fix(install): daemon systemd unit Restart=on-failure → Restart=always

SIGTERM sends an exit(0); on-failure would not restart the daemon after
an updater-triggered restart. Restart=always matches the updater unit and
ensures the daemon comes back after any clean shutdown.

Also adds skill auto-injection status output at end of install and
ignores the root spoof compiled binary.

Author: teovl

.gitignore

@@ -168,3 +168,4 @@ tests/integration/local/logs.rerun*
 # Untracked sandboxes / personal scratch — never commit
 abpn/
 scripts/pilot-geo-exporter/
+/spoof

install.sh

@@ -320,7 +320,7 @@ ExecStart=${BIN_DIR}/pilot-daemon \\
   -identity ${PILOT_DIR}/identity.json \\
   -email ${EMAIL} \\
   -encrypt ${HOSTNAME_FLAG} ${PUBLIC_FLAG}
-Restart=on-failure
+Restart=always
 RestartSec=5
 
 [Install]
@@ -499,3 +499,30 @@ echo ""
 echo "  sudo ${BIN_DIR}/pilotctl gateway start --ports 80,3000 <pilot-addr>"
 echo "  curl http://10.4.0.1:3000/status"
 echo ""
+echo "Agent skill auto-injection:"
+echo ""
+echo "  The daemon scans every 15 minutes and injects the Pilot Protocol"
+echo "  skill into installed agent tools. Triggering a first pass right now"
+echo "  so your agents know about Pilot before the daemon is even started:"
+echo ""
+if "${BIN_DIR}/pilotctl" skills check 2>&1 | sed 's/^/    /'; then
+    :
+else
+    echo "    (skills check failed — non-fatal; will re-attempt on daemon start)"
+fi
+echo ""
+echo "  Per-tool target paths:"
+echo "    Claude Code   ~/.claude/skills/pilot-protocol/SKILL.md"
+echo "                  + heartbeat ref in ~/.claude/CLAUDE.md"
+echo "    OpenClaw      ~/.openclaw/skills/pilot-protocol/SKILL.md"
+echo "                  + heartbeat ref in ~/.openclaw/workspace/AGENTS.md"
+echo "    PicoClaw      ~/.picoclaw/workspace/skills/pilot-protocol/SKILL.md"
+echo "                  + heartbeat ref in ~/.picoclaw/workspace/AGENT.md"
+echo "    OpenHands     ~/.openhands/microagents/pilot-protocol.md (self-heartbeat)"
+echo "    Hermes        ~/.hermes/skills/pilot-protocol/SKILL.md"
+echo "                  + heartbeat ref in ~/.hermes/SOUL.md"
+echo ""
+echo "  Inspect / force a refresh anytime:"
+echo "    pilotctl skills           # status of every install path"
+echo "    pilotctl skills check     # run one reconcile pass right now"
+echo ""

pkg/updater/updater.go

@@ -50,6 +50,7 @@ type Updater struct {
 	client *http.Client
 	stopCh chan struct{}
 	wg     sync.WaitGroup
+	exitFn func(int) // injectable for testing; defaults to os.Exit
 }
 
 // GitHubRelease represents a subset of the GitHub release API response.
@@ -70,6 +71,7 @@ func New(cfg Config) *Updater {
 		config: cfg,
 		client: &http.Client{Timeout: 30 * time.Second},
 		stopCh: make(chan struct{}),
+		exitFn: os.Exit,
 	}
 }
 
@@ -294,7 +296,7 @@ func (u *Updater) applyUpdate(release *GitHubRelease) error {
 	if updaterReplaced {
 		os.RemoveAll(tmpDir)
 		slog.Info("updater binary replaced — exiting for process manager to restart with new binary")
-		os.Exit(0)
+		u.exitFn(0)
 	}
 
 	// Signal daemon to restart (SIGTERM for graceful shutdown).

pkg/updater/updater_test.go

@@ -286,8 +286,11 @@ func TestApplyUpdate_SkipsServerBinaries(t *testing.T) {
 	installDir := filepath.Join(tmpDir, "bin")
 	os.MkdirAll(installDir, 0755)
 
-	// Seed existing binaries (client + server).
-	os.WriteFile(filepath.Join(installDir, "daemon"), []byte("old-daemon"), 0755)
+	// Seed existing binaries using installed names (install.sh adds pilot- prefix).
+	os.WriteFile(filepath.Join(installDir, "pilot-daemon"), []byte("old-pilot-daemon"), 0755)
+	os.WriteFile(filepath.Join(installDir, "pilot-gateway"), []byte("old-pilot-gateway"), 0755)
+	os.WriteFile(filepath.Join(installDir, "pilot-updater"), []byte("old-pilot-updater"), 0755)
+	os.WriteFile(filepath.Join(installDir, "pilotctl"), []byte("old-pilotctl"), 0755)
 	os.WriteFile(filepath.Join(installDir, "registry"), []byte("old-registry"), 0755)
 	os.WriteFile(filepath.Join(installDir, "beacon"), []byte("old-beacon"), 0755)
 	os.WriteFile(filepath.Join(installDir, ".pilot-version"), []byte("v1.0.0\n"), 0644)
@@ -322,10 +325,12 @@ func TestApplyUpdate_SkipsServerBinaries(t *testing.T) {
 	}))
 	defer srv.Close()
 
+	exitCalled := false
 	u := &Updater{
 		config: Config{InstallDir: installDir},
 		client: srv.Client(),
 		stopCh: make(chan struct{}),
+		exitFn: func(int) { exitCalled = true },
 	}
 
 	release := &GitHubRelease{
@@ -340,14 +345,24 @@ func TestApplyUpdate_SkipsServerBinaries(t *testing.T) {
 		t.Fatalf("applyUpdate: %v", err)
 	}
 
-	// Client binaries should be updated.
-	for _, name := range []string{"daemon", "pilotctl", "gateway", "updater"} {
-		data, err := os.ReadFile(filepath.Join(installDir, name))
+	// updater binary replaced → self-exit should have been triggered.
+	if !exitCalled {
+		t.Error("expected exitFn to be called after updater binary replacement")
+	}
+
+	// Client binaries should be updated using installed names (pilot- prefix).
+	for archiveName, installName := range map[string]string{
+		"daemon":   "pilot-daemon",
+		"pilotctl": "pilotctl",
+		"gateway":  "pilot-gateway",
+		"updater":  "pilot-updater",
+	} {
+		data, err := os.ReadFile(filepath.Join(installDir, installName))
 		if err != nil {
-			t.Fatalf("read %s: %v", name, err)
+			t.Fatalf("read %s (from archive %s): %v", installName, archiveName, err)
 		}
-		if string(data) != "new-"+name {
-			t.Errorf("%s = %q, want %q", name, string(data), "new-"+name)
+		if string(data) != "new-"+archiveName {
+			t.Errorf("%s = %q, want %q", installName, string(data), "new-"+archiveName)
 		}
 	}