fix(update): require MainPID ownership before treating a daemon as systemd-managed (issue #92)

$INVOCATION_ID and a .service cgroup leaf are inherited by every
descendant of any systemd service — e.g. all processes inside a GitHub
Actions runner (hosted-compute-agent.service) — so unit membership
alone misidentified daemons as supervised and update install skipped
restarting them (failing master CI on ubuntu since PR #89).

detectSelfSupervisor and the legacy cgroup fallback in
resolveDaemonSupervisor now also require the unit's MainPID (via
systemctl show) to be the daemon itself or its direct parent (covering
ExecStart shell wrappers). When MainPID can't be read the daemon is
treated as unsupervised, restoring the pre-#82 direct-restart path.

Author: Rinse12

src/common-utils/daemon-state.ts

@@ -68,32 +68,80 @@ export async function readSystemdUnit(pid: number | "self"): Promise<string | un
     }
 }
 
+/**
+ * MainPID of a systemd unit as reported by the system manager, or undefined when it cannot be
+ * determined (systemctl missing, unit unknown, MainPID=0). `systemctl --user` units are invisible
+ * to the system manager and resolve to undefined — the daemon is then treated as unsupervised,
+ * matching the restart path, which also only drives the system manager.
+ */
+export async function readUnitMainPid(unit: string): Promise<number | undefined> {
+    try {
+        const { stdout } = await execFileAsync("systemctl", ["show", "--property=MainPID", "--value", unit]);
+        const mainPid = Number(String(stdout).trim());
+        return Number.isInteger(mainPid) && mainPid > 0 ? mainPid : undefined;
+    } catch {
+        return undefined;
+    }
+}
+
+/** Parent PID of `pid` from /proc/<pid>/stat, or undefined. */
+export async function readParentPid(pid: number): Promise<number | undefined> {
+    try {
+        const stat = await fs.readFile(`/proc/${pid}/stat`, "utf-8");
+        // Format: `pid (comm) state ppid …` — comm may itself contain spaces or parens, so the
+        // fields are only parseable after the LAST closing paren.
+        const afterComm = stat.slice(stat.lastIndexOf(")") + 2);
+        const ppid = Number(afterComm.split(" ")[1]);
+        return Number.isInteger(ppid) && ppid > 0 ? ppid : undefined;
+    } catch {
+        return undefined;
+    }
+}
+
 /**
  * Detect whether THIS process was started by systemd, and under which unit. systemd sets
- * $INVOCATION_ID for every service it spawns; the unit name comes from this process's own cgroup.
- * `env`/`readUnit` are injectable for testing. Returns undefined when not systemd-supervised.
+ * $INVOCATION_ID for every service it spawns and the unit name comes from this process's own
+ * cgroup — but BOTH are inherited by every descendant of any service (e.g. all processes inside a
+ * CI runner's agent service, issue #92), so unit membership alone is not ownership. The daemon is
+ * only systemd-supervised when it is the unit's main process (or its direct child, covering
+ * `ExecStart=/bin/sh -c …` wrappers); otherwise restarting the unit would bounce an unrelated
+ * service. `env`/`readUnit`/`getMainPid`/`self` are injectable for testing. Returns undefined when
+ * not systemd-supervised.
  */
 export async function detectSelfSupervisor(
     env: NodeJS.ProcessEnv = process.env,
-    readUnit: (pid: number | "self") => Promise<string | undefined> = readSystemdUnit
+    readUnit: (pid: number | "self") => Promise<string | undefined> = readSystemdUnit,
+    getMainPid: (unit: string) => Promise<number | undefined> = readUnitMainPid,
+    self: { pid: number; ppid: number } = { pid: process.pid, ppid: process.ppid }
 ): Promise<DaemonSupervisor | undefined> {
     if (!env.INVOCATION_ID) return undefined;
     const unit = await readUnit("self");
-    return unit ? { type: "systemd", unit } : undefined;
+    if (!unit) return undefined;
+    const mainPid = await getMainPid(unit);
+    if (mainPid === undefined || (mainPid !== self.pid && mainPid !== self.ppid)) return undefined;
+    return { type: "systemd", unit };
 }
 
 /**
  * Resolve the supervisor for a daemon described by `state`. Prefers the `supervisor` it recorded
- * at startup; for legacy daemons that predate that field, falls back to inferring the unit from the
- * live process's cgroup. `readUnit` is injectable for testing.
+ * at startup (already ownership-verified by detectSelfSupervisor); for legacy daemons that predate
+ * that field, falls back to inferring the unit from the live process's cgroup, with the same
+ * MainPID ownership check as detectSelfSupervisor (issue #92).
+ * `readUnit`/`getMainPid`/`getParentPid` are injectable for testing.
  */
 export async function resolveDaemonSupervisor(
     state: DaemonState,
-    readUnit: (pid: number | "self") => Promise<string | undefined> = readSystemdUnit
+    readUnit: (pid: number | "self") => Promise<string | undefined> = readSystemdUnit,
+    getMainPid: (unit: string) => Promise<number | undefined> = readUnitMainPid,
+    getParentPid: (pid: number) => Promise<number | undefined> = readParentPid
 ): Promise<DaemonSupervisor | undefined> {
     if (state.supervisor) return state.supervisor;
     const unit = await readUnit(state.pid);
-    return unit ? { type: "systemd", unit } : undefined;
+    if (!unit) return undefined;
+    const mainPid = await getMainPid(unit);
+    if (mainPid === undefined) return undefined;
+    if (mainPid !== state.pid && mainPid !== (await getParentPid(state.pid))) return undefined;
+    return { type: "systemd", unit };
 }
 
 function stateFilePath(pid: number): string {

test/common-utils/daemon-supervisor.test.ts

@@ -44,18 +44,37 @@ describe("parseSystemdUnitFromCgroup", () => {
 });
 
 describe("detectSelfSupervisor", () => {
+    const self = { pid: 5678, ppid: 5600 };
+
     it("returns undefined when INVOCATION_ID is absent (not started by systemd)", async () => {
-        const sup = await detectSelfSupervisor({}, async () => "bitsocial.service");
+        const sup = await detectSelfSupervisor({}, async () => "bitsocial.service", async () => self.pid, self);
         expect(sup).toBeUndefined();
     });
 
-    it("returns the systemd unit when INVOCATION_ID is set and the cgroup is a service", async () => {
-        const sup = await detectSelfSupervisor({ INVOCATION_ID: "abc" }, async () => "bitsocial.service");
+    it("returns the systemd unit when this process is the unit's MainPID", async () => {
+        const sup = await detectSelfSupervisor({ INVOCATION_ID: "abc" }, async () => "bitsocial.service", async () => self.pid, self);
+        expect(sup).toEqual({ type: "systemd", unit: "bitsocial.service" });
+    });
+
+    it("returns the systemd unit when the parent is the MainPID (ExecStart shell wrapper)", async () => {
+        const sup = await detectSelfSupervisor({ INVOCATION_ID: "abc" }, async () => "bitsocial.service", async () => self.ppid, self);
         expect(sup).toEqual({ type: "systemd", unit: "bitsocial.service" });
     });
 
     it("returns undefined when INVOCATION_ID is set but the cgroup is not a service", async () => {
-        const sup = await detectSelfSupervisor({ INVOCATION_ID: "abc" }, async () => undefined);
+        const sup = await detectSelfSupervisor({ INVOCATION_ID: "abc" }, async () => undefined, async () => self.pid, self);
+        expect(sup).toBeUndefined();
+    });
+
+    it("returns undefined when the unit's MainPID is an unrelated ancestor (issue #92: CI runner agent)", async () => {
+        // On GitHub Actions every process inherits $INVOCATION_ID and lives in the runner agent's
+        // service cgroup; the agent's MainPID is neither this process nor its parent.
+        const sup = await detectSelfSupervisor({ INVOCATION_ID: "abc" }, async () => "hosted-compute-agent.service", async () => 1234, self);
+        expect(sup).toBeUndefined();
+    });
+
+    it("returns undefined when the unit's MainPID cannot be read", async () => {
+        const sup = await detectSelfSupervisor({ INVOCATION_ID: "abc" }, async () => "bitsocial.service", async () => undefined, self);
         expect(sup).toBeUndefined();
     });
 });
@@ -71,16 +90,59 @@ describe("resolveDaemonSupervisor", () => {
         expect(sup).toEqual(recorded);
     });
 
-    it("falls back to the process cgroup for a legacy daemon (no supervisor field)", async () => {
-        const sup = await resolveDaemonSupervisor(base, async (pid) => {
-            expect(pid).toBe(base.pid);
-            return "bitsocial.service";
-        });
+    it("falls back to the process cgroup for a legacy daemon that is the unit's MainPID", async () => {
+        const sup = await resolveDaemonSupervisor(
+            base,
+            async (pid) => {
+                expect(pid).toBe(base.pid);
+                return "bitsocial.service";
+            },
+            async () => base.pid,
+            async () => undefined
+        );
         expect(sup).toEqual({ type: "systemd", unit: "bitsocial.service" });
     });
 
+    it("accepts a legacy daemon whose parent is the unit's MainPID (shell wrapper)", async () => {
+        const sup = await resolveDaemonSupervisor(
+            base,
+            async () => "bitsocial.service",
+            async () => 4000,
+            async (pid) => {
+                expect(pid).toBe(base.pid);
+                return 4000;
+            }
+        );
+        expect(sup).toEqual({ type: "systemd", unit: "bitsocial.service" });
+    });
+
+    it("returns undefined for a legacy daemon inside an unrelated ancestor service (issue #92)", async () => {
+        const sup = await resolveDaemonSupervisor(
+            base,
+            async () => "hosted-compute-agent.service",
+            async () => 1,
+            async () => 999
+        );
+        expect(sup).toBeUndefined();
+    });
+
+    it("returns undefined for a legacy daemon when the unit's MainPID cannot be read", async () => {
+        const sup = await resolveDaemonSupervisor(
+            base,
+            async () => "bitsocial.service",
+            async () => undefined,
+            async () => undefined
+        );
+        expect(sup).toBeUndefined();
+    });
+
     it("returns undefined for a legacy daemon whose cgroup is not a service", async () => {
-        const sup = await resolveDaemonSupervisor(base, async () => undefined);
+        const sup = await resolveDaemonSupervisor(
+            base,
+            async () => undefined,
+            async () => base.pid,
+            async () => undefined
+        );
         expect(sup).toBeUndefined();
     });
 });