From 01f63120d8913bb63fea9986d75521daca908eaf Mon Sep 17 00:00:00 2001
From: Teodor Calin <teodor@vulturelabs.io>
Date: Mon, 27 Jul 2026 18:10:39 +0300
Subject: [PATCH] installer: actually enable the auto-updater on Linux and
 macOS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The installer writes /etc/systemd/system/pilot-updater.service (Linux) and
~/Library/LaunchAgents/network.pilotprotocol.pilot-updater.plist (macOS), and
it writes ~/.pilot/auto-update.json with {"enabled": true} while printing
"Auto-updates ENABLED (opt-out)". The consent block goes further and promises:

    AUTO-UPDATES (on by default)
    The pilot-updater service checks GitHub for new stable releases and
    installs them automatically.

None of that was true. The unit and the plist were written but never
activated, so on a fresh install `systemctl is-enabled pilot-updater` reports
`disabled` / `inactive (dead)` and launchctl has no such job. Every install
from https://pilotprotocol.network/install.sh stays pinned on whatever release
shipped at install time and never receives a security or perf fix — silently,
while telling the operator the opposite.

This is not a recent regression: `git log -S` finds no commit in this repo that
ever added the activation. The fix exists in pilot-protocol/pilotprotocol's
copy of install.sh (added specifically to close this gap, and guarded there by
install-test.yml), but the two scripts had forked, and the copy served to users
is this one — the one that never got it. The guard never covered the canonical
script, so CI stayed green while the live installer shipped the defect.

Ported both branches verbatim from the working copy:
  - Linux: `sudo systemctl enable --now pilot-updater`, non-fatal on failure.
  - macOS: unload-then-`launchctl load -w` on the updater plist, which keeps
    re-running install.sh (the upgrade path) idempotent.

The daemon is deliberately left opt-in on both platforms — it has
operator-tunable flags (-public, -hostname, registry overrides) that an
operator may want to set before first start. Only the updater is auto-started.

Verified on real GitHub-hosted ubuntu-latest and macos-latest runners via
pilot-protocol/pilotprotocol#432, which asserts the updater is enabled+active
(Linux) and loaded (macOS) after a non-interactive install.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 install.sh | 39 +++++++++++++++++++++++++++++++++++----
 1 file changed, 35 insertions(+), 4 deletions(-)

diff --git a/install.sh b/install.sh
index 7683296..87d1376 100755
--- a/install.sh
+++ b/install.sh
@@ -849,8 +849,23 @@ USVC
     sudo systemctl daemon-reload || true
     echo "  Service: pilot-daemon.service"
     echo "  Service: pilot-updater.service (auto-updates)"
-    echo "  Start:   sudo systemctl start pilot-daemon pilot-updater"
-    echo "  Enable:  sudo systemctl enable pilot-daemon pilot-updater"
+
+    # Auto-enable + start the updater so future releases land without
+    # operator action. The unit file alone is not enough — without this,
+    # fresh installs sit on whatever release shipped at install time and
+    # never see security/perf fixes, while ~/.pilot/auto-update.json and
+    # the consent block above both tell the operator auto-updates are ON.
+    # The daemon is left as opt-in because it has operator-tunable flags
+    # (-public, -hostname, registry overrides) that the operator may want
+    # to set before first start.
+    if [ -f "$BIN_DIR/pilot-updater" ]; then
+        if sudo systemctl enable --now pilot-updater; then
+            echo "  Started: pilot-updater (auto-updates enabled)"
+        else
+            echo "  Note: could not enable pilot-updater via systemd (non-fatal)."
+        fi
+    fi
+    echo "  Start daemon: sudo systemctl enable --now pilot-daemon"
     else
     echo "  Skipped systemd setup (run as root or with passwordless sudo to enable)"
     fi
@@ -945,8 +960,24 @@ UPLIST
 
     echo "  Service: network.pilotprotocol.pilot-daemon"
     echo "  Service: network.pilotprotocol.pilot-updater (auto-updates)"
-    echo "  Start:   launchctl load $PLIST"
-    echo "  Stop:    launchctl unload $PLIST"
+
+    # Auto-load the updater LaunchAgent so future releases land without
+    # operator action. Without this, install.sh writes the plist but leaves
+    # it cold — fresh installs sit on whatever release shipped at install
+    # time and never see security/perf fixes. Symmetric with the Linux
+    # `systemctl enable --now pilot-updater` branch above.
+    #
+    # unload-then-load makes re-running install.sh (the upgrade path)
+    # idempotent: any stale running agent is replaced cleanly. -w persists
+    # the load across reboots. The daemon is left as opt-in for the same
+    # reason as the Linux branch.
+    if [ -f "$BIN_DIR/pilot-updater" ] && [ -f "$UPLIST" ]; then
+        launchctl unload "$UPLIST" 2>/dev/null || true
+        launchctl load -w "$UPLIST"
+        echo "  Started: pilot-updater (auto-updates enabled)"
+    fi
+    echo "  Start daemon: launchctl load -w $PLIST"
+    echo "  Stop daemon:  launchctl unload $PLIST"
 fi
 
 # --- Add to PATH ---