deploy.sh: prefer passwordless restart helper on targets

The helper scripts (/usr/local/sbin/frank-restart-<large|small>.sh)
cover unit symlink, cache drop (dankclaw), daemon-reload, and restart
in one root-owned script, run via sudoers NOPASSWD. deploy.sh now uses
the helper when present and falls back to inline sudo commands.

scripts/deploy.sh

@@ -10,6 +10,10 @@
 #
 # Sudo: when FRANK_SUDO_PW is set, remote sudo pipes it via `sudo -S` for
 # headless runs. Otherwise plain `sudo` is used (tty or passwordless config).
+# Prefer the passwordless restart helpers installed on each target
+# (/usr/local/sbin/frank-restart-<large|small>.sh); they cover the unit
+# symlink, cache drop (dankclaw), daemon-reload, and restart in one root
+# script. See docs/deployment.md -> Passwordless restart.
 #
 # Usage:
 #   ./deploy.sh <target> [--dry-run]
@@ -27,7 +31,7 @@ set -euo pipefail
 # ---------------------------------------------------------------------------
 # Target configuration
 # ---------------------------------------------------------------------------
-declare -A REMOTE_USER REMOTE_HOST REMOTE_DIR SERVICE SERVICE_HEALTH DROP_CACHES
+declare -A REMOTE_USER REMOTE_HOST REMOTE_DIR SERVICE SERVICE_HEALTH DROP_CACHES HELPER
 
 REMOTE_USER[dankclaw]=dank
 REMOTE_HOST[dankclaw]=dankclaw
@@ -37,6 +41,9 @@ SERVICE_HEALTH[dankclaw]="http://127.0.0.1:7770/health"
 # Drop page caches before restart: with the model's pages fully cached, the
 # KV/graph allocation stalls at load (VRAM stuck at 28 GiB). See AGENTS.md.
 DROP_CACHES[dankclaw]=1
+# Passwordless restart helper (root-owned, installed via /etc/sudoers.d/frank-large).
+# When present, deploy.sh uses it instead of inline sudo commands.
+HELPER[dankclaw]="/usr/local/sbin/frank-restart-large.sh"
 
 REMOTE_USER[dankserver]=dank
 REMOTE_HOST[dankserver]=dankserver
@@ -44,6 +51,7 @@ REMOTE_DIR[dankserver]="/home/dank/vLLM"
 SERVICE[dankserver]="frank-default-small"
 SERVICE_HEALTH[dankserver]="http://127.0.0.1:7770/health"
 DROP_CACHES[dankserver]=0
+HELPER[dankserver]="/usr/local/sbin/frank-restart-small.sh"
 
 TARGET="${1:-}"
 DRY_RUN=0
@@ -119,6 +127,8 @@ ${SUDO_PREFIX} sh -c 'sync; echo 3 > /proc/sys/vm/drop_caches'
 "
 fi
 
+HELPER_PATH="${HELPER[$TARGET]:-}"
+
 REMOTE_SCRIPT="
 set -euo pipefail
 cd '${REMOTE_DIR[$TARGET]}'
@@ -126,20 +136,27 @@ cd '${REMOTE_DIR[$TARGET]}'
 echo '[2/4] Pulling repo on ${TARGET}...'
 git pull origin main
 
-# Install / symlink the systemd unit
+if [ -x '${HELPER_PATH}' ]; then
-case '${TARGET}' in
+    # Passwordless restart helper (sudoers NOPASSWD) - preferred path.
-  dankclaw)
+    echo '[3/4] Restarting via passwordless helper ${HELPER_PATH}...'
-    ${SUDO_PREFIX} ln -sf '${REMOTE_DIR[$TARGET]}/scripts/frank-default-large.service' /etc/systemd/system/frank-default-large.service
+    ${SUDO_PREFIX} '${HELPER_PATH}'
-    ;;
+else
-  dankserver)
+    echo '[3/4] Helper not installed; using inline sudo commands...'
-    ${SUDO_PREFIX} ln -sf '${REMOTE_DIR[$TARGET]}/scripts/frank-default-small.service' /etc/systemd/system/frank-default-small.service
+    # Install / symlink the systemd unit
-    ;;
+    case '${TARGET}' in
-esac
+      dankclaw)
-${DROP_CACHES_CMD}
+        ${SUDO_PREFIX} ln -sf '${REMOTE_DIR[$TARGET]}/scripts/frank-default-large.service' /etc/systemd/system/frank-default-large.service
-echo '[3/4] Reload and restart ${SERVICE[$TARGET]}...'
+        ;;
-${SUDO_PREFIX} systemctl daemon-reload
+      dankserver)
-${SUDO_PREFIX} systemctl enable '${SERVICE[$TARGET]}'
+        ${SUDO_PREFIX} ln -sf '${REMOTE_DIR[$TARGET]}/scripts/frank-default-small.service' /etc/systemd/system/frank-default-small.service
-${SUDO_PREFIX} systemctl restart '${SERVICE[$TARGET]}'
+        ;;
+    esac
+    ${DROP_CACHES_CMD}
+    echo '[3/4] Reload and restart ${SERVICE[$TARGET]}...'
+    ${SUDO_PREFIX} systemctl daemon-reload
+    ${SUDO_PREFIX} systemctl enable '${SERVICE[$TARGET]}'
+    ${SUDO_PREFIX} systemctl restart '${SERVICE[$TARGET]}'
+fi
 "
 
 if [ "$DRY_RUN" = "1" ]; then