revision === null ? 'version unknown' : `running r${revision}`}). Check Plutainer auto-update settings.`);
+        }
+        return finish(job, 'done', `Server recovered; ${revision === null ? 'running revision unknown' : `running r${revision}`}.`);
+    }
+    if (!komodoConfigured() || !rconConfigured()) return hold(job, 'Configure Komodo and RCON before restarting.');
+    if (conflictingWork(job.server)) return hold(job, 'Waiting for deployment or beta work on this server.');
+    const reason = rolloutWaitReason(job.server);
+    if (reason) return hold(job, reason);
+    const players = await rconGetPlayerCount(job.server);
+    if (players === null || players > 0) return hold(job, players === null ? 'Waiting for a fresh RCON player count.' : `Waiting for ${players} player(s) to leave.`);
+    // Recheck after async I/O; cancellation and lifecycle operations may have arrived.
+    const current = getServer(job.server);
+    if (!current || current.destroyed_at) return finish(job, 'cancelled', 'Server removed.');
+    if (conflictingWork(job.server)) return hold(job, 'Waiting for deployment or beta work on this server.');
+    const claimed = db().prepare(`UPDATE maintenance_jobs SET state = 'restarting', restarted_at = ?, detail = 'Restart requested'
+        WHERE id = ? AND state = 'queued'`).run(nowIso(), job.id);
+    if (!claimed.changes) return;
+    db().prepare('UPDATE plutonium_versions SET revision = NULL, error = ? WHERE server = ?')
+        .run('Waiting for restart recovery.', job.server);
+    // Persist intent before remote I/O. An ambiguous timeout must never cause an automatic second restart.
+    const result = await restartInRollout(job.server);
+    if (result.kind === 'queued') {
+        db().prepare(`UPDATE maintenance_jobs SET state = 'queued', restarted_at = NULL, detail = ? WHERE id = ?`).run(result.message, job.id);
+    } else if (result.kind === 'failed') finish(job, 'failed', result.message);
+}

src/lib/server/integrations/rcon.ts

@@ -3,6 +3,7 @@ import type { Socket } from 'node:dgram';
 import { config, komodoConfigured, rconConfigured } from '../config.js';
 import { getServer, setServerField } from '../fleet/servers.js';
 import { komodoResolveGamePort } from './komodo.js';
+import { parsePlutoniumRevision } from '../../plutonium.js';
 
 // Plutonium/CoD RCON is UDP with a 4-byte 0xff prefix. Requests look like
 //   \xff\xff\xff\xffrcon <password> <command>
@@ -451,3 +452,14 @@ function positiveCapacity(value: string | undefined): number | null {
     const count = Number(value);
     return Number.isInteger(count) && count > 0 ? count : null;
 }
+
+/** Query the running process, not the updater's on-disk files. */
+export async function rconPlutoniumVersion(server: string): Promise<{ revision: number | null; error: string | null }> {
+    const { endpoint } = await endpointFor(server);
+    if (!endpoint) return { revision: null, error: 'No RCON endpoint available.' };
+    const response = await sendRcon(endpoint.host, endpoint.port, 'version');
+    if (!response.ok) return { revision: null, error: response.detail };
+    const body = stripPrefix(response.buf);
+    const revision = body?.trimStart().startsWith('print') ? parsePlutoniumRevision(body) : null;
+    return { revision, error: revision === null ? 'RCON version reply did not identify a Plutonium revision.' : null };
+}

src/lib/server/pipeline/worker.ts

@@ -13,6 +13,7 @@ import { isProvisioning } from '../fleet/provisioning.js';
 import { STATUS_REFRESH_MS } from '../../server-freshness.js';
 import { recordMetrics } from '../fleet/metrics.js';
 import { selectedZombieMap } from '../../map-aliases.js';
+import { maintenanceTick } from '../fleet/plutonium.js';
 
 const TICK_MS = 15_000;
 // Cap concurrent UDP RCON calls so a 15-server fleet doesn't blast the
@@ -46,6 +47,8 @@ async function runTick(): Promise<void> {
     } catch (err) {
         console.error('[worker] beta-runner error:', err);
     }
+    try { await maintenanceTick(); }
+    catch (err) { console.error('[worker] maintenance error:', err); }
 }
 
 /**

src/lib/ui/components/PlutoniumMaintenance.svelte

@@ -0,0 +1,108 @@
+<script lang="ts">
+    import { onMount } from 'svelte';
+    import type { PlutoniumStatus } from '$lib/plutonium.js';
+    import { timeFormat } from '$ui/stores/time-zone.js';
+    import Button from './primitives/Button.svelte';
+
+    let data = $state<PlutoniumStatus | null>(null);
+    let busy = $state(false);
+    let error = $state('');
+    let notice = $state('');
+    let enabled = $state(false);
+    let time = $state('06:00');
+    let initialized = false;
+    async function refresh(action?: Record<string, unknown>) {
+        if (busy) return;
+        busy = true;
+        try {
+            const response = await fetch('/api/plutonium', action ? {
+                method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(action)
+            } : undefined);
+            const result = await response.json();
+            if (!response.ok) throw new Error(result.error ?? 'Could not load Plutonium status.');
+            data = result;
+            error = '';
+            if (!initialized) {
+                enabled = result.schedule.enabled; time = result.schedule.time; initialized = true;
+            }
+            if (action) notice = action.action === 'schedule' ? 'Schedule saved.'
+                : action.action === 'restart' ? 'Restart queued. Occupied servers will wait until empty.'
+                : action.action === 'cancel' ? 'Queued restart cancelled.' : 'Version checks finished.';
+        } catch (cause) { error = (cause as Error).message; }
+        finally { busy = false; }
+    }
+    function pending(server: string) {
+        return data?.jobs.some(j => j.server === server && ['queued', 'restarting'].includes(j.state));
+    }
+    onMount(() => {
+        void refresh();
+        const timer = setInterval(() => { if (!document.hidden) void refresh(); }, 5000);
+        return () => clearInterval(timer);
+    });
+</script>
+
+<section id="plutonium" aria-labelledby="plutonium-heading">
+    <div class="heading"><h2 id="plutonium-heading">Plutonium updates & restarts</h2>
+        <Button disabled={busy} onclick={() => refresh({ action: 'check' })}>Check versions</Button>
+    </div>
+    <p>Plutainer applies updates on startup when auto-update is enabled. Restarts wait for a fresh player count of zero and share the fleet’s rolling restart limit.</p>
+    {#if error}<p class="ui-error" role="alert">{error}</p>{/if}
+    {#if notice}<p role="status">{notice}</p>{/if}
+    {#if data}
+        <p>Latest published revision: <strong>{data.release.revision ? `r${data.release.revision}` : 'Unknown'}</strong>
+            · <a href="https://plutonium.pw/docs/changelog/" target="_blank" rel="noreferrer">Changelog</a>
+            {#if data.release.checkedAt} · Checked {$timeFormat.dateTime(data.release.checkedAt)}{/if}
+        </p>
+        {#if data.release.error}<p role="alert">Update check failed: {data.release.error} Any displayed release is cached.</p>{/if}
+        <form onsubmit={(event) => { event.preventDefault(); void refresh({ action: 'schedule', enabled, time }); }}>
+            <label class="toggle"><input type="checkbox" bind:checked={enabled} /> Daily fleet restart</label>
+            <label>Queue time (UTC)<input type="time" bind:value={time} required /></label>
+            <Button type="submit" disabled={busy}>Save schedule</Button>
+        </form>
+        <p>This restarts all fleet servers daily, even without a new release. Busy servers may restart later. Disabling the schedule stops future runs; cancel existing queued restarts below.</p>
+        {#if data.schedule.nextAt}<p>Next run: {$timeFormat.dateTime(data.schedule.nextAt)}</p>{/if}
+        <div class="table-wrap"><table>
+            <thead><tr><th>Server</th><th>Running revision</th><th>Update status</th><th>Action</th></tr></thead>
+            <tbody>{#each data.servers as server (server.server)}
+                <tr><td><a href={`/servers/${encodeURIComponent(server.server)}`}>{server.server}</a></td>
+                    <td>{server.revision ? `r${server.revision}` : 'Unknown'}
+                        {#if server.checked_at}<small>Checked {$timeFormat.dateTime(server.checked_at)}</small>{/if}
+                        {#if server.error}<small>{server.error}</small>{/if}
+                    </td>
+                    <td>{server.revision === null || data.release.revision === null || data.release.error ? 'Unverified'
+                        : server.revision < data.release.revision ? 'Update available' : server.revision > data.release.revision ? 'Ahead of changelog' : 'Up to date'}</td>
+                    <td><Button size="sm" disabled={busy || pending(server.server)} onclick={() => refresh({ action: 'restart', servers: [server.server] })}>
+                        {pending(server.server) ? 'Restart pending' : 'Queue restart'}
+                    </Button></td></tr>
+            {:else}<tr><td colspan="4">No fleet servers yet.</td></tr>{/each}</tbody>
+        </table></div>
+        {#if data.servers.length}<Button disabled={busy || data.servers.every(s => pending(s.server))} onclick={() => refresh({ action: 'restart', servers: data!.servers.map(s => s.server) })}>Queue fleet restart</Button>{/if}
+        {#if data.jobs.length}
+            <h3>Restart activity</h3>
+            <ul>{#each data.jobs as job (job.id)}<li>
+                <strong>{job.server}</strong> · {job.state} · {$timeFormat.dateTime(job.requested_at)}
+                {#if job.target_revision} · Target r{job.target_revision}{/if}
+                {#if job.detail}<small>{job.detail}</small>{/if}
+                {#if job.state === 'queued'}<Button size="sm" disabled={busy} onclick={() => refresh({ action: 'cancel', id: job.id })}>Cancel</Button>{/if}
+            </li>{/each}</ul>
+        {/if}
+    {:else}<p role="status">{busy ? 'Loading maintenance status…' : 'Maintenance status unavailable.'}</p>{/if}
+</section>
+
+<style>
+    section { padding: 20px; border: 1px solid var(--border-strong); border-radius: var(--radius-md); background: var(--surface); scroll-margin-top: 90px; }
+    .heading, form { display: flex; flex-wrap: wrap; gap: 16px; align-items: center; justify-content: space-between; }
+    h2 { font-size: var(--text-md); margin: 0; }
+    h3 { font-size: var(--text-sm); margin-top: 24px; }
+    p, td, th, label, li { font-size: var(--text-sm); line-height: 1.6; }
+    p, small { color: var(--text-secondary); }
+    label { display: grid; gap: 6px; }
+    .toggle { display: flex; align-items: center; }
+    input[type='time'] { padding: 8px; color: var(--text-primary); background: var(--surface); border: 1px solid var(--border-strong); border-radius: var(--radius-sm); }
+    .table-wrap { overflow-x: auto; margin: 16px 0; }
+    table { width: 100%; border-collapse: collapse; text-align: left; }
+    th, td { padding: 10px; border-bottom: 1px solid var(--border-strong); }
+    small { display: block; }
+    ul { padding-left: 20px; }
+    li { margin-bottom: 12px; }
+</style>