fix: validate ARMv6 upgrades and publish rolling development bundles

cli/scripts/build.cjs

@@ -21,6 +21,10 @@ fs.copyFileSync(
   path.join(root, 'src/internal/maintenance/panelUpgrade.cjs'),
   path.join(root, 'dist/internal/maintenance/panelUpgrade.cjs'),
 );
+fs.copyFileSync(
+  path.join(root, 'src/internal/maintenance/nodeRuntime.cjs'),
+  path.join(root, 'dist/internal/maintenance/nodeRuntime.cjs'),
+);
 // The operational CLI may live outside the panel and has no panel node_modules.
 require('esbuild').buildSync({
   entryPoints: [path.join(root, 'src/internal/maintenance/platformBundle.cjs')],

cli/src/internal/maintenance/nodeRuntime.cjs

@@ -0,0 +1,18 @@
+// Node 24's ARMv6 JS compiler tiers can trap on ARM1176. Keep WebAssembly
+// enabled for fetch/undici; --jitless disables their HTTP parser as well.
+const armv6ServerArgs = Object.freeze([
+  '--no-opt',
+  '--no-sparkplug',
+  '--no-maglev',
+]);
+function serverRuntimeArgs(runtime = process) {
+  return runtime.arch === 'arm' &&
+    Number(runtime.config.variables.arm_version) === 6 &&
+    Number(runtime.versions.node.split('.')[0]) >= 24
+    ? [...armv6ServerArgs]
+    : [];
+}
+
+module.exports = { serverRuntimeArgs, armv6ServerArgs };
+if (require.main === module)
+  process.stdout.write(serverRuntimeArgs().join(' '));

cli/src/internal/maintenance/operator.ts

@@ -7,6 +7,10 @@ import type { LocalContext } from '../runtime/context';
 import { atomicWrite } from '../runtime/files';
 import { runProcess, checkedProcess } from '../runtime/process';
 import { findDirectBackendPids } from '../runtime/backendProcesses';
+const { serverRuntimeArgs, armv6ServerArgs } = require('./nodeRuntime.cjs') as {
+  serverRuntimeArgs(): string[];
+  armv6ServerArgs: readonly string[];
+};
 
 export async function repairConfiguration(
   context: LocalContext,
@@ -117,7 +121,11 @@ async function stopDirectBackend(context: LocalContext): Promise<void> {
   for (const line of result.stdout.split('\n')) {
     const match = line.trim().match(/^(\d+)\s+(\S+)\s+(.*)$/);
     if (!match || !/^node(?:\d+)?$/.test(path.basename(match[2]!))) continue;
-    if (match[3] !== entry) continue;
+    if (
+      match[3] !== entry &&
+      match[3] !== `${armv6ServerArgs.join(' ')} ${entry}`
+    )
+      continue;
     const pid = Number(match[1]);
     if (pid === process.pid) continue;
     try {
@@ -179,7 +187,7 @@ export async function startPanel(
     0o600,
   );
   try {
-    const child = spawn(process.execPath, [entry], {
+    const child = spawn(process.execPath, [...serverRuntimeArgs(), entry], {
       ...options,
       detached: true,
       stdio: ['ignore', log.fd, log.fd],

cli/src/internal/maintenance/platformBundle.cjs

@@ -6,6 +6,7 @@ const os = require('node:os');
 const { execFile } = require('node:child_process');
 const { promisify } = require('node:util');
 const tar = require('tar');
+const { serverRuntimeArgs } = require('./nodeRuntime.cjs');
 const {
   prestartBackend,
   dependencyFailure,
@@ -211,10 +212,12 @@ async function smokeDependencies(source, signal) {
   `;
   // Match the server's normal runtime. Node 20.18's built-in HTTP parser needs
   // WebAssembly, which --jitless disables; only archive workers need that flag.
-  await execute(process.execPath, ['-e', probe], {
+  await execute(process.execPath, [...serverRuntimeArgs(process), '-e', probe], {
     cwd: source,
     env: { ...process.env, NODE_PATH: '', NODE_OPTIONS: '' },
-    timeout: 30000,
+    // ARM1176 devices need the same startup allowance as the backend probe.
+    // Keep this bounded and cancellable without forcing an unnecessary repair.
+    timeout: nodeRuntimeArgs().length ? 300000 : 30000,
     signal,
   });
 }

cli/src/internal/maintenance/upgradePrestart.cjs

@@ -3,6 +3,7 @@ const path = require('node:path');
 const { spawn } = require('node:child_process');
 const crypto = require('node:crypto');
 const os = require('node:os');
+const { serverRuntimeArgs } = require('./nodeRuntime.cjs');
 
 function probeLimits(target) {
   const small = target.arch === 'armv6';
@@ -122,7 +123,7 @@ async function prestartBackend(
       // one backend process. Keep normal V8 mode for Node 20's HTTP/WASM support.
       const child = spawn(
         process.execPath,
-        [`--max-old-space-size=${limits.heapMb}`, entry],
+        [...serverRuntimeArgs(), `--max-old-space-size=${limits.heapMb}`, entry],
         {
           cwd: workspace,
           env,

cli/src/internal/runtime/backendProcesses.ts

@@ -1,5 +1,8 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
+const { armv6ServerArgs } = require('../maintenance/nodeRuntime.cjs') as {
+  armv6ServerArgs: readonly string[];
+};
 
 // Linux preserves argv boundaries in cmdline. Resolve relative entrypoints from
 // each process's cwd, not from the operator's cwd or a broad ps substring match.
@@ -27,11 +30,18 @@ export async function findDirectBackendPids(
       );
       const args = command.split('\0');
       if (args.at(-1) === '') args.pop();
-      // Both the legacy fallback and the TS fallback launch one script without
-      // Node flags or application arguments. Reject other command shapes.
-      if (args.length !== 2 || !/^node(?:\d+)?$/.test(path.basename(args[0]!)))
+      // Accept only the two launch shapes we own. Never treat eval, preload or
+      // application arguments containing this path as a running backend.
+      const scriptIndex =
+        args.length === 2
+          ? 1
+          : args.length === armv6ServerArgs.length + 2 &&
+            armv6ServerArgs.every((flag, i) => args[i + 1] === flag)
+          ? args.length - 1
+          : -1;
+      if (scriptIndex < 0 || !/^node(?:\d+)?$/.test(path.basename(args[0]!)))
         continue;
-      const script = args[1]!;
+      const script = args[scriptIndex]!;
       if (!script) continue;
       const absolute = path.isAbsolute(script)
         ? script

cli/test/internal/armv6-startup.test.cjs

@@ -0,0 +1,183 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs/promises');
+const path = require('node:path');
+const os = require('node:os');
+const vm = require('node:vm');
+const { createRequire } = require('node:module');
+const { createContext } = require('../../dist/internal/runtime/context');
+const { replaceAndReload } = require('../../dist/internal/maintenance/upgrade');
+const runtime = require('../../dist/internal/maintenance/nodeRuntime.cjs');
+
+// Change only runtime selection; execute the compiled operator, actual child
+// Node and process discovery, without pretending the host CPU is ARM.
+async function operatorFor(arch, armVersion, node) {
+  const filename = require.resolve('../../dist/internal/maintenance/operator');
+  const localRequire = createRequire(filename);
+  const module = { exports: {} };
+  const flags = runtime.serverRuntimeArgs({
+    arch,
+    config: { variables: { arm_version: armVersion } },
+    versions: { node },
+  });
+  vm.runInNewContext(
+    await fs.readFile(filename, 'utf8'),
+    {
+      module,
+      exports: module.exports,
+      process,
+      setTimeout,
+      clearTimeout,
+      require(name) {
+        return name === './nodeRuntime.cjs'
+          ? { ...runtime, serverRuntimeArgs: () => [...flags] }
+          : localRequire(name);
+      },
+    },
+    { filename },
+  );
+  return { ...module.exports, flags };
+}
+
+for (const [arch, arm, node] of [
+  ['arm', 6, '24.18.1'],
+  ['arm', 6, '20.18.1'],
+  ['arm', 6, '22.20.0'],
+  ['arm', 7, '24.18.1'],
+  ['arm64', undefined, '24.18.1'],
+  ['x64', undefined, '24.18.1'],
+])
+  test(`CLI direct startup and stop use compatible arguments: ${arch}/${arm}/${node}`, async (t) => {
+    const operator = await operatorFor(arch, arm, node);
+    const root = await fs.realpath(
+      await fs.mkdtemp(path.join(os.tmpdir(), 'ql-runtime-start-')),
+    );
+    const context = createContext(
+      { root },
+      { PATH: process.platform === 'linux' ? '' : '/usr/bin:/bin', QL_LANG: 'en' },
+    );
+    const entry = path.join(context.paths.dir_static, 'build/app.js');
+    let pid;
+    t.after(async () => {
+      if (pid) {
+        try {
+          process.kill(pid, 'SIGKILL');
+        } catch {}
+      }
+      await fs.rm(root, { recursive: true, force: true });
+    });
+    await fs.mkdir(path.dirname(entry), { recursive: true });
+    await fs.writeFile(
+      entry,
+      `require('fs').writeFileSync(${JSON.stringify(
+        path.join(root, 'runtime.json'),
+      )}, JSON.stringify({args:process.execArgv,pid:process.pid}));setInterval(()=>{},1000);`,
+    );
+    const started = await operator.startPanel(context);
+    pid = started.pid;
+    const report = JSON.parse(
+      await fs.readFile(path.join(root, 'runtime.json')),
+    );
+    assert.equal(started.manager, 'node');
+    assert.deepEqual(report.args, operator.flags);
+    assert.equal(report.pid, pid);
+    await operator.stopPanel(context);
+    for (let n = 0; n < 100; n++) {
+      try {
+        process.kill(pid, 0);
+      } catch (e) {
+        if (e.code === 'ESRCH') {
+          pid = undefined;
+          break;
+        }
+        throw e;
+      }
+      await new Promise((resolve) => setTimeout(resolve, 20));
+    }
+    assert.equal(
+      pid,
+      undefined,
+      'the exact backend must stop even with Node flags',
+    );
+  });
+
+test(
+  'ARMv6 CLI replacement stops flagged new backend before restoring old backend and data',
+  {
+    skip: process.platform !== 'linux',
+    timeout: 20000,
+  },
+  async (t) => {
+    const operator = await operatorFor('arm', 6, '24.18.1');
+    const root = await fs.realpath(
+      await fs.mkdtemp(path.join(os.tmpdir(), 'ql-arm-rollback-')),
+    );
+    const context = createContext({ root }, { PATH: '', QL_LANG: 'en' });
+    const entry = path.join(context.paths.dir_static, 'build/app.js');
+    const incoming = path.join(root, 'incoming.js'),
+      journal = path.join(root, 'journal.jsonl');
+    const record = (version) =>
+      `const fs=require('fs');fs.appendFileSync(${JSON.stringify(
+        journal,
+      )},JSON.stringify({version:${JSON.stringify(
+        version,
+      )},pid:process.pid,args:process.execArgv})+'\\n');setInterval(()=>{},1000);`;
+    await fs.mkdir(path.dirname(entry), { recursive: true });
+    await fs.mkdir(context.data, { recursive: true });
+    await fs.writeFile(path.join(root, '.env'), 'KEEP=custom\n', {
+      mode: 0o600,
+    });
+    await fs.writeFile(path.join(context.data, 'keep'), 'old data');
+    await fs.writeFile(entry, record('old'));
+    await fs.writeFile(incoming, record('new'));
+    const pids = [];
+    t.after(async () => {
+      for (const pid of pids) {
+        try {
+          process.kill(pid, 'SIGKILL');
+        } catch {}
+      }
+      await fs.rm(root, { recursive: true, force: true });
+    });
+    pids.push((await operator.startPanel(context)).pid);
+    await assert.rejects(
+      replaceAndReload(context, [{ source: incoming, target: entry }], {
+        stop: (ctx) => operator.stopPanel(ctx),
+        start: async (ctx, recover) => {
+          const result = await operator.startPanel(ctx);
+          pids.push(result.pid);
+          if (!recover) throw new Error('injected new-version health failure');
+        },
+      }),
+      /injected new-version health failure/,
+    );
+    const launches = (await fs.readFile(journal, 'utf8'))
+      .trim()
+      .split('\n')
+      .map(JSON.parse);
+    assert.deepEqual(
+      launches.map((x) => x.version),
+      ['old', 'new', 'old'],
+    );
+    for (const row of launches) assert.deepEqual(row.args, operator.flags);
+    for (const row of launches.slice(0, -1))
+      assert.throws(() => process.kill(row.pid, 0), { code: 'ESRCH' });
+    process.kill(launches.at(-1).pid, 0);
+    assert.equal(
+      await fs.readFile(path.join(root, '.env'), 'utf8'),
+      'KEEP=custom\n',
+    );
+    assert.equal((await fs.stat(path.join(root, '.env'))).mode & 0o777, 0o600);
+    assert.equal(
+      await fs.readFile(path.join(context.data, 'keep'), 'utf8'),
+      'old data',
+    );
+    assert.equal(await fs.readFile(entry, 'utf8'), record('old'));
+    assert.ok(
+      !(await fs.readdir(path.dirname(entry))).some((x) =>
+        x.includes('ql-backup'),
+      ),
+    );
+    await operator.stopPanel(context);
+  },
+);

cli/test/internal/backendProcesses.test.cjs

@@ -3,7 +3,46 @@ const assert = require('node:assert/strict');
 const fs = require('node:fs/promises');
 const path = require('node:path');
 const os = require('node:os');
-const { findDirectBackendPids } = require('../../dist/internal/runtime/backendProcesses');
+const {
+  findDirectBackendPids,
+} = require('../../dist/internal/runtime/backendProcesses');
+
+test('backend discovery accepts only owned compatibility flags and the exact installation entry', async (t) => {
+  const root = await fs.realpath(
+    await fs.mkdtemp(path.join(os.tmpdir(), 'ql-flagged-proc-')),
+  );
+  t.after(() => fs.rm(root, { recursive: true, force: true }));
+  const proc = path.join(root, 'proc'),
+    panel = path.join(root, 'panel with spaces');
+  const other = path.join(root, 'other/static/build/app.js');
+  const entry = path.join(panel, 'static/build/app.js');
+  for (const file of [entry, other]) {
+    await fs.mkdir(path.dirname(file), { recursive: true });
+    await fs.writeFile(file, '');
+  }
+  const flags = ['--no-opt', '--no-sparkplug', '--no-maglev'];
+  const cases = [
+    [['/usr/bin/node', ...flags, entry], true],
+    [['node24', ...flags, 'static/build/app.js'], true],
+    [['node', ...flags, other], false],
+    [['node', '-e', entry], false],
+    [['node', '-r', entry], false],
+    [['node', ...flags, entry, 'argument'], false],
+    [['node', '--no-opt', entry], false],
+    [['bash', ...flags, entry], false],
+    [['node', ...flags, '-e', entry], false],
+  ];
+  const expected = [];
+  for (const [i, [args, matches]] of cases.entries()) {
+    const pid = 910001 + i,
+      directory = path.join(proc, String(pid));
+    await fs.mkdir(directory, { recursive: true });
+    await fs.writeFile(path.join(directory, 'cmdline'), args.join('\0') + '\0');
+    await fs.symlink(panel, path.join(directory, 'cwd'));
+    if (matches) expected.push(pid);
+  }
+  assert.deepEqual((await findDirectBackendPids(entry, proc)).sort(), expected);
+});
 
 test('Linux backend discovery scopes legacy relative and absolute commands to one installation', async (t) => {
   const root = await fs.realpath(
@@ -64,7 +103,10 @@ test(
     const { spawn } = require('node:child_process');
     const { once } = require('node:events');
     const { createContext } = require('../../dist/internal/runtime/context');
-    const { stopPanel, startPanel } = require('../../dist/internal/maintenance/operator');
+    const {
+      stopPanel,
+      startPanel,
+    } = require('../../dist/internal/maintenance/operator');
     const root = await fs.mkdtemp(path.join(os.tmpdir(), 'ql-live-proc-'));
     const children = [];
     let fallbackPid;
@@ -223,7 +265,9 @@ for (const language of ['zh', 'en', 'unsupported']) {
       );
       t.after(() => fs.rm(root, { recursive: true, force: true }));
       const { createContext } = require('../../dist/internal/runtime/context');
-      const { startPanel } = require('../../dist/internal/maintenance/operator');
+      const {
+        startPanel,
+      } = require('../../dist/internal/maintenance/operator');
       const context = createContext({ root }, { PATH: '', QL_LANG: language });
       const entry = path.join(context.paths.dir_static, 'build/app.js');
       await fs.mkdir(path.dirname(entry), { recursive: true });