Local control channel: unprivileged users can trigger --force-update via the running service

cmd/gpu-turnstile/main.go

@@ -17,11 +17,13 @@ import (
 	"path/filepath"
 	"runtime"
 	"strings"
+	"sync"
 	"syscall"
 	"time"
 
 	"gpu-turnstile/internal/comfy"
 	"gpu-turnstile/internal/config"
+	"gpu-turnstile/internal/control"
 	"gpu-turnstile/internal/game"
 	"gpu-turnstile/internal/lock"
 	"gpu-turnstile/internal/metrics"
@@ -98,6 +100,7 @@ Usage:
   gpu-turnstile -v | --version                                print just the version
   gpu-turnstile --force-update                                check for a signed update now,
                                                               apply it and restart the service
+                                                              (no admin needed when the service runs)
   gpu-turnstile -h | --help                                   this help
 
 Options:
@@ -347,6 +350,13 @@ func forceUpdateCommand(configPath string, elevatedChild bool) int {
 		fmt.Printf("%s: APP_VER=dev, updates disabled\n", versionLine())
 		return 0
 	}
+	// A running service can do the privileged work itself (its account owns
+	// the install dir and it knows when the GPU is idle): ask it over the
+	// local control channel first, no admin rights needed. Fails fast when
+	// no service is listening, in which case we do the direct check below.
+	if reply, err := control.Ask(control.CmdUpdateNow); err == nil {
+		return printControlReply(reply)
+	}
 	u := &update.Updater{Repo: cfg.UpdateRepo, Asset: cfg.UpdateAsset, Version: version, Desired: cfg.AppVersion, Log: log}
 
 	// Single-shot: one attempt, fail fast when the server is unreachable
@@ -397,6 +407,17 @@ func forceUpdateCommand(configPath string, elevatedChild bool) int {
 	return 0
 }
 
+// printControlReply prints the service's answer to a control-channel
+// request: "OK ..." on stdout (exit 0), "ERR ..." on stderr (exit 1).
+func printControlReply(reply string) int {
+	if msg, ok := strings.CutPrefix(reply, "ERR "); ok {
+		fmt.Fprintf(os.Stderr, "gpu-turnstile: %s\n", msg)
+		return 1
+	}
+	fmt.Println("gpu-turnstile: " + strings.TrimPrefix(reply, "OK "))
+	return 0
+}
+
 // reportElevatedUpdate prints the parent's summary of an elevated
 // --force-update child: exitCodeStaged means the child staged a new binary,
 // 0 means it found nothing to do. to is the tag the parent's own check
@@ -688,7 +709,35 @@ func run(ctx context.Context, cfg config.Config, log *slog.Logger, logOut io.Wri
 	service.StartWatchdog(ctx)
 
 	if cfg.AutoUpdate {
-		go updateLoop(ctx, cfg, log, lk, isService)
+		exePath, err := os.Executable()
+		if err != nil {
+			log.Warn("auto-update disabled: cannot locate executable", "err", err)
+		} else {
+			u := &update.Updater{Repo: cfg.UpdateRepo, Asset: cfg.UpdateAsset, Version: version, Desired: cfg.AppVersion, Log: log}
+			// applyStaged is shared by the hourly loop and the control
+			// channel; the once guard keeps a second trigger from
+			// double-waiting on the GPU lock.
+			var once sync.Once
+			applyStaged := func(to string) {
+				if !isService {
+					log.Warn("auto-update: new binary staged; restart gpu-turnstile to apply", "version", to)
+					return
+				}
+				log.Warn("auto-update: staged; restarting once the GPU is idle", "version", to)
+				once.Do(func() {
+					go func() {
+						if waitForIdle(ctx, lk, 24*time.Hour) {
+							log.Warn("auto-update: restarting to apply update")
+							os.Exit(exitCodeUpdate)
+						}
+					}()
+				})
+			}
+			go updateLoop(ctx, cfg.UpdateInterval, log, u, exePath, applyStaged)
+			if isService {
+				serveControl(ctx, log, u, exePath, applyStaged)
+			}
+		}
 	}
 
 	select {
@@ -830,42 +879,63 @@ func healthLoop(ctx context.Context, interval, probeTimeout time.Duration, log *
 	}
 }
 
-// updateLoop checks for signed updates on startup and every UPDATE_INTERVAL.
-// In service mode a staged update is applied by exiting with exitCodeUpdate
-// once the GPU lock is idle; the service recovery configuration restarts the
-// process with the new binary. Interactively it only logs.
-func updateLoop(ctx context.Context, cfg config.Config, log *slog.Logger, lk *lock.Lock, isService bool) {
-	exePath, err := os.Executable()
-	if err != nil {
-		log.Warn("auto-update disabled: cannot locate executable", "err", err)
-		return
-	}
-	u := &update.Updater{Repo: cfg.UpdateRepo, Asset: cfg.UpdateAsset, Version: version, Desired: cfg.AppVersion, Log: log}
+// updateLoop checks for signed updates on startup and every interval;
+// applyStaged decides what a staged update means (restart when idle as a
+// service, log only interactively).
+func updateLoop(ctx context.Context, interval time.Duration, log *slog.Logger, u *update.Updater, exePath string, applyStaged func(to string)) {
 	for {
 		staged, to, err := u.Check(ctx, exePath)
 		if err != nil && ctx.Err() == nil {
 			log.Warn("auto-update check failed", "err", err)
 		}
 		if staged {
-			if !isService {
-				log.Warn("auto-update: new binary staged; restart gpu-turnstile to apply", "version", to)
-				return
-			}
-			log.Warn("auto-update: staged; restarting once the GPU is idle", "version", to)
-			if waitForIdle(ctx, lk, 24*time.Hour) {
-				log.Warn("auto-update: restarting to apply update")
-				os.Exit(exitCodeUpdate)
-			}
+			applyStaged(to)
 			return
 		}
 		select {
 		case <-ctx.Done():
 			return
-		case <-time.After(cfg.UpdateInterval):
+		case <-time.After(interval):
 		}
 	}
 }
 
+// serveControl opens the local control channel (named pipe on Windows,
+// unix socket on Linux) so unprivileged local users can trigger an update
+// check via --force-update without admin rights. The check payload is
+// signature-verified regardless of who asks; triggers are rate-limited to
+// one per minute so the channel cannot be used to spam restarts.
+func serveControl(ctx context.Context, log *slog.Logger, u *update.Updater, exePath string, applyStaged func(to string)) {
+	var mu sync.Mutex
+	var lastTrigger time.Time
+	h := func(cmd string) string {
+		if cmd != control.CmdUpdateNow {
+			return "ERR unknown command: " + cmd
+		}
+		mu.Lock()
+		if wait := time.Minute - time.Since(lastTrigger); wait > 0 {
+			mu.Unlock()
+			return fmt.Sprintf("ERR rate limited: retry in %ds", int(wait.Seconds())+1)
+		}
+		lastTrigger = time.Now()
+		mu.Unlock()
+		cctx, cancel := context.WithTimeout(ctx, 30*time.Second)
+		defer cancel()
+		staged, to, err := u.Check(cctx, exePath)
+		if err != nil {
+			return "ERR update check failed: " + err.Error()
+		}
+		if !staged {
+			return "OK " + version + " is up to date"
+		}
+		applyStaged(to)
+		return "OK updated from " + version + " to " + to + "; the service restarts once the GPU is idle"
+	}
+	if err := control.Serve(ctx, h, log); err != nil {
+		log.Warn("control channel disabled", "err", err)
+	}
+}
+
 // waitForIdle polls the lock until no LLM or image work is active or
 // pending, max at most. Returns false on timeout or cancellation.
 func waitForIdle(ctx context.Context, lk *lock.Lock, max time.Duration) bool {