Janady13/thatstupidcomputer / deploy/release.mjs

1#!/usr/bin/env node 2/** Linux/Node24 release preflight and atomic pointer selection. No email sends. */ 3import { readFile, writeFile, lstat, realpath, mkdir, symlink, rename, unlink, rmdir } from 'node:fs/promises'; 4import { resolve, join, dirname, basename, isAbsolute, relative } from 'node:path'; 5import { createHash, randomUUID } from 'node:crypto'; 6import { parseEnv } from 'node:util'; 7import { pathToFileURL } from 'node:url'; 8import { spawnSync } from 'node:child_process'; 9 10const DEFAULT_ROOT = '/home/user/sites/thatstupidcomputer-runtime'; 11const DEFAULT_UNIT = 'thatstupidcomputer-runtime.service'; 12const safeId = value => /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/.test(value) && !value.includes('..'); 13const fail = message => { throw Object.assign(new Error(message), { safe: true }); }; 14const isInside = (parent, child) => { const rel = relative(parent, child); return Boolean(rel) && !rel.startsWith('..') && !isAbsolute(rel); }; 15async function file(path) { const value = await lstat(path); if (!value.isFile()) fail('A required release artifact is not a regular file.'); return value; } 16async function privateSnapshot(path, directory) { 17 const target = await realpath(path); 18 if (await realpath(directory) !== directory || !isInside(directory, target)) fail('Environment snapshot must be inside its protected shared directory without directory aliases.'); 19 const info = await file(target); 20 if ((info.mode & 0o077) !== 0) fail('Environment snapshots require mode 0600 or stricter.'); 21 const data = await readFile(target, 'utf8'); 22 if (Buffer.byteLength(data) > 32_768) fail('Environment snapshot exceeds its size limit.'); 23 return parseEnv(data); 24} 25export async function validateRelease(runtimeRoot, releaseId) { 26 if (!safeId(releaseId)) fail('Use a simple release identifier, not a path.'); 27 const root = await realpath(runtimeRoot); 28 if (root !== resolve(runtimeRoot)) fail('Runtime root must not resolve through a symlink.'); 29 const releaseDir = join(root, 'releases', releaseId); 30 if (await realpath(releaseDir) !== releaseDir) fail('Release directories must not be symlink aliases.'); 31 if (await realpath(join(root, 'shared')) !== join(root, 'shared')) fail('Shared directory must not be a symlink.'); 32 const record = JSON.parse(await readFile(join(releaseDir, '.build/build-record.json'), 'utf8')); 33 if (record.deployment !== 'production' || record.truthStatus !== 'approved-projection') fail('Activation requires a completed production build with an approved projection.'); 34 const lockHash = createHash('sha256').update(await readFile(join(releaseDir, 'package-lock.json'))).digest('hex'); 35 if (record.lockSha256 !== lockHash) fail('The dependency lock differs from the production build record.'); 36 const runtime = await privateSnapshot(join(releaseDir, 'runtime.env'), join(root, 'shared/runtime-env')); 37 const build = await privateSnapshot(join(releaseDir, 'build.env'), join(root, 'shared/build-env')); 38 if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(build.TSC_TRUTH_COMMIT || '') || !/^[a-f0-9]{64}$/.test(build.TSC_TRUTH_SHA256 || '') || !['allow', 'deny'].includes(build.AI_TRAINING_POLICY) || !['allow', 'deny'].includes(build.GOOGLE_EXTENDED_POLICY)) fail('The protected build snapshot must explicitly contain full truth pins and both crawler policies.'); 39 const { loadConfig } = await import(pathToFileURL(join(releaseDir, 'apps/api/src/config.ts')).href); 40 const config = loadConfig(runtime); 41 if (!config.production || config.host !== '127.0.0.1' || config.port !== 3000 || !config.smtp || config.publicOrigin !== 'https://thatstupidcomputer.com') fail('Runtime requires complete production SMTP configuration, canonical origin, and 127.0.0.1:3000.'); 42 if (JSON.stringify(config.trustProxy) !== JSON.stringify(['127.0.0.1'])) fail('This proxy template requires TRUST_PROXY=127.0.0.1 exactly. Review any other ingress design separately.'); 43 if (!build.TSC_TRUTH_PROJECTION || !isAbsolute(build.TSC_TRUTH_PROJECTION)) fail('Build projection path must be absolute.'); 44 const projection = await realpath(build.TSC_TRUTH_PROJECTION); 45 if (!isInside(join(releaseDir, 'private/truth'), projection)) fail('Use the reviewed projection imported into this release private/truth directory.'); 46 const { loadSiteConfig } = await import(pathToFileURL(join(releaseDir, 'packages/site/truth.ts')).href); 47 const publicConfig = loadSiteConfig({ 48 deployment: 'production', projectionPath: projection, 49 expectedCommit: build.TSC_TRUTH_COMMIT, expectedSha256: build.TSC_TRUTH_SHA256, 50 aiTrainingPolicy: build.AI_TRAINING_POLICY, googleExtendedPolicy: build.GOOGLE_EXTENDED_POLICY, 51 openaiTrainingPolicy: build.OPENAI_TRAINING_POLICY ?? '', anthropicTrainingPolicy: build.ANTHROPIC_TRAINING_POLICY ?? '', 52 mistralTrainingPolicy: build.MISTRAL_TRAINING_POLICY ?? '', 53 ga4MeasurementId: build.GA4_MEASUREMENT_ID, 54 googleSiteVerification: build.GOOGLE_SITE_VERIFICATION, bingSiteVerification: build.BING_SITE_VERIFICATION, 55 }); 56 if (record.truthCommit !== build.TSC_TRUTH_COMMIT || record.truthSha256 !== build.TSC_TRUTH_SHA256) fail('Production build and protected truth pins do not match. Rebuild, never edit the record.'); 57 if (record.crawlerPolicy?.training !== publicConfig.crawlerPolicy.training || record.crawlerPolicy?.googleExtended !== publicConfig.crawlerPolicy.googleExtended) fail('Crawler policy differs from the production build.'); 58 for (const field of ['openaiTraining', 'anthropicTraining', 'mistralTraining']) { 59 if ((record.crawlerPolicy?.[field] ?? record.crawlerPolicy?.training) !== (publicConfig.crawlerPolicy[field] ?? publicConfig.crawlerPolicy.training)) fail('Crawler policy differs from the production build.'); 60 } 61 if ((record.ga4MeasurementId || null) !== (config.measurementId || null) || (record.ga4MeasurementId || null) !== (publicConfig.ga4MeasurementId || null)) fail('Build and runtime GA4 configuration must match.'); 62 for (const artifact of ['apps/api/dist/server.mjs', 'apps/web/dist/index.html', 'apps/web/dist/404.html', 'apps/web/dist/robots.txt', 'apps/web/dist/sitemap.xml']) { 63 const target = join(releaseDir, artifact); 64 await file(target); 65 if (!isInside(releaseDir, await realpath(target))) fail('A built artifact escapes its release.'); 66 } 67 if (!Array.isArray(record.routes) || record.routes.length !== 11) fail('The build record must declare all 11 public routes.'); 68 for (const route of record.routes) { 69 if (typeof route !== 'string' || !/^\/(?:[a-z-]+\/)*$/.test(route)) fail('Invalid public route in build record.'); 70 await file(join(releaseDir, 'apps/web/dist', route, 'index.html')); 71 } 72 const deps = await lstat(join(releaseDir, 'node_modules')); 73 if (!deps.isDirectory() || deps.isSymbolicLink()) fail('Install this release dependencies with npm ci; do not share a mutable node_modules symlink.'); 74 return { root, releaseDir, releaseId, buildRecord: record }; 75} 76async function currentRelease(root) { 77 const path = join(root, 'current'); 78 let info; 79 try { info = await lstat(path); } catch (error) { if (error.code === 'ENOENT') return null; throw error; } 80 if (!info.isSymbolicLink()) fail('Refusing to replace current because it is not a symlink.'); 81 const target = await realpath(path); 82 if (dirname(target) !== join(root, 'releases') || !safeId(basename(target))) fail('The existing current pointer does not identify a direct release.'); 83 return basename(target); 84} 85export async function selectRelease(root, name, releaseId) { 86 if (!['current', 'previous'].includes(name) || !safeId(releaseId)) fail('Invalid pointer selection.'); 87 const target = join(root, name); 88 try { if (!(await lstat(target)).isSymbolicLink()) fail(`Refusing to replace ${name}: it is not a symlink.`); } 89 catch (error) { if (error.code !== 'ENOENT') throw error; } 90 const temporary = join(root, `.${name}-${randomUUID()}`); 91 await symlink(`releases/${releaseId}`, temporary); 92 try { await rename(temporary, target); } catch (error) { await unlink(temporary).catch(() => {}); throw error; } 93} 94function serviceAction(command, action, unit) { 95 const result = spawnSync(command, [action, unit], { stdio: ['ignore', 'pipe', 'pipe'], timeout: 45_000, maxBuffer: 16_384 }); 96 if (result.error || result.status !== 0) fail(`Service ${action} failed. Inspect the protected host service status; no request has been retried.`); 97} 98async function verifyServiceIdentity(command, unit, releaseDir) { 99 const result = spawnSync(command, ['show', '--property=MainPID', '--value', unit], { stdio: ['ignore', 'pipe', 'pipe'], timeout: 5_000, maxBuffer: 1024 }); 100 const pid = result.stdout?.toString().trim(); 101 if (result.error || result.status !== 0 || !/^[1-9][0-9]*$/.test(pid || '')) fail('The selected service has no verified running process.'); 102 if (await realpath(`/proc/${pid}/cwd`) !== releaseDir) fail('The running service does not belong to the selected release.'); 103} 104async function ready() { 105 for (let attempt = 0; attempt < 12; attempt++) { 106 try { 107 const res = await fetch('http://127.0.0.1:3000/api/ready', { signal: AbortSignal.timeout(1_500), redirect: 'error' }); 108 const body = await res.json(); 109 if (res.status === 200 && body.ok === true && body.checks?.mail === 'configured' && body.checks?.site === 'available' && body.delivery === 'not_checked') return; 110 } catch { /* finite retry; no SMTP or POST requests */ } 111 if (attempt < 11) await new Promise(resolve => setTimeout(resolve, 500)); 112 } 113 fail('Configuration readiness did not pass within the bounded observation window.'); 114} 115async function main(args) { 116 if (process.platform !== 'linux' || Number(process.versions.node.split('.')[0]) !== 24 || Number(process.versions.node.split('.')[1]) < 19) fail('Use a verified Linux Node 24.19+ executable (major 24).'); 117 const options = { root: DEFAULT_ROOT, unit: DEFAULT_UNIT, systemctl: '/usr/bin/systemctl', release: '', activate: false }; 118 for (let index = 0; index < args.length; index++) { 119 const arg = args[index]; 120 if (arg === '--activate') options.activate = true; 121 else if (['--root', '--unit', '--systemctl', '--release'].includes(arg) && args[index + 1]) options[arg.slice(2)] = args[++index]; 122 else fail('Usage: node deploy/release.mjs --release RELEASE_ID [--root ABSOLUTE_ROOT] [--activate] [--unit NAME.service] [--systemctl ABSOLUTE_PATH]'); 123 } 124 if (!isAbsolute(options.root) || !isAbsolute(options.systemctl) || !/^[a-zA-Z0-9_.@-]+\.service$/.test(options.unit)) fail('Invalid runtime root, service name or systemctl path.'); 125 const checked = await validateRelease(options.root, options.release); 126 const previous = await currentRelease(checked.root); 127 console.log(JSON.stringify({ mode: options.activate ? 'activate' : 'dry-run', release: checked.releaseId, previous, runtimeRoot: checked.root, service: options.unit, productionBuild: 'validated', smtp: 'configured-not-contacted', mailboxReceipt: 'not-tested' })); 128 if (!options.activate) return; 129 if (previous === checked.releaseId) fail('This release is already selected; no restart was performed.'); 130 await file(options.systemctl); 131 const lock = join(checked.root, 'shared/activation.lock'); 132 await mkdir(lock, { mode: 0o700 }); // Exclusive lock: an existing lock blocks activation. 133 const journalDirectory = join(checked.root, 'shared/activations'); 134 const journalPath = join(journalDirectory, `${Date.now()}-${randomUUID()}.json`); 135 let selected = false; 136 try { 137 if (await currentRelease(checked.root) !== previous) fail('Current changed since preflight. Start a fresh review.'); 138 await mkdir(journalDirectory, { recursive: true, mode: 0o700 }); 139 await writeFile(journalPath, JSON.stringify({ timestamp: new Date().toISOString(), previous, selected: checked.releaseId, service: options.unit, state: 'pending' }, null, 2) + '\n', { mode: 0o600, flag: 'wx' }); 140 if (previous) await selectRelease(checked.root, 'previous', previous); 141 await selectRelease(checked.root, 'current', checked.releaseId); 142 selected = true; 143 serviceAction(options.systemctl, 'restart', options.unit); 144 await ready(); 145 serviceAction(options.systemctl, 'is-active', options.unit); 146 await verifyServiceIdentity(options.systemctl, options.unit, checked.releaseDir); 147 await writeFile(journalPath, JSON.stringify({ timestamp: new Date().toISOString(), previous, selected: checked.releaseId, service: options.unit, state: 'configuration-ready', mailboxReceipt: 'not-tested', publicAcceptance: 'pending' }, null, 2) + '\n'); 148 console.log('Release selected and configuration readiness passed. Public/TLS/browser/SMTP-mailbox acceptance remains pending.'); 149 } catch (error) { 150 if (selected) { 151 if (previous) { 152 await selectRelease(checked.root, 'current', previous); 153 serviceAction(options.systemctl, 'restart', options.unit); 154 } else { 155 await unlink(join(checked.root, 'current')); 156 serviceAction(options.systemctl, 'stop', options.unit); 157 } 158 console.error('Candidate failed; prior pointer was restored (or first selection removed). Verify restored service and public behavior.'); 159 } 160 throw error; 161 } finally { await rmdir(lock); } 162} 163if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) { 164 main(process.argv.slice(2)).catch(error => { console.error(error.safe ? error.message : 'Deployment did not complete. Inspect the protected staged artifacts and service status; no secrets are printed.'); process.exitCode = 1; }); 165} 166