Function expressCreateServer

src/node/updater/index.ts:502–567

()

/** Hook entry point — called by ep.json on createServer. */
export const expressCreateServer = async (): Promise<void> => {
  detectedMethod = await detectInstallMethod({
    override: settings.updates.installMethod,
    rootDir: settings.root,
  });
  logger.info(`updater: install method = ${detectedMethod}, tier = ${settings.updates.tier}`);

  // Tier 2: if the previous boot left the state in pending-verification, arm
  // the health-check timer (or force rollback when bootCount has climbed past
  // the crash-loop threshold). This must run BEFORE polling starts so the
  // rollback can fire even if the version checker is misconfigured.
  const state = await getCurrentState();
  pendingVerification = checkPendingVerification(state, getRollbackDeps());

  // Boot-time failure notification. If a previous run produced a failure
  // outcome whose admin email we haven't already sent (lastFailureKey
  // dedupe), fire it now. Covers:
  //  - health-check timeout rollback on the previous boot
  //  - crash-loop forced rollback (detected on a later boot)
  //  - preflight-failed where we never got to send (e.g. process kill)
  //  - rollback-failed terminal that the operator hasn't acknowledged
  // Fire-and-forget — the rest of boot must proceed regardless.
  const failureOutcome = state.lastResult?.outcome === 'rolled-back' ? 'rolled-back'
                       : state.lastResult?.outcome === 'rollback-failed' ? 'rollback-failed'
                       : state.lastResult?.outcome === 'preflight-failed' ? 'preflight-failed'
                       : null;
  if (failureOutcome && state.lastResult) {
    void notifyApplyFailure({
      outcome: failureOutcome,
      targetTag: state.lastResult.targetTag,
      reason: state.lastResult.reason ?? failureOutcome,
    });
  }

  // Tier 3: instantiate the scheduler unless updates are entirely disabled.
  // The runner is purely in-memory — the persisted state file is the source
  // of truth for "is something scheduled." On `tier: "off"` we explicitly
  // clear any previously-persisted scheduled state to idle so a stale
  // schedule from a prior boot can't auto-fire after the operator opted
  // out (Qodo #1).
  if (settings.updates.tier === 'off') {
    if (state.execution.status === 'scheduled') {
      logger.info(
        `updater: discarding pending Tier 3 schedule for ${state.execution.targetTag} ` +
        `because updates.tier="off"`);
      state.execution = {status: 'idle'};
      await saveState(stateFilePath(), state);
    }
  } else {
    scheduler = createSchedulerRunner({
      now: () => new Date(),
      setTimer: (cb, ms) => setTimeout(cb, ms),
      clearTimer: clearTimeout,
      triggerApply: schedulerTriggerApply,
    });
    if (state.execution.status === 'scheduled') {
      logger.info(`updater: rehydrating Tier 3 schedule for ${state.execution.targetTag} at ${state.execution.scheduledFor}`);
      scheduler.arm({