fix(web,server): the server update banner copies a command that works under systemd#22773

Approvability

Verdict: Needs Human Approval

Macroscope's review found this PR requires human approval — This production change adds systemd detection and copies commands that can disable services, install replacement services, or restart existing services. The supplied findings identify risks around non-default data directories, daemon reloads, and shell-safe unit names, so the update workflow needs human review.

Needs human approval because:

• 3 blocking correctness issues found at or above your repo's Minimum Blocking Severity

^{Adjust the Minimum Blocking Severity for this repo — including turning it Off — in Settings. You can add or adjust custom eligibility rules. Learn more.}

Review in Change Stack →

No actionable comments were generated in the recent review.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

thanks @dw3105. your serve metadata, cgroup detection, quoting and reload fix are retained, with your commits preserved. i merged main and pushed the focused follow-up to this head.

removed user-unit replacement and its baseDir field: restarting the existing unit preserves all launch options and avoids disabling a working service. added ExecStart verification so an ide terminal cannot offer to restart its editor. standalone installs now retain launch metadata and receive executable-update guidance, and older-server guidance keeps the subcommand instruction. i compared the original diff against the final change.

passed: blacksmith vp run check:changed, including format, lint, knip, 30 affected package typechecks and 38 tests; browser clipboard/toast cases; real user-unit reload/restart preserving custom base-dir and host arguments; real server descriptor through the web action.

unverified: published npm upgrade, privileged system-service restart, electron/mobile and relay. @dw3105, shell-wrapped units receive manual guidance because ownership cannot be proven from their ExecStart.

before on main: copied relaunch omits serve

after: restart the same service and preserve launch options

copy restart interaction

final head: real service metadata reaches the clipboard action

standalone service: update its executable and keep launch configuration

FYI, I rebased this branch onto main on Oct 28 (now 23e36c7a9d). The changes are identical to your 32dad0c73c, with your commits kept; only your merge of main became a rebase. I'll leave the branch to you from here.

merged current main into the original head, keeping @dw3105's commits and the prior takeover fixes. the only conflict was in the shared update action; main's release-track guard and the manual-command helper are both retained. no service is replaced or disabled.

passed this run: blacksmith vp run check:changed (format, lint, both knip passes, graphql, 35 affected package typechecks, 40 tests and the compiler check); all 28 ci checks; two independent final-head reviews with no findings. chrome clipboard checks covered manual serve, user/system units, escaped names, npm-global prefixes and actual service metadata. real user-service config rpc reported its owning unit and serve; daemon-reload/restart changed its pid while preserving custom base-dir, host and port.

before/after below use the same version/unit descriptor fixture in the real settings action. the recording was trimmed and inspected, including uploaded playback and seeking.

unverified: published npm upgrade, privileged system-service restart, native mobile/electron and relay. known low limit: root-owned npm prefixes may need elevated npm permissions. system-unit scope does not establish prefix ownership, so automatically adding sudo could change ownership in a user-managed prefix. @dw3105, shell-wrapped units still use manual guidance because launch ownership cannot be proven.

main: copied relaunch omits serve and ignores systemd

final: restart existing unit and preserve launch options

copy restart command and show launch-option guidance

git.cafe renders these external media embeds as links. github renders the screenshots but does not embed the external mp4. the uploaded video plays and seeks in chrome; inline pr video playback is unavailable.

Verified in a real dev environment

verified unchanged head 757465f1defae59c5443dd2fce3c9cd95d479496 on this linux boat vm. no source changes or pushes were needed.

• reproduced on github/main (6575ce3250) in /home/user/main after vp i: a real user-systemd unit launched serve with a custom data directory, host and port. settings > sharing & access copied npx t3@0.1.6, omitting serve and ignoring the supervising service.
• checked out the exact pr head, ran vp i, and started vp run dev in the background. stopped main before starting the pr. used repo playwright and /usr/bin/google-chrome throughout.
• then ran the pr backend under the same real user-systemd unit. its live descriptor reported unknown, serve, and pr22773-verify.service in user scope. the actual settings button copied daemon-reload plus restart, and its toast explained updating the existing executable while preserving launch configuration.
• executed that copied command. the service pid changed from 42159 to 47897. ExecStart retained serve --base-dir /home/user/t3code/.t3 --host 127.0.0.1 --port 13773. the project and conversation survived reconnecting.
• created a project pointing at a real git repository through the app. selected codex gpt-6.1-sol and ran a real pwd / git status --short turn. after the service restart, a follow-up turn in the same conversation ran pwd and displayed "restart continuity verified" with the correct directory.
• neighboring launch paths: unmanaged root launch still copied npx t3@0.1.6; unmanaged serve reported {kind:"unknown",subcommand:"serve"} and copied npx t3@0.1.6 serve.
• blacksmith passed all 32 existing tests across invocation, server environment, version skew and environment contracts. the head has 28 successful ci checks.

both clients used the existing APP_VERSION=0.1.6 configuration against the real 0.1.5 server to expose the update action. no mocked descriptors, intercepted responses, fixtures or demo turns were used. this verifies command selection and a real restart, not a published version upgrade.

main: relaunch guidance omits serve and ignores the real systemd unit

pr: guidance preserves the existing systemd launch configuration

copy restart command in the real settings flow

real codex conversation continues after the copied service restart

Not verified

published npm/global/standalone upgrades; real npx/pnpm/bunx installation detection; privileged system-scope service restarts; escaped unit names in a live service; electron, native ios/android, macos/windows, relay and tunnel connections. formatting cases are covered by the focused tests, not claimed as live installation checks. uploaded video playback to completion and seeking passed in chrome.