From 34a6def8397ca17d6cb7a6dc58bcb16d3dfffdf6 Mon Sep 17 00:00:00 2001 From: Waters Church Date: Wed, 7 Oct 2026 11:45:07 -0400 Subject: [PATCH] Shell 1.12.1: a catalog install keeps the tarball's file modes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit parseTar threw away each entry's mode, so installModule wrote every downloaded file 0644 — including the prebuilt helpers modules ship under bin/. spawn() then failed with EACCES: on the 1.10.2 rollout (AB, 2026-10-04) that silently killed both LTC capture (Timers 1.7.0) and SPL metering (0.5.0) until the binaries were chmod +x'd by hand. carryOverExecutables (1.9.2) never applied: it only carries files the download does NOT include, and these downloads include the helpers. parseTar now keeps the header's mode field (permission bits only, defaulting to 0644) and both writers pass it on: installModule's staging and the archive-based shell update. The unbundled-shell test's mock repo now ships an executable bin/ helper and asserts it still spawns-worthy after a catalog install, alongside the existing carry-over check. Co-Authored-By: Claude Fable 5 --- package.json | 2 +- server.js | 29 ++++++++++++++++++----------- tools/unbundled.test.js | 23 ++++++++++++++++++++++- 3 files changed, 41 insertions(+), 13 deletions(-) diff --git a/package.json b/package.json index 2dd686c..0630900 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "proddash", - "version": "1.12.0", + "version": "1.12.1", "private": true, "description": "Modular production dashboard for Waters Church \u2014 zero-dependency Node server + vanilla client", "license": "UNLICENSED", diff --git a/server.js b/server.js index cb8a838..5289a7d 100644 --- a/server.js +++ b/server.js @@ -1121,6 +1121,11 @@ function parseTar(buf) { while (off + 512 <= buf.length) { const h = buf.subarray(off, off + 512); if (h.every((b) => b === 0)) break; // end-of-archive blocks + // The mode matters: modules ship prebuilt helpers under bin/, and writing + // one out without its execute bits leaves spawn() with EACCES and the + // feature silently dead. Permission bits only — setuid/sticky from an + // archive are not wanted here. + const mode = (parseInt(cstr(h, 100, 8).trim() || '0', 8) & 0o777) || 0o644; const size = parseInt(cstr(h, 124, 12).trim() || '0', 8) || 0; const type = h[156] === 0 ? '0' : String.fromCharCode(h[156]); const prefix = cstr(h, 257, 6).startsWith('ustar') ? cstr(h, 345, 155) : ''; @@ -1136,7 +1141,7 @@ function parseTar(buf) { } const name = pendingName || shortName; pendingName = null; - if (type === '0') files.set(name, Buffer.from(data)); + if (type === '0') files.set(name, { data: Buffer.from(data), mode }); } return { files, comment }; } @@ -1165,9 +1170,9 @@ async function fetchArchive() { } const { files, comment } = parseTar(zlib.gunzipSync(gz)); const stripped = new Map(); // drop the archive's single top-level folder - for (const [p, data] of files) { + for (const [p, entry] of files) { const i = p.indexOf('/'); - if (i > 0 && i < p.length - 1) stripped.set(p.slice(i + 1), data); + if (i > 0 && i < p.length - 1) stripped.set(p.slice(i + 1), entry); } return { files: stripped, sha: /^[0-9a-f]{7,40}$/.test(comment) ? comment : '' }; } @@ -1182,17 +1187,17 @@ async function refreshRemote(force = false) { const job = (async () => { try { const { files, sha } = await fetchArchive(); - const pkg = safeJson(files.get('package.json')); + const pkg = safeJson(files.get('package.json')?.data); const modules = new Map(); - for (const [p, data] of files) { + for (const [p, file] of files) { const m = p.match(/^modules\/([^/]+)\/(.+)$/); if (!m) continue; const entry = modules.get(m[1]) || { id: m[1], manifest: null, files: new Map() }; - entry.files.set(m[2], data); + entry.files.set(m[2], file); modules.set(m[1], entry); } for (const [id, entry] of modules) { - const man = safeJson(entry.files.get('module.json')); + const man = safeJson(entry.files.get('module.json')?.data); if (!man || typeof man !== 'object' || (man.id && man.id !== id) || !man.client) { modules.delete(id); continue; @@ -1322,12 +1327,14 @@ async function installModule(id) { const staging = path.join(INSTALLED_MODULES_DIR, `.${id}.installing`); fs.rmSync(staging, { recursive: true, force: true }); const shipped = new Set(); - for (const [rel, data] of remoteEntry.files) { + for (const [rel, { data, mode }] of remoteEntry.files) { if (!safeRelPath(rel)) continue; shipped.add(rel); const target = path.join(staging, rel); fs.mkdirSync(path.dirname(target), { recursive: true }); - fs.writeFileSync(target, data); + // The tarball's mode, or a shipped bin/ helper lands 0644 and spawns + // EACCES (what broke LTC and SPL on the 1.10.2 rollout, 2026-10-04). + fs.writeFileSync(target, data, { mode }); } const dest = path.join(INSTALLED_MODULES_DIR, id); // Per-machine executables — a capture tool compiled here, or copied in @@ -1439,11 +1446,11 @@ async function updateShell() { } else { const staging = path.join(ROOT, '.proddash-update'); fs.rmSync(staging, { recursive: true, force: true }); - for (const [rel, data] of remote.files) { + for (const [rel, { data, mode }] of remote.files) { if (!safeRelPath(rel) || isKeptOnUpdate(rel)) continue; const target = path.join(staging, rel); fs.mkdirSync(path.dirname(target), { recursive: true }); - fs.writeFileSync(target, data); + fs.writeFileSync(target, data, { mode }); } const newServer = path.join(staging, 'server.js'); if (!fs.existsSync(newServer)) { diff --git a/tools/unbundled.test.js b/tools/unbundled.test.js index 7c17bd3..6f9b5d9 100644 --- a/tools/unbundled.test.js +++ b/tools/unbundled.test.js @@ -12,7 +12,12 @@ * 2. a shell update from an archive that carries modules/ never writes * them into the app folder — they show up in the catalog instead; * 3. a fresh install lists everything the repo offers, and installing - * several at once lands them in the data directory and mounts them. + * several at once lands them in the data directory and mounts them; + * 4. a module downloaded from the catalog keeps the tarball's modes — a + * shipped bin/ helper is still executable (0644 means spawn EACCES, + * which is what broke LTC and SPL on the 1.10.2 rollout) — while + * per-machine executables the download does not include are still + * carried over from the copy being replaced. * * node tools/unbundled.test.js * @@ -70,6 +75,11 @@ function buildArchive(dir) { fs.copyFileSync(path.join(REPO, 'server.js'), path.join(top, 'server.js')); fs.writeFileSync(path.join(top, 'package.json'), JSON.stringify({ name: 'proddash', version: '9.9.9' })); writeModule(path.join(top, 'modules', 'demo'), 'demo', '2.0.0'); + // The repo ships this one prebuilt (the way Timers and SPL ship their + // capture helpers): it must come out of the download still executable. + fs.mkdirSync(path.join(top, 'modules', 'demo', 'bin')); + fs.writeFileSync(path.join(top, 'modules', 'demo', 'bin', 'demo-capture'), '#!/bin/sh\necho capture\n'); + fs.chmodSync(path.join(top, 'modules', 'demo', 'bin', 'demo-capture'), 0o755); writeModule(path.join(top, 'modules', 'other'), 'other', '1.0.0'); writeModule(path.join(top, 'modules', 'third'), 'third', '1.0.0'); const out = path.join(dir, 'main.tar.gz'); @@ -188,6 +198,17 @@ function buildPackagedApp(app) { const empty = await api('/api/admin/modules/install', { method: 'POST', body: '{}' }); assert.equal(empty.status, 400, 'nothing to install is said'); + // ── 4. a download keeps executable modes, and carry-over still works ── + const upd = await api('/api/admin/modules/demo/install', { method: 'POST', body: '{}' }); + assert.equal(upd.status, 200, 'demo update: ' + JSON.stringify(upd.body)); + assert.equal(upd.body.version, '2.0.0', 'demo was updated from the repo'); + const shipped = path.join(dataDir, 'modules', 'demo', 'bin', 'demo-capture'); + assert.ok(fs.existsSync(shipped), 'the downloaded helper is there'); + assert.ok(fs.statSync(shipped).mode & 0o111, 'and the tarball\'s execute bit survived the install'); + const carried = path.join(dataDir, 'modules', 'demo', 'bin', 'demo-helper'); + assert.ok(fs.existsSync(carried), 'the per-machine executable the download lacks was carried over'); + assert.ok(fs.statSync(carried).mode & 0o111, 'still executable'); + console.log('unbundled shell: every check passed'); } catch (err) { failed = true; -- 2.54.0