@hasna/uptime 0.1.17 → 0.1.18

package/CHANGELOG.md

@@ -6,6 +6,16 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.1.18] - 2026-06-28
+
+### Changed
+
+- Added explicit ECS container health checks to the AWS Terraform module task
+  definitions. The web task checks `/health`, while disabled non-web roles use
+  a hosted-environment sanity check until their worker entrypoints are enabled.
+- Updated cloud planning and AWS deployment docs to keep the zero-count
+  deployment status clear while the private root is repinned and verified.
+
 ## [0.1.17] - 2026-06-28
 
 ### Fixed

package/dist/cli/index.js

@@ -6943,7 +6943,7 @@ function buildAwsDeploymentPlan(options = {}) {
   const image = clean(options.image, `${imageRepositoryUri}@sha256:<image-digest>`);
   const evidenceBucket = clean(options.evidenceBucket, `hasna-${stage}-${prefix}-evidence`);
   const hostedSqliteDbPath = clean(options.hostedSqliteDbPath, DEFAULT_HOSTED_SQLITE_DB);
-  const runtimePackageVersion = clean(options.runtimePackageVersion, "0.1.17");
+  const runtimePackageVersion = clean(options.runtimePackageVersion, "0.1.18");
   const protectedAccessMode = options.protectedAccessMode ?? DEFAULT_PROTECTED_ACCESS_MODE;
   const protectedAccessUrl = protectedAccessMode === "cloudfront_default_domain" ? "https://<cloudfront-domain>" : `https://${hostname}`;
   const cluster = `${prefix}-${stage}`;
@@ -7194,7 +7194,7 @@ function servicePlan(prefix, stage, role, desiredCount, image, workspaceId, secr
     taskRole: `${name}-task-role`,
     executionRole: `${prefix}-${stage}-execution-role`,
     logGroup: `/ecs/${name}`,
-    healthCommand: role === "web" ? "GET /health" : undefined,
+    healthCommand: role === "web" ? "GET /health" : "hosted environment sanity check",
     environment: {
       HASNA_UPTIME_IMAGE: image,
       ...environment

package/dist/cloud-plan.js

@@ -21,7 +21,7 @@ function buildAwsDeploymentPlan(options = {}) {
   const image = clean(options.image, `${imageRepositoryUri}@sha256:<image-digest>`);
   const evidenceBucket = clean(options.evidenceBucket, `hasna-${stage}-${prefix}-evidence`);
   const hostedSqliteDbPath = clean(options.hostedSqliteDbPath, DEFAULT_HOSTED_SQLITE_DB);
-  const runtimePackageVersion = clean(options.runtimePackageVersion, "0.1.17");
+  const runtimePackageVersion = clean(options.runtimePackageVersion, "0.1.18");
   const protectedAccessMode = options.protectedAccessMode ?? DEFAULT_PROTECTED_ACCESS_MODE;
   const protectedAccessUrl = protectedAccessMode === "cloudfront_default_domain" ? "https://<cloudfront-domain>" : `https://${hostname}`;
   const cluster = `${prefix}-${stage}`;
@@ -272,7 +272,7 @@ function servicePlan(prefix, stage, role, desiredCount, image, workspaceId, secr
     taskRole: `${name}-task-role`,
     executionRole: `${prefix}-${stage}-execution-role`,
     logGroup: `/ecs/${name}`,
-    healthCommand: role === "web" ? "GET /health" : undefined,
+    healthCommand: role === "web" ? "GET /health" : "hosted environment sanity check",
     environment: {
       HASNA_UPTIME_IMAGE: image,
       ...environment

package/dist/index.js

@@ -4349,7 +4349,7 @@ function buildAwsDeploymentPlan(options = {}) {
   const image = clean(options.image, `${imageRepositoryUri}@sha256:<image-digest>`);
   const evidenceBucket = clean(options.evidenceBucket, `hasna-${stage}-${prefix}-evidence`);
   const hostedSqliteDbPath = clean(options.hostedSqliteDbPath, DEFAULT_HOSTED_SQLITE_DB);
-  const runtimePackageVersion = clean(options.runtimePackageVersion, "0.1.17");
+  const runtimePackageVersion = clean(options.runtimePackageVersion, "0.1.18");
   const protectedAccessMode = options.protectedAccessMode ?? DEFAULT_PROTECTED_ACCESS_MODE;
   const protectedAccessUrl = protectedAccessMode === "cloudfront_default_domain" ? "https://<cloudfront-domain>" : `https://${hostname}`;
   const cluster = `${prefix}-${stage}`;
@@ -4600,7 +4600,7 @@ function servicePlan(prefix, stage, role, desiredCount, image, workspaceId, secr
     taskRole: `${name}-task-role`,
     executionRole: `${prefix}-${stage}-execution-role`,
     logGroup: `/ecs/${name}`,
-    healthCommand: role === "web" ? "GET /health" : undefined,
+    healthCommand: role === "web" ? "GET /health" : "hosted environment sanity check",
     environment: {
       HASNA_UPTIME_IMAGE: image,
       ...environment

package/infra/aws/README.md

@@ -71,6 +71,12 @@ Keep this disabled when private endpoints are the approved egress path. Runtime
 scale-up still requires ECS task evidence for image pull, secret injection, log
 delivery, S3 access, and EFS mount behavior.
 
+Every ECS task definition includes an explicit container health check. The web
+task checks `GET /health` through Bun's built-in `fetch`; disabled non-web roles
+currently run a hosted-environment sanity check so scheduler, public-probe,
+reporter, and migration tasks do not start from empty ECS health semantics when
+their long-running workers are later enabled.
+
 Interface endpoint private DNS is VPC-wide. In shared VPCs, either keep endpoint
 creation in the approved networking root, or pass
 `additional_vpc_endpoint_source_security_group_ids` for every workload that must

package/infra/aws/main.tf

@@ -79,6 +79,43 @@ locals {
     : ["arn:${data.aws_partition.current.partition}:ssm:${var.region}:${data.aws_caller_identity.current.account_id}:parameter/${local.prefix}/no-ssm-refs-configured"]
   )
   service_log_group_arns = [for group in aws_cloudwatch_log_group.service : "${group.arn}:*"]
+  service_health_checks = {
+    web = {
+      command     = ["CMD-SHELL", "bun -e \"const r = await fetch('http://127.0.0.1:${local.container_port}/health'); process.exit(r.ok ? 0 : 1)\""]
+      interval    = 30
+      timeout     = 5
+      retries     = 3
+      startPeriod = 30
+    }
+    scheduler = {
+      command     = ["CMD-SHELL", "bun -e \"process.exit(process.env.HASNA_UPTIME_MODE === 'hosted' && process.env.HASNA_UPTIME_COMPONENT === 'scheduler' ? 0 : 1)\""]
+      interval    = 30
+      timeout     = 5
+      retries     = 3
+      startPeriod = 30
+    }
+    "public-probe" = {
+      command     = ["CMD-SHELL", "bun -e \"process.exit(process.env.HASNA_UPTIME_MODE === 'hosted' && process.env.HASNA_UPTIME_COMPONENT === 'public-probe' ? 0 : 1)\""]
+      interval    = 30
+      timeout     = 5
+      retries     = 3
+      startPeriod = 30
+    }
+    reporter = {
+      command     = ["CMD-SHELL", "bun -e \"process.exit(process.env.HASNA_UPTIME_MODE === 'hosted' && process.env.HASNA_UPTIME_COMPONENT === 'reporter' ? 0 : 1)\""]
+      interval    = 30
+      timeout     = 5
+      retries     = 3
+      startPeriod = 30
+    }
+    migration = {
+      command     = ["CMD-SHELL", "bun -e \"process.exit(process.env.HASNA_UPTIME_MODE === 'hosted' && process.env.HASNA_UPTIME_COMPONENT === 'migration' ? 0 : 1)\""]
+      interval    = 30
+      timeout     = 5
+      retries     = 3
+      startPeriod = 30
+    }
+  }
 }
 
 data "aws_vpc" "target" {
@@ -1090,6 +1127,7 @@ resource "aws_ecs_task_definition" "service" {
           readOnly      = false
         }
       ] : []
+      healthCheck = local.service_health_checks[each.key]
       secrets = [
         for name, value_from in each.value.secrets : {
           name      = name

package/infra/aws/terraform.tfvars.example

@@ -16,7 +16,7 @@ alb_ingress_cidr_blocks = []
 private_subnet_ids       = ["subnet-replace-private-a", "subnet-replace-private-b"]
 private_route_table_ids  = ["rtb-replace-private"]
 container_image          = "123456789012.dkr.ecr.us-east-1.amazonaws.com/open-uptime@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-runtime_package_version  = "0.1.17"
+runtime_package_version  = "0.1.18"
 certificate_arn          = null
 hosted_zone_id           = null
 app_env_secret_arn       = "arn:aws:secretsmanager:us-east-1:123456789012:secret:open-uptime/prod/app/env"

package/infra/aws/variables.tf

@@ -116,7 +116,7 @@ variable "container_image" {
 variable "runtime_package_version" {
   description = "Published @hasna/uptime package version that CodeBuild should build into the ECR image."
   type        = string
-  default     = "0.1.17"
+  default     = "0.1.18"
 
   validation {
     condition     = can(regex("^[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.-]+)?$", var.runtime_package_version))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/uptime",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "description": "Local-first uptime and downtime monitoring service with CLI, MCP, SDK, SQLite persistence, and a dashboard.",
   "license": "Apache-2.0",
   "type": "module",