feat(servers): read and install plugin files through the AMP API

[ryanbarlow97]

Stacked on #234. With /etc/tfmc-server-control/amp-login.json present, the restart helper now does all its file work through AMP's file manager as TFWeb, so it no longer needs the root-set bind mounts, ACLs or the sudo console wrapper.

How

• Mirror: _paths() returns a private copy under state/mirror/<server>/ refreshed through the API: plugin jars (and plugins/update), the Maintenance config, latest.log and the newest rotated logs. A jar is re-downloaded only when AMP's MD5 changes; latest.log is appended while the server's file only grows and replaced (new inode) when it starts over, so the existing boot/save detection is unchanged. All existing checks (snapshot, read_startup, boot errors, Dev evidence) run on these real bytes.
• Install: upload the verified release as plugins/.control-<plan>, compare AMP's MD5, rename to the release name, and TrashFile the old jar (Java keeps the open inode; AMP keeps it in .trash). Failures restore the recorded old jars the same way.
• Backup time comes from AMP's backup list.
• Dev evidence: AMP reports only modified times, so the jar-before-startup check uses the modified time in AMP mode (local mode still uses max(mtime, ctime)).
• Without the login file nothing changes: mounts and sudo wrapper.
• Also fixes the local install leaving a corrupted .control-<plan> temp file in plugins after a checksum failure.

Tests

The controller fixture now runs every controller test twice: against the mounts and against a fake AMP file manager over the same folders (237 passed). Three tests that monkeypatch local file mechanics got AMP equivalents; the symlink case is local-only.

Live, read-only on tf-hetzner with the TFWeb account: mirror jar hashes equal the mounted jars on Main (74) and Dev (75); first sync 5.1 s / 2.4 s, then ~0.6 s; startup parse, maintenance state and last backup match; plan(main|dev, restart) returns in ~1 s. Upload/MD5/rename/trash were exercised live on Dev with amp-api.

Docs: TF-Minecraft/Docs (linked below), stacked on Docs #276.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: b5806791-37b9-4a13-a4a3-c016115350a1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ryanbarlow97]

Closing: its only purpose was to let the host administrator remove the helper's bind mounts, ACLs and sudo wrapper afterwards, and that root step isn't available. The helper keeps using the mounts for files; #234 moves the AMP login to the site instead of a root-created file.