From 4cfa0401541475425817d1ccd7fd0ac542bfa731 Mon Sep 17 00:00:00 2001 From: atlas Date: Tue, 14 Jul 2026 19:57:50 +0200 Subject: [PATCH] feat(#2398): dagify hivectl restart (RestartScoped) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit hivectl restart --agent NAME previously composed stop() then start() as two separate client-side daemon calls glued by CLI-process control flow — not one DAG, and a dropped hivectl connection mid-restart (ssh drop, Ctrl-C) left the agent stopped with no automatic follow-up. mara flagged this as the first target for the 'dagify hivectl commands' issue. New HostRequest::RestartScoped{scope, graceful} handles it server-side: each targeted agent now rides exactly one atomic Restart-template DAG (same one hivectl agents restart / restart-all already use) in the common non-graceful case. --graceful has no single-DAG template yet, so it submits the graceful-stop DAGs, awaits them server-side, then submits the start DAGs — still one daemon call end to end, just not yet a single DAG (noted as a follow-up). Infra containers restart synchronously as before (no lease/DAG concept for them). CLI-side restart() now just makes the one call + waits, same output shape as before via render_lifecycle. --- hive-c0re/src/bin/hivectl.rs | 29 ++++++++----- hive-c0re/src/server.rs | 82 ++++++++++++++++++++++++++++++++++++ hive-host-sock/src/lib.rs | 17 ++++++++ 3 files changed, 118 insertions(+), 10 deletions(-) diff --git a/hive-c0re/src/bin/hivectl.rs b/hive-c0re/src/bin/hivectl.rs index e2b7a029..b912976e 100644 --- a/hive-c0re/src/bin/hivectl.rs +++ b/hive-c0re/src/bin/hivectl.rs @@ -1642,22 +1642,31 @@ async fn start(socket: &Path, scope: hive_host_sock::LifecycleScope, no_wait: bo rendered } -/// Restart = `stop` then `start` over the same scope, composed client-side -/// from the two daemon ops (no dedicated wire op). The stop phase honours -/// `--graceful`; if it reports a failure (`stop` returns `Err`) the `?` -/// short-circuits before the start phase, so a half-stopped hive isn't -/// blindly started over — the operator sees the stop errors and can recover. +/// Restart — one `RestartScoped` daemon call, server-side DAG-based (see +/// issue tracker "dagify hivectl commands"). Each targeted agent rides one +/// atomic `Restart` DAG (or, with `--graceful`, a server-awaited +/// graceful-stop DAG followed by a start DAG); infra containers restart +/// synchronously. Unlike the old client-side stop-then-start compose, a +/// dropped `hivectl` connection mid-restart no longer leaves an agent +/// stopped with no automatic follow-up — the daemon owns the whole +/// sequence once this call is made. /// -/// No `--no-wait` here on purpose: the stop DAGs must complete before -/// the start submits, otherwise the start's `wanted = Up` write would -/// land before the queued stops execute and turn them into noops. +/// No `--no-wait` here on purpose, same as before: the operator wants to +/// see the restart actually land, not just get queued. async fn restart( socket: &Path, scope: hive_host_sock::LifecycleScope, graceful: bool, ) -> Result<()> { - stop(socket, scope.clone(), graceful, false).await?; - start(socket, scope, false).await + let resp = hive_c0re::client::request( + socket, + hive_host_sock::HostRequest::RestartScoped { scope, graceful }, + ) + .await + .with_context(|| format!("connect to daemon socket {}", socket.display()))?; + let rendered = render_lifecycle(&resp, "restart queued"); + wait_for_dags(socket, resp.queued_dags.unwrap_or_default(), false).await?; + rendered } /// A [`LifecycleScope`](hive_host_sock::LifecycleScope) targeting exactly one diff --git a/hive-c0re/src/server.rs b/hive-c0re/src/server.rs index 008359da..e9fae489 100644 --- a/hive-c0re/src/server.rs +++ b/hive-c0re/src/server.rs @@ -94,6 +94,9 @@ async fn dispatch(req: &HostRequest, coord: Arc) -> HostResponse { HostRequest::Kill { name } => submit_single(&coord, name, Verb::Kill), HostRequest::Restart { name } => submit_single(&coord, name, Verb::Restart), HostRequest::RestartAll => handle_restart_all(&coord).await?, + HostRequest::RestartScoped { scope, graceful } => { + handle_restart_scoped(&coord, scope, *graceful).await? + } HostRequest::Stop { scope, graceful } => { // Resolve the scope to explicit container names at the entry // point, then operate on names — never pass the bare "all @@ -631,6 +634,85 @@ async fn handle_start( Ok(resp) } +/// Restart containers hive-wide (`hivectl restart`) — the DAG-based +/// sibling of [`handle_stop`]/[`handle_start`], replacing the old +/// client-side stop-then-start composition (issue tracker "dagify hivectl +/// commands"). Each targeted agent gets exactly one atomic `Restart` +/// template DAG in the common (non-graceful) case, so it survives a +/// dropped `hivectl` connection the same way `handle_restart_all` already +/// does. `graceful` has no single-DAG template yet, so it falls back to +/// submitting the graceful-stop DAGs, waiting them out server-side, then +/// submitting the start DAGs — still one daemon call end to end, unlike +/// the old CLI-side compose. Infra containers have no lease/DAG and +/// restart synchronously (stop then start). +async fn handle_restart_scoped( + coord: &Arc, + scope: &LifecycleScope, + graceful: bool, +) -> Result { + tracing::info!(?scope, graceful, "restart"); + let agents = scoped_agents(scope).await?; + let infra = scoped_infra(scope); + let mut ok_items: Vec = Vec::new(); + let mut errors: Vec = Vec::new(); + let mut queued: Vec = Vec::new(); + + if graceful { + let mut stop_ids = Vec::new(); + for agent in &agents { + stop_ids.push(crate::job_queue::submit::graceful_stop( + coord, + agent, + crate::job_queue::Source::Manual, + "manual via hivectl restart --graceful".to_owned(), + )); + } + // Graceful drains can take a while; bound the wait generously — + // same shape as `handle_stop`'s hard-stop-before-infra wait, just + // a longer ceiling since drains are minutes, not seconds. + await_dags(coord, &stop_ids, std::time::Duration::from_mins(10)).await; + for agent in &agents { + queued.push(crate::job_queue::submit::start( + coord, + agent, + crate::job_queue::Source::Manual, + "manual via hivectl restart --graceful".to_owned(), + )); + ok_items.push(agent.clone()); + } + } else { + for agent in &agents { + queued.push(crate::job_queue::submit::restart( + coord, + agent, + crate::job_queue::Source::Manual, + "manual restart via hivectl restart".to_owned(), + )); + ok_items.push(agent.clone()); + } + } + + for &container in &infra { + let name = container.unit_name(); + let res = async { + crate::priv_client::control_infra_container(container, InfraAction::Stop).await?; + crate::priv_client::control_infra_container(container, InfraAction::Start).await + } + .await; + match res { + Ok(()) => ok_items.push(name.to_owned()), + Err(e) => { + tracing::warn!(%name, error = ?e, "restart: infra restart failed"); + errors.push(format!("{name}: {e:#}")); + } + } + } + + let mut resp = finish_lifecycle(ok_items, &errors); + resp.queued_dags = Some(queued); + Ok(resp) +} + /// Resolve which sub-agent logical names a scope targets: every live /// container (from `lifecycle::list`) when `agents` is set or the scope is /// "everything", plus any explicit `agent_names`. Returns de-duplicated diff --git a/hive-host-sock/src/lib.rs b/hive-host-sock/src/lib.rs index 9d7ed40c..96c0dee2 100644 --- a/hive-host-sock/src/lib.rs +++ b/hive-host-sock/src/lib.rs @@ -39,6 +39,23 @@ pub enum HostRequest { /// wrapper for `hivectl agents restart-all`; iterates the live /// container list and restarts each one. RestartAll, + /// Restart containers hive-wide (`hivectl restart`), scoped like + /// `Stop`/`Start`. Each targeted agent rides exactly one DAG server-side + /// (the `Restart` template, hard stop + reconcile — or, when `graceful` + /// is set, a submitted graceful-stop DAG the server itself waits out + /// before submitting the start DAG) rather than the old client-side + /// stop-then-start composition: a dropped `hivectl` connection mid-way + /// used to leave the agent stopped with no automatic follow-up, since + /// nothing durable remembered "finish the restart" once the CLI process + /// was gone. Infra containers have no lease/DAG and restart + /// synchronously (stop then start), same as before. Scope semantics + /// match `Stop`/`Start` (all-false = everything). + RestartScoped { + #[serde(default)] + scope: LifecycleScope, + #[serde(default)] + graceful: bool, + }, /// Apply pending config to a managed container. Rebuild { name: String }, /// List managed containers.